@lunora/runtime 1.0.0-alpha.37 → 1.0.0-alpha.39

package/dist/index.d.mts

@@ -1560,6 +1560,20 @@ interface LogSinkContext {
 interface LogEvent {
   /** Raw arguments passed to the `ctx.log.*` call, in order. */
   args: unknown[];
+  /**
+   * OTel `LogRecord.eventName` — set when the line was emitted as a **structured
+   * event** via `ctx.log.event(name, fields)` rather than as a human-readable
+   * log line.
+   *
+   * The distinction is the whole point of the Events API: a log line's payload
+   * is its `message` (prose, for a human, unstable), while an event's payload is
+   * its `fields` (a named schema, for a query, stable). A collector that knows
+   * `eventName` can index and aggregate the latter; without it, "how many
+   * checkouts failed" degrades into a substring search over prose.
+   *
+   * Absent for ordinary `ctx.log.*` calls.
+   */
+  eventName?: string;
   /**
    * Structured fields the caller attached (`ctx.log.info(message, fields)` or a
    * bound `ctx.log.with(fields)` child), already normalized to a fresh bag of
@@ -1817,6 +1831,58 @@ interface MetricEvent {
    */
   value: number;
 }
+/** A JS attribute value the encoder maps onto an OTLP `AnyValue`. */
+type OtlpAttributeValue = boolean | number | string;
+/**
+ * A `Resource.attributes` bag — the process-level identity (`service.name`,
+ * `service.version`, `cloud.region`, …) attached to every exported signal.
+ * Lives here rather than in either exporter because both packages build one and
+ * `wrapResource*` consumes it.
+ */
+type OtlpResourceAttributes = Record<string, OtlpAttributeValue>;
+/**
+ * The OTel `SpanKind` union, in the spec's own words rather than its wire
+ * numbers, so a call site reads `{ kind: "client" }` instead of `{ kind: 3 }`.
+ *
+ * Kind is not cosmetic: a service map is built from it. A CLIENT span with no
+ * matching SERVER span on the other side is a dropped hop; PRODUCER/CONSUMER is
+ * what makes a queue render as an async edge rather than a synchronous call.
+ * Getting it wrong is why "everything is INTERNAL" traces produce no topology.
+ */
+type OtlpSpanKind = "client" | "consumer" | "internal" | "producer" | "server";
+/**
+ * One timestamped occurrence inside a span — OTel's `Span.events`.
+ *
+ * The right shape for something that has a moment but no duration: a retry, a
+ * cache miss, a validation failure, a thrown exception. Modelling those as
+ * near-zero-width child spans clutters the waterfall, and modelling them as
+ * separate log lines loses the "which span was I in" correlation that makes them
+ * useful in the first place.
+ */
+interface SpanEventPoint {
+  /** Structured attributes, normalized like a span's own. */
+  attributes?: LogFields;
+  /** Event name, e.g. `"exception"` or `"cache.miss"`. */
+  name: string;
+  /** Wall-clock millis when it happened. */
+  ts: number;
+}
+/**
+ * A causal reference to a span in ANOTHER trace — OTel's `Span.links`.
+ *
+ * The standard answer to fan-in: a queue consumer processing a batch of 100
+ * messages links to the 100 producing spans rather than parenting to one of them
+ * (arbitrary) or all of them (impossible). The traces stay separately navigable
+ * and the causal edge survives.
+ */
+interface SpanLink {
+  /** Attributes describing the relationship, e.g. `{ "link.kind": "enqueued_by" }`. */
+  attributes?: LogFields;
+  /** Linked span id (16-hex). */
+  spanId: string;
+  /** Linked trace id (32-hex). */
+  traceId: string;
+}
 interface SpanEvent {
   /**
    * Structured attributes the caller attached, already normalized to a fresh
@@ -1826,6 +1892,12 @@ interface SpanEvent {
   attributes?: LogFields;
   /** Wall-clock duration of the span body, in milliseconds. */
   durationMs: number;
+  /**
+   * Timestamped occurrences inside the span (see {@link SpanEventPoint}) —
+   * `ctx.trace`'s `span.addEvent(...)` / `span.recordException(...)`. Absent
+   * when the body recorded none.
+   */
+  events?: SpanEventPoint[];
   /**
    * Populated when the span body threw. `type` is the error's constructor name
    * (or its `LunoraError` code); `message` is the human-readable string and may
@@ -1842,6 +1914,14 @@ interface SpanEvent {
    * reuses its context — the same attribution rule `ctx.log` follows.
    */
   functionPath: string;
+  /**
+   * OTel `SpanKind`. Absent means `"internal"` — the overwhelming majority of
+   * `ctx.trace` spans — so the common case costs no bytes on the wire and every
+   * pre-existing recorded span stays valid.
+   */
+  kind?: OtlpSpanKind;
+  /** Causal references to spans in other traces (see {@link SpanLink}). Absent when none. */
+  links?: SpanLink[];
   /** Caller-supplied span name, e.g. `"stripe.charge"`. */
   name: string;
   /** True when the span body returned without throwing. */
@@ -1963,6 +2043,21 @@ type ObservabilitySinkContext = LogSinkContext;
  * events it cares about; the runtime no-ops the others.
  */
 interface ObservabilitySink {
+  /**
+   * Ship anything the sink is holding, now.
+   *
+   * A batching sink (`otlpSink` by default) buffers events and exports them as
+   * one request instead of one request per event. That is only safe because a
+   * Workers isolate can be frozen the instant a response is returned: the
+   * runtime calls this at every invocation boundary — end of `fetch`, `queue`,
+   * `scheduled`, and each Durable Object dispatch — passing the request's
+   * `waitUntil` so the export outlives the response.
+   *
+   * Optional and idempotent: a non-buffering sink simply omits it, and calling
+   * it with an empty buffer is a no-op. A sink must never throw from here; like
+   * every other hook, a telemetry failure must not surface to the caller.
+   */
+  flush?: (context?: ObservabilitySinkContext) => void;
   /**
    * **Opt-in, EXPERIMENTAL, default `false`.** When `true`, each `ctx.trace`
    * span the Durable Object records is ALSO emitted as a Cloudflare **custom
@@ -1993,6 +2088,23 @@ interface ObservabilitySink {
    * `createShardDO` — the DO reads the flag when building `ctx.trace`.
    */
   fuseCloudflareTraces?: boolean;
+  /**
+   * How much detail automatic `ctx.db` instrumentation produces.
+   *
+   * `"summary"` (**default**) — aggregate counters (`db.calls`, `db.duration_ms`,
+   * per-operation counts) folded onto the dispatch's wide event. No extra spans
+   * and no extra log records, so the cost is flat no matter how many queries a
+   * handler makes.
+   *
+   * `"spans"` — one span per database call: the full waterfall, for when you are
+   * chasing a specific slow query. Capped per dispatch so a query loop cannot
+   * bury the trace; truncation is reported as `db.spans_truncated`.
+   *
+   * `"off"` — no database telemetry.
+   *
+   * Applies only when a sink is configured; with none, `ctx.db` is untouched.
+   */
+  instrumentDatabase?: "off" | "spans" | "summary";
   /** Invoked once per `ctx.log.*` call from a function handler. */
   onLog?: (event: LogEvent, context?: ObservabilitySinkContext) => void;
   /**
@@ -2008,6 +2120,20 @@ interface ObservabilitySink {
    * INTERNAL spans a handler creates beneath it.
    */
   onSpan?: (event: SpanEvent, context?: ObservabilitySinkContext) => void;
+  /**
+   * Whether `ctx.fetch` is instrumented: each outbound call becomes a **CLIENT
+   * span**, and a W3C `traceparent` naming that span is injected so the callee's
+   * spans join this trace instead of starting a disconnected one. Default `true`
+   * whenever a sink is configured.
+   *
+   * Set `false` for the bare platform `fetch` (no span, no header). Pass
+   * `{ propagate }` to keep the spans but control who receives trace context, e.g.
+   * `propagate: (url) => url.host.endsWith(".internal")` to send it to your own
+   * services and not to third parties.
+   */
+  traceFetch?: boolean | {
+    propagate?: ((url: URL) => boolean) | boolean;
+  };
 }
 /**
  * Invoke `sink.onRpc` with the given event, swallowing any error the sink
@@ -2187,6 +2313,23 @@ interface CorsOptions {
 }
 /** Origin/CSRF guard configuration. */
 interface CsrfOptions {
+  /**
+   * Whether a loopback `Origin` is trusted **when the worker itself is serving on
+   * loopback**. Defaults to `true`.
+   *
+   * This is the local-development shape: the browser loads the app from the dev
+   * server on `localhost:3000` which proxies `/_lunora` to wrangler on
+   * `localhost:8787`. With `changeOrigin`, the worker sees its own URL as
+   * `:8787` while the browser's `Origin` stays `:3000`, so the two don't match and
+   * the cookie-bearing WS upgrade is rejected — the app then hangs on its loading
+   * state with no clue why. Both ends are loopback, so nothing cross-site can
+   * reach them.
+   *
+   * It cannot loosen production: the exemption requires the worker's OWN origin to
+   * be loopback, which a deployed worker's never is. Set `false` for a hardened
+   * local setup that wants the strict same-origin rule.
+   */
+  allowLoopback?: boolean;
   /** Extra origins (beyond same-origin and the CORS allowlist) accepted on unsafe cookie requests. */
   trustedOrigins?: string[];
 }
@@ -2232,6 +2375,7 @@ interface ResolvedCors {
   maxAge: number;
 }
 interface ResolvedCsrf {
+  allowLoopback: boolean;
   enabled: boolean;
   trustedOrigins: string[];
 }
@@ -3754,15 +3898,53 @@ declare class LunoraError extends LunoraError$1 {
   });
   toResponse(): Response;
 }
-/** A JS attribute value the encoder maps onto an OTLP `AnyValue`. */
-type OtlpAttributeValue = boolean | number | string;
 /**
- * A `Resource.attributes` bag — the process-level identity (`service.name`,
- * `service.version`, `cloud.region`, …) attached to every exported signal.
- * Lives here rather than in either exporter because both packages build one and
- * `wrapResource*` consumes it.
+ * Memoize a resolver **within a single request**.
+ *
+ * The safe default: keyed on the `Request` object itself, so the result is reused by
+ * every code path handling that request (the RPC dispatch, each fan-out leg, an
+ * admin gate) and discarded the moment the request is collected. It cannot serve a
+ * stale identity, because it never outlives the request that produced it — a revoked
+ * session is re-verified on the very next request.
+ *
+ * ```ts
+ * createWorker({ resolveIdentity: memoizeIdentityPerRequest(myResolver), … });
+ * ```
  */
-type OtlpResourceAttributes = Record<string, OtlpAttributeValue>;
+declare const memoizeIdentityPerRequest: (resolver: IdentityResolver) => IdentityResolver;
+/** Tuning for {@link memoizeIdentity}. */
+interface MemoizeIdentityOptions {
+  /**
+   * Cache size before the oldest entry is evicted. Defaults to 500 — an isolate
+   * serves a bounded set of concurrent users, and an unbounded map in a
+   * long-lived isolate is a leak.
+   */
+  maxEntries?: number;
+  /**
+   * How long a verified identity is reused for the same credential, in ms.
+   * Defaults to 5000.
+   *
+   * **This is the revocation delay.** A signed-out or revoked session keeps
+   * resolving for up to this long, so keep it in the seconds — long enough to
+   * collapse a burst (a page load's parallel queries, one query's fan-out across
+   * shards), short enough that a sign-out is effectively immediate. Do not raise it
+   * into the minutes to save verifications.
+   */
+  ttlMs?: number;
+}
+/**
+ * Memoize a resolver **across requests**, keyed on the presented credential, for
+ * `ttlMs`.
+ *
+ * Use it when session verification is genuinely expensive (a JWKS fetch, a D1 read)
+ * and a few seconds of revocation delay is acceptable — see
+ * {@link MemoizeIdentityOptions.ttlMs}, which is the whole trade-off. Composes with
+ * (and subsumes) {@link memoizeIdentityPerRequest}: within one request the same entry
+ * is reused regardless of TTL.
+ *
+ * An anonymous request (no cookie, no bearer) is never cached.
+ */
+declare const memoizeIdentity: (resolver: IdentityResolver, options?: MemoizeIdentityOptions) => IdentityResolver;
 /** Shared shape for sinks that can be limited to error events only. */
 interface OnlyErrorsOption {
   /** When true, only events with `ok === false` are forwarded. */
@@ -3961,8 +4143,76 @@ interface PipelineLogSinkOptions {
  * `serializeFields` stores `fields` as a queryable JSON string.
  */
 declare const pipelineLogSink: (options: PipelineLogSinkOptions) => ObservabilitySink;
+/**
+ * Everything the exporter buffered for one flush window, grouped so a
+ * {@link TailSampler} can judge a trace as a whole.
+ *
+ * This is what makes it *tail* sampling rather than another head decision: by
+ * flush time the trace's spans have all settled, so "keep it if anything in it
+ * was slow or failed" is answerable — which it is not at the moment the first
+ * span starts.
+ */
+interface TailSamplerInput {
+  /** Log records emitted under this trace. */
+  logs: LogEvent[];
+  /** RPC (SERVER) dispatch events belonging to this trace. */
+  rpc: ObservabilityEvent[];
+  /** `ctx.trace` spans belonging to this trace. */
+  spans: SpanEvent[];
+  /** The trace's id, or `undefined` for events that carried no trace context. */
+  traceId: string | undefined;
+}
+/**
+ * Decide whether a whole trace is exported. Return `false` to drop it — spans,
+ * logs, and all.
+ *
+ * Composes with head sampling rather than replacing it: head sampling cheaply
+ * discards most traces before they cost anything, and this makes the final call
+ * on what survived. The canonical policy — "keep errors and slow requests, drop
+ * the rest" — needs both.
+ */
+type TailSampler = (input: TailSamplerInput) => boolean;
+/**
+ * Last-chance transforms applied to each event immediately before encoding.
+ *
+ * Return `undefined` from any hook to drop that event entirely. This is the
+ * redaction seam: attributes, log messages, and error strings can all carry user
+ * input, and once a payload leaves for a third-party collector it is out of your
+ * control. Doing it here rather than at each call site means one auditable place
+ * to prove PII cannot escape.
+ *
+ * A hook that THROWS also drops the event. Redaction is a privacy control, so it
+ * fails closed — losing a span beats exporting the thing the hook existed to
+ * remove.
+ */
+interface OtlpPostProcessor {
+  log?: (event: LogEvent) => LogEvent | undefined;
+  metric?: (event: MetricEvent) => MetricEvent | undefined;
+  rpc?: (event: ObservabilityEvent) => ObservabilityEvent | undefined;
+  span?: (event: SpanEvent) => SpanEvent | undefined;
+}
+/** Batching knobs for {@link otlpSink}; pass `batch: false` to export each event immediately. */
+interface OtlpBatchOptions {
+  /**
+   * Flush this long after the first buffered event, as a backstop for contexts
+   * with no invocation boundary. Default 200ms.
+   */
+  maxDelayMs?: number;
+  /** Flush as soon as this many events are buffered. Default 512. */
+  maxItems?: number;
+}
 /** Options for {@link otlpSink}. */
 interface OtlpSinkOptions extends OnlyErrorsOption {
+  /**
+   * Buffer events and export them as one request per signal instead of one
+   * request per event (the default). Pass `false` to restore per-event POSTs.
+   *
+   * Batching is on by default because the alternative is a correctness problem,
+   * not just an efficiency one: a Worker is capped at 50 (free) / 1000 (paid)
+   * subrequests per invocation, so a well-instrumented handler exporting one
+   * `fetch` per span can exhaust the budget its own business logic needs.
+   */
+  batch?: OtlpBatchOptions | false;
   /**
    * Value of the `deployment.environment` resource attribute (e.g.
    * `"production"`, `"staging"`, `"development"`).
@@ -3999,6 +4249,12 @@ interface OtlpSinkOptions extends OnlyErrorsOption {
    * default and may be overridden here.
    */
   headers?: Record<string, string>;
+  /**
+   * Redact or drop events just before they are encoded — see
+   * {@link OtlpPostProcessor}. A hook that throws drops the event (fail-closed);
+   * see {@link postProcess}.
+   */
+  postProcessor?: OtlpPostProcessor;
   /**
    * Additional resource attributes to attach to every exported signal. These
    * ride alongside the built-in `service.name` and any convenience fields
@@ -4022,6 +4278,18 @@ interface OtlpSinkOptions extends OnlyErrorsOption {
    * release tag).
    */
   serviceVersion?: string;
+  /**
+   * Decide per trace, at flush time, whether it is exported — see
+   * {@link TailSampler}. Requires batching (the default); ignored when
+   * `batch: false`, because an unbuffered exporter has no trace to judge.
+   *
+   * A sampler that throws **keeps** the trace (fail-open) and the failure is
+   * reported to `console.error`, rate-limited per sink. Treat this hook as a
+   * cost control, not a guarantee: if a bounded export volume is a hard
+   * requirement, enforce it at the collector, which cannot be bypassed by a bug
+   * in this predicate.
+   */
+  tailSampler?: TailSampler;
   /**
    * Convenience bearer token: when set, an `Authorization: Bearer` header
    * carrying it is added to every POST (overriding any authorization in
@@ -4065,5 +4333,88 @@ declare const otlpSink: (options: OtlpSinkOptions) => ObservabilitySink;
  * @param sinks The sinks to fan out to.
  */
 declare const combineSinks: (...sinks: ObservabilitySink[]) => ObservabilitySink;
+/**
+ * Structural mirror of `@lunora/client`'s `FunctionReference`, re-declared so this
+ * module carries no `runtime → client` (browser SDK) dependency. The phantom
+ * marker's shape matches, so a generated `api.*` / `internal.*` reference infers
+ * its args and return type through {@link ShardClient.call} unchanged.
+ */
+interface ShardFunctionReference<Args = unknown, Return = unknown> {
+  readonly __lunoraPhantom?: {
+    args: Args;
+    kind: string;
+    returns: Return;
+  };
+  readonly __lunoraRef: string;
+}
+/** Args type of a {@link ShardFunctionReference} (`Record&lt;string, unknown>` for an untyped ref). */
+type ShardCallArgs<F> = F extends ShardFunctionReference<infer A, infer _R> ? A : Record<string, unknown>;
+/** Return type of a {@link ShardFunctionReference} (`unknown` for an untyped ref). */
+type ShardCallReturn<F> = F extends ShardFunctionReference<infer _A, infer R> ? R : unknown;
+/** A verified end-user identity a shard call runs as. */
+interface ShardCallerIdentity {
+  /**
+   * Full identity claims, forwarded so `ctx.auth.getIdentity()` and any
+   * claim-reading RLS policy see the same object the HTTP path would build. Omit
+   * to forward only `userId`.
+   */
+  claims?: Record<string, unknown>;
+  /** The verified user id — becomes `ctx.auth.userId` on the shard. */
+  userId: string;
+}
+/** Options for {@link createShardClient}. */
+interface ShardClientOptions {
+  /** Run every call as this verified end-user identity. See {@link ShardClient.as}. */
+  as?: ShardCallerIdentity;
+  /** Pin the DO namespace to a data-residency jurisdiction, exactly as the worker does. */
+  jurisdiction?: DurableObjectJurisdiction;
+  /** Default shard key for calls that don't pass one. See {@link ShardClient.forShard}. */
+  shardKey?: string;
+  /**
+   * Whether calls carry system privilege (may invoke `internalQuery` /
+   * `internalMutation` / `internalAction`). Defaults to `true` — a caller holding
+   * the DO binding is already inside the trust boundary. Set `false` to make calls
+   * behave exactly like an end-user RPC, so an accidental `internal.*` call is
+   * rejected by the shard instead of succeeding.
+   */
+  system?: boolean;
+}
+/** Per-call overrides. */
+interface ShardCallOptions {
+  /**
+   * Idempotency key. The DO dedupes on `(identity, mutationId)` and replays the
+   * cached result, so an at-least-once retry (a queue redelivery, a webhook resend)
+   * applies the mutation once. Use a key derived from the upstream event, not a
+   * fresh uuid per attempt.
+   */
+  mutationId?: string;
+  /** Override the client's default shard key for this call. */
+  shardKey?: string;
+}
+/** A typed caller bound to a namespace + privilege + (optionally) a shard. */
+interface ShardClient {
+  /** Derive a client that runs as `identity`. Keeps system privilege unless `system: false` was set. */
+  as: (identity: ShardCallerIdentity) => ShardClient;
+  /** Derive a client with no end-user identity — a pure system caller. */
+  asSystem: () => ShardClient;
+  /**
+   * Call a Lunora function on the shard. Pass a generated reference
+   * (`internal.mcp.listNodes`) for typed args and return; a bare
+   * `"namespace:fn"` string works as the escape hatch and returns `unknown`.
+   *
+   * Throws a {@link LunoraError} carrying the server's `code` when the function
+   * fails — the same error shape the browser client surfaces, so a caller branches
+   * on `FORBIDDEN` / `CONFLICT` / … identically on both sides.
+   */
+  call: <F extends ShardFunctionReference | string>(reference: F, args: F extends string ? Record<string, unknown> : ShardCallArgs<F>, options?: ShardCallOptions) => Promise<ShardCallReturn<F>>;
+  /** Derive a client whose calls default to `shardKey`. */
+  forShard: (shardKey: string) => ShardClient;
+}
+/**
+ * Create a typed server-side caller over a `ShardDO` namespace binding.
+ *
+ * See the module docs for the privilege model and the authorization caveat.
+ */
+declare const createShardClient: (namespace: ShardNamespaceLike, options?: ShardClientOptions) => ShardClient;
 declare const VERSION: string;
-export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthConfigInfo, type AuthImpersonation, type AuthPage, type AuthSession, type AuthUser, type AuthUserFieldSpec, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_LOG_COLUMNS, DEFAULT_LOG_LIMIT, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportBatch, type ExportChange, type ExportCursorStore, type ExportFanOutRequest, type ExportFanOutResult, type ExportSink, type ExportTapFailure, type ExportTapResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, HEALTH_PATH, HEALTH_READY_PATH, type HealthAuthPosture, type HealthBody, type HealthCheckReport, type HealthProbe, type HealthProbeKind, type HealthProbeResult, type HealthRouteDeps, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type KvIntrospector, type KvKeyEntry, type KvKeyListResult, type KvNamespaceSummary, type KvValueResult, LOG_ARCHIVE_NOT_CONFIGURED, LOG_ARCHIVE_PATH, type ListAuthUsersOptions, type LogArchiveConfig, type LogEvent, type LogFields, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MetricEvent, type MetricKind, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type NotifySubscriptionDevice, type NotifySubscriptionStoreLike, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type OtlpResourceAttributes, type OtlpSinkOptions, type PipelineLike, type PipelineLogColumnMap, type PipelineLogCursor, type PipelineLogField, type PipelineLogPage, type PipelineLogQuery, type PipelineLogReader, type PipelineLogReaderOptions, type PipelineLogRow, type PipelineLogSinkOptions, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type RateLimiterLike, type ResolvedSecurity, type ResolvedShard, type RestInvoke, type RestRateLimit, type RestRegistryEntry, type RestRegistryLike, type RestRoute, type RestRouteDeps, type Route, type RpcContext, type RpcEnvelope, type RunExportTapOptions, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type SpanEvent, type StorageListFunction as StorageListFn, type StorageObject, type TraceSamplingConfig, type TraceTrustSignal, type TrustInboundTraceContext, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, argsFromQuery, buildHealthRoutes, buildRestRoutes, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createKvCursorStore, createLunoraHandler, createMemoryCursorStore, createPipelineLogReader, createQueryCoordinator, createRestRateLimit, createStaticShardRegistry, createWorker, d1Probe, decorateResponse, defineExportSink, defineRpcEnvelope, durableObjectProbe, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, otlpSink, pipelineLogSink, presenceProbe, r2Sink, readShardKey, resolveLogArchiveFromEnv, resolveLunoraOptions, resolveSecurity, resolveShard, restSurfaceFromRegistry, routeIdentityResolvers, runExportTap, sanitizeChange, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookExportSink, webhookSink, withFrameworkWorker };
+export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthConfigInfo, type AuthImpersonation, type AuthPage, type AuthSession, type AuthUser, type AuthUserFieldSpec, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_LOG_COLUMNS, DEFAULT_LOG_LIMIT, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportBatch, type ExportChange, type ExportCursorStore, type ExportFanOutRequest, type ExportFanOutResult, type ExportSink, type ExportTapFailure, type ExportTapResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, HEALTH_PATH, HEALTH_READY_PATH, type HealthAuthPosture, type HealthBody, type HealthCheckReport, type HealthProbe, type HealthProbeKind, type HealthProbeResult, type HealthRouteDeps, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type KvIntrospector, type KvKeyEntry, type KvKeyListResult, type KvNamespaceSummary, type KvValueResult, LOG_ARCHIVE_NOT_CONFIGURED, LOG_ARCHIVE_PATH, type ListAuthUsersOptions, type LogArchiveConfig, type LogEvent, type LogFields, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MemoizeIdentityOptions, type MergeStrategy, type MetricEvent, type MetricKind, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type NotifySubscriptionDevice, type NotifySubscriptionStoreLike, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type OtlpResourceAttributes, type OtlpSinkOptions, type PipelineLike, type PipelineLogColumnMap, type PipelineLogCursor, type PipelineLogField, type PipelineLogPage, type PipelineLogQuery, type PipelineLogReader, type PipelineLogReaderOptions, type PipelineLogRow, type PipelineLogSinkOptions, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type RateLimiterLike, type ResolvedSecurity, type ResolvedShard, type RestInvoke, type RestRateLimit, type RestRegistryEntry, type RestRegistryLike, type RestRoute, type RestRouteDeps, type Route, type RpcContext, type RpcEnvelope, type RunExportTapOptions, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardCallArgs, type ShardCallOptions, type ShardCallReturn, type ShardCallerIdentity, type ShardClient, type ShardClientOptions, type ShardError, type ShardExportOutcome, type ShardFunctionReference, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type SpanEvent, type StorageListFunction as StorageListFn, type StorageObject, type TraceSamplingConfig, type TraceTrustSignal, type TrustInboundTraceContext, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, argsFromQuery, buildHealthRoutes, buildRestRoutes, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createKvCursorStore, createLunoraHandler, createMemoryCursorStore, createPipelineLogReader, createQueryCoordinator, createRestRateLimit, createShardClient, createStaticShardRegistry, createWorker, d1Probe, decorateResponse, defineExportSink, defineRpcEnvelope, durableObjectProbe, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, memoizeIdentity, memoizeIdentityPerRequest, mergeStrategyForAggregate, otlpSink, pipelineLogSink, presenceProbe, r2Sink, readShardKey, resolveLogArchiveFromEnv, resolveLunoraOptions, resolveSecurity, resolveShard, restSurfaceFromRegistry, routeIdentityResolvers, runExportTap, sanitizeChange, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookExportSink, webhookSink, withFrameworkWorker };