@lunora/runtime 1.0.0-alpha.35 → 1.0.0-alpha.36

package/dist/index.d.mts

@@ -1536,6 +1536,20 @@ type ContextLogLevel = "debug" | "error" | "fatal" | "info" | "log" | "trace" |
  * `waitUntil` (no request context) means the sink falls back to fire-and-forget.
  */
 interface LogSinkContext {
+  /**
+   * Resolves this request's detected OTLP resource attributes (`service.version`,
+   * `cloud.region`, …) on demand, or absent when the host does not detect any.
+   *
+   * Deliberately a resolved, allowlisted bag behind a thunk rather than the raw
+   * `env` and `Request` the host detected them from: this context is fanned out
+   * to **every** registered sink, including user-authored ones, so anything
+   * reachable here should be assumed to end up in someone's debug log — and raw
+   * `env` is every secret binding, while a raw `Request` carries the caller's
+   * `Authorization` and `Cookie`. The thunk keeps detection lazy (a sink that
+   * does not want resource attributes pays nothing) and hosts are expected to
+   * memoize it per request.
+   */
+  resourceAttributes?: () => Record<string, boolean | number | string>;
   /** Keep a background promise alive past the response (the request's `waitUntil`). */
   waitUntil?: (promise: Promise<unknown>) => void;
 }
@@ -1894,8 +1908,24 @@ interface ObservabilityEvent {
   };
   /** Function path being invoked, e.g. `"messages:list"`. */
   functionPath: string;
+  /** Host of the inbound request (e.g. `"api.example.com"`). */
+  host?: string;
+  /** HTTP method of the inbound request (e.g. `"POST"`). */
+  method?: string;
   /** True when the dispatch completed without throwing. */
   ok: boolean;
+  /**
+   * Span id of the upstream caller extracted from the inbound `traceparent`,
+   * when present. This becomes the OTLP `parentSpanId` for the dispatch span so
+   * collector waterfalls show the worker span nested under the upstream caller.
+   */
+  parentSpanId?: string;
+  /** URL path of the inbound request (e.g. `"/_lunora/rpc"`). */
+  path?: string;
+  /** Port of the inbound request, when available. */
+  port?: number;
+  /** URL scheme of the inbound request (e.g. `"https"`). */
+  scheme?: string;
   /** Shard key for single-shard calls; absent for fan-outs. */
   shardKey?: string;
   /**
@@ -1907,7 +1937,14 @@ interface ObservabilityEvent {
    * falls back to random ids).
    */
   spanId?: string;
+  /**
+   * W3C trace flags for this dispatch (the sampled flag, bit 0). Carried from
+   * the upstream `traceparent` or set by the runtime's head-sampling decision.
+   */
+  traceFlags?: number;
   traceId?: string;
+  /** Inbound `User-Agent` header, when available. */
+  userAgent?: string;
 }
 /**
  * The `ctx.log` observability contract lives in `shared/` (inlined into each
@@ -2036,6 +2073,8 @@ type RestInvoke = (parameters: {
   functionPath: string;
   request: Request;
   shardKey?: string;
+  /** The request's `waitUntil`, so dispatch telemetry survives isolate teardown. */
+  waitUntil?: (promise: Promise<unknown>) => void;
 }) => Promise<Response>;
 /**
  * Optional per-request rate-limit gate for the public surface. Returns a `429`
@@ -2044,6 +2083,15 @@ type RestInvoke = (parameters: {
  * `@lunora/ratelimit`.
  */
 type RestRateLimit = (request: Request, functionPath: string) => Promise<Response | undefined> | Response | undefined;
+/**
+ * A built REST route. Takes the same `(request, env, url, context)` shape as the
+ * runtime's internal route table so it can be spread straight into it; `url` is
+ * unused here (the route re-parses it) and `context` is read only for its
+ * `waitUntil`, which keeps dispatch telemetry alive past the response.
+ */
+type RestRoute = (request: Request, env: unknown, url?: URL, context?: {
+  waitUntil?: (promise: Promise<unknown>) => void;
+}) => Promise<Response>;
 interface RestRouteDeps {
   /** The generated function registry — the source of which procedures are exposed. */
   functions: RestRegistryLike;
@@ -2075,7 +2123,7 @@ declare const argsFromQuery: (url: URL) => Record<string, unknown>;
  * construction. A `query` handler accepts `GET` (args from the query string) and
  * `POST` (args from a JSON body); a `mutation` / `action` accepts `POST` only.
  */
-declare const buildRestRoutes: (deps: RestRouteDeps) => Record<string, (request: Request, env: unknown) => Promise<Response>>;
+declare const buildRestRoutes: (deps: RestRouteDeps) => Record<string, RestRoute>;
 /** Structural view of a `@lunora/ratelimit` `RateLimiter` — only the `.limit()` call, so the runtime needs no hard dependency. */
 interface RateLimiterLike {
   limit: (name: string, args?: {
@@ -2238,6 +2286,68 @@ declare const handleCorsPreflight: (request: Request, resolved: ResolvedSecurity
  * hibernation handshake.
  */
 declare const decorateResponse: (response: Response, request: Request, resolved: ResolvedSecurity) => Response;
+/**
+ * Who is allowed to hand this worker a trace to join.
+ *
+ * Continuing an inbound W3C `traceparent` is what makes a distributed waterfall
+ * stitch end to end, but the header is caller-supplied: on a public worker,
+ * trusting it lets anyone choose which trace their spans and `ctx.log` lines land
+ * in, and — because `shared/sampling` derives the head verdict from the trace id —
+ * choose their own sampling outcome. Whether that matters is a *deployment*
+ * question ("can an untrusted client reach this worker directly?"), which no
+ * amount of request inspection can answer on its own.
+ *
+ * So rather than ask users to hand-roll a security predicate, this module ships
+ * the answers that are actually sound, named:
+ *
+ * ```ts
+ * createWorker({ trustInboundTraceContext: true });            // nothing untrusted can reach this worker
+ * createWorker({ trustInboundTraceContext: "mtls" });          // only edge-verified client certs
+ * createWorker({ trustInboundTraceContext: (request) => … });  // anything else
+ * ```
+ *
+ * **Behind a gateway, mesh, or Cloudflare Access, `true` is the answer.** If the
+ * worker is genuinely unreachable except through that front door, every caller
+ * has already passed it and there is nothing left to discriminate on. Check that
+ * it really is unreachable — a `*.workers.dev` route left enabled, or a hostname
+ * outside the Access policy, is a second front door with no gate on it.
+ *
+ * There is deliberately no `"cloudflare-access"` signal. Recognising Access by its
+ * `cf-access-jwt-assertion` header only tests that a header is present, which is
+ * redundant when the worker is properly fronted (`true` already covers it) and
+ * forgeable in one `curl` when it is not. Verifying the assertion for real means a
+ * JWKS fetch and an audience check — `@lunora/cloudflare-access` does exactly
+ * that, and it is async, so it belongs in `resolveIdentity` rather than on the
+ * dispatch path. Pass a predicate if you want to wire it in yourself.
+ *
+ * Everything resolves to one predicate at worker construction, so the per-request
+ * cost is a single call.
+ *
+ * The custom form receives only the `Request`, deliberately: handing user code the
+ * Worker `env` would put every secret binding behind a telemetry callback, the
+ * same boundary `LogSinkContext` was just narrowed to avoid. A predicate that
+ * needs to compare against a binding should close over it — build the worker per
+ * request from an options factory, the pattern `createLunoraHandler` already uses.
+ */
+/**
+ * A named trust signal — a per-request property that, on its own, establishes the
+ * caller is one whose trace context may be adopted.
+ *
+ * - `"mtls"` — the caller presented a client certificate that **Cloudflare
+ * verified at the edge**. `cf.tlsClientAuth` is platform-injected request
+ * metadata, not a header, so a caller cannot write it: the check carries its own
+ * proof and holds regardless of how the worker is exposed.
+ *
+ * Signals live here only when they meet that bar. A property a client can set for
+ * itself is not a signal; see the module doc on why Cloudflare Access is absent.
+ */
+type TraceTrustSignal = "mtls";
+/**
+ * How much of the inbound trace context to trust. `false` (the default) ignores
+ * it entirely; `true` trusts every caller, which is right when nothing untrusted
+ * can reach the worker.
+ */
+type TrustInboundTraceContext = boolean | TraceTrustSignal | ((request: Request) => boolean);
 /**
  * Wire-format RPC envelope. Posted to `POST /_lunora/rpc`.
  *
@@ -3273,6 +3383,39 @@ interface WorkerOptions {
    * endpoint. When omitted, the sync feed covers only shard-local tables.
    */
   syncGlobals?: GlobalCdcSyncFunction;
+  /**
+   * Who may hand this worker a trace to join. Controls whether an inbound W3C
+   * `traceparent` is continued — adopting its trace id, parenting this
+   * dispatch's span under the upstream span, and carrying its `tracestate` to
+   * the shard. **Default: off.**
+   *
+   * ```ts
+   * trustInboundTraceContext: true             // nothing untrusted can reach this worker
+   * trustInboundTraceContext: "mtls"           // only edge-verified client certificates
+   * trustInboundTraceContext: (request) => …   // anything else
+   * ```
+   *
+   * Off by default because the header is caller-supplied: on a worker an
+   * untrusted client can reach directly, trusting it lets anyone choose which
+   * trace their spans and `ctx.log` lines join — grafting entries into another
+   * tenant's waterfall in a shared collector — and, because the head-sampling
+   * verdict is derived from the trace id, choose their own sampling outcome.
+   * (Error traces are unaffected either way: the tail bias is evaluated from
+   * the worker's own decision, never the caller's.)
+   *
+   * Turn it on when something you control — a gateway, service mesh, or
+   * Cloudflare Access — sets `traceparent` itself; a proxy that only _forwards_
+   * the client's header is not such a thing. Behind a front door like that,
+   * `true` is the answer, because every caller has already passed it. Confirm
+   * the worker really is unreachable otherwise — a `*.workers.dev` route left
+   * enabled is a second front door with no gate on it.
+   *
+   * Leaving this unset logs a one-time hint if an inbound trace is actually
+   * dropped; setting it explicitly to `false` keeps the behaviour and silences
+   * that.
+   * @see {@link TrustInboundTraceContext} for what each signal proves.
+   */
+  trustInboundTraceContext?: TrustInboundTraceContext;
   /**
    * Read-only introspector for Vectorize indexes, backing the studio's vector
    * browser via `GET /_lunora/admin/vector/indexes` and
@@ -3357,9 +3500,12 @@ interface LunoraWorker {
    * @param options Call options mirroring the RPC envelope.
    * @param options.shardKey Routes to a specific shard (omitted → the worker's
    * `defaultShardKey`).
+   * @param options.waitUntil The host's `waitUntil`, so dispatch telemetry
+   * whose export is deferred (a gzipped OTLP body) survives isolate teardown.
    */
   serverQuery: (request: Request, env: unknown, reference: unknown, args?: Record<string, unknown>, options?: {
     shardKey?: string;
+    waitUntil?: (promise: Promise<unknown>) => void;
   }) => Promise<Response>;
 }
 /**
@@ -3608,6 +3754,15 @@ declare class LunoraError extends LunoraError$1 {
   });
   toResponse(): Response;
 }
+/** A JS attribute value the encoder maps onto an OTLP `AnyValue`. */
+type OtlpAttributeValue = boolean | number | string;
+/**
+ * A `Resource.attributes` bag — the process-level identity (`service.name`,
+ * `service.version`, `cloud.region`, …) attached to every exported signal.
+ * Lives here rather than in either exporter because both packages build one and
+ * `wrapResource*` consumes it.
+ */
+type OtlpResourceAttributes = Record<string, OtlpAttributeValue>;
 /** Shared shape for sinks that can be limited to error events only. */
 interface OnlyErrorsOption {
   /** When true, only events with `ok === false` are forwarded. */
@@ -3808,6 +3963,28 @@ interface PipelineLogSinkOptions {
 declare const pipelineLogSink: (options: PipelineLogSinkOptions) => ObservabilitySink;
 /** Options for {@link otlpSink}. */
 interface OtlpSinkOptions extends OnlyErrorsOption {
+  /**
+   * Value of the `deployment.environment` resource attribute (e.g.
+   * `"production"`, `"staging"`, `"development"`).
+   */
+  deploymentEnvironment?: string;
+  /**
+   * When `true`, the sink attaches the resource attributes the **host** detected
+   * for the current request, merged *under* any explicit option so those always
+   * win on collision. In a Worker that is `service.version`,
+   * `deployment.environment`, `cloud.provider`, and `cloud.region` (the colo).
+   *
+   * The sink never inspects `env` or the request itself — detection happens once
+   * per request in the runtime and arrives pre-resolved on the sink context (see
+   * `LogSinkContext.resourceAttributes`), so no sink is ever handed raw bindings.
+   *
+   * Events that originate inside a shard (`ctx.log`, `ctx.trace`, `ctx.metrics`)
+   * carry no host-detected attributes today — the shard has no `env` of its own —
+   * so they export with the explicit options only. Set the values you need
+   * explicitly if you require them to match across worker and shard spans of the
+   * same trace.
+   */
+  detectResources?: boolean;
   /**
    * The OTLP-over-HTTP collector base endpoint (e.g.
    * `https://collector.example.com`). Following the OTel base-endpoint
@@ -3822,11 +3999,29 @@ interface OtlpSinkOptions extends OnlyErrorsOption {
    * default and may be overridden here.
    */
   headers?: Record<string, string>;
+  /**
+   * Additional resource attributes to attach to every exported signal. These
+   * ride alongside the built-in `service.name` and any convenience fields
+   * (`serviceVersion`, `deploymentEnvironment`, etc.). A key that collides with
+   * a built-in resource attribute wins; use this for custom dimensions like
+   * `deployment.region`, `host.name`, or `service.instance.id`.
+   */
+  resourceAttributes?: OtlpResourceAttributes;
   /**
    * Value of the `service.name` resource attribute on every exported span and
    * log — the logical service the telemetry belongs to. Defaults to `lunora`.
    */
   serviceName?: string;
+  /**
+   * Value of the `service.namespace` resource attribute, useful when multiple
+   * services share the same `service.name` under a tenant or team boundary.
+   */
+  serviceNamespace?: string;
+  /**
+   * Value of the `service.version` resource attribute (e.g. a git sha or
+   * release tag).
+   */
+  serviceVersion?: string;
   /**
    * Convenience bearer token: when set, an `Authorization: Bearer` header
    * carrying it is added to every POST (overriding any authorization in
@@ -3871,4 +4066,4 @@ declare const otlpSink: (options: OtlpSinkOptions) => ObservabilitySink;
  */
 declare const combineSinks: (...sinks: ObservabilitySink[]) => ObservabilitySink;
 declare const VERSION: string;
-export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthConfigInfo, type AuthImpersonation, type AuthPage, type AuthSession, type AuthUser, type AuthUserFieldSpec, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_LOG_COLUMNS, DEFAULT_LOG_LIMIT, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportBatch, type ExportChange, type ExportCursorStore, type ExportFanOutRequest, type ExportFanOutResult, type ExportSink, type ExportTapFailure, type ExportTapResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, HEALTH_PATH, HEALTH_READY_PATH, type HealthAuthPosture, type HealthBody, type HealthCheckReport, type HealthProbe, type HealthProbeKind, type HealthProbeResult, type HealthRouteDeps, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type KvIntrospector, type KvKeyEntry, type KvKeyListResult, type KvNamespaceSummary, type KvValueResult, LOG_ARCHIVE_NOT_CONFIGURED, LOG_ARCHIVE_PATH, type ListAuthUsersOptions, type LogArchiveConfig, type LogEvent, type LogFields, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MetricEvent, type MetricKind, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type NotifySubscriptionDevice, type NotifySubscriptionStoreLike, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type OtlpSinkOptions, type PipelineLike, type PipelineLogColumnMap, type PipelineLogCursor, type PipelineLogField, type PipelineLogPage, type PipelineLogQuery, type PipelineLogReader, type PipelineLogReaderOptions, type PipelineLogRow, type PipelineLogSinkOptions, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type RateLimiterLike, type ResolvedSecurity, type ResolvedShard, type RestInvoke, type RestRateLimit, type RestRegistryEntry, type RestRegistryLike, type RestRouteDeps, type Route, type RpcContext, type RpcEnvelope, type RunExportTapOptions, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type SpanEvent, type StorageListFunction as StorageListFn, type StorageObject, type TraceSamplingConfig, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, argsFromQuery, buildHealthRoutes, buildRestRoutes, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createKvCursorStore, createLunoraHandler, createMemoryCursorStore, createPipelineLogReader, createQueryCoordinator, createRestRateLimit, createStaticShardRegistry, createWorker, d1Probe, decorateResponse, defineExportSink, defineRpcEnvelope, durableObjectProbe, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, otlpSink, pipelineLogSink, presenceProbe, r2Sink, readShardKey, resolveLogArchiveFromEnv, resolveLunoraOptions, resolveSecurity, resolveShard, restSurfaceFromRegistry, routeIdentityResolvers, runExportTap, sanitizeChange, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookExportSink, webhookSink, withFrameworkWorker };
+export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthConfigInfo, type AuthImpersonation, type AuthPage, type AuthSession, type AuthUser, type AuthUserFieldSpec, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_LOG_COLUMNS, DEFAULT_LOG_LIMIT, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportBatch, type ExportChange, type ExportCursorStore, type ExportFanOutRequest, type ExportFanOutResult, type ExportSink, type ExportTapFailure, type ExportTapResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, HEALTH_PATH, HEALTH_READY_PATH, type HealthAuthPosture, type HealthBody, type HealthCheckReport, type HealthProbe, type HealthProbeKind, type HealthProbeResult, type HealthRouteDeps, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type KvIntrospector, type KvKeyEntry, type KvKeyListResult, type KvNamespaceSummary, type KvValueResult, LOG_ARCHIVE_NOT_CONFIGURED, LOG_ARCHIVE_PATH, type ListAuthUsersOptions, type LogArchiveConfig, type LogEvent, type LogFields, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MetricEvent, type MetricKind, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type NotifySubscriptionDevice, type NotifySubscriptionStoreLike, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type OtlpResourceAttributes, type OtlpSinkOptions, type PipelineLike, type PipelineLogColumnMap, type PipelineLogCursor, type PipelineLogField, type PipelineLogPage, type PipelineLogQuery, type PipelineLogReader, type PipelineLogReaderOptions, type PipelineLogRow, type PipelineLogSinkOptions, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type RateLimiterLike, type ResolvedSecurity, type ResolvedShard, type RestInvoke, type RestRateLimit, type RestRegistryEntry, type RestRegistryLike, type RestRoute, type RestRouteDeps, type Route, type RpcContext, type RpcEnvelope, type RunExportTapOptions, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type SpanEvent, type StorageListFunction as StorageListFn, type StorageObject, type TraceSamplingConfig, type TraceTrustSignal, type TrustInboundTraceContext, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, argsFromQuery, buildHealthRoutes, buildRestRoutes, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createKvCursorStore, createLunoraHandler, createMemoryCursorStore, createPipelineLogReader, createQueryCoordinator, createRestRateLimit, createStaticShardRegistry, createWorker, d1Probe, decorateResponse, defineExportSink, defineRpcEnvelope, durableObjectProbe, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, otlpSink, pipelineLogSink, presenceProbe, r2Sink, readShardKey, resolveLogArchiveFromEnv, resolveLunoraOptions, resolveSecurity, resolveShard, restSurfaceFromRegistry, routeIdentityResolvers, runExportTap, sanitizeChange, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookExportSink, webhookSink, withFrameworkWorker };

package/dist/index.d.ts

@@ -1536,6 +1536,20 @@ type ContextLogLevel = "debug" | "error" | "fatal" | "info" | "log" | "trace" |
  * `waitUntil` (no request context) means the sink falls back to fire-and-forget.
  */
 interface LogSinkContext {
+  /**
+   * Resolves this request's detected OTLP resource attributes (`service.version`,
+   * `cloud.region`, …) on demand, or absent when the host does not detect any.
+   *
+   * Deliberately a resolved, allowlisted bag behind a thunk rather than the raw
+   * `env` and `Request` the host detected them from: this context is fanned out
+   * to **every** registered sink, including user-authored ones, so anything
+   * reachable here should be assumed to end up in someone's debug log — and raw
+   * `env` is every secret binding, while a raw `Request` carries the caller's
+   * `Authorization` and `Cookie`. The thunk keeps detection lazy (a sink that
+   * does not want resource attributes pays nothing) and hosts are expected to
+   * memoize it per request.
+   */
+  resourceAttributes?: () => Record<string, boolean | number | string>;
   /** Keep a background promise alive past the response (the request's `waitUntil`). */
   waitUntil?: (promise: Promise<unknown>) => void;
 }
@@ -1894,8 +1908,24 @@ interface ObservabilityEvent {
   };
   /** Function path being invoked, e.g. `"messages:list"`. */
   functionPath: string;
+  /** Host of the inbound request (e.g. `"api.example.com"`). */
+  host?: string;
+  /** HTTP method of the inbound request (e.g. `"POST"`). */
+  method?: string;
   /** True when the dispatch completed without throwing. */
   ok: boolean;
+  /**
+   * Span id of the upstream caller extracted from the inbound `traceparent`,
+   * when present. This becomes the OTLP `parentSpanId` for the dispatch span so
+   * collector waterfalls show the worker span nested under the upstream caller.
+   */
+  parentSpanId?: string;
+  /** URL path of the inbound request (e.g. `"/_lunora/rpc"`). */
+  path?: string;
+  /** Port of the inbound request, when available. */
+  port?: number;
+  /** URL scheme of the inbound request (e.g. `"https"`). */
+  scheme?: string;
   /** Shard key for single-shard calls; absent for fan-outs. */
   shardKey?: string;
   /**
@@ -1907,7 +1937,14 @@ interface ObservabilityEvent {
    * falls back to random ids).
    */
   spanId?: string;
+  /**
+   * W3C trace flags for this dispatch (the sampled flag, bit 0). Carried from
+   * the upstream `traceparent` or set by the runtime's head-sampling decision.
+   */
+  traceFlags?: number;
   traceId?: string;
+  /** Inbound `User-Agent` header, when available. */
+  userAgent?: string;
 }
 /**
  * The `ctx.log` observability contract lives in `shared/` (inlined into each
@@ -2036,6 +2073,8 @@ type RestInvoke = (parameters: {
   functionPath: string;
   request: Request;
   shardKey?: string;
+  /** The request's `waitUntil`, so dispatch telemetry survives isolate teardown. */
+  waitUntil?: (promise: Promise<unknown>) => void;
 }) => Promise<Response>;
 /**
  * Optional per-request rate-limit gate for the public surface. Returns a `429`
@@ -2044,6 +2083,15 @@ type RestInvoke = (parameters: {
  * `@lunora/ratelimit`.
  */
 type RestRateLimit = (request: Request, functionPath: string) => Promise<Response | undefined> | Response | undefined;
+/**
+ * A built REST route. Takes the same `(request, env, url, context)` shape as the
+ * runtime's internal route table so it can be spread straight into it; `url` is
+ * unused here (the route re-parses it) and `context` is read only for its
+ * `waitUntil`, which keeps dispatch telemetry alive past the response.
+ */
+type RestRoute = (request: Request, env: unknown, url?: URL, context?: {
+  waitUntil?: (promise: Promise<unknown>) => void;
+}) => Promise<Response>;
 interface RestRouteDeps {
   /** The generated function registry — the source of which procedures are exposed. */
   functions: RestRegistryLike;
@@ -2075,7 +2123,7 @@ declare const argsFromQuery: (url: URL) => Record<string, unknown>;
  * construction. A `query` handler accepts `GET` (args from the query string) and
  * `POST` (args from a JSON body); a `mutation` / `action` accepts `POST` only.
  */
-declare const buildRestRoutes: (deps: RestRouteDeps) => Record<string, (request: Request, env: unknown) => Promise<Response>>;
+declare const buildRestRoutes: (deps: RestRouteDeps) => Record<string, RestRoute>;
 /** Structural view of a `@lunora/ratelimit` `RateLimiter` — only the `.limit()` call, so the runtime needs no hard dependency. */
 interface RateLimiterLike {
   limit: (name: string, args?: {
@@ -2238,6 +2286,68 @@ declare const handleCorsPreflight: (request: Request, resolved: ResolvedSecurity
  * hibernation handshake.
  */
 declare const decorateResponse: (response: Response, request: Request, resolved: ResolvedSecurity) => Response;
+/**
+ * Who is allowed to hand this worker a trace to join.
+ *
+ * Continuing an inbound W3C `traceparent` is what makes a distributed waterfall
+ * stitch end to end, but the header is caller-supplied: on a public worker,
+ * trusting it lets anyone choose which trace their spans and `ctx.log` lines land
+ * in, and — because `shared/sampling` derives the head verdict from the trace id —
+ * choose their own sampling outcome. Whether that matters is a *deployment*
+ * question ("can an untrusted client reach this worker directly?"), which no
+ * amount of request inspection can answer on its own.
+ *
+ * So rather than ask users to hand-roll a security predicate, this module ships
+ * the answers that are actually sound, named:
+ *
+ * ```ts
+ * createWorker({ trustInboundTraceContext: true });            // nothing untrusted can reach this worker
+ * createWorker({ trustInboundTraceContext: "mtls" });          // only edge-verified client certs
+ * createWorker({ trustInboundTraceContext: (request) => … });  // anything else
+ * ```
+ *
+ * **Behind a gateway, mesh, or Cloudflare Access, `true` is the answer.** If the
+ * worker is genuinely unreachable except through that front door, every caller
+ * has already passed it and there is nothing left to discriminate on. Check that
+ * it really is unreachable — a `*.workers.dev` route left enabled, or a hostname
+ * outside the Access policy, is a second front door with no gate on it.
+ *
+ * There is deliberately no `"cloudflare-access"` signal. Recognising Access by its
+ * `cf-access-jwt-assertion` header only tests that a header is present, which is
+ * redundant when the worker is properly fronted (`true` already covers it) and
+ * forgeable in one `curl` when it is not. Verifying the assertion for real means a
+ * JWKS fetch and an audience check — `@lunora/cloudflare-access` does exactly
+ * that, and it is async, so it belongs in `resolveIdentity` rather than on the
+ * dispatch path. Pass a predicate if you want to wire it in yourself.
+ *
+ * Everything resolves to one predicate at worker construction, so the per-request
+ * cost is a single call.
+ *
+ * The custom form receives only the `Request`, deliberately: handing user code the
+ * Worker `env` would put every secret binding behind a telemetry callback, the
+ * same boundary `LogSinkContext` was just narrowed to avoid. A predicate that
+ * needs to compare against a binding should close over it — build the worker per
+ * request from an options factory, the pattern `createLunoraHandler` already uses.
+ */
+/**
+ * A named trust signal — a per-request property that, on its own, establishes the
+ * caller is one whose trace context may be adopted.
+ *
+ * - `"mtls"` — the caller presented a client certificate that **Cloudflare
+ * verified at the edge**. `cf.tlsClientAuth` is platform-injected request
+ * metadata, not a header, so a caller cannot write it: the check carries its own
+ * proof and holds regardless of how the worker is exposed.
+ *
+ * Signals live here only when they meet that bar. A property a client can set for
+ * itself is not a signal; see the module doc on why Cloudflare Access is absent.
+ */
+type TraceTrustSignal = "mtls";
+/**
+ * How much of the inbound trace context to trust. `false` (the default) ignores
+ * it entirely; `true` trusts every caller, which is right when nothing untrusted
+ * can reach the worker.
+ */
+type TrustInboundTraceContext = boolean | TraceTrustSignal | ((request: Request) => boolean);
 /**
  * Wire-format RPC envelope. Posted to `POST /_lunora/rpc`.
  *
@@ -3273,6 +3383,39 @@ interface WorkerOptions {
    * endpoint. When omitted, the sync feed covers only shard-local tables.
    */
   syncGlobals?: GlobalCdcSyncFunction;
+  /**
+   * Who may hand this worker a trace to join. Controls whether an inbound W3C
+   * `traceparent` is continued — adopting its trace id, parenting this
+   * dispatch's span under the upstream span, and carrying its `tracestate` to
+   * the shard. **Default: off.**
+   *
+   * ```ts
+   * trustInboundTraceContext: true             // nothing untrusted can reach this worker
+   * trustInboundTraceContext: "mtls"           // only edge-verified client certificates
+   * trustInboundTraceContext: (request) => …   // anything else
+   * ```
+   *
+   * Off by default because the header is caller-supplied: on a worker an
+   * untrusted client can reach directly, trusting it lets anyone choose which
+   * trace their spans and `ctx.log` lines join — grafting entries into another
+   * tenant's waterfall in a shared collector — and, because the head-sampling
+   * verdict is derived from the trace id, choose their own sampling outcome.
+   * (Error traces are unaffected either way: the tail bias is evaluated from
+   * the worker's own decision, never the caller's.)
+   *
+   * Turn it on when something you control — a gateway, service mesh, or
+   * Cloudflare Access — sets `traceparent` itself; a proxy that only _forwards_
+   * the client's header is not such a thing. Behind a front door like that,
+   * `true` is the answer, because every caller has already passed it. Confirm
+   * the worker really is unreachable otherwise — a `*.workers.dev` route left
+   * enabled is a second front door with no gate on it.
+   *
+   * Leaving this unset logs a one-time hint if an inbound trace is actually
+   * dropped; setting it explicitly to `false` keeps the behaviour and silences
+   * that.
+   * @see {@link TrustInboundTraceContext} for what each signal proves.
+   */
+  trustInboundTraceContext?: TrustInboundTraceContext;
   /**
    * Read-only introspector for Vectorize indexes, backing the studio's vector
    * browser via `GET /_lunora/admin/vector/indexes` and
@@ -3357,9 +3500,12 @@ interface LunoraWorker {
    * @param options Call options mirroring the RPC envelope.
    * @param options.shardKey Routes to a specific shard (omitted → the worker's
    * `defaultShardKey`).
+   * @param options.waitUntil The host's `waitUntil`, so dispatch telemetry
+   * whose export is deferred (a gzipped OTLP body) survives isolate teardown.
    */
   serverQuery: (request: Request, env: unknown, reference: unknown, args?: Record<string, unknown>, options?: {
     shardKey?: string;
+    waitUntil?: (promise: Promise<unknown>) => void;
   }) => Promise<Response>;
 }
 /**
@@ -3608,6 +3754,15 @@ declare class LunoraError extends LunoraError$1 {
   });
   toResponse(): Response;
 }
+/** A JS attribute value the encoder maps onto an OTLP `AnyValue`. */
+type OtlpAttributeValue = boolean | number | string;
+/**
+ * A `Resource.attributes` bag — the process-level identity (`service.name`,
+ * `service.version`, `cloud.region`, …) attached to every exported signal.
+ * Lives here rather than in either exporter because both packages build one and
+ * `wrapResource*` consumes it.
+ */
+type OtlpResourceAttributes = Record<string, OtlpAttributeValue>;
 /** Shared shape for sinks that can be limited to error events only. */
 interface OnlyErrorsOption {
   /** When true, only events with `ok === false` are forwarded. */
@@ -3808,6 +3963,28 @@ interface PipelineLogSinkOptions {
 declare const pipelineLogSink: (options: PipelineLogSinkOptions) => ObservabilitySink;
 /** Options for {@link otlpSink}. */
 interface OtlpSinkOptions extends OnlyErrorsOption {
+  /**
+   * Value of the `deployment.environment` resource attribute (e.g.
+   * `"production"`, `"staging"`, `"development"`).
+   */
+  deploymentEnvironment?: string;
+  /**
+   * When `true`, the sink attaches the resource attributes the **host** detected
+   * for the current request, merged *under* any explicit option so those always
+   * win on collision. In a Worker that is `service.version`,
+   * `deployment.environment`, `cloud.provider`, and `cloud.region` (the colo).
+   *
+   * The sink never inspects `env` or the request itself — detection happens once
+   * per request in the runtime and arrives pre-resolved on the sink context (see
+   * `LogSinkContext.resourceAttributes`), so no sink is ever handed raw bindings.
+   *
+   * Events that originate inside a shard (`ctx.log`, `ctx.trace`, `ctx.metrics`)
+   * carry no host-detected attributes today — the shard has no `env` of its own —
+   * so they export with the explicit options only. Set the values you need
+   * explicitly if you require them to match across worker and shard spans of the
+   * same trace.
+   */
+  detectResources?: boolean;
   /**
    * The OTLP-over-HTTP collector base endpoint (e.g.
    * `https://collector.example.com`). Following the OTel base-endpoint
@@ -3822,11 +3999,29 @@ interface OtlpSinkOptions extends OnlyErrorsOption {
    * default and may be overridden here.
    */
   headers?: Record<string, string>;
+  /**
+   * Additional resource attributes to attach to every exported signal. These
+   * ride alongside the built-in `service.name` and any convenience fields
+   * (`serviceVersion`, `deploymentEnvironment`, etc.). A key that collides with
+   * a built-in resource attribute wins; use this for custom dimensions like
+   * `deployment.region`, `host.name`, or `service.instance.id`.
+   */
+  resourceAttributes?: OtlpResourceAttributes;
   /**
    * Value of the `service.name` resource attribute on every exported span and
    * log — the logical service the telemetry belongs to. Defaults to `lunora`.
    */
   serviceName?: string;
+  /**
+   * Value of the `service.namespace` resource attribute, useful when multiple
+   * services share the same `service.name` under a tenant or team boundary.
+   */
+  serviceNamespace?: string;
+  /**
+   * Value of the `service.version` resource attribute (e.g. a git sha or
+   * release tag).
+   */
+  serviceVersion?: string;
   /**
    * Convenience bearer token: when set, an `Authorization: Bearer` header
    * carrying it is added to every POST (overriding any authorization in
@@ -3871,4 +4066,4 @@ declare const otlpSink: (options: OtlpSinkOptions) => ObservabilitySink;
  */
 declare const combineSinks: (...sinks: ObservabilitySink[]) => ObservabilitySink;
 declare const VERSION: string;
-export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthConfigInfo, type AuthImpersonation, type AuthPage, type AuthSession, type AuthUser, type AuthUserFieldSpec, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_LOG_COLUMNS, DEFAULT_LOG_LIMIT, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportBatch, type ExportChange, type ExportCursorStore, type ExportFanOutRequest, type ExportFanOutResult, type ExportSink, type ExportTapFailure, type ExportTapResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, HEALTH_PATH, HEALTH_READY_PATH, type HealthAuthPosture, type HealthBody, type HealthCheckReport, type HealthProbe, type HealthProbeKind, type HealthProbeResult, type HealthRouteDeps, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type KvIntrospector, type KvKeyEntry, type KvKeyListResult, type KvNamespaceSummary, type KvValueResult, LOG_ARCHIVE_NOT_CONFIGURED, LOG_ARCHIVE_PATH, type ListAuthUsersOptions, type LogArchiveConfig, type LogEvent, type LogFields, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MetricEvent, type MetricKind, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type NotifySubscriptionDevice, type NotifySubscriptionStoreLike, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type OtlpSinkOptions, type PipelineLike, type PipelineLogColumnMap, type PipelineLogCursor, type PipelineLogField, type PipelineLogPage, type PipelineLogQuery, type PipelineLogReader, type PipelineLogReaderOptions, type PipelineLogRow, type PipelineLogSinkOptions, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type RateLimiterLike, type ResolvedSecurity, type ResolvedShard, type RestInvoke, type RestRateLimit, type RestRegistryEntry, type RestRegistryLike, type RestRouteDeps, type Route, type RpcContext, type RpcEnvelope, type RunExportTapOptions, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type SpanEvent, type StorageListFunction as StorageListFn, type StorageObject, type TraceSamplingConfig, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, argsFromQuery, buildHealthRoutes, buildRestRoutes, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createKvCursorStore, createLunoraHandler, createMemoryCursorStore, createPipelineLogReader, createQueryCoordinator, createRestRateLimit, createStaticShardRegistry, createWorker, d1Probe, decorateResponse, defineExportSink, defineRpcEnvelope, durableObjectProbe, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, otlpSink, pipelineLogSink, presenceProbe, r2Sink, readShardKey, resolveLogArchiveFromEnv, resolveLunoraOptions, resolveSecurity, resolveShard, restSurfaceFromRegistry, routeIdentityResolvers, runExportTap, sanitizeChange, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookExportSink, webhookSink, withFrameworkWorker };
+export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthConfigInfo, type AuthImpersonation, type AuthPage, type AuthSession, type AuthUser, type AuthUserFieldSpec, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_LOG_COLUMNS, DEFAULT_LOG_LIMIT, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportBatch, type ExportChange, type ExportCursorStore, type ExportFanOutRequest, type ExportFanOutResult, type ExportSink, type ExportTapFailure, type ExportTapResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, HEALTH_PATH, HEALTH_READY_PATH, type HealthAuthPosture, type HealthBody, type HealthCheckReport, type HealthProbe, type HealthProbeKind, type HealthProbeResult, type HealthRouteDeps, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type KvIntrospector, type KvKeyEntry, type KvKeyListResult, type KvNamespaceSummary, type KvValueResult, LOG_ARCHIVE_NOT_CONFIGURED, LOG_ARCHIVE_PATH, type ListAuthUsersOptions, type LogArchiveConfig, type LogEvent, type LogFields, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MetricEvent, type MetricKind, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type NotifySubscriptionDevice, type NotifySubscriptionStoreLike, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type OtlpResourceAttributes, type OtlpSinkOptions, type PipelineLike, type PipelineLogColumnMap, type PipelineLogCursor, type PipelineLogField, type PipelineLogPage, type PipelineLogQuery, type PipelineLogReader, type PipelineLogReaderOptions, type PipelineLogRow, type PipelineLogSinkOptions, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type RateLimiterLike, type ResolvedSecurity, type ResolvedShard, type RestInvoke, type RestRateLimit, type RestRegistryEntry, type RestRegistryLike, type RestRoute, type RestRouteDeps, type Route, type RpcContext, type RpcEnvelope, type RunExportTapOptions, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type SpanEvent, type StorageListFunction as StorageListFn, type StorageObject, type TraceSamplingConfig, type TraceTrustSignal, type TrustInboundTraceContext, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, argsFromQuery, buildHealthRoutes, buildRestRoutes, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createKvCursorStore, createLunoraHandler, createMemoryCursorStore, createPipelineLogReader, createQueryCoordinator, createRestRateLimit, createStaticShardRegistry, createWorker, d1Probe, decorateResponse, defineExportSink, defineRpcEnvelope, durableObjectProbe, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, otlpSink, pipelineLogSink, presenceProbe, r2Sink, readShardKey, resolveLogArchiveFromEnv, resolveLunoraOptions, resolveSecurity, resolveShard, restSurfaceFromRegistry, routeIdentityResolvers, runExportTap, sanitizeChange, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookExportSink, webhookSink, withFrameworkWorker };

package/dist/index.mjs

@@ -1,5 +1,5 @@
 export { toAirbyteMessages, toFivetranResponse } from './packem_shared/toAirbyteMessages-DrHdplb4.mjs';
-export { composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker } from './packem_shared/composeWorker-UwHY2r8O.mjs';
+export { composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker } from './packem_shared/composeWorker-DiWwOXXt.mjs';
 export { createCrossShardRelationCapabilities } from './packem_shared/createCrossShardRelationCapabilities-CbcWjkAn.mjs';
 export { DEFAULT_REGISTRY_CACHE_TTL_MS, SHARD_REGISTRY_DO_NAME, createDynamicShardRegistry } from './packem_shared/DEFAULT_REGISTRY_CACHE_TTL_MS-B3pA7aXp.mjs';
 export { LunoraError, toErrorResponse } from './packem_shared/LunoraError-Bpb9EFJ3.mjs';
@@ -7,11 +7,11 @@ export { createKvCursorStore, createMemoryCursorStore, defineExportSink, r2Sink,
 export { HEALTH_PATH, HEALTH_READY_PATH, buildHealthRoutes, d1Probe, durableObjectProbe, presenceProbe } from './packem_shared/HEALTH_PATH-e5J_NHBx.mjs';
 export { LOG_ARCHIVE_PATH, resolveLogArchiveFromEnv } from './packem_shared/LOG_ARCHIVE_PATH-CNs0bznX.mjs';
 export { e as emitLogEvent, a as emitRpcEvent } from './packem_shared/observability--NOFYBFc.mjs';
-export { analyticsEngineSink, combineSinks, consoleSink, otlpSink, pipelineLogSink, sentrySink, webhookSink } from './packem_shared/analyticsEngineSink-DgL64WVC.mjs';
+export { analyticsEngineSink, combineSinks, consoleSink, otlpSink, pipelineLogSink, sentrySink, webhookSink } from './packem_shared/analyticsEngineSink-yLFNjHDt.mjs';
 export { D as DEFAULT_LOG_COLUMNS, a as DEFAULT_LOG_LIMIT, c as createPipelineLogReader } from './packem_shared/pipeline-log-reader-BXULGNC3.mjs';
 export { createQueryCoordinator, createStaticShardRegistry, mergeStrategyForAggregate } from './packem_shared/createQueryCoordinator-DNCJzOZE.mjs';
 export { applyJurisdiction, resolveShard } from './packem_shared/applyJurisdiction-BkZtTkct.mjs';
-export { argsFromQuery, buildRestRoutes, createRestRateLimit, readShardKey, restSurfaceFromRegistry } from './packem_shared/argsFromQuery-BqPiQTPc.mjs';
+export { argsFromQuery, buildRestRoutes, createRestRateLimit, readShardKey, restSurfaceFromRegistry } from './packem_shared/argsFromQuery-c-U1WRy-.mjs';
 export { decorateResponse, enforceOrigin, handleCorsPreflight, resolveSecurity } from './packem_shared/decorateResponse-DRWQFNhF.mjs';
 export { LOG_ARCHIVE_NOT_CONFIGURED } from './packem_shared/LOG_ARCHIVE_NOT_CONFIGURED-acNcguqc.mjs';
 export { NOOP_EXECUTION_CONTEXT } from './packem_shared/NOOP_EXECUTION_CONTEXT-CCTu0Bf1.mjs';