@lunora/runtime 1.0.0-alpha.37 → 1.0.0-alpha.39

package/dist/packem_shared/composeWorker-DiWwOXXt.mjs

@@ -1,3738 +0,0 @@
-import { isLunoraError, toErrorBody } from '@lunora/errors';
-import { NOOP_EXECUTION_CONTEXT } from './NOOP_EXECUTION_CONTEXT-CCTu0Bf1.mjs';
-import { LunoraError, toErrorResponse } from './LunoraError-Bpb9EFJ3.mjs';
-import { runExportTap } from './createKvCursorStore-g8aA6B4L.mjs';
-import { m as methodGuard } from './method-guard-Qzw99aCj.mjs';
-import { buildHealthRoutes, durableObjectProbe, d1Probe, presenceProbe } from './HEALTH_PATH-e5J_NHBx.mjs';
-import { wrapResolverWithContract } from './composeIdentityResolvers-XGjO7V1J.mjs';
-export { composeIdentityResolvers, routeIdentityResolvers } from './composeIdentityResolvers-XGjO7V1J.mjs';
-import { buildLogArchiveAdminRoutes } from './LOG_ARCHIVE_PATH-CNs0bznX.mjs';
-import { r as resolveTraceSampling, a as emitRpcEvent } from './observability--NOFYBFc.mjs';
-import { o as otlpRandomHex, b as buildTraceparent, p as parseTraceparent, m as mergeResourceAttributes, d as detectCloudflareResource, a as detectServiceResource, r as readerFromRecord } from './otlp-resource-Dow6-F_u.mjs';
-import { resolveShard, applyJurisdiction } from './applyJurisdiction-BkZtTkct.mjs';
-import { buildRestRoutes } from './argsFromQuery-c-U1WRy-.mjs';
-import { resolveSecurity, handleCorsPreflight, enforceOrigin, decorateResponse, enforceWebSocketOrigin } from './decorateResponse-DRWQFNhF.mjs';
-
-const evictOldestEntry = (map, capacity) => {
-  if (map.size < capacity) {
-    return;
-  }
-  const oldest = map.keys().next().value;
-  if (oldest !== void 0) {
-    map.delete(oldest);
-  }
-};
-
-const RELAY_NAME_INFIX = "::relay::";
-const relayName = (ownerKey, index) => `${ownerKey}${RELAY_NAME_INFIX}${String(index)}`;
-
-const textEncoder = new TextEncoder();
-const toBase64Url = (bytes) => {
-  const binary = String.fromCodePoint(...bytes);
-  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
-};
-const fromBase64Url = (input) => {
-  const padded = input.replaceAll("-", "+").replaceAll("_", "/") + "===".slice((input.length + 3) % 4);
-  const binary = atob(padded);
-  const bytes = new Uint8Array(binary.length);
-  for (let index = 0; index < binary.length; index += 1) {
-    bytes[index] = binary.codePointAt(index) ?? 0;
-  }
-  return bytes;
-};
-const KEY_CACHE_MAX = 64;
-const keyCache = /* @__PURE__ */ new Map();
-const importHmacKey = async (secret) => {
-  const cached = keyCache.get(secret);
-  if (cached) {
-    return cached;
-  }
-  evictOldestEntry(keyCache, KEY_CACHE_MAX);
-  const keyPromise = crypto.subtle.importKey("raw", textEncoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, ["sign", "verify"]);
-  keyCache.set(secret, keyPromise);
-  return keyPromise;
-};
-const signCanonical = async (secret, canonical) => {
-  const cryptoKey = await importHmacKey(secret);
-  const signature = await crypto.subtle.sign("HMAC", cryptoKey, textEncoder.encode(canonical));
-  return toBase64Url(new Uint8Array(signature));
-};
-const verifyCanonical = async (secret, canonical, sigBytes) => {
-  const cryptoKey = await importHmacKey(secret);
-  return crypto.subtle.verify("HMAC", cryptoKey, sigBytes, textEncoder.encode(canonical));
-};
-
-const WS_ADMIN_TOKEN_VERSION = "v1";
-const WS_ADMIN_TOKEN_TTL_MS = 6e4;
-const mintWsAdminToken = async (secret, options = {}) => {
-  const expiresAtMs = (options.now ?? Date.now()) + (options.ttlMs ?? WS_ADMIN_TOKEN_TTL_MS);
-  const canonical = `${WS_ADMIN_TOKEN_VERSION}.${String(expiresAtMs)}`;
-  const signature = await signCanonical(secret, canonical);
-  return { expiresAtMs, token: `${canonical}.${signature}` };
-};
-const verifyWsAdminToken = async (secret, token, now = Date.now()) => {
-  if (secret.length === 0 || token.length === 0) {
-    return false;
-  }
-  const parts = token.split(".");
-  if (parts.length !== 3) {
-    return false;
-  }
-  const [version, expString, signature] = parts;
-  if (version !== WS_ADMIN_TOKEN_VERSION || signature.length === 0) {
-    return false;
-  }
-  const expiresAtMs = Number(expString);
-  if (!Number.isFinite(expiresAtMs) || expiresAtMs <= now) {
-    return false;
-  }
-  let signatureBytes;
-  try {
-    signatureBytes = fromBase64Url(signature);
-  } catch {
-    return false;
-  }
-  return verifyCanonical(secret, `${version}.${expString}`, signatureBytes);
-};
-
-const AUTH_BASE = "/_lunora/admin/auth";
-const AUTH_ADMIN_ERROR_STATUS = {
-  INVITER_REQUIRED: 400,
-  ORG_SLUG_INVALID: 400,
-  ORG_SLUG_TAKEN: 409,
-  PASSWORD_TOO_LONG: 400,
-  PASSWORD_TOO_SHORT: 400,
-  USER_ALREADY_EXISTS: 409,
-  USER_NOT_FOUND: 404
-};
-const requireBodyString = (body, field) => {
-  const value = body[field];
-  if (typeof value !== "string" || value === "") {
-    throw new LunoraError(`\`${field}\` is required`, { code: "BAD_REQUEST", status: 400 });
-  }
-  return value;
-};
-const requireQuery$1 = (query, name) => {
-  const value = query(name);
-  if (value === void 0) {
-    throw new LunoraError(`\`${name}\` query parameter is required`, { code: "BAD_REQUEST", status: 400 });
-  }
-  return value;
-};
-const parseRoleInput = (value) => {
-  if (typeof value === "string") {
-    return value;
-  }
-  if (Array.isArray(value) && value.every((entry) => typeof entry === "string")) {
-    return value;
-  }
-  return void 0;
-};
-const optionalBodyString = (body, field) => typeof body[field] === "string" ? body[field] : void 0;
-const optionalBodyObject = (body, field) => {
-  const value = body[field];
-  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
-};
-const requirePermission = (body) => {
-  const value = body["permission"];
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    throw new LunoraError("`permission` object is required", { code: "BAD_REQUEST", status: 400 });
-  }
-  const out = {};
-  for (const [resource, actions] of Object.entries(value)) {
-    if (Array.isArray(actions) && actions.every((action) => typeof action === "string")) {
-      out[resource] = actions;
-    }
-  }
-  return out;
-};
-const AUTH_ROUTES = {
-  [`${AUTH_BASE}/capabilities`]: {
-    build: () => {
-      return {};
-    },
-    http: "GET",
-    method: "capabilities"
-  },
-  [`${AUTH_BASE}/users`]: {
-    build: ({ paging, query }) => {
-      const direction = query("sortDirection");
-      return {
-        ...paging,
-        filterField: query("filterField"),
-        filterValue: query("filterValue"),
-        search: query("search"),
-        searchField: query("searchField"),
-        sortBy: query("sortBy"),
-        sortDirection: direction === "asc" || direction === "desc" ? direction : void 0
-      };
-    },
-    http: "GET",
-    method: "listUsers"
-  },
-  [`${AUTH_BASE}/sessions`]: {
-    build: ({ paging, query }) => {
-      return { ...paging, userId: query("userId") };
-    },
-    http: "GET",
-    method: "listSessions"
-  },
-  [`${AUTH_BASE}/accounts`]: {
-    build: ({ query }) => {
-      return { userId: requireQuery$1(query, "userId") };
-    },
-    http: "GET",
-    method: "listAccounts"
-  },
-  [`${AUTH_BASE}/passkeys`]: {
-    build: ({ query }) => {
-      return { userId: requireQuery$1(query, "userId") };
-    },
-    http: "GET",
-    method: "listPasskeys"
-  },
-  [`${AUTH_BASE}/organizations`]: {
-    build: ({ paging }) => {
-      return { ...paging };
-    },
-    http: "GET",
-    method: "listOrganizations"
-  },
-  [`${AUTH_BASE}/organizations/members`]: {
-    build: ({ paging, query }) => {
-      return { ...paging, organizationId: requireQuery$1(query, "organizationId") };
-    },
-    http: "GET",
-    method: "listMembers"
-  },
-  [`${AUTH_BASE}/organizations/invitations`]: {
-    build: ({ paging, query }) => {
-      return { ...paging, organizationId: requireQuery$1(query, "organizationId") };
-    },
-    http: "GET",
-    method: "listInvitations"
-  },
-  [`${AUTH_BASE}/config`]: {
-    build: () => {
-      return {};
-    },
-    http: "GET",
-    method: "config"
-  },
-  [`${AUTH_BASE}/organizations/teams`]: {
-    build: ({ paging, query }) => {
-      return { ...paging, organizationId: requireQuery$1(query, "organizationId") };
-    },
-    http: "GET",
-    method: "listTeams"
-  },
-  [`${AUTH_BASE}/organizations/teams/members`]: {
-    build: ({ paging, query }) => {
-      return { ...paging, teamId: requireQuery$1(query, "teamId") };
-    },
-    http: "GET",
-    method: "listTeamMembers"
-  },
-  [`${AUTH_BASE}/organizations/roles`]: {
-    build: ({ paging, query }) => {
-      return { ...paging, organizationId: requireQuery$1(query, "organizationId") };
-    },
-    http: "GET",
-    method: "listOrgRoles"
-  },
-  // --- mutations (POST) -------------------------------------------------------
-  [`${AUTH_BASE}/users/create`]: {
-    build: ({ body }) => {
-      return {
-        data: typeof body["data"] === "object" && body["data"] !== null && !Array.isArray(body["data"]) ? body["data"] : void 0,
-        email: requireBodyString(body, "email"),
-        name: requireBodyString(body, "name"),
-        password: optionalBodyString(body, "password"),
-        role: parseRoleInput(body["role"])
-      };
-    },
-    http: "POST",
-    method: "createUser"
-  },
-  [`${AUTH_BASE}/users/update`]: {
-    build: ({ body }) => {
-      const { data } = body;
-      if (typeof data !== "object" || data === null || Array.isArray(data)) {
-        throw new LunoraError("`data` object is required", { code: "BAD_REQUEST", status: 400 });
-      }
-      return { data, userId: requireBodyString(body, "userId") };
-    },
-    http: "POST",
-    method: "updateUser"
-  },
-  [`${AUTH_BASE}/users/role`]: {
-    build: ({ body }) => {
-      const role = parseRoleInput(body["role"]);
-      if (role === void 0 || typeof role === "string" && role.trim() === "") {
-        throw new LunoraError("`role` is required", { code: "BAD_REQUEST", status: 400 });
-      }
-      return { role, userId: requireBodyString(body, "userId") };
-    },
-    http: "POST",
-    method: "setRole"
-  },
-  [`${AUTH_BASE}/users/ban`]: {
-    build: ({ body }) => {
-      return {
-        expiresInSeconds: typeof body["expiresInSeconds"] === "number" ? body["expiresInSeconds"] : void 0,
-        reason: optionalBodyString(body, "reason"),
-        userId: requireBodyString(body, "userId")
-      };
-    },
-    http: "POST",
-    method: "banUser"
-  },
-  [`${AUTH_BASE}/users/unban`]: {
-    build: ({ body }) => {
-      return { userId: requireBodyString(body, "userId") };
-    },
-    http: "POST",
-    method: "unbanUser"
-  },
-  [`${AUTH_BASE}/users/password`]: {
-    build: ({ body }) => {
-      return { newPassword: requireBodyString(body, "newPassword"), userId: requireBodyString(body, "userId") };
-    },
-    http: "POST",
-    method: "setUserPassword",
-    returns: "void"
-  },
-  [`${AUTH_BASE}/users/remove`]: {
-    build: ({ body }) => {
-      return { userId: requireBodyString(body, "userId") };
-    },
-    http: "POST",
-    method: "removeUser",
-    returns: "void"
-  },
-  [`${AUTH_BASE}/users/impersonate`]: {
-    build: ({ body }) => {
-      return { userId: requireBodyString(body, "userId") };
-    },
-    http: "POST",
-    method: "impersonateUser"
-  },
-  [`${AUTH_BASE}/sessions/revoke`]: {
-    build: ({ body }) => {
-      return { sessionId: requireBodyString(body, "sessionId") };
-    },
-    http: "POST",
-    method: "revokeUserSession",
-    returns: "void"
-  },
-  [`${AUTH_BASE}/sessions/revoke-all`]: {
-    build: ({ body }) => {
-      return { userId: requireBodyString(body, "userId") };
-    },
-    http: "POST",
-    method: "revokeUserSessions",
-    returns: "void"
-  },
-  [`${AUTH_BASE}/accounts/unlink`]: {
-    build: ({ body }) => {
-      return { accountId: requireBodyString(body, "accountId"), userId: requireBodyString(body, "userId") };
-    },
-    http: "POST",
-    method: "unlinkAccount",
-    returns: "void"
-  },
-  [`${AUTH_BASE}/two-factor/disable`]: {
-    build: ({ body }) => {
-      return { userId: requireBodyString(body, "userId") };
-    },
-    http: "POST",
-    method: "disableTwoFactor",
-    returns: "void"
-  },
-  [`${AUTH_BASE}/passkeys/delete`]: {
-    build: ({ body }) => {
-      return { passkeyId: requireBodyString(body, "passkeyId") };
-    },
-    http: "POST",
-    method: "deletePasskey",
-    returns: "void"
-  },
-  [`${AUTH_BASE}/organizations/members/remove`]: {
-    build: ({ body }) => {
-      return { memberId: requireBodyString(body, "memberId") };
-    },
-    http: "POST",
-    method: "removeMember",
-    returns: "void"
-  },
-  [`${AUTH_BASE}/organizations/invitations/cancel`]: {
-    build: ({ body }) => {
-      return { invitationId: requireBodyString(body, "invitationId") };
-    },
-    http: "POST",
-    method: "cancelInvitation",
-    returns: "void"
-  },
-  [`${AUTH_BASE}/organizations/create`]: {
-    build: ({ body }) => {
-      return {
-        logo: optionalBodyString(body, "logo"),
-        metadata: optionalBodyObject(body, "metadata"),
-        name: requireBodyString(body, "name"),
-        ownerId: optionalBodyString(body, "ownerId"),
-        slug: optionalBodyString(body, "slug")
-      };
-    },
-    http: "POST",
-    method: "createOrganization"
-  },
-  [`${AUTH_BASE}/organizations/update`]: {
-    build: ({ body }) => {
-      return {
-        logo: optionalBodyString(body, "logo"),
-        metadata: optionalBodyObject(body, "metadata"),
-        name: optionalBodyString(body, "name"),
-        organizationId: requireBodyString(body, "organizationId"),
-        slug: optionalBodyString(body, "slug")
-      };
-    },
-    http: "POST",
-    method: "updateOrganization"
-  },
-  [`${AUTH_BASE}/organizations/remove`]: {
-    build: ({ body }) => {
-      return { organizationId: requireBodyString(body, "organizationId") };
-    },
-    http: "POST",
-    method: "deleteOrganization",
-    returns: "void"
-  },
-  [`${AUTH_BASE}/organizations/members/add`]: {
-    build: ({ body }) => {
-      return {
-        organizationId: requireBodyString(body, "organizationId"),
-        role: optionalBodyString(body, "role"),
-        userId: requireBodyString(body, "userId")
-      };
-    },
-    http: "POST",
-    method: "addMember"
-  },
-  [`${AUTH_BASE}/organizations/members/invite`]: {
-    build: ({ body }) => {
-      return {
-        email: requireBodyString(body, "email"),
-        inviterId: optionalBodyString(body, "inviterId"),
-        organizationId: requireBodyString(body, "organizationId"),
-        role: optionalBodyString(body, "role")
-      };
-    },
-    http: "POST",
-    method: "inviteMember"
-  },
-  [`${AUTH_BASE}/organizations/members/role`]: {
-    build: ({ body }) => {
-      const role = parseRoleInput(body["role"]);
-      if (role === void 0 || typeof role === "string" && role.trim() === "") {
-        throw new LunoraError("`role` is required", { code: "BAD_REQUEST", status: 400 });
-      }
-      return { memberId: requireBodyString(body, "memberId"), role };
-    },
-    http: "POST",
-    method: "updateMemberRole"
-  },
-  [`${AUTH_BASE}/organizations/teams/create`]: {
-    build: ({ body }) => {
-      return { name: requireBodyString(body, "name"), organizationId: requireBodyString(body, "organizationId") };
-    },
-    http: "POST",
-    method: "createTeam"
-  },
-  [`${AUTH_BASE}/organizations/teams/update`]: {
-    build: ({ body }) => {
-      return { name: requireBodyString(body, "name"), teamId: requireBodyString(body, "teamId") };
-    },
-    http: "POST",
-    method: "updateTeam"
-  },
-  [`${AUTH_BASE}/organizations/teams/remove`]: {
-    build: ({ body }) => {
-      return { teamId: requireBodyString(body, "teamId") };
-    },
-    http: "POST",
-    method: "removeTeam",
-    returns: "void"
-  },
-  [`${AUTH_BASE}/organizations/teams/members/add`]: {
-    build: ({ body }) => {
-      return { teamId: requireBodyString(body, "teamId"), userId: requireBodyString(body, "userId") };
-    },
-    http: "POST",
-    method: "addTeamMember"
-  },
-  [`${AUTH_BASE}/organizations/teams/members/remove`]: {
-    build: ({ body }) => {
-      return { teamMemberId: requireBodyString(body, "teamMemberId") };
-    },
-    http: "POST",
-    method: "removeTeamMember",
-    returns: "void"
-  },
-  [`${AUTH_BASE}/organizations/roles/create`]: {
-    build: ({ body }) => {
-      return {
-        organizationId: requireBodyString(body, "organizationId"),
-        permission: requirePermission(body),
-        role: requireBodyString(body, "role")
-      };
-    },
-    http: "POST",
-    method: "createOrgRole"
-  },
-  [`${AUTH_BASE}/organizations/roles/update`]: {
-    build: ({ body }) => {
-      return { permission: requirePermission(body), roleId: requireBodyString(body, "roleId") };
-    },
-    http: "POST",
-    method: "updateOrgRole"
-  },
-  [`${AUTH_BASE}/organizations/roles/remove`]: {
-    build: ({ body }) => {
-      return { roleId: requireBodyString(body, "roleId") };
-    },
-    http: "POST",
-    method: "deleteOrgRole",
-    returns: "void"
-  }
-};
-const buildAuthAdminRoutes = (deps) => {
-  const runAuthOp = async (op) => {
-    try {
-      return await op();
-    } catch (error) {
-      if (error instanceof LunoraError) {
-        throw error;
-      }
-      const candidate = error;
-      const code = typeof candidate.code === "string" ? candidate.code : "AUTH_ADMIN_ERROR";
-      console.error("[lunora] auth admin operation failed:", error);
-      throw new LunoraError("auth admin operation failed", { code, status: AUTH_ADMIN_ERROR_STATUS[code] ?? 500 });
-    }
-  };
-  const handle = async (request, descriptor) => {
-    deps.assertAdmin(request);
-    if (request.method !== descriptor.http) {
-      throw new LunoraError(`Auth admin endpoint requires ${descriptor.http}`, { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    const admin = deps.getAuthAdmin();
-    if (admin === void 0) {
-      throw new LunoraError("auth endpoints require an `authAdmin` on the worker", { code: "AUTH_NOT_CONFIGURED", status: 400 });
-    }
-    const method = admin[descriptor.method];
-    if (method === void 0) {
-      throw new LunoraError(`auth admin does not support \`${descriptor.method}\``, { code: "AUTH_OP_NOT_SUPPORTED", status: 400 });
-    }
-    const url = new URL(request.url);
-    const context = {
-      body: descriptor.http === "POST" ? await deps.readJsonBody(request) : {},
-      paging: deps.parsePaging(request),
-      query: (name) => deps.queryParameter(url, name)
-    };
-    const input = descriptor.build(context);
-    const result = await runAuthOp(() => method(input));
-    return Response.json(descriptor.returns === "void" ? { ok: true } : result, { headers: { "content-type": "application/json" }, status: 200 });
-  };
-  const routes = {};
-  for (const [path, descriptor] of Object.entries(AUTH_ROUTES)) {
-    routes[path] = (request) => handle(request, descriptor);
-  }
-  return routes;
-};
-
-const GET_AUTH_AUDIT_LOG_OP = "__lunora_admin__:getAuthAuditLog";
-const stringArgument = (value) => typeof value === "string" && value !== "" ? value : void 0;
-const numericArgument = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : void 0;
-const buildGetAuthAuditLog = (deps) => {
-  const handle = async (request, args) => {
-    deps.assertAdmin(request);
-    const reader = deps.getReader();
-    if (reader === void 0) {
-      throw new LunoraError("the auth/security audit endpoint requires an `authAuditReader` on the worker", {
-        code: "AUTH_AUDIT_NOT_CONFIGURED",
-        status: 400
-      });
-    }
-    const query = {};
-    const actorId = stringArgument(args["actorId"]);
-    const event = stringArgument(args["event"]);
-    const sinceSeq = numericArgument(args["sinceSeq"]);
-    const limit = numericArgument(args["limit"]);
-    if (actorId !== void 0) {
-      query.actorId = actorId;
-    }
-    if (event !== void 0) {
-      query.event = event;
-    }
-    if (sinceSeq !== void 0) {
-      query.sinceSeq = sinceSeq;
-    }
-    if (limit !== void 0) {
-      query.limit = limit;
-    }
-    let entries;
-    try {
-      entries = await reader.read(query);
-    } catch (error) {
-      if (error instanceof LunoraError) {
-        throw error;
-      }
-      console.error("[lunora] auth audit read failed:", error);
-      throw new LunoraError("auth audit read failed", { code: "AUTH_AUDIT_READ_FAILED", status: 500 });
-    }
-    const result = { entries };
-    return Response.json(result, { headers: { "content-type": "application/json" }, status: 200 });
-  };
-  return handle;
-};
-
-const MAX_BATCH_ENTRIES = 500;
-
-const normalizeBatchCall = (raw, index, defaultShard) => {
-  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-    throw new LunoraError("each batch call must be an object", { code: "BAD_REQUEST", status: 400 });
-  }
-  const call = raw;
-  if (typeof call.functionPath !== "string") {
-    throw new LunoraError("each batch call needs a string `functionPath`", { code: "BAD_REQUEST", status: 400 });
-  }
-  if (call.functionPath.startsWith("__lunora_relation__:") || call.functionPath.startsWith("__lunora_admin__")) {
-    throw new LunoraError("reserved function path cannot be batched", { code: "FORBIDDEN", status: 403 });
-  }
-  if (call.args !== void 0 && (typeof call.args !== "object" || call.args === null || Array.isArray(call.args))) {
-    throw new LunoraError("each batch call `args` must be an object", { code: "BAD_REQUEST", status: 400 });
-  }
-  return {
-    entry: {
-      args: call.args === void 0 ? {} : call.args,
-      clientId: typeof call.clientId === "string" ? call.clientId : void 0,
-      clientSeq: typeof call.clientSeq === "number" ? call.clientSeq : void 0,
-      functionPath: call.functionPath,
-      id: typeof call.id === "number" ? call.id : index,
-      mutationId: typeof call.mutationId === "string" ? call.mutationId : void 0
-    },
-    shardKey: typeof call.shardKey === "string" ? call.shardKey : defaultShard
-  };
-};
-const groupBatchCallsByShard = (calls, defaultShard) => {
-  if (calls.length > MAX_BATCH_ENTRIES) {
-    throw new LunoraError(`RPC batch exceeds the ${String(MAX_BATCH_ENTRIES)}-call limit`, { code: "BAD_REQUEST", status: 400 });
-  }
-  const groups = /* @__PURE__ */ new Map();
-  for (const [index, raw] of calls.entries()) {
-    const { entry, shardKey } = normalizeBatchCall(raw, index, defaultShard);
-    const group = groups.get(shardKey) ?? [];
-    group.push(entry);
-    groups.set(shardKey, group);
-  }
-  return groups;
-};
-
-const MAX_BODY_BYTES = 1048576;
-const readBodyTextWithLimit = async (request, limit = MAX_BODY_BYTES) => {
-  if (!request.body) {
-    return "";
-  }
-  const reader = request.body.getReader();
-  const decoder = new TextDecoder();
-  let total = 0;
-  let text = "";
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) {
-      break;
-    }
-    if (value) {
-      total += value.byteLength;
-      if (total > limit) {
-        await reader.cancel().catch(() => {
-        });
-        throw new LunoraError("Body too large", { code: "PAYLOAD_TOO_LARGE", status: 413 });
-      }
-      text += decoder.decode(value, { stream: true });
-    }
-  }
-  text += decoder.decode();
-  return text;
-};
-const readBodyBytesWithLimit = async (request, limit = MAX_BODY_BYTES) => {
-  if (!request.body) {
-    return new ArrayBuffer(0);
-  }
-  const reader = request.body.getReader();
-  const chunks = [];
-  let total = 0;
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) {
-      break;
-    }
-    if (value) {
-      total += value.byteLength;
-      if (total > limit) {
-        await reader.cancel().catch(() => {
-        });
-        throw new LunoraError("Body too large", { code: "PAYLOAD_TOO_LARGE", status: 413 });
-      }
-      chunks.push(value);
-    }
-  }
-  const out = new Uint8Array(total);
-  let offset = 0;
-  for (const chunk of chunks) {
-    out.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  return out.buffer;
-};
-const readJsonBodyWithLimit = async (request, limit = MAX_BODY_BYTES) => {
-  try {
-    const text = await readBodyTextWithLimit(request, limit);
-    return text === "" ? {} : JSON.parse(text);
-  } catch (error) {
-    if (error instanceof LunoraError) {
-      throw error;
-    }
-    throw new LunoraError("Request body must be valid JSON", { code: "BAD_REQUEST", status: 400 });
-  }
-};
-
-const CURSOR_ENCODER = new TextEncoder();
-const encodeConnectorCursor = (state) => {
-  const json = JSON.stringify(state);
-  const bytes = CURSOR_ENCODER.encode(json);
-  let binary = "";
-  for (const byte of bytes) {
-    binary += String.fromCodePoint(byte);
-  }
-  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
-};
-const decodeConnectorCursor = (token) => {
-  const empty = { g: 0, s: {}, v: 1 };
-  if (typeof token !== "string" || token.length === 0) {
-    return empty;
-  }
-  try {
-    const binary = atob(token.replaceAll("-", "+").replaceAll("_", "/"));
-    const bytes = new Uint8Array(binary.length);
-    for (let index = 0; index < binary.length; index += 1) {
-      bytes[index] = binary.codePointAt(index) ?? 0;
-    }
-    const parsed = JSON.parse(new TextDecoder().decode(bytes));
-    const shards = parsed.s && typeof parsed.s === "object" ? parsed.s : {};
-    const sanitized = {};
-    for (const [key, value] of Object.entries(shards)) {
-      if (typeof value === "number" && Number.isFinite(value)) {
-        sanitized[key] = value;
-      }
-    }
-    return { g: typeof parsed.g === "number" && Number.isFinite(parsed.g) ? parsed.g : 0, s: sanitized, v: 1 };
-  } catch {
-    return empty;
-  }
-};
-const flattenCdcChange = (change) => {
-  const table = typeof change["table"] === "string" ? change["table"] : "";
-  const rawOp = typeof change["op"] === "string" ? change["op"] : "";
-  const op = rawOp === "delete" || rawOp === "insert" || rawOp === "update" ? rawOp : "upsert";
-  const id = typeof change["id"] === "string" ? change["id"] : void 0;
-  const postImage = change["doc"] && typeof change["doc"] === "object" ? change["doc"] : void 0;
-  const documentRow = postImage ?? (id === void 0 ? {} : { _id: id });
-  return { doc: documentRow, op, table };
-};
-const foldCdcPage = (changes, pageChanges, limit) => {
-  for (const change of pageChanges) {
-    changes.push(flattenCdcChange(change));
-  }
-  return limit !== void 0 && pageChanges.length >= limit;
-};
-
-const EXPORT_PATH = "/_lunora/admin/export";
-const IMPORT_PATH = "/_lunora/admin/import";
-const SYNC_PATH = "/_lunora/admin/sync";
-const CONNECTOR_SYNC_PATH = "/_lunora/admin/connector/sync";
-const APPLY_PATH = "/_lunora/admin/apply";
-const EXPORT_TAP_RUN_PATH = "/_lunora/admin/export-tap/run";
-const NDJSON_ENCODER$1 = new TextEncoder();
-const parseExportBody = async (request) => {
-  let body;
-  try {
-    const text = await readBodyTextWithLimit(request);
-    body = text === "" ? {} : JSON.parse(text);
-  } catch (error) {
-    if (error instanceof LunoraError) {
-      throw error;
-    }
-    throw new LunoraError("Export body must be valid JSON", { code: "BAD_REQUEST", status: 400 });
-  }
-  const candidate = body ?? {};
-  if (candidate.tables === void 0) {
-    return { tables: void 0 };
-  }
-  if (!Array.isArray(candidate.tables)) {
-    throw new LunoraError("Export `tables` must be a string array", { code: "BAD_REQUEST", status: 400 });
-  }
-  const tables = [];
-  for (const entry of candidate.tables) {
-    if (typeof entry !== "string" || entry.length === 0) {
-      throw new LunoraError("Export `tables` entries must be non-empty strings", { code: "BAD_REQUEST", status: 400 });
-    }
-    tables.push(entry);
-  }
-  return { tables };
-};
-const buildDataMovementAdminRoutes = (deps) => {
-  const {
-    applyGlobals,
-    exportCursorStore,
-    exportSinks,
-    knownTables,
-    queryCoordinator,
-    requireAdminOption,
-    resolveForwardContext,
-    shardDO,
-    streamExportRows,
-    streamingImport,
-    syncGlobals
-  } = deps;
-  const handleExport = async (request, env) => {
-    const wrongMethod = methodGuard(request, ["POST"]);
-    if (wrongMethod) {
-      return wrongMethod;
-    }
-    const coordinator = requireAdminOption(request, queryCoordinator, {
-      code: "BAD_REQUEST",
-      message: "Export endpoint requires a `queryCoordinator` on the worker"
-    });
-    const body = await parseExportBody(request);
-    const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
-    const stream = new ReadableStream({
-      async pull(controller) {
-        const writeRow = (row) => {
-          controller.enqueue(NDJSON_ENCODER$1.encode(`${JSON.stringify(row)}
-`));
-        };
-        try {
-          await streamExportRows(coordinator, forwardedHeaders, body.tables, writeRow);
-          controller.close();
-        } catch (error) {
-          controller.error(error);
-        }
-      }
-    });
-    return new Response(stream, { headers: { "content-type": "application/x-ndjson" }, status: 200 });
-  };
-  const handleCdcSync = async (request, env) => {
-    const wrongMethod = methodGuard(request, ["POST"]);
-    if (wrongMethod) {
-      return wrongMethod;
-    }
-    const coordinator = requireAdminOption(request, queryCoordinator, {
-      code: "BAD_REQUEST",
-      message: "Sync endpoint requires a `queryCoordinator` on the worker"
-    });
-    const raw = await readJsonBodyWithLimit(request);
-    const cursors = typeof raw["cursors"] === "object" && raw["cursors"] !== null ? raw["cursors"] : {};
-    const limit = typeof raw["limit"] === "number" ? raw["limit"] : void 0;
-    const globalCursor = typeof raw["globalCursor"] === "number" ? raw["globalCursor"] : 0;
-    const requestedTables = Array.isArray(raw["tables"]) ? raw["tables"].filter((table) => typeof table === "string") : void 0;
-    const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
-    const probeTables = requestedTables ?? knownTables();
-    const shardResult = await coordinator.orchestrateCdcSync(shardDO, {
-      cursors,
-      headers: forwardedHeaders,
-      limit,
-      tables: probeTables
-    });
-    const global = syncGlobals ? await syncGlobals({ limit, sinceSeq: globalCursor }) : void 0;
-    return Response.json({ global, shards: shardResult.shards }, { status: 200 });
-  };
-  const handleConnectorSync = async (request, env) => {
-    const wrongMethod = methodGuard(request, ["POST"]);
-    if (wrongMethod) {
-      return wrongMethod;
-    }
-    const coordinator = requireAdminOption(request, queryCoordinator, {
-      code: "BAD_REQUEST",
-      message: "Connector sync endpoint requires a `queryCoordinator` on the worker"
-    });
-    const raw = await readJsonBodyWithLimit(request);
-    const state = decodeConnectorCursor(raw["cursor"]);
-    const limit = typeof raw["limit"] === "number" && raw["limit"] > 0 ? raw["limit"] : void 0;
-    const requestedTables = Array.isArray(raw["tables"]) ? raw["tables"].filter((table) => typeof table === "string") : void 0;
-    const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
-    const probeTables = requestedTables ?? knownTables();
-    const shardResult = await coordinator.orchestrateCdcSync(shardDO, {
-      cursors: state.s,
-      headers: forwardedHeaders,
-      limit,
-      tables: probeTables
-    });
-    const changes = [];
-    const nextShardCursors = { ...state.s };
-    let hasMore = false;
-    for (const shard of shardResult.shards) {
-      hasMore = foldCdcPage(changes, shard.changes ?? [], limit) || hasMore;
-      nextShardCursors[shard.shardKey] = shard.cursor;
-    }
-    let nextGlobalCursor = state.g;
-    if (syncGlobals) {
-      const global = await syncGlobals({ limit, sinceSeq: state.g });
-      hasMore = foldCdcPage(changes, global.changes, limit) || hasMore;
-      nextGlobalCursor = global.cursor;
-    }
-    const nextCursor = encodeConnectorCursor({ g: nextGlobalCursor, s: nextShardCursors, v: 1 });
-    const page = { changes, hasMore, nextCursor };
-    return Response.json(page, { status: 200 });
-  };
-  const handleApplyCdc = async (request, env) => {
-    const wrongMethod = methodGuard(request, ["POST"]);
-    if (wrongMethod) {
-      return wrongMethod;
-    }
-    const coordinator = requireAdminOption(request, queryCoordinator, {
-      code: "BAD_REQUEST",
-      message: "Apply endpoint requires a `queryCoordinator` on the worker"
-    });
-    const raw = await readJsonBodyWithLimit(request);
-    const rawBatches = Array.isArray(raw["batches"]) ? raw["batches"] : [];
-    const batches = rawBatches.map((batch) => batch).filter(
-      (batch) => (
-        // Guard object-ness before property access — a `null`/non-object
-        // entry (e.g. `{"batches":[null]}`) would otherwise throw a
-        // TypeError that surfaces as a confusing 500; here it's skipped.
-        batch !== null && typeof batch === "object" && typeof batch.shardKey === "string" && Array.isArray(batch.changes)
-      )
-    );
-    const globalChanges = Array.isArray(raw["globalChanges"]) ? raw["globalChanges"] : [];
-    const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
-    const shardResult = await coordinator.orchestrateApplyCdc(shardDO, { batches, headers: forwardedHeaders });
-    const globalApplied = globalChanges.length > 0 && applyGlobals ? await applyGlobals({ changes: globalChanges }) : 0;
-    return Response.json({ applied: shardResult.applied + globalApplied, failed: shardResult.failed, ok: shardResult.ok }, { status: 200 });
-  };
-  const handleImport = async (request, env) => {
-    const wrongMethod = methodGuard(request, ["POST"]);
-    if (wrongMethod) {
-      return wrongMethod;
-    }
-    requireAdminOption(request, queryCoordinator, { code: "BAD_REQUEST", message: "Import endpoint requires a `queryCoordinator` on the worker" });
-    const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
-    const result = await streamingImport(request, forwardedHeaders);
-    return Response.json(result, {
-      headers: { "content-type": "application/json" },
-      status: 200
-    });
-  };
-  const handleExportTapRun = async (request, env) => {
-    const wrongMethod = methodGuard(request, ["POST"]);
-    if (wrongMethod) {
-      return wrongMethod;
-    }
-    const coordinator = requireAdminOption(request, queryCoordinator, {
-      code: "BAD_REQUEST",
-      message: "Export-tap endpoint requires a `queryCoordinator` on the worker"
-    });
-    if (exportSinks === void 0 || Object.keys(exportSinks).length === 0 || exportCursorStore === void 0) {
-      throw new LunoraError("Export-tap endpoint requires `exportSinks` + `exportCursorStore` on the worker", {
-        code: "EXPORT_TAP_NOT_CONFIGURED",
-        status: 400
-      });
-    }
-    const raw = await readJsonBodyWithLimit(request);
-    const sinkName = typeof raw["sink"] === "string" ? raw["sink"] : void 0;
-    const limit = typeof raw["limit"] === "number" && raw["limit"] > 0 ? raw["limit"] : void 0;
-    const requestedTables = Array.isArray(raw["tables"]) ? raw["tables"].filter((table) => typeof table === "string") : void 0;
-    if (sinkName === void 0) {
-      throw new LunoraError("Export-tap `sink` must name a configured sink", { code: "BAD_REQUEST", status: 400 });
-    }
-    const sink = exportSinks[sinkName];
-    if (sink === void 0) {
-      throw new LunoraError(`Export-tap sink "${sinkName}" is not configured`, { code: "NOT_FOUND", status: 404 });
-    }
-    const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
-    const probeTables = requestedTables ?? knownTables();
-    const result = await runExportTap({
-      coordinator,
-      cursorStore: exportCursorStore,
-      headers: forwardedHeaders,
-      limit,
-      shardDO,
-      sink,
-      tables: probeTables
-    });
-    return Response.json(result, { headers: { "content-type": "application/json" }, status: 200 });
-  };
-  return {
-    [APPLY_PATH]: handleApplyCdc,
-    [CONNECTOR_SYNC_PATH]: handleConnectorSync,
-    [EXPORT_PATH]: handleExport,
-    [EXPORT_TAP_RUN_PATH]: handleExportTapRun,
-    [IMPORT_PATH]: handleImport,
-    [SYNC_PATH]: handleCdcSync
-  };
-};
-
-const collectKnownTables = (_resolver) => [];
-const partitionExportTables = (options, tables) => {
-  const shardLocalTables = [];
-  const globalTables = [];
-  if (tables && tables.length > 0) {
-    for (const table of tables) {
-      const info = options.resolveTableSharding?.(table);
-      if (info?.mode.kind === "global") {
-        globalTables.push(table);
-      } else {
-        shardLocalTables.push(table);
-      }
-    }
-  }
-  return { globalTables, shardLocalTables };
-};
-const exportShardLocalRows = async (options, coordinator, forwardedHeaders, tables, shardLocalTables, writeRow, namespace) => {
-  if (tables !== void 0 && shardLocalTables.length === 0) {
-    return;
-  }
-  const exportTables = tables === void 0 ? [] : shardLocalTables;
-  const probeFallback = tables === void 0 ? collectKnownTables() : [];
-  const probeTables = exportTables.length > 0 ? exportTables : probeFallback;
-  const result = await coordinator.orchestrateExport(namespace, {
-    args: { tables: exportTables },
-    headers: forwardedHeaders,
-    tables: probeTables
-  });
-  for (const shard of result.shards) {
-    if (shard.error) {
-      continue;
-    }
-    for (const row of shard.rows ?? []) {
-      writeRow(row);
-    }
-  }
-};
-const streamExportRows = async (options, coordinator, forwardedHeaders, tables, writeRow, namespace) => {
-  const { globalTables, shardLocalTables } = partitionExportTables(options, tables);
-  await exportShardLocalRows(options, coordinator, forwardedHeaders, tables, shardLocalTables, writeRow, namespace);
-  const exportGlobalsFunction = options.exportGlobals;
-  const wantGlobals = tables === void 0 || globalTables.length > 0;
-  if (wantGlobals && exportGlobalsFunction) {
-    const tablesArgument = tables === void 0 ? [] : globalTables;
-    for await (const row of exportGlobalsFunction({ tables: tablesArgument })) {
-      writeRow(row);
-    }
-  }
-};
-
-const parseImportRow = (trimmed, lineNumber) => {
-  let parsed;
-  try {
-    parsed = JSON.parse(trimmed);
-  } catch {
-    return { error: { code: "BAD_ROW", line: lineNumber, message: "line is not valid JSON", table: "" }, ok: false };
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    return { error: { code: "BAD_ROW", line: lineNumber, message: "row must be a JSON object", table: "" }, ok: false };
-  }
-  const candidate = parsed;
-  if (typeof candidate.table !== "string" || candidate.table.length === 0) {
-    return { error: { code: "BAD_ROW", line: lineNumber, message: "row is missing `table`", table: "" }, ok: false };
-  }
-  if (!candidate.doc || typeof candidate.doc !== "object" || Array.isArray(candidate.doc)) {
-    return { error: { code: "BAD_ROW", line: lineNumber, message: "row is missing or malformed `doc`", table: candidate.table }, ok: false };
-  }
-  return { doc: candidate.doc, ok: true, table: candidate.table };
-};
-const resolveImportShardKey = (documentRow, table, info, defaultShard, lineNumber) => {
-  if (info?.mode.kind === "shardBy" && typeof info.mode.field === "string") {
-    const raw = documentRow[info.mode.field];
-    if (raw === void 0 || raw === null) {
-      return {
-        error: { code: "BAD_ROW", line: lineNumber, message: `row missing shard field "${info.mode.field}" for table "${table}"`, table },
-        ok: false
-      };
-    }
-    return { ok: true, shardKey: typeof raw === "string" ? raw : JSON.stringify(raw) };
-  }
-  return { ok: true, shardKey: defaultShard };
-};
-const bucketImportStream = async (request, options, defaultShard) => {
-  if (!request.body) {
-    throw new LunoraError("Import endpoint requires a request body", { code: "BAD_REQUEST", status: 400 });
-  }
-  const errors = [];
-  const globalRows = [];
-  const perShard = /* @__PURE__ */ new Map();
-  let physicalLine = 0;
-  const reader = request.body.getReader();
-  const decoder = new TextDecoder();
-  let buffer = "";
-  let totalBytes = 0;
-  const handleLine = (line) => {
-    physicalLine += 1;
-    const trimmed = line.trim();
-    if (trimmed.length === 0) {
-      return;
-    }
-    const row = parseImportRow(trimmed, physicalLine);
-    if (!row.ok) {
-      errors.push(row.error);
-      return;
-    }
-    const { doc: documentRow, table } = row;
-    const info = options.resolveTableSharding?.(table);
-    if (info?.mode.kind === "global") {
-      globalRows.push({ doc: documentRow, line: physicalLine, table });
-      return;
-    }
-    const resolved = resolveImportShardKey(documentRow, table, info, defaultShard, physicalLine);
-    if (!resolved.ok) {
-      errors.push(resolved.error);
-      return;
-    }
-    const existing = perShard.get(resolved.shardKey);
-    if (existing) {
-      existing.rows.push({ doc: documentRow, table });
-    } else {
-      perShard.set(resolved.shardKey, { rows: [{ doc: documentRow, table }], shardKey: resolved.shardKey, startLine: physicalLine });
-    }
-  };
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) {
-      break;
-    }
-    if (value) {
-      totalBytes += value.byteLength;
-      if (totalBytes > MAX_BODY_BYTES) {
-        await reader.cancel().catch(() => {
-        });
-        throw new LunoraError("Body too large", { code: "PAYLOAD_TOO_LARGE", status: 413 });
-      }
-    }
-    buffer += decoder.decode(value, { stream: true });
-    let newlineIndex = buffer.indexOf("\n");
-    while (newlineIndex !== -1) {
-      const line = buffer.slice(0, newlineIndex);
-      buffer = buffer.slice(newlineIndex + 1);
-      handleLine(line);
-      newlineIndex = buffer.indexOf("\n");
-    }
-  }
-  if (buffer.length > 0) {
-    handleLine(buffer);
-  }
-  return { errors, globalRows, perShard };
-};
-const mergeImportResult = (totals, result) => {
-  for (const [table, count] of Object.entries(result.inserted)) {
-    totals.inserted[table] = (totals.inserted[table] ?? 0) + count;
-  }
-  for (const rowError of result.errors) {
-    totals.errors.push({ ...rowError });
-  }
-  totals.conflicts += result.conflicts;
-};
-const streamingImport = async (request, options, forwardedHeaders, namespace) => {
-  const defaultShard = options.defaultShardKey ?? "__root__";
-  const { errors, globalRows, perShard } = await bucketImportStream(request, options, defaultShard);
-  const totals = { conflicts: 0, errors, inserted: {} };
-  if (perShard.size > 0) {
-    const coordinator = options.queryCoordinator;
-    if (!coordinator) {
-      throw new LunoraError("Import endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
-    }
-    const result = await coordinator.orchestrateImport(namespace, {
-      batches: [...perShard.values()],
-      headers: forwardedHeaders
-    });
-    mergeImportResult(totals, result);
-  }
-  if (globalRows.length > 0) {
-    if (options.importGlobals) {
-      const startLine = globalRows[0]?.line ?? 1;
-      const result = await options.importGlobals({ rows: globalRows, startLine });
-      mergeImportResult(totals, result);
-    } else {
-      for (const globalRow of globalRows) {
-        totals.errors.push({
-          code: "GLOBAL_NOT_CONFIGURED",
-          line: globalRow.line,
-          message: `row targets global table "${globalRow.table}" but no \`importGlobals\` is configured`,
-          table: globalRow.table
-        });
-      }
-    }
-  }
-  return { conflicts: totals.conflicts, errors: totals.errors, inserted: totals.inserted };
-};
-
-const asValidator = (value) => typeof value === "object" && value !== null ? value : {};
-const kindOf = (validator) => typeof validator.kind === "string" ? validator.kind : "unknown";
-const describeArgument = (name, validator) => {
-  let current = asValidator(validator);
-  let optional = false;
-  if (kindOf(current) === "optional") {
-    optional = true;
-    current = asValidator(current._meta?.["inner"]);
-  }
-  const kind = kindOf(current);
-  const meta = current._meta ?? {};
-  const descriptor = { kind, name, optional };
-  if (kind === "id" && typeof meta["tableName"] === "string") {
-    descriptor.table = meta["tableName"];
-  }
-  if (kind === "array") {
-    const elementKind = kindOf(asValidator(meta["inner"]));
-    if (elementKind !== "unknown") {
-      descriptor.element = elementKind;
-    }
-  }
-  return descriptor;
-};
-const describeArguments = (args) => {
-  if (typeof args !== "object" || args === null) {
-    return [];
-  }
-  return Object.entries(args).map(([name, validator]) => describeArgument(name, validator)).toSorted((a, b) => a.name.localeCompare(b.name));
-};
-
-const FUNCTIONS_PATH = "/_lunora/admin/functions";
-const CRON_JOBS_PATH = "/_lunora/admin/cron-jobs";
-const OPENAPI_PATH = "/_lunora/admin/openapi";
-const OPENRPC_PATH = "/_lunora/admin/openrpc";
-const GLOBAL_TABLES_PATH = "/_lunora/admin/global/tables";
-const GLOBAL_TABLE_PATH = "/_lunora/admin/global/table";
-const GLOBAL_FACET_PATH = "/_lunora/admin/global/facet";
-const parseGlobalFilters = (raw) => {
-  if (raw === void 0 || raw === "") {
-    return void 0;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return void 0;
-  }
-  if (!Array.isArray(parsed)) {
-    return void 0;
-  }
-  const clauses = parsed.flatMap((entry) => {
-    if (typeof entry !== "object" || entry === null || typeof entry.column !== "string") {
-      return [];
-    }
-    const { column, value } = entry;
-    return [{ column, value }];
-  });
-  return clauses.length === 0 ? void 0 : clauses;
-};
-const EMPTY_OPENAPI_DOCUMENT = Object.freeze({
-  info: {
-    description: 'No OpenAPI spec is configured on this worker. Run `lunora codegen`, then wire the generated module to `createWorker`: `import { openApiSpec } from "./lunora/_generated/openapi"`.',
-    title: "Lunora API",
-    version: "0.0.0"
-  },
-  openapi: "3.1.0",
-  paths: {}
-});
-const EMPTY_OPENRPC_DOCUMENT = Object.freeze({
-  info: {
-    description: 'No OpenRPC spec is configured on this worker. Run `lunora codegen --api-spec openrpc` (or `both`), then wire the generated module to `createWorker`: `import { openRpcSpec } from "./lunora/_generated/openrpc"`.',
-    title: "Lunora RPC",
-    version: "0.0.0"
-  },
-  methods: [],
-  openrpc: "1.3.2"
-});
-const buildIntrospectionAdminRoutes = (deps) => {
-  const { assertAdmin, options, parsePaging, queryParameter, requireAdminOption } = deps;
-  const handleFunctionsList = (request) => {
-    if (request.method !== "GET") {
-      throw new LunoraError("Functions endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    const registry = requireAdminOption(request, options.functions, {
-      code: "FUNCTIONS_NOT_CONFIGURED",
-      message: "functions endpoint requires a `functions` registry on the worker"
-    });
-    const functions = Object.entries(registry).flatMap(([path, entry]) => {
-      if (entry.visibility === "internal" || entry.kind === "stream") {
-        return [];
-      }
-      return [{ args: describeArguments(entry.args), kind: entry.kind, path }];
-    }).toSorted((a, b) => a.path.localeCompare(b.path));
-    return Response.json({ functions }, { headers: { "content-type": "application/json" }, status: 200 });
-  };
-  const handleCronJobs = (request) => {
-    if (request.method !== "GET") {
-      throw new LunoraError("Cron-jobs endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    const registry = requireAdminOption(request, options.cronJobs, {
-      code: "CRON_JOBS_NOT_CONFIGURED",
-      message: "cron-jobs endpoint requires a `cronJobs` map on the worker"
-    });
-    const jobs = Object.entries(registry).flatMap(
-      ([cron, dispatches]) => dispatches.map((dispatch) => {
-        return {
-          args: dispatch.args,
-          cron,
-          functionPath: dispatch.functionPath,
-          name: dispatch.name,
-          shardKey: dispatch.shardKey,
-          workflow: dispatch.workflow
-        };
-      })
-    ).toSorted((a, b) => a.name.localeCompare(b.name));
-    return Response.json({ jobs }, { headers: { "content-type": "application/json" }, status: 200 });
-  };
-  const handleOpenApi = (request) => {
-    if (request.method !== "GET") {
-      throw new LunoraError("OpenAPI endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    assertAdmin(request);
-    return Response.json(options.openApiSpec ?? EMPTY_OPENAPI_DOCUMENT, { headers: { "content-type": "application/json" }, status: 200 });
-  };
-  const handleOpenRpc = (request) => {
-    if (request.method !== "GET") {
-      throw new LunoraError("OpenRPC endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    assertAdmin(request);
-    return Response.json(options.openRpcSpec ?? EMPTY_OPENRPC_DOCUMENT, { headers: { "content-type": "application/json" }, status: 200 });
-  };
-  const handleGlobalTables = async (request) => {
-    if (request.method !== "GET") {
-      throw new LunoraError("Global-tables endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    const introspector = requireAdminOption(request, options.globalIntrospector, {
-      code: "GLOBALS_NOT_CONFIGURED",
-      message: "global endpoints require a `globalIntrospector` on the worker"
-    });
-    return Response.json(await introspector.listTables(), { headers: { "content-type": "application/json" }, status: 200 });
-  };
-  const handleGlobalTablePage = async (request) => {
-    if (request.method !== "GET") {
-      throw new LunoraError("Global-table endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    const introspector = requireAdminOption(request, options.globalIntrospector, {
-      code: "GLOBALS_NOT_CONFIGURED",
-      message: "global endpoints require a `globalIntrospector` on the worker"
-    });
-    const url = new URL(request.url);
-    const table = queryParameter(url, "table");
-    if (table === void 0) {
-      throw new LunoraError("Global-table endpoint requires a `table` query param", { code: "BAD_REQUEST", status: 400 });
-    }
-    const page = await introspector.readTablePage({ ...parsePaging(request), filters: parseGlobalFilters(queryParameter(url, "filters")), table });
-    return Response.json(page, { headers: { "content-type": "application/json" }, status: 200 });
-  };
-  const handleGlobalFacet = async (request) => {
-    if (request.method !== "GET") {
-      throw new LunoraError("Global-facet endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    const introspector = requireAdminOption(request, options.globalIntrospector, {
-      code: "GLOBALS_NOT_CONFIGURED",
-      message: "global endpoints require a `globalIntrospector` on the worker"
-    });
-    const url = new URL(request.url);
-    const table = queryParameter(url, "table");
-    const column = queryParameter(url, "column");
-    if (table === void 0 || column === void 0) {
-      throw new LunoraError("Global-facet endpoint requires `table` and `column` query params", { code: "BAD_REQUEST", status: 400 });
-    }
-    const limitParameter = queryParameter(url, "limit");
-    const limit = limitParameter === void 0 ? void 0 : Number(limitParameter);
-    const result = await introspector.facetColumn({
-      column,
-      filters: parseGlobalFilters(queryParameter(url, "filters")),
-      limit: limit !== void 0 && Number.isFinite(limit) ? limit : void 0,
-      table
-    });
-    return Response.json(result, { headers: { "content-type": "application/json" }, status: 200 });
-  };
-  return {
-    [CRON_JOBS_PATH]: handleCronJobs,
-    [FUNCTIONS_PATH]: handleFunctionsList,
-    [GLOBAL_FACET_PATH]: handleGlobalFacet,
-    [GLOBAL_TABLE_PATH]: handleGlobalTablePage,
-    [GLOBAL_TABLES_PATH]: handleGlobalTables,
-    [OPENAPI_PATH]: handleOpenApi,
-    [OPENRPC_PATH]: handleOpenRpc
-  };
-};
-
-const KV_NAMESPACES_PATH = "/_lunora/admin/kv/namespaces";
-const KV_KEYS_PATH = "/_lunora/admin/kv/keys";
-const KV_VALUE_PATH = "/_lunora/admin/kv/value";
-const KV_VALUE_MAX_BODY_BYTES = 32 * 1048576;
-const KV_MIN_EXPIRATION_SECONDS = 60;
-const buildKvAdminRoutes = (deps) => {
-  const { readJsonBody, requireAdminOption } = deps;
-  const gate = (request) => requireAdminOption(request, deps.kvIntrospector, {
-    code: "KV_NOT_CONFIGURED",
-    message: "KV endpoints require a `kvIntrospector` on the worker"
-  });
-  const ok = (payload) => Response.json(payload, { headers: { "content-type": "application/json" }, status: 200 });
-  const requireNamespaceAndKey = (request, verb) => {
-    const url = new URL(request.url);
-    const namespace = url.searchParams.get("namespace") ?? "";
-    const key = url.searchParams.get("key") ?? "";
-    if (namespace === "") {
-      throw new LunoraError(`KV-value ${verb} request requires a \`namespace\` query parameter`, { code: "BAD_REQUEST", status: 400 });
-    }
-    if (key === "") {
-      throw new LunoraError(`KV-value ${verb} request requires a \`key\` query parameter`, { code: "BAD_REQUEST", status: 400 });
-    }
-    return { key, namespace };
-  };
-  const requireKnownNamespace = async (introspector, namespace) => {
-    const namespaces = await introspector.listNamespaces();
-    if (!namespaces.some((entry) => entry.binding === namespace)) {
-      throw new LunoraError(`Unknown KV namespace binding \`${namespace}\``, { code: "NOT_FOUND", status: 404 });
-    }
-  };
-  const handleKvNamespaces = async (request) => {
-    if (request.method !== "GET") {
-      throw new LunoraError("KV-namespaces endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    return ok({ namespaces: await gate(request).listNamespaces() });
-  };
-  const handleKvKeys = async (request) => {
-    if (request.method !== "GET") {
-      throw new LunoraError("KV-keys endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    const introspector = gate(request);
-    const url = new URL(request.url);
-    const namespace = url.searchParams.get("namespace") ?? "";
-    if (namespace === "") {
-      throw new LunoraError("KV-keys request requires a `namespace` query parameter", { code: "BAD_REQUEST", status: 400 });
-    }
-    const prefix = url.searchParams.get("prefix") ?? void 0;
-    const cursor = url.searchParams.get("cursor") ?? void 0;
-    const limitRaw = url.searchParams.get("limit");
-    const parsedLimit = limitRaw === null ? void 0 : Number.parseInt(limitRaw, 10);
-    if (parsedLimit !== void 0 && (!Number.isInteger(parsedLimit) || parsedLimit < 1)) {
-      throw new LunoraError("KV-keys `limit` must be a positive integer", { code: "BAD_REQUEST", status: 400 });
-    }
-    const limit = parsedLimit === void 0 ? void 0 : Math.min(parsedLimit, 1e3);
-    await requireKnownNamespace(introspector, namespace);
-    return ok(await introspector.listKeys({ cursor, limit, namespace, prefix }));
-  };
-  const handleKvValueGet = async (request) => {
-    const introspector = gate(request);
-    const params = requireNamespaceAndKey(request, "GET");
-    await requireKnownNamespace(introspector, params.namespace);
-    return ok(await introspector.getValue(params));
-  };
-  const handleKvValuePut = async (request) => {
-    const introspector = gate(request);
-    const candidate = await readJsonBody(request, KV_VALUE_MAX_BODY_BYTES);
-    if (typeof candidate.namespace !== "string" || candidate.namespace === "") {
-      throw new LunoraError("KV-value PUT request requires a `namespace` string", { code: "BAD_REQUEST", status: 400 });
-    }
-    if (typeof candidate.key !== "string" || candidate.key === "") {
-      throw new LunoraError("KV-value PUT request requires a `key` string", { code: "BAD_REQUEST", status: 400 });
-    }
-    if (typeof candidate.value !== "string") {
-      throw new LunoraError("KV-value PUT request requires a `value` string", { code: "BAD_REQUEST", status: 400 });
-    }
-    if (candidate.expirationTtl !== void 0 && (typeof candidate.expirationTtl !== "number" || !Number.isInteger(candidate.expirationTtl) || candidate.expirationTtl < KV_MIN_EXPIRATION_SECONDS)) {
-      throw new LunoraError("KV-value PUT `expirationTtl` must be an integer ≥ 60", { code: "BAD_REQUEST", status: 400 });
-    }
-    const minExpiration = Math.floor(Date.now() / 1e3) + KV_MIN_EXPIRATION_SECONDS;
-    if (candidate.expiration !== void 0 && (typeof candidate.expiration !== "number" || !Number.isInteger(candidate.expiration) || candidate.expiration < minExpiration)) {
-      throw new LunoraError("KV-value PUT `expiration` must be a Unix-seconds timestamp at least 60 seconds in the future", {
-        code: "BAD_REQUEST",
-        status: 400
-      });
-    }
-    await requireKnownNamespace(introspector, candidate.namespace);
-    await introspector.putValue({
-      expiration: candidate.expiration,
-      expirationTtl: candidate.expirationTtl,
-      key: candidate.key,
-      metadata: candidate.metadata,
-      namespace: candidate.namespace,
-      value: candidate.value
-    });
-    return ok({ ok: true });
-  };
-  const handleKvValueDelete = async (request) => {
-    const introspector = gate(request);
-    const params = requireNamespaceAndKey(request, "DELETE");
-    await requireKnownNamespace(introspector, params.namespace);
-    await introspector.deleteKey(params);
-    return ok({ deleted: true });
-  };
-  const kvValueHandlers = {
-    DELETE: handleKvValueDelete,
-    GET: handleKvValueGet,
-    PUT: handleKvValuePut
-  };
-  const handleKvValue = (request) => {
-    const handler = kvValueHandlers[request.method];
-    if (!handler) {
-      throw new LunoraError("KV-value endpoint requires GET, PUT, or DELETE", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    return handler(request);
-  };
-  return {
-    [KV_NAMESPACES_PATH]: handleKvNamespaces,
-    [KV_KEYS_PATH]: handleKvKeys,
-    [KV_VALUE_PATH]: handleKvValue
-  };
-};
-
-const MIGRATE_PATH$1 = "/_lunora/migrate";
-const PITR_PATH = "/_lunora/admin/pitr";
-const RANK_PATH = "/_lunora/admin/rank";
-const RANKPAGE_PATH = "/_lunora/admin/rankpage";
-const SHARD_TRAFFIC_PATH = "/_lunora/admin/shard-traffic";
-const MIGRATION_ADMIN_OPS = /* @__PURE__ */ new Set(["__lunora_admin__:migrationStatus", "__lunora_admin__:runMigration"]);
-const PITR_ADMIN_OPS = /* @__PURE__ */ new Set(["__lunora_admin__:getPitrBookmark", "__lunora_admin__:pitrRestore"]);
-const parseMigrateRequest = async (request) => {
-  let body;
-  try {
-    const text = await readBodyTextWithLimit(request);
-    body = text === "" ? {} : JSON.parse(text);
-  } catch (error) {
-    if (error instanceof LunoraError) {
-      throw error;
-    }
-    throw new LunoraError("Migration body must be valid JSON", { code: "BAD_REQUEST", status: 400 });
-  }
-  const candidate = body ?? {};
-  if (typeof candidate.table !== "string" || candidate.table.length === 0) {
-    throw new LunoraError("Migration request is missing `table`", { code: "BAD_REQUEST", status: 400 });
-  }
-  if (typeof candidate.functionPath !== "string" || !MIGRATION_ADMIN_OPS.has(candidate.functionPath)) {
-    throw new LunoraError("Migration request `functionPath` must be a migration admin op", { code: "BAD_REQUEST", status: 400 });
-  }
-  return {
-    args: candidate.args ?? {},
-    functionPath: candidate.functionPath,
-    table: candidate.table
-  };
-};
-const parseRankRequest = async (request) => {
-  let body;
-  try {
-    const text = await readBodyTextWithLimit(request);
-    body = text === "" ? {} : JSON.parse(text);
-  } catch (error) {
-    if (error instanceof LunoraError) {
-      throw error;
-    }
-    throw new LunoraError("Rank body must be valid JSON", { code: "BAD_REQUEST", status: 400 });
-  }
-  const candidate = body ?? {};
-  if (typeof candidate.table !== "string" || candidate.table.length === 0) {
-    throw new LunoraError("Rank request is missing `table`", { code: "BAD_REQUEST", status: 400 });
-  }
-  if (typeof candidate.index !== "string" || candidate.index.length === 0) {
-    throw new LunoraError("Rank request is missing `index`", { code: "BAD_REQUEST", status: 400 });
-  }
-  if (typeof candidate.partitionKey !== "string") {
-    throw new LunoraError("Rank request `partitionKey` must be a string", { code: "BAD_REQUEST", status: 400 });
-  }
-  if (typeof candidate.rowId !== "string" || candidate.rowId.length === 0) {
-    throw new LunoraError("Rank request is missing `rowId`", { code: "BAD_REQUEST", status: 400 });
-  }
-  if (!Array.isArray(candidate.sortValues)) {
-    throw new LunoraError("Rank request `sortValues` must be an array", { code: "BAD_REQUEST", status: 400 });
-  }
-  return {
-    index: candidate.index,
-    partitionKey: candidate.partitionKey,
-    rowId: candidate.rowId,
-    sortValues: candidate.sortValues,
-    table: candidate.table
-  };
-};
-const parseRankPageDirections = (raw) => {
-  if (raw === void 0) {
-    return void 0;
-  }
-  if (!Array.isArray(raw) || raw.some((d) => d !== "asc" && d !== "desc")) {
-    throw new LunoraError('Rank page request `directions` must be an array of "asc"|"desc"', { code: "BAD_REQUEST", status: 400 });
-  }
-  return raw;
-};
-const validateRankPageScalars = (candidate) => {
-  if (typeof candidate.table !== "string" || candidate.table.length === 0) {
-    throw new LunoraError("Rank page request is missing `table`", { code: "BAD_REQUEST", status: 400 });
-  }
-  if (typeof candidate.index !== "string" || candidate.index.length === 0) {
-    throw new LunoraError("Rank page request is missing `index`", { code: "BAD_REQUEST", status: 400 });
-  }
-  if (candidate.partitionKey !== void 0 && typeof candidate.partitionKey !== "string") {
-    throw new LunoraError("Rank page request `partitionKey` must be a string", { code: "BAD_REQUEST", status: 400 });
-  }
-  if (candidate.take !== void 0 && (typeof candidate.take !== "number" || !Number.isFinite(candidate.take))) {
-    throw new LunoraError("Rank page request `take` must be a number", { code: "BAD_REQUEST", status: 400 });
-  }
-  if (candidate.cursor !== void 0 && candidate.cursor !== null && typeof candidate.cursor !== "string") {
-    throw new LunoraError("Rank page request `cursor` must be a string or null", { code: "BAD_REQUEST", status: 400 });
-  }
-};
-const parseRankPageRequest = async (request) => {
-  let body;
-  try {
-    const text = await readBodyTextWithLimit(request);
-    body = text === "" ? {} : JSON.parse(text);
-  } catch (error) {
-    if (error instanceof LunoraError) {
-      throw error;
-    }
-    throw new LunoraError("Rank page body must be valid JSON", { code: "BAD_REQUEST", status: 400 });
-  }
-  const candidate = body ?? {};
-  validateRankPageScalars(candidate);
-  const directions = parseRankPageDirections(candidate.directions);
-  return {
-    // eslint-disable-next-line unicorn/no-null -- the wire cursor is `null | string`; normalize an absent cursor to null so the coordinator starts at the first page
-    cursor: typeof candidate.cursor === "string" ? candidate.cursor : null,
-    directions,
-    index: candidate.index,
-    partitionKey: typeof candidate.partitionKey === "string" ? candidate.partitionKey : void 0,
-    table: candidate.table,
-    take: typeof candidate.take === "number" ? candidate.take : void 0
-  };
-};
-const parseShardTrafficRequest = async (request) => {
-  let body;
-  try {
-    const text = await readBodyTextWithLimit(request);
-    body = text === "" ? {} : JSON.parse(text);
-  } catch (error) {
-    if (error instanceof LunoraError) {
-      throw error;
-    }
-    throw new LunoraError("Shard-traffic body must be valid JSON", { code: "BAD_REQUEST", status: 400 });
-  }
-  const candidate = body ?? {};
-  if (typeof candidate.table !== "string" || candidate.table.length === 0) {
-    throw new LunoraError("Shard-traffic request is missing `table`", { code: "BAD_REQUEST", status: 400 });
-  }
-  return { table: candidate.table };
-};
-const parsePitrRequest = async (request) => {
-  const body = await readJsonBodyWithLimit(request);
-  const candidate = body;
-  if (typeof candidate.functionPath !== "string" || !PITR_ADMIN_OPS.has(candidate.functionPath)) {
-    throw new LunoraError("PITR request `functionPath` must be a PITR admin op", { code: "BAD_REQUEST", status: 400 });
-  }
-  if (candidate.shardKey !== void 0 && typeof candidate.shardKey !== "string") {
-    throw new LunoraError("PITR `shardKey` must be a string", { code: "BAD_REQUEST", status: 400 });
-  }
-  return {
-    args: candidate.args ?? {},
-    functionPath: candidate.functionPath,
-    shardKey: candidate.shardKey
-  };
-};
-const buildOrchestrationAdminRoutes = (deps) => {
-  const { defaultShard, forwardToShard, isAdmin, queryCoordinator, resolveForwardContext, shardDO } = deps;
-  const handleMigrate = async (request, env) => {
-    if (request.method !== "POST") {
-      throw new LunoraError("Migration endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    if (!isAdmin(request)) {
-      throw new LunoraError("Admin auth required", { code: "FORBIDDEN", status: 403 });
-    }
-    if (!queryCoordinator) {
-      throw new LunoraError("Migration endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
-    }
-    const migrate = await parseMigrateRequest(request);
-    const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
-    const result = await queryCoordinator.orchestrateMigration(shardDO, {
-      args: migrate.args,
-      functionPath: migrate.functionPath,
-      headers: forwardedHeaders,
-      table: migrate.table
-    });
-    return Response.json(result, {
-      headers: { "content-type": "application/json" },
-      status: 200
-    });
-  };
-  const handleRank = async (request, env) => {
-    if (request.method !== "POST") {
-      throw new LunoraError("Rank endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    if (!isAdmin(request)) {
-      throw new LunoraError("Admin auth required", { code: "FORBIDDEN", status: 403 });
-    }
-    if (!queryCoordinator) {
-      throw new LunoraError("Rank endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
-    }
-    const rank = await parseRankRequest(request);
-    const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
-    const result = await queryCoordinator.orchestrateRank(shardDO, {
-      headers: forwardedHeaders,
-      index: rank.index,
-      partitionKey: rank.partitionKey,
-      rowId: rank.rowId,
-      sortValues: rank.sortValues,
-      table: rank.table
-    });
-    return Response.json(result, {
-      headers: { "content-type": "application/json" },
-      status: 200
-    });
-  };
-  const handleRankPage = async (request, env) => {
-    if (request.method !== "POST") {
-      throw new LunoraError("Rank page endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    if (!isAdmin(request)) {
-      throw new LunoraError("Admin auth required", { code: "FORBIDDEN", status: 403 });
-    }
-    if (!queryCoordinator) {
-      throw new LunoraError("Rank page endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
-    }
-    const rankPage = await parseRankPageRequest(request);
-    const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
-    const result = await queryCoordinator.orchestrateRankPage(shardDO, {
-      ...rankPage,
-      headers: forwardedHeaders
-    });
-    return Response.json(result, {
-      headers: { "content-type": "application/json" },
-      status: 200
-    });
-  };
-  const handleShardTraffic = async (request, env) => {
-    if (request.method !== "POST") {
-      throw new LunoraError("Shard-traffic endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    if (!isAdmin(request)) {
-      throw new LunoraError("Admin auth required", { code: "FORBIDDEN", status: 403 });
-    }
-    if (!queryCoordinator) {
-      throw new LunoraError("Shard-traffic endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
-    }
-    const trafficRequest = await parseShardTrafficRequest(request);
-    const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
-    const result = await queryCoordinator.orchestrateShardTraffic(shardDO, {
-      headers: forwardedHeaders,
-      table: trafficRequest.table
-    });
-    return Response.json(result, {
-      headers: { "content-type": "application/json" },
-      status: 200
-    });
-  };
-  const handlePitr = async (request, env) => {
-    if (request.method !== "POST") {
-      throw new LunoraError("PITR endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    if (!isAdmin(request)) {
-      throw new LunoraError("admin PITR endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
-    }
-    const pitr = await parsePitrRequest(request);
-    const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
-    const forwarded = new Request("https://shard.internal/rpc", {
-      body: JSON.stringify({ args: pitr.args, functionPath: pitr.functionPath }),
-      headers: forwardedHeaders,
-      method: "POST"
-    });
-    return forwardToShard(shardDO, pitr.shardKey ?? defaultShard, forwarded);
-  };
-  return {
-    [MIGRATE_PATH$1]: handleMigrate,
-    [PITR_PATH]: handlePitr,
-    [RANK_PATH]: handleRank,
-    [RANKPAGE_PATH]: handleRankPage,
-    [SHARD_TRAFFIC_PATH]: handleShardTraffic
-  };
-};
-
-const SAMPLED_FLAG = 1;
-const UNSAMPLED_FLAG = 0;
-const MAX_TRACE_STATE_MEMBERS = 32;
-const MAX_TRACE_STATE_LENGTH = 512;
-const TRACE_STATE_MEMBER = /^[a-z][\d_a-z*/-]{0,255}(?:@[a-z][\d_a-z*/-]{0,13})?=[\u0020-\u002B\u002D-\u003C\u003E-\u007E]{1,256}$/;
-const sanitizeTraceState = (header) => {
-  if (header === null || header === void 0) {
-    return void 0;
-  }
-  const trimmed = header.trim();
-  if (trimmed.length === 0 || trimmed.length > MAX_TRACE_STATE_LENGTH) {
-    return void 0;
-  }
-  const members = trimmed.split(",");
-  if (members.length > MAX_TRACE_STATE_MEMBERS) {
-    return void 0;
-  }
-  for (const member of members) {
-    if (!TRACE_STATE_MEMBER.test(member.trim())) {
-      return void 0;
-    }
-  }
-  return trimmed;
-};
-const extractTraceContext = (request) => {
-  const parsed = parseTraceparent(request.headers.get("traceparent"));
-  if (parsed === void 0) {
-    return void 0;
-  }
-  const traceState = sanitizeTraceState(request.headers.get("tracestate"));
-  return {
-    parentSpanId: parsed.parentSpanId,
-    sampled: parsed.sampled,
-    traceId: parsed.traceId,
-    ...traceState === void 0 ? {} : { traceState }
-  };
-};
-const beginDispatchTrace = (request, options = {}) => {
-  const upstream = extractTraceContext(request);
-  const trusted = options.trustInbound === true ? upstream : void 0;
-  const spanId = otlpRandomHex(8);
-  const traceId = trusted?.traceId ?? otlpRandomHex(16);
-  const decision = resolveTraceSampling(options.sampling, trusted === void 0 ? spanId : traceId);
-  const sampled = decision.isTraced && (trusted === void 0 || trusted.sampled);
-  return {
-    decision,
-    // A parseable upstream trace existed, and we chose not to join it.
-    ignoredUpstream: upstream !== void 0 && trusted === void 0,
-    trace: {
-      sampled,
-      spanId,
-      traceFlags: sampled ? SAMPLED_FLAG : UNSAMPLED_FLAG,
-      traceId,
-      ...trusted?.parentSpanId === void 0 ? {} : { parentSpanId: trusted.parentSpanId },
-      ...trusted?.traceState === void 0 ? {} : { traceState: trusted.traceState }
-    }
-  };
-};
-const injectTraceContext = (trace, headers) => {
-  headers.traceparent = buildTraceparent(trace.traceId, trace.spanId, trace.sampled);
-  if (trace.traceState !== void 0) {
-    headers.tracestate = trace.traceState;
-  }
-};
-
-const createResourceAttributeResolver = (environment, request) => {
-  let resolved;
-  return () => {
-    if (resolved === void 0) {
-      const read = readerFromRecord(environment);
-      const cf = request === void 0 ? void 0 : request.cf;
-      resolved = mergeResourceAttributes(detectServiceResource(read), detectCloudflareResource(read, cf));
-    }
-    return resolved;
-  };
-};
-
-const SCHEDULED_PATH = "/_lunora/admin/scheduled";
-const SCHEDULED_STATUS_PATH = "/_lunora/admin/scheduled/status";
-const SCHEDULED_WS_PATH = "/_lunora/admin/scheduled/ws";
-const SCHEDULED_CANCEL_PATH = "/_lunora/admin/scheduled/cancel";
-const SCHEDULED_DEAD_PATH = "/_lunora/admin/scheduled/dead";
-const SCHEDULED_DEAD_RETRY_PATH = "/_lunora/admin/scheduled/dead/retry";
-const SCHEDULED_DEAD_CANCEL_PATH = "/_lunora/admin/scheduled/dead/cancel";
-const buildScheduledAdminRoutes = (deps) => {
-  const { checkWsAdmin, requireSchedulerNamespace, resolveSchedulerStub, schedulerInstanceName } = deps;
-  const handleScheduledList = async (request) => {
-    if (request.method !== "GET") {
-      throw new LunoraError("Scheduled-list endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    const stub = resolveSchedulerStub(request);
-    return stub.fetch(new Request("https://scheduler.internal/list", { method: "GET" }));
-  };
-  const handleSchedulerStatus = async (request) => {
-    if (request.method !== "GET") {
-      throw new LunoraError("Scheduler-status endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    const stub = resolveSchedulerStub(request);
-    return stub.fetch(new Request("https://scheduler.internal/status", { method: "GET" }));
-  };
-  const handleScheduledWebSocket = async (request) => {
-    if (request.headers.get("Upgrade") !== "websocket") {
-      throw new LunoraError("WebSocket upgrade header missing", { code: "BAD_REQUEST", status: 426 });
-    }
-    if (!await checkWsAdmin(request)) {
-      throw new LunoraError("admin authorization required", { code: "ADMIN_FORBIDDEN", status: 403 });
-    }
-    const namespace = requireSchedulerNamespace();
-    const stub = resolveShard(namespace, schedulerInstanceName);
-    return stub.fetch(new Request("https://scheduler.internal/ws", { headers: { Upgrade: "websocket" } }));
-  };
-  const handleScheduledCancel = async (request) => {
-    if (request.method !== "POST") {
-      throw new LunoraError("Scheduled-cancel endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    const stub = resolveSchedulerStub(request);
-    const body = await request.json().catch(() => void 0);
-    if (typeof body?.id !== "string" || body.id === "") {
-      throw new LunoraError("Scheduled-cancel requires a string `id`", { code: "BAD_REQUEST", status: 400 });
-    }
-    return stub.fetch(
-      new Request("https://scheduler.internal/cancel", {
-        body: JSON.stringify({ id: body.id }),
-        headers: { "content-type": "application/json" },
-        method: "POST"
-      })
-    );
-  };
-  const handleDeadList = async (request) => {
-    if (request.method !== "GET") {
-      throw new LunoraError("Scheduled dead-letter endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    const stub = resolveSchedulerStub(request);
-    return stub.fetch(new Request("https://scheduler.internal/dead", { method: "GET" }));
-  };
-  const proxyDeadAction = (doPath) => async (request) => {
-    if (request.method !== "POST") {
-      throw new LunoraError("Scheduled dead-letter action requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    const stub = resolveSchedulerStub(request);
-    const body = await request.json().catch(() => void 0);
-    if (typeof body?.id !== "string" || body.id === "") {
-      throw new LunoraError("Scheduled dead-letter action requires a string `id`", { code: "BAD_REQUEST", status: 400 });
-    }
-    return stub.fetch(
-      new Request(`https://scheduler.internal${doPath}`, {
-        body: JSON.stringify({ id: body.id }),
-        headers: { "content-type": "application/json" },
-        method: "POST"
-      })
-    );
-  };
-  return {
-    [SCHEDULED_CANCEL_PATH]: handleScheduledCancel,
-    [SCHEDULED_DEAD_CANCEL_PATH]: proxyDeadAction("/dead/cancel"),
-    [SCHEDULED_DEAD_PATH]: handleDeadList,
-    [SCHEDULED_DEAD_RETRY_PATH]: proxyDeadAction("/dead/retry"),
-    [SCHEDULED_PATH]: handleScheduledList,
-    [SCHEDULED_STATUS_PATH]: handleSchedulerStatus,
-    [SCHEDULED_WS_PATH]: handleScheduledWebSocket
-  };
-};
-
-const STORAGE_PATH = "/_lunora/admin/storage";
-const STORAGE_URL_PATH = "/_lunora/admin/storage/url";
-const STORAGE_BUCKETS_PATH = "/_lunora/admin/storage/buckets";
-const MAX_STORAGE_EXPIRES_IN_SECONDS = 7 * 24 * 60 * 60;
-const buildStorageAdminRoutes = (deps) => {
-  const { assertAdmin, parsePaging, queryParameter, readBodyBytes, requireAdminOption, storage } = deps;
-  const requireStorageKey = (url) => {
-    const key = queryParameter(url, "key");
-    if (key === void 0) {
-      throw new LunoraError("Storage endpoint requires a `key` query parameter", { code: "BAD_REQUEST", status: 400 });
-    }
-    return key;
-  };
-  const handleStorageList = async (request) => {
-    const storageList = requireAdminOption(request, storage.storageList, {
-      code: "STORAGE_NOT_CONFIGURED",
-      message: "storage endpoint requires a `storageList` function on the worker"
-    });
-    const url = new URL(request.url);
-    const result = await storageList(queryParameter(url, "prefix"), {
-      bucket: queryParameter(url, "bucket"),
-      cursor: queryParameter(url, "cursor"),
-      ...parsePaging(request)
-    });
-    return Response.json(result, { headers: { "content-type": "application/json" }, status: 200 });
-  };
-  const handleStorageBuckets = (request) => {
-    if (request.method !== "GET") {
-      throw new LunoraError("Storage-buckets endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    assertAdmin(request);
-    return Response.json({ buckets: storage.storageBuckets ?? [] }, { headers: { "content-type": "application/json" }, status: 200 });
-  };
-  const handleStorageDelete = async (request) => {
-    const storageDelete = requireAdminOption(request, storage.storageDelete, {
-      code: "STORAGE_DELETE_NOT_CONFIGURED",
-      message: "storage delete requires a `storageDelete` function on the worker"
-    });
-    const url = new URL(request.url);
-    const key = requireStorageKey(url);
-    await storageDelete(key, { bucket: queryParameter(url, "bucket") });
-    return Response.json({ deleted: true, key }, { headers: { "content-type": "application/json" }, status: 200 });
-  };
-  const handleStorageUpload = async (request) => {
-    const storageUpload = requireAdminOption(request, storage.storageUpload, {
-      code: "STORAGE_UPLOAD_NOT_CONFIGURED",
-      message: "storage upload requires a `storageUpload` function on the worker"
-    });
-    const url = new URL(request.url);
-    const key = requireStorageKey(url);
-    const body = await readBodyBytes(request);
-    const headerContentType = request.headers.get("content-type");
-    const contentType = headerContentType === null || headerContentType === "" ? void 0 : headerContentType;
-    const result = await storageUpload(key, body, { bucket: queryParameter(url, "bucket"), contentType });
-    return Response.json(result, { headers: { "content-type": "application/json" }, status: 200 });
-  };
-  const handleStorage = async (request) => {
-    switch (request.method) {
-      case "DELETE": {
-        return handleStorageDelete(request);
-      }
-      case "GET": {
-        return handleStorageList(request);
-      }
-      case "POST":
-      case "PUT": {
-        return handleStorageUpload(request);
-      }
-      default: {
-        throw new LunoraError("Storage endpoint requires GET, PUT, POST, or DELETE", { code: "METHOD_NOT_ALLOWED", status: 405 });
-      }
-    }
-  };
-  const handleStorageSignedUrl = async (request) => {
-    if (request.method !== "GET") {
-      throw new LunoraError("Storage URL endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    const storageSignedUrl = requireAdminOption(request, storage.storageSignedUrl, {
-      code: "STORAGE_URL_NOT_CONFIGURED",
-      message: "storage URL endpoint requires a `storageSignedUrl` function on the worker"
-    });
-    const url = new URL(request.url);
-    const key = requireStorageKey(url);
-    const expiresInRaw = Number(queryParameter(url, "expiresIn") ?? "");
-    const expiresInSeconds = Number.isFinite(expiresInRaw) && expiresInRaw > 0 ? Math.min(expiresInRaw, MAX_STORAGE_EXPIRES_IN_SECONDS) : void 0;
-    const signedUrl = await storageSignedUrl(key, { bucket: queryParameter(url, "bucket"), expiresInSeconds });
-    return Response.json({ key, url: signedUrl }, { headers: { "content-type": "application/json" }, status: 200 });
-  };
-  return {
-    [STORAGE_BUCKETS_PATH]: handleStorageBuckets,
-    [STORAGE_PATH]: handleStorage,
-    [STORAGE_URL_PATH]: handleStorageSignedUrl
-  };
-};
-
-const cfString = (request, ...path) => {
-  let current = request.cf;
-  for (const key of path) {
-    if (typeof current !== "object" || current === null) {
-      return void 0;
-    }
-    current = current[key];
-  }
-  return typeof current === "string" ? current : void 0;
-};
-const SIGNAL_CHECKS = {
-  // Edge-verified client certificate — the platform sets `certVerified`, so
-  // unlike a header this cannot be spoofed by the caller.
-  mtls: (request) => cfString(request, "tlsClientAuth", "certVerified") === "SUCCESS"
-};
-const resolveTraceTrust = (option) => {
-  if (option === void 0 || option === false) {
-    return () => false;
-  }
-  if (option === true) {
-    return () => true;
-  }
-  if (typeof option === "function") {
-    return option;
-  }
-  const check = Object.entries(SIGNAL_CHECKS).find(([signal]) => signal === option)?.[1];
-  return check ?? (() => false);
-};
-const createDroppedTraceNotice = (option) => {
-  if (option !== void 0) {
-    return () => {
-    };
-  }
-  let notified = false;
-  return () => {
-    if (notified) {
-      return;
-    }
-    notified = true;
-    console.warn(
-      '[lunora] Ignored an inbound `traceparent`, so this request starts a new trace instead of joining the caller\'s. That is the safe default: the header is caller-supplied, and trusting it lets any client choose which trace its spans and logs join. If this worker sits behind a gateway, service mesh, or Cloudflare Access that sets `traceparent` itself, set `trustInboundTraceContext: true` on createWorker() (or `"mtls"` to trust only edge-verified client certificates). Set it to `false` to keep this behaviour and silence this message.'
-    );
-  };
-};
-
-const VECTOR_INDEXES_PATH = "/_lunora/admin/vector/indexes";
-const VECTOR_QUERY_PATH = "/_lunora/admin/vector/query";
-const buildVectorAdminRoutes = (deps) => {
-  const { readJsonBody, requireAdminOption } = deps;
-  const handleVectorIndexes = async (request) => {
-    if (request.method !== "GET") {
-      throw new LunoraError("Vector-indexes endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    const introspector = requireAdminOption(request, deps.vectorIntrospector, {
-      code: "VECTORS_NOT_CONFIGURED",
-      message: "vector endpoints require a `vectorIntrospector` on the worker"
-    });
-    return Response.json({ indexes: await introspector.listIndexes() }, { headers: { "content-type": "application/json" }, status: 200 });
-  };
-  const handleVectorQuery = async (request) => {
-    if (request.method !== "POST") {
-      throw new LunoraError("Vector-query endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    const introspector = requireAdminOption(request, deps.vectorIntrospector, {
-      code: "VECTORS_NOT_CONFIGURED",
-      message: "vector endpoints require a `vectorIntrospector` on the worker"
-    });
-    if (introspector.queryIndex === void 0) {
-      throw new LunoraError("vector index querying is not enabled on this worker", { code: "VECTOR_QUERY_UNSUPPORTED", status: 400 });
-    }
-    const body = await readJsonBody(request);
-    const candidate = body;
-    if (typeof candidate.name !== "string" || candidate.name === "") {
-      throw new LunoraError("Vector-query request requires a `name` string", { code: "BAD_REQUEST", status: 400 });
-    }
-    if (typeof candidate.text !== "string" || candidate.text === "") {
-      throw new LunoraError("Vector-query request requires a `text` string", { code: "BAD_REQUEST", status: 400 });
-    }
-    if (candidate.topK !== void 0 && (typeof candidate.topK !== "number" || !Number.isInteger(candidate.topK) || candidate.topK < 1)) {
-      throw new LunoraError("Vector-query `topK` must be a positive integer", { code: "BAD_REQUEST", status: 400 });
-    }
-    const result = await introspector.queryIndex({ name: candidate.name, text: candidate.text, topK: candidate.topK });
-    return Response.json(result, { headers: { "content-type": "application/json" }, status: 200 });
-  };
-  return {
-    [VECTOR_INDEXES_PATH]: handleVectorIndexes,
-    [VECTOR_QUERY_PATH]: handleVectorQuery
-  };
-};
-
-const WORKFLOWS_INSTANCES_PATH = "/_lunora/admin/workflows/instances";
-const WORKFLOWS_INSTANCE_PATH = "/_lunora/admin/workflows/instance";
-const WORKFLOWS_STATUS_PATH = "/_lunora/admin/workflows/status";
-const INSTANCE_STATUSES = {
-  complete: true,
-  errored: true,
-  paused: true,
-  queued: true,
-  running: true,
-  terminated: true,
-  unknown: true,
-  waiting: true,
-  waitingForPause: true
-};
-const toInstanceStatus = (value) => value !== null && Object.hasOwn(INSTANCE_STATUSES, value) ? value : void 0;
-const positiveIntParameter = (url, key) => {
-  const raw = url.searchParams.get(key);
-  if (raw === null) {
-    return void 0;
-  }
-  const value = Number(raw);
-  return Number.isInteger(value) && value > 0 ? value : void 0;
-};
-const requireQuery = (url, key) => {
-  const value = url.searchParams.get(key);
-  if (value === null || value === "") {
-    throw new LunoraError(`Workflows admin endpoint requires a \`${key}\` query parameter`, { code: "BAD_REQUEST", status: 400 });
-  }
-  return value;
-};
-const throwNotConfigured = () => {
-  throw new LunoraError("Workflow inspection is unconfigured. Set CLOUDFLARE_ACCOUNT_ID + CLOUDFLARE_API_TOKEN in your .dev.vars to enable it.", {
-    code: "WORKFLOWS_NOT_CONFIGURED",
-    status: 501
-  });
-};
-const buildWorkflowsAdminRoutes = (deps) => {
-  const { assertAdmin, resolveWorkflowsClient } = deps;
-  const handleInstances = async (request, env, url) => {
-    if (request.method !== "GET") {
-      throw new LunoraError("Workflows instances endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    assertAdmin(request);
-    const client = resolveWorkflowsClient(env);
-    if (!client) {
-      return Response.json({ configured: false, instances: [], page: 1, perPage: 0, totalCount: 0 });
-    }
-    const workflowName = requireQuery(url, "name");
-    const status = toInstanceStatus(url.searchParams.get("status"));
-    return Response.json(
-      await client.listInstances({
-        page: positiveIntParameter(url, "page"),
-        perPage: positiveIntParameter(url, "perPage"),
-        status,
-        workflowName
-      })
-    );
-  };
-  const handleInstance = async (request, env, url) => {
-    if (request.method !== "GET") {
-      throw new LunoraError("Workflows instance endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    assertAdmin(request);
-    const client = resolveWorkflowsClient(env);
-    if (!client) {
-      return throwNotConfigured();
-    }
-    return Response.json(await client.getInstance({ instanceId: requireQuery(url, "id"), workflowName: requireQuery(url, "name") }));
-  };
-  const handleStatus = async (request, env) => {
-    if (request.method !== "POST") {
-      throw new LunoraError("Workflows status endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    assertAdmin(request);
-    const client = resolveWorkflowsClient(env);
-    if (!client) {
-      return throwNotConfigured();
-    }
-    const body = await request.json().catch(() => void 0);
-    if (typeof body?.name !== "string" || body.name === "" || typeof body.id !== "string" || body.id === "") {
-      throw new LunoraError("Workflows status action requires string `name` and `id`", { code: "BAD_REQUEST", status: 400 });
-    }
-    const { action } = body;
-    if (action !== "pause" && action !== "resume" && action !== "terminate") {
-      throw new LunoraError("Workflows status action must be one of: pause, resume, terminate", { code: "BAD_REQUEST", status: 400 });
-    }
-    return Response.json(await client.setInstanceStatus({ action, instanceId: body.id, workflowName: body.name }));
-  };
-  return {
-    [WORKFLOWS_INSTANCE_PATH]: handleInstance,
-    [WORKFLOWS_INSTANCES_PATH]: handleInstances,
-    [WORKFLOWS_STATUS_PATH]: handleStatus
-  };
-};
-
-const NDJSON_ENCODER = new TextEncoder();
-const RPC_PATH = "/_lunora/rpc";
-const RPC_BATCH_PATH = "/_lunora/rpc-batch";
-const WS_PATH = "/_lunora/ws";
-const buildSinkContext = (environment, request, waitUntil) => {
-  return {
-    resourceAttributes: createResourceAttributeResolver(environment, request),
-    ...waitUntil === void 0 ? {} : { waitUntil }
-  };
-};
-const traceEventFields = (trace) => {
-  return {
-    spanId: trace.spanId,
-    traceFlags: trace.traceFlags,
-    traceId: trace.traceId,
-    ...trace.parentSpanId === void 0 ? {} : { parentSpanId: trace.parentSpanId }
-  };
-};
-const requestTelemetryMeta = (request) => {
-  const { method } = request;
-  const userAgent = request.headers.get("user-agent") ?? void 0;
-  let url;
-  try {
-    url = new URL(request.url);
-  } catch {
-    return { method, userAgent };
-  }
-  const port = url.port === "" ? void 0 : Number(url.port);
-  return {
-    host: url.hostname,
-    method,
-    path: url.pathname,
-    port: Number.isNaN(port) ? void 0 : port,
-    scheme: url.protocol.replace(":", ""),
-    userAgent
-  };
-};
-const VOICE_PATH_PREFIX = "/_lunora/voice/";
-const SCHEDULER_DISPATCH_PATH = "/_lunora/scheduler/dispatch";
-const CRON_JOBS_RUN_PATH = "/_lunora/admin/cron-jobs/run";
-const ADMIN_WS_TOKEN_PATH = "/_lunora/admin/ws-token";
-const ADMIN_PATH_PREFIX = "/_lunora/admin/";
-const MIGRATE_PATH = "/_lunora/migrate";
-const STATUS_PATH = "/_lunora/status";
-const isAdminPath = (pathname) => pathname.startsWith(ADMIN_PATH_PREFIX) || pathname === MIGRATE_PATH;
-const REQUIRE_EPHEMERAL_ENV_VALUES = /* @__PURE__ */ new Set(["1", "enabled", "on", "true", "yes"]);
-const readForwardedIdentity = (request) => {
-  const forwardedUserId = request.headers.get("x-lunora-userid");
-  const forwardedIdentity = request.headers.get("x-lunora-identity");
-  if (forwardedUserId === null && forwardedIdentity === null) {
-    return void 0;
-  }
-  return {
-    ...forwardedIdentity === null ? {} : { identity: forwardedIdentity },
-    ...forwardedUserId === null ? {} : { userId: forwardedUserId }
-  };
-};
-const DEFAULT_AUTH_BASE_PATH = "/api/auth";
-const RECORD_AUTH_EVENT_OP = "__lunora_admin__:recordAuthEvent";
-const LIST_PUSH_SUBSCRIPTIONS_OP = "__lunora_admin__:listPushSubscriptions";
-const AUTH_ATTEMPT_SEGMENTS = ["/sign-in", "/sign-up", "/callback"];
-const isAuthAttemptPath = (pathname, basePath) => {
-  const base = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath;
-  if (!pathname.startsWith(`${base}/`)) {
-    return false;
-  }
-  const suffix = pathname.slice(base.length);
-  return AUTH_ATTEMPT_SEGMENTS.some((segment) => suffix === segment || suffix.startsWith(`${segment}/`));
-};
-const buildErrorEvent = (functionPath, durationMs, error, extra) => {
-  const mappable = isLunoraError(error);
-  const code = mappable ? error.code : "INTERNAL_SERVER_ERROR";
-  const status = mappable ? error.status : 500;
-  const message = error instanceof Error ? error.message : String(error);
-  return {
-    durationMs,
-    error: { code, message, status },
-    functionPath,
-    ok: false,
-    ...extra.fanOut ? { fanOut: { failed: 0, shards: 0, table: extra.fanOut.table } } : {},
-    ...extra.shardKey ? { shardKey: extra.shardKey } : {}
-  };
-};
-const identityExpiryMs = (identity) => {
-  const { exp, expiresAtMs } = identity;
-  if (typeof expiresAtMs === "number" && Number.isFinite(expiresAtMs)) {
-    return expiresAtMs;
-  }
-  if (typeof exp === "number" && Number.isFinite(exp)) {
-    return exp * 1e3;
-  }
-  return void 0;
-};
-const resolveForwardContext = async (request, env, resolveIdentity) => {
-  const headers = { "content-type": "application/json" };
-  const authorization = request.headers.get("authorization");
-  const cookie = request.headers.get("cookie");
-  const bookmark = request.headers.get("x-d1-bookmark");
-  const mutationId = request.headers.get("x-lunora-mutation-id");
-  const clientId = request.headers.get("x-lunora-client-id");
-  const clientSeq = request.headers.get("x-lunora-client-seq");
-  if (authorization) {
-    headers["authorization"] = authorization;
-  }
-  if (cookie) {
-    headers["cookie"] = cookie;
-  }
-  if (bookmark) {
-    headers["x-d1-bookmark"] = bookmark;
-  }
-  if (mutationId) {
-    headers["x-lunora-mutation-id"] = mutationId;
-  }
-  if (clientId) {
-    headers["x-lunora-client-id"] = clientId;
-  }
-  if (clientSeq) {
-    headers["x-lunora-client-seq"] = clientSeq;
-  }
-  const clientIp = request.headers.get("cf-connecting-ip");
-  if (clientIp) {
-    headers["x-lunora-client-ip"] = clientIp;
-  }
-  if (!resolveIdentity) {
-    return { claims: null, headers, identity: null, userId: null };
-  }
-  const identity = await resolveIdentity(request, env);
-  if (!identity || typeof identity.userId !== "string" || identity.userId.length === 0) {
-    return { claims: null, headers, identity: null, userId: null };
-  }
-  headers["x-lunora-userid"] = identity.userId;
-  const expiresAtMs = identityExpiryMs(identity);
-  if (expiresAtMs !== void 0) {
-    headers["x-lunora-identity-exp"] = String(expiresAtMs);
-  }
-  const { userId, ...extra } = identity;
-  const claims = Object.keys(extra).length > 0 ? extra : null;
-  if (claims) {
-    headers["x-lunora-identity"] = JSON.stringify(claims);
-  }
-  return { claims, headers, identity, userId };
-};
-const KNOWN_MERGE_KINDS = /* @__PURE__ */ new Set(["concat", "first", "groupBy", "max", "min", "rank", "sum", "topK"]);
-const validateFanOut = (fanOut) => {
-  if (fanOut === void 0) {
-    return void 0;
-  }
-  if (!fanOut || typeof fanOut !== "object") {
-    throw new LunoraError("RPC `fanOut` must be an object", { code: "BAD_REQUEST", status: 400 });
-  }
-  const spec = fanOut;
-  if (typeof spec.table !== "string" || spec.table.length === 0) {
-    throw new LunoraError("RPC `fanOut.table` must be a non-empty string", { code: "BAD_REQUEST", status: 400 });
-  }
-  if (!spec.merge || typeof spec.merge !== "object") {
-    throw new LunoraError("RPC `fanOut.merge` must be an object", { code: "BAD_REQUEST", status: 400 });
-  }
-  const merge = spec.merge;
-  if (typeof merge.kind !== "string" || !KNOWN_MERGE_KINDS.has(merge.kind)) {
-    throw new LunoraError("RPC `fanOut.merge.kind` is not a recognized merge strategy", { code: "BAD_REQUEST", status: 400 });
-  }
-  if (merge.kind === "topK") {
-    if (typeof merge.k !== "number" || !Number.isInteger(merge.k) || merge.k < 0) {
-      throw new LunoraError("RPC `fanOut.merge.k` must be a non-negative integer", { code: "BAD_REQUEST", status: 400 });
-    }
-    if (typeof merge.by !== "string" || merge.by.length === 0) {
-      throw new LunoraError("RPC `fanOut.merge.by` must be a non-empty string", { code: "BAD_REQUEST", status: 400 });
-    }
-  }
-  return spec;
-};
-const logRpcDebug = (env, envelope) => {
-  if (!env?.LUNORA_DEBUG_RPC) {
-    return;
-  }
-  console.warn(`[lunora:rpc] ${envelope.fanOut ? "fan-out" : `shard=${envelope.shardKey ?? "(root)"}`} ${envelope.functionPath}`);
-};
-const resolveX402Charge = (envelope, options) => {
-  const x402Tag = options.functions?.[envelope.functionPath]?.x402;
-  if (!x402Tag) {
-    return void 0;
-  }
-  if (envelope.fanOut) {
-    throw new LunoraError("a paid (`.x402`) function cannot be fanned out", { code: "BAD_REQUEST", status: 400 });
-  }
-  if (!options.x402Charge) {
-    throw new LunoraError(`function "${envelope.functionPath}" is marked paid (.x402) but no x402Charge gate is configured on the worker`, {
-      code: "MISCONFIGURED",
-      status: 500
-    });
-  }
-  return x402Tag;
-};
-const parseEnvelope = async (request) => {
-  const text = await readBodyTextWithLimit(request);
-  let body;
-  try {
-    body = JSON.parse(text);
-  } catch {
-    throw new LunoraError("RPC body must be valid JSON", { code: "BAD_REQUEST", status: 400 });
-  }
-  if (!body || typeof body !== "object" || typeof body.functionPath !== "string") {
-    throw new LunoraError("RPC envelope is missing `functionPath`", { code: "BAD_REQUEST", status: 400 });
-  }
-  const raw = body;
-  if (raw.args !== void 0 && (typeof raw.args !== "object" || raw.args === null || Array.isArray(raw.args))) {
-    throw new LunoraError("RPC `args` must be an object", { code: "BAD_REQUEST", status: 400 });
-  }
-  if (raw.shardKey !== void 0 && typeof raw.shardKey !== "string") {
-    throw new LunoraError("RPC `shardKey` must be a string", { code: "BAD_REQUEST", status: 400 });
-  }
-  const envelope = body;
-  const fanOut = validateFanOut(envelope.fanOut);
-  const args = envelope.args ?? {};
-  if (fanOut && envelope.functionPath.startsWith("__lunora_relation__:")) {
-    const requestedTable = args.table;
-    if (typeof requestedTable === "string" && requestedTable !== fanOut.table) {
-      throw new LunoraError("RPC `args.table` must match the authorized `fanOut.table` for a relation fan-out", { code: "BAD_REQUEST", status: 400 });
-    }
-    args.table = fanOut.table;
-  }
-  return {
-    args,
-    fanOut,
-    functionPath: envelope.functionPath,
-    shardKey: envelope.shardKey
-  };
-};
-const forwardToShard = async (namespace, shardKey, request) => {
-  const stub = resolveShard(namespace, shardKey);
-  return stub.fetch(request);
-};
-const relayProbeCache = /* @__PURE__ */ new Map();
-const RELAY_PROBE_TTL_MS = 5e3;
-const RELAY_PROBE_MAX_ENTRIES = 4096;
-const probeRelayCount = async (namespace, shardKey) => {
-  const now = Date.now();
-  const cached = relayProbeCache.get(shardKey);
-  if (cached !== void 0 && cached.expiresMs > now) {
-    return cached.relayCount;
-  }
-  if (cached !== void 0) {
-    relayProbeCache.delete(shardKey);
-  }
-  let relayCount = 0;
-  try {
-    const response = await resolveShard(namespace, shardKey).fetch(new Request("https://shard.internal/_lunora/route"));
-    if (response.ok) {
-      const body = await response.json();
-      const reported = body.relayCount;
-      if (typeof reported === "number" && reported > 0) {
-        relayCount = Math.floor(reported);
-      }
-    }
-  } catch {
-    relayCount = 0;
-  }
-  evictOldestEntry(relayProbeCache, RELAY_PROBE_MAX_ENTRIES);
-  relayProbeCache.set(shardKey, { expiresMs: now + RELAY_PROBE_TTL_MS, relayCount });
-  return relayCount;
-};
-const resolveShardBindingName = (env, namespace) => {
-  if (env === null || typeof env !== "object") {
-    return void 0;
-  }
-  for (const [key, value] of Object.entries(env)) {
-    if (value === namespace) {
-      return key;
-    }
-  }
-  return void 0;
-};
-const constantTimeEqual = (expected, supplied) => {
-  const max = Math.max(expected.length, supplied.length);
-  let diff = expected.length ^ supplied.length;
-  for (let index = 0; index < max; index += 1) {
-    const expectedCode = index < expected.length ? expected.codePointAt(index) ?? 0 : 0;
-    const suppliedCode = index < supplied.length ? supplied.codePointAt(index) ?? 0 : 0;
-    diff |= expectedCode ^ suppliedCode;
-  }
-  return diff === 0;
-};
-const verifyHmacSignature = async (secret, body, suppliedSignature) => {
-  if (secret.length === 0 || suppliedSignature.length === 0) {
-    return false;
-  }
-  const encoder = new TextEncoder();
-  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, ["sign"]);
-  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(body));
-  const bytes = new Uint8Array(signature);
-  let binary = "";
-  for (const byte of bytes) {
-    binary += String.fromCodePoint(byte);
-  }
-  const expected = btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
-  return constantTimeEqual(expected, suppliedSignature);
-};
-const checkAdminAuth = (request, expected) => {
-  if (!expected || expected.length === 0) {
-    return false;
-  }
-  const authorization = request.headers.get("authorization");
-  if (!authorization) {
-    return false;
-  }
-  const [scheme, ...rest] = authorization.split(" ");
-  if (scheme?.toLowerCase() !== "bearer") {
-    return false;
-  }
-  return constantTimeEqual(expected, rest.join(" ").trim());
-};
-const checkAdminWsToken = async (request, expected, requireEphemeral) => {
-  if (!expected || expected.length === 0) {
-    return false;
-  }
-  const supplied = new URL(request.url).searchParams.get("token");
-  if (supplied === null) {
-    return false;
-  }
-  if (await verifyWsAdminToken(expected, supplied)) {
-    return true;
-  }
-  if (requireEphemeral) {
-    return false;
-  }
-  return constantTimeEqual(expected, supplied);
-};
-const detectBindingProbe = (key, value) => {
-  if (value === null || typeof value !== "object" && typeof value !== "function") {
-    return void 0;
-  }
-  const shape = value;
-  if (typeof shape["prepare"] === "function" && typeof shape["batch"] === "function" && typeof shape["dump"] === "function") {
-    return d1Probe(`d1:${key}`, value);
-  }
-  if (typeof shape["list"] === "function" && typeof shape["head"] === "function" && typeof shape["createMultipartUpload"] === "function") {
-    return presenceProbe(`r2:${key}`, true);
-  }
-  if (typeof shape["send"] === "function" && typeof shape["sendBatch"] === "function" && typeof shape["get"] !== "function") {
-    return presenceProbe(`queue:${key}`, true);
-  }
-  if (typeof shape["connectionString"] === "string") {
-    return presenceProbe(`hyperdrive:${key}`, true);
-  }
-  return void 0;
-};
-const createWorker = (options) => {
-  const isTrustedUpstream = resolveTraceTrust(options.trustInboundTraceContext);
-  const noticeDroppedTrace = createDroppedTraceNotice(options.trustInboundTraceContext);
-  const defaultShard = options.defaultShardKey ?? "__root__";
-  const publicResolveIdentity = wrapResolverWithContract(options.resolveIdentity, options.identity);
-  const shardDO = applyJurisdiction(options.shardDO, options.jurisdiction);
-  const schedulerDO = options.schedulerDO === void 0 ? void 0 : applyJurisdiction(options.schedulerDO, options.jurisdiction);
-  let envAdminToken;
-  const effectiveAdminToken = () => options.adminToken ?? envAdminToken;
-  let envRequireEphemeralWsToken;
-  const effectiveRequireEphemeralWsToken = () => options.requireEphemeralWsToken ?? envRequireEphemeralWsToken ?? false;
-  const resolveAdminTokenFromEnv = (env) => {
-    const record = env ?? {};
-    if (envRequireEphemeralWsToken === void 0 && options.requireEphemeralWsToken === void 0) {
-      const raw = record["LUNORA_REQUIRE_EPHEMERAL_WS_TOKEN"];
-      if (typeof raw === "string" && raw.length > 0) {
-        envRequireEphemeralWsToken = REQUIRE_EPHEMERAL_ENV_VALUES.has(raw.trim().toLowerCase());
-      }
-    }
-    if (envAdminToken !== void 0 || options.adminToken !== void 0) {
-      return;
-    }
-    const value = record["LUNORA_ADMIN_TOKEN"];
-    if (typeof value === "string" && value.length > 0) {
-      envAdminToken = value;
-    }
-  };
-  const accessAdminGrants = /* @__PURE__ */ new WeakSet();
-  const requestIsAdmin = (request) => checkAdminAuth(request, effectiveAdminToken()) || accessAdminGrants.has(request);
-  const resolveAdminForwardContext = async (request, env) => {
-    const context = await resolveForwardContext(request, env, options.resolveIdentity);
-    if (accessAdminGrants.has(request) && context.headers["authorization"] === void 0) {
-      const token = effectiveAdminToken();
-      if (token !== void 0) {
-        context.headers["authorization"] = `Bearer ${token}`;
-      }
-    }
-    return context;
-  };
-  let warnedUnauthenticatedShardAccess = false;
-  const guardUnauthenticatedShardAccess = (kind) => {
-    if (!options.allowUnauthenticatedShardAccess) {
-      const callback = kind === "fan-out" ? "authorizeFanOut" : "authorizeShard";
-      throw new LunoraError(
-        `${kind} access is default-denied: configure \`${callback}\` on the worker, or set \`allowUnauthenticatedShardAccess: true\` to explicitly allow unauthenticated ${kind} access (relying solely on per-row RLS).`,
-        { code: kind === "fan-out" ? "FORBIDDEN_FANOUT" : "FORBIDDEN_SHARD", status: 403 }
-      );
-    }
-    if (warnedUnauthenticatedShardAccess) {
-      return;
-    }
-    warnedUnauthenticatedShardAccess = true;
-    console.warn(
-      [
-        `[lunora] SECURITY: serving ${kind} access with \`allowUnauthenticatedShardAccess: true\` and no \`authorizeShard\`/\`authorizeFanOut\` — `,
-        `any caller (including unauthenticated ones) can target any shard / fan out across the table. `,
-        `This is safe only if every table is protected by per-row RLS. Configure \`authorizeShard\`/\`authorizeFanOut\` to gate it.`
-      ].join("")
-    );
-  };
-  const orchestrationAdminRoutes = buildOrchestrationAdminRoutes({
-    defaultShard,
-    forwardToShard,
-    isAdmin: requestIsAdmin,
-    queryCoordinator: options.queryCoordinator,
-    resolveForwardContext: resolveAdminForwardContext,
-    shardDO
-  });
-  const dispatchToShard = async (functionPath, args, shardKey, mutationId, forwardedIdentity) => {
-    if (options.authorizeShard) {
-      const allowed = await options.authorizeShard(null, shardKey);
-      if (!allowed) {
-        throw new LunoraError("Forbidden shard", { code: "FORBIDDEN_SHARD", status: 403 });
-      }
-    }
-    const headers = { "content-type": "application/json", "x-lunora-system": "1" };
-    if (forwardedIdentity?.userId !== void 0 && forwardedIdentity.userId.length > 0) {
-      headers["x-lunora-userid"] = forwardedIdentity.userId;
-    }
-    if (forwardedIdentity?.identity !== void 0 && forwardedIdentity.identity.length > 0) {
-      headers["x-lunora-identity"] = forwardedIdentity.identity;
-    }
-    if (mutationId !== void 0 && mutationId.length > 0) {
-      headers["x-lunora-mutation-id"] = mutationId;
-    }
-    const forwarded = new Request("https://shard.internal/rpc", {
-      body: JSON.stringify({ args, functionPath }),
-      headers,
-      method: "POST"
-    });
-    return forwardToShard(shardDO, shardKey, forwarded);
-  };
-  const startWorkflowInstance = async (binding, args, env, label) => {
-    const candidate = env?.[binding];
-    if (!candidate || typeof candidate.create !== "function") {
-      throw new LunoraError(`${label} targets workflow binding "${binding}", which is not bound on env`, {
-        code: "CRON_JOB_FAILED",
-        status: 500
-      });
-    }
-    await candidate.create({ params: args });
-  };
-  const startCronWorkflow = async (binding, job, env) => startWorkflowInstance(binding, job.args ?? {}, env, `cron job "${job.name}"`);
-  const runOneCronJob = async (job, env) => {
-    if (job.workflow) {
-      await startCronWorkflow(job.workflow, job, env);
-      return;
-    }
-    if (job.functionPath === void 0) {
-      throw new LunoraError(`cron job "${job.name}" has neither a function target nor a workflow target`, {
-        code: "CRON_JOB_FAILED",
-        status: 500
-      });
-    }
-    const response = await dispatchToShard(job.functionPath, job.args ?? {}, job.shardKey ?? defaultShard);
-    if (!response.ok) {
-      throw new LunoraError(`cron job "${job.name}" (${job.functionPath}) failed with shard status ${String(response.status)}`, {
-        code: "CRON_JOB_FAILED",
-        status: 500
-      });
-    }
-  };
-  const runCronJobs = async (cron, env, errors, toError) => {
-    const cronJobs = options.cronJobs?.[cron];
-    if (!cronJobs) {
-      return;
-    }
-    for (const job of cronJobs) {
-      try {
-        await runOneCronJob(job, env);
-      } catch (error) {
-        errors.push(toError(error));
-      }
-    }
-  };
-  const handleRunCronJob = async (request, env) => {
-    if (!requestIsAdmin(request)) {
-      throw new LunoraError("admin endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
-    }
-    if (request.method !== "POST") {
-      throw new LunoraError("cron-jobs run endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    if (!options.cronJobs) {
-      throw new LunoraError("cron-jobs run endpoint requires a `cronJobs` map on the worker", { code: "CRON_JOBS_NOT_CONFIGURED", status: 400 });
-    }
-    const body = await readJsonBodyWithLimit(request);
-    const name = typeof body.name === "string" ? body.name : "";
-    if (name === "") {
-      throw new LunoraError("cron-jobs run endpoint requires a job `name`", { code: "BAD_REQUEST", status: 400 });
-    }
-    const job = Object.values(options.cronJobs).flat().find((candidate) => candidate.name === name);
-    if (!job) {
-      throw new LunoraError(`no cron job named "${name}" is registered`, { code: "CRON_JOB_NOT_FOUND", status: 404 });
-    }
-    await runOneCronJob(job, env);
-    return Response.json({ name, ran: true }, { status: 200 });
-  };
-  const releasePoolSlot = async (candidate) => {
-    const pool = typeof candidate.pool === "string" && candidate.pool.length > 0 ? candidate.pool : void 0;
-    if (!pool || !schedulerDO || typeof candidate.id !== "string") {
-      return;
-    }
-    const instanceName = typeof candidate.instanceName === "string" && candidate.instanceName.length > 0 ? candidate.instanceName : "default";
-    try {
-      await schedulerDO.get(schedulerDO.idFromName(instanceName)).fetch(
-        new Request("https://scheduler.internal/complete", {
-          body: JSON.stringify({ id: candidate.id, pool }),
-          headers: { "content-type": "application/json" },
-          method: "POST"
-        })
-      );
-    } catch {
-    }
-  };
-  const handleSchedulerDispatch = async (request, env) => {
-    if (request.method !== "POST") {
-      throw new LunoraError("Scheduler dispatch endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    const rawBody = await readBodyTextWithLimit(request);
-    const envRecord = env ?? {};
-    const schedulerSecret = typeof envRecord["LUNORA_SCHEDULER_SECRET"] === "string" ? envRecord["LUNORA_SCHEDULER_SECRET"] : void 0;
-    const adminBearer = options.adminToken ?? (typeof envRecord["LUNORA_ADMIN_TOKEN"] === "string" ? envRecord["LUNORA_ADMIN_TOKEN"] : void 0);
-    const signatureHeader = request.headers.get("x-lunora-scheduler-signature");
-    let authenticated = false;
-    if (signatureHeader && schedulerSecret) {
-      authenticated = await verifyHmacSignature(schedulerSecret, rawBody, signatureHeader);
-    } else if (adminBearer) {
-      authenticated = checkAdminAuth(request, adminBearer);
-    }
-    if (!authenticated) {
-      throw new LunoraError("Scheduler dispatch requires a valid signature or admin bearer", { code: "FORBIDDEN", status: 403 });
-    }
-    let body;
-    try {
-      body = JSON.parse(rawBody);
-    } catch {
-      throw new LunoraError("Scheduler dispatch body must be valid JSON", { code: "BAD_REQUEST", status: 400 });
-    }
-    const candidate = body ?? {};
-    const args = candidate.args ?? {};
-    if (typeof candidate.workflow === "string" && candidate.workflow.length > 0) {
-      await startWorkflowInstance(candidate.workflow, args, env, "scheduled workflow");
-      return Response.json({ ok: true }, { status: 200 });
-    }
-    if (typeof candidate.functionPath !== "string" || candidate.functionPath.length === 0) {
-      throw new LunoraError("Scheduler dispatch is missing `functionPath`", { code: "BAD_REQUEST", status: 400 });
-    }
-    const shardKey = typeof candidate.shardKey === "string" && candidate.shardKey.length > 0 ? candidate.shardKey : defaultShard;
-    const mutationId = typeof candidate.id === "string" && candidate.id.length > 0 ? candidate.id : void 0;
-    const identity = readForwardedIdentity(request);
-    const response = await dispatchToShard(candidate.functionPath, args, shardKey, mutationId, identity);
-    await releasePoolSlot(candidate);
-    return response;
-  };
-  const assertAdminAuthorized = (request) => {
-    if (!requestIsAdmin(request)) {
-      throw new LunoraError("admin endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
-    }
-  };
-  const requireAdminOption = (request, value, notConfigured) => {
-    assertAdminAuthorized(request);
-    if (value === void 0) {
-      throw new LunoraError(notConfigured.message, { code: notConfigured.code, status: 400 });
-    }
-    return value;
-  };
-  const getAuthAuditLog = buildGetAuthAuditLog({
-    assertAdmin: assertAdminAuthorized,
-    getReader: () => options.authAuditReader
-  });
-  const listPushSubscriptions = async (request, args) => {
-    assertAdminAuthorized(request);
-    const store = options.notifySubscriptionStore;
-    if (store === void 0) {
-      return Response.json({ subscriptions: [] }, { headers: { "content-type": "application/json" }, status: 200 });
-    }
-    const rawKind = args?.["kind"];
-    const rawUserId = args?.["userId"];
-    const kindFilter = typeof rawKind === "string" && rawKind !== "" ? rawKind : void 0;
-    const userIdFilter = typeof rawUserId === "string" && rawUserId !== "" ? rawUserId : void 0;
-    const stored = await store.list();
-    const subscriptions = stored.filter((device) => (kindFilter === void 0 || device.kind === kindFilter) && (userIdFilter === void 0 || device.userId === userIdFilter)).map(({ keys: _keys, token: _token, ...device }) => device);
-    return Response.json({ subscriptions }, { headers: { "content-type": "application/json" }, status: 200 });
-  };
-  const serveReservedWorkerRpc = async (request, envelope) => {
-    if (envelope.fanOut) {
-      return void 0;
-    }
-    if (envelope.functionPath === GET_AUTH_AUDIT_LOG_OP) {
-      return getAuthAuditLog(request, envelope.args ?? {});
-    }
-    if (envelope.functionPath === LIST_PUSH_SUBSCRIPTIONS_OP) {
-      return listPushSubscriptions(request, envelope.args);
-    }
-    return void 0;
-  };
-  const dataMovementAdminRoutes = buildDataMovementAdminRoutes({
-    applyGlobals: options.applyGlobals,
-    exportCursorStore: options.exportCursorStore,
-    exportSinks: options.exportSinks,
-    knownTables: () => collectKnownTables(),
-    queryCoordinator: options.queryCoordinator,
-    requireAdminOption,
-    resolveForwardContext: resolveAdminForwardContext,
-    shardDO,
-    streamExportRows: (coordinator, headers, tables, writeRow) => streamExportRows(options, coordinator, headers, tables, writeRow, shardDO),
-    streamingImport: (request, headers) => streamingImport(request, options, headers, shardDO),
-    syncGlobals: options.syncGlobals
-  });
-  const queryParameter = (url, name) => {
-    const value = url.searchParams.get(name);
-    return value === null || value === "" ? void 0 : value;
-  };
-  const parsePaging = (request) => {
-    const url = new URL(request.url);
-    const limitParameter = url.searchParams.get("limit");
-    const offsetParameter = url.searchParams.get("offset");
-    const limit = limitParameter === null ? void 0 : Number.parseInt(limitParameter, 10);
-    const offset = offsetParameter === null ? void 0 : Number.parseInt(offsetParameter, 10);
-    return {
-      limit: limit !== void 0 && Number.isFinite(limit) && limit >= 0 ? limit : void 0,
-      offset: offset !== void 0 && Number.isFinite(offset) && offset >= 0 ? offset : void 0
-    };
-  };
-  const requireSchedulerNamespace = () => {
-    if (schedulerDO === void 0) {
-      throw new LunoraError("scheduled endpoints require a `schedulerDO` namespace on the worker", { code: "SCHEDULER_NOT_CONFIGURED", status: 400 });
-    }
-    return schedulerDO;
-  };
-  const resolveSchedulerStub = (request) => {
-    assertAdminAuthorized(request);
-    return resolveShard(requireSchedulerNamespace(), options.schedulerInstanceName ?? "default");
-  };
-  const scheduledAdminRoutes = buildScheduledAdminRoutes({
-    checkWsAdmin: async (request) => requestIsAdmin(request) || checkAdminWsToken(request, effectiveAdminToken(), effectiveRequireEphemeralWsToken()),
-    requireSchedulerNamespace,
-    resolveSchedulerStub,
-    schedulerInstanceName: options.schedulerInstanceName ?? "default"
-  });
-  const workflowsAdminRoutes = buildWorkflowsAdminRoutes({
-    assertAdmin: assertAdminAuthorized,
-    resolveWorkflowsClient: options.workflowsClient ?? (() => void 0)
-  });
-  const storageAdminRoutes = buildStorageAdminRoutes({
-    assertAdmin: assertAdminAuthorized,
-    parsePaging,
-    queryParameter,
-    readBodyBytes: readBodyBytesWithLimit,
-    requireAdminOption,
-    storage: {
-      storageBuckets: options.storageBuckets,
-      storageDelete: options.storageDelete,
-      storageList: options.storageList,
-      storageSignedUrl: options.storageSignedUrl,
-      storageUpload: options.storageUpload
-    }
-  });
-  const vectorAdminRoutes = buildVectorAdminRoutes({
-    readJsonBody: readJsonBodyWithLimit,
-    requireAdminOption,
-    vectorIntrospector: options.vectorIntrospector
-  });
-  const kvAdminRoutes = buildKvAdminRoutes({
-    kvIntrospector: options.kvIntrospector,
-    readJsonBody: readJsonBodyWithLimit,
-    requireAdminOption
-  });
-  const logArchiveAdminRoutes = buildLogArchiveAdminRoutes({
-    logArchive: options.logArchive,
-    readJsonBody: readJsonBodyWithLimit,
-    requireAdminOption
-  });
-  const introspectionAdminRoutes = buildIntrospectionAdminRoutes({
-    assertAdmin: assertAdminAuthorized,
-    options: {
-      cronJobs: options.cronJobs,
-      functions: options.functions,
-      globalIntrospector: options.globalIntrospector,
-      openApiSpec: options.openApiSpec,
-      openRpcSpec: options.openRpcSpec
-    },
-    parsePaging,
-    queryParameter,
-    requireAdminOption
-  });
-  const resolveHealthProbes = (env) => {
-    const probes = [];
-    const namespace = shardDO ?? env?.SHARD;
-    if (namespace !== void 0) {
-      probes.push(durableObjectProbe("durable-object", namespace, defaultShard));
-    }
-    if (options.health?.disableBindingProbes !== true) {
-      for (const [key, value] of Object.entries(env ?? {})) {
-        const probe = detectBindingProbe(key, value);
-        if (probe !== void 0) {
-          probes.push(probe);
-        }
-      }
-    }
-    for (const probe of options.health?.probes ?? []) {
-      probes.push(probe);
-    }
-    return probes;
-  };
-  const healthRoutes = buildHealthRoutes({
-    appName: options.health?.appName,
-    appVersion: options.health?.appVersion,
-    auth: options.health?.auth ?? "public",
-    isAdmin: requestIsAdmin,
-    resolveProbes: resolveHealthProbes
-  });
-  const buildHttpActionContext = async (request, env, context) => {
-    const { claims, headers, userId } = await resolveForwardContext(request, env, publicResolveIdentity);
-    const run = async (reference, args = {}) => {
-      const functionPath = reference.__lunoraRef;
-      if (typeof functionPath !== "string") {
-        throw new LunoraError("ctx.run*: expected a function reference from the generated `api`", { code: "BAD_REQUEST", status: 400 });
-      }
-      const forwarded = new Request("https://shard.internal/rpc", {
-        body: JSON.stringify({ args, functionPath }),
-        headers,
-        method: "POST"
-      });
-      const response = await forwardToShard(shardDO, defaultShard, forwarded);
-      const payload = await response.json();
-      if (payload.error) {
-        throw new LunoraError(payload.error.message ?? "shard RPC failed", {
-          code: payload.error.code ?? "INTERNAL",
-          status: response.status
-        });
-      }
-      return payload.result;
-    };
-    return {
-      auth: {
-        getIdentity: () => Promise.resolve(claims),
-        userId
-      },
-      cache: context.cache,
-      fetch: globalThis.fetch.bind(globalThis),
-      runAction: run,
-      runMutation: run,
-      runQuery: run
-    };
-  };
-  const dispatchHttpRoute = async (request, env, context) => {
-    if (!options.httpRouter) {
-      return void 0;
-    }
-    const httpContext = await buildHttpActionContext(request, env, context);
-    try {
-      return await options.httpRouter.fetch(request, { ...env, __lunoraCtx: httpContext }, context);
-    } catch (error) {
-      console.error("[lunora] httpRouter (SSR) handler threw:", error);
-      return new Response("Internal Server Error", { status: 500 });
-    }
-  };
-  const handleWebSocketUpgrade = async (request, env, url) => {
-    if (request.headers.get("Upgrade") !== "websocket") {
-      throw new LunoraError("WebSocket upgrade header missing", { code: "BAD_REQUEST", status: 426 });
-    }
-    const blockedUpgrade = enforceWebSocketOrigin(request, resolvedSecurity);
-    if (blockedUpgrade) {
-      return blockedUpgrade;
-    }
-    const shardKey = url.searchParams.get("shard") ?? defaultShard;
-    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
-    if (options.authorizeShard) {
-      const allowed = await options.authorizeShard(identity, shardKey);
-      if (!allowed) {
-        throw new LunoraError("Forbidden shard", { code: "FORBIDDEN_SHARD", status: 403 });
-      }
-    } else if (shardKey !== defaultShard) {
-      guardUnauthenticatedShardAccess("shard");
-    }
-    const upgradeHeaders = new Headers(request.headers);
-    const clientHeaderNames = [...upgradeHeaders.keys()];
-    for (const name of clientHeaderNames) {
-      if (name.startsWith("x-lunora-")) {
-        upgradeHeaders.delete(name);
-      }
-    }
-    const forwardedUserId = forwardedHeaders["x-lunora-userid"];
-    const forwardedIdentity = forwardedHeaders["x-lunora-identity"];
-    const forwardedExp = forwardedHeaders["x-lunora-identity-exp"];
-    if (forwardedUserId !== void 0) {
-      upgradeHeaders.set("x-lunora-userid", forwardedUserId);
-    }
-    if (forwardedIdentity !== void 0) {
-      upgradeHeaders.set("x-lunora-identity", forwardedIdentity);
-    }
-    if (forwardedExp !== void 0) {
-      upgradeHeaders.set("x-lunora-identity-exp", forwardedExp);
-    }
-    const binding = resolveShardBindingName(env, options.shardDO);
-    if (binding !== void 0) {
-      upgradeHeaders.set("x-lunora-shard-binding", binding);
-      const relayCount = await probeRelayCount(shardDO, shardKey);
-      if (relayCount > 0) {
-        const target = relayName(shardKey, Math.floor(Math.random() * relayCount));
-        return forwardToShard(shardDO, target, new Request(request, { headers: upgradeHeaders }));
-      }
-    }
-    return forwardToShard(shardDO, shardKey, new Request(request, { headers: upgradeHeaders }));
-  };
-  const handleVoiceUpgrade = async (request, env, url) => {
-    const { voiceAgents } = options;
-    if (voiceAgents === void 0) {
-      return new Response("Not found", { status: 404 });
-    }
-    if (request.headers.get("Upgrade") !== "websocket") {
-      return new Response("Expected a WebSocket upgrade", { headers: { allow: "GET" }, status: 426 });
-    }
-    const blockedUpgrade = enforceWebSocketOrigin(request, resolvedSecurity);
-    if (blockedUpgrade) {
-      return blockedUpgrade;
-    }
-    let agentName;
-    try {
-      agentName = decodeURIComponent(url.pathname.slice(VOICE_PATH_PREFIX.length));
-    } catch {
-      return new Response("Unknown voice agent", { status: 404 });
-    }
-    const namespace = Object.hasOwn(voiceAgents, agentName) ? voiceAgents[agentName] : void 0;
-    if (namespace === void 0) {
-      return new Response("Unknown voice agent", { status: 404 });
-    }
-    const threadKey = url.searchParams.get("threadKey");
-    if (threadKey === null || threadKey.length === 0) {
-      return new Response("Missing threadKey", { status: 400 });
-    }
-    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
-    if (options.authorizeShard) {
-      const allowed = await options.authorizeShard(identity, threadKey);
-      if (!allowed) {
-        return new Response("Forbidden", { status: 403 });
-      }
-    } else {
-      guardUnauthenticatedShardAccess("shard");
-    }
-    const upgradeHeaders = new Headers(request.headers);
-    upgradeHeaders.delete("x-lunora-userid");
-    upgradeHeaders.delete("x-lunora-identity");
-    upgradeHeaders.delete("x-lunora-identity-exp");
-    const forwardedUserId = forwardedHeaders["x-lunora-userid"];
-    const forwardedIdentity = forwardedHeaders["x-lunora-identity"];
-    const forwardedExp = forwardedHeaders["x-lunora-identity-exp"];
-    if (forwardedUserId !== void 0) {
-      upgradeHeaders.set("x-lunora-userid", forwardedUserId);
-    }
-    if (forwardedIdentity !== void 0) {
-      upgradeHeaders.set("x-lunora-identity", forwardedIdentity);
-    }
-    if (forwardedExp !== void 0) {
-      upgradeHeaders.set("x-lunora-identity-exp", forwardedExp);
-    }
-    return forwardToShard(namespace, threadKey, new Request(request, { headers: upgradeHeaders }));
-  };
-  const authorizeFanOutEnvelope = async (fanOut, functionPath, identity) => {
-    if (options.authorizeFanOut) {
-      const allowed = await options.authorizeFanOut(identity, fanOut.table, functionPath);
-      if (!allowed) {
-        throw new LunoraError("Forbidden fan-out", { code: "FORBIDDEN_FANOUT", status: 403 });
-      }
-      return;
-    }
-    if (functionPath.startsWith("__lunora_relation__:")) {
-      throw new LunoraError("reverse cross-backend relation reads (`__lunora_relation__:*`) require `authorizeFanOut` to be configured on the worker", {
-        code: "FORBIDDEN_FANOUT",
-        status: 403
-      });
-    }
-    if (options.authorizeShard) {
-      throw new LunoraError("Fan-out requires `authorizeFanOut` to be configured on the worker when `authorizeShard` is set", {
-        code: "FORBIDDEN_FANOUT",
-        status: 403
-      });
-    }
-    guardUnauthenticatedShardAccess("fan-out");
-  };
-  const authorizeRpcEnvelope = async (envelope, identity) => {
-    if (!envelope.fanOut && envelope.functionPath.startsWith("__lunora_admin__:")) {
-      return;
-    }
-    if (envelope.fanOut) {
-      await authorizeFanOutEnvelope(envelope.fanOut, envelope.functionPath, identity);
-      return;
-    }
-    if (options.authorizeShard) {
-      const shardKeyForAuth = envelope.shardKey ?? defaultShard;
-      const allowed = await options.authorizeShard(identity, shardKeyForAuth);
-      if (!allowed) {
-        throw new LunoraError("Forbidden shard", { code: "FORBIDDEN_SHARD", status: 403 });
-      }
-    } else if (envelope.shardKey !== void 0 && envelope.shardKey !== defaultShard) {
-      guardUnauthenticatedShardAccess("shard");
-    }
-  };
-  const dispatchSingleShard = async (request, functionPath, args, shardKey, forwardedHeaders, sinkContext) => {
-    const rpcStartedAt = Date.now();
-    const { observability, sampling } = options;
-    const requestMeta = requestTelemetryMeta(request);
-    const { decision, ignoredUpstream, trace } = beginDispatchTrace(request, {
-      ...sampling === void 0 ? {} : { sampling },
-      trustInbound: isTrustedUpstream(request)
-    });
-    if (ignoredUpstream) {
-      noticeDroppedTrace();
-    }
-    const outgoingHeaders = {
-      ...forwardedHeaders,
-      "x-lunora-sample-errors": decision.keepErrors ? "1" : "0"
-    };
-    injectTraceContext(trace, outgoingHeaders);
-    const forwarded = new Request(`https://shard.internal/rpc`, {
-      body: JSON.stringify({ args, functionPath }),
-      headers: outgoingHeaders,
-      method: "POST"
-    });
-    try {
-      const response = await forwardToShard(shardDO, shardKey, forwarded);
-      emitRpcEvent(
-        observability,
-        {
-          ...requestMeta,
-          ...traceEventFields(trace),
-          durationMs: Date.now() - rpcStartedAt,
-          functionPath,
-          ok: response.ok,
-          shardKey,
-          ...response.ok ? {} : { error: { code: "SHARD_ERROR", message: `shard returned ${String(response.status)}`, status: response.status } }
-        },
-        sinkContext,
-        sampling
-      );
-      return response;
-    } catch (error) {
-      emitRpcEvent(
-        observability,
-        {
-          ...requestMeta,
-          ...traceEventFields(trace),
-          ...buildErrorEvent(functionPath, Date.now() - rpcStartedAt, error, { shardKey })
-        },
-        sinkContext,
-        sampling
-      );
-      throw error;
-    }
-  };
-  const assertDispatchableEnvelope = (envelope) => {
-    if (envelope.fanOut && envelope.shardKey) {
-      throw new LunoraError("RPC envelope cannot set both `shardKey` and `fanOut`", { code: "BAD_REQUEST", status: 400 });
-    }
-    if (!envelope.fanOut && envelope.functionPath.startsWith("__lunora_relation__:")) {
-      throw new LunoraError("`__lunora_relation__:*` is a fan-out-only reserved RPC and cannot be dispatched to a single shard", {
-        code: "FORBIDDEN",
-        status: 403
-      });
-    }
-    if (envelope.fanOut && !options.queryCoordinator) {
-      throw new LunoraError("RPC envelope set `fanOut` but no `queryCoordinator` is configured on the worker", {
-        code: "BAD_REQUEST",
-        status: 400
-      });
-    }
-  };
-  const handleRpc = async (request, env, context) => {
-    if (request.method !== "POST") {
-      throw new LunoraError("RPC endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    const envelope = await parseEnvelope(request);
-    logRpcDebug(env, envelope);
-    assertDispatchableEnvelope(envelope);
-    const reservedResponse = await serveReservedWorkerRpc(request, envelope);
-    if (reservedResponse !== void 0) {
-      return reservedResponse;
-    }
-    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
-    await authorizeRpcEnvelope(envelope, identity);
-    const x402Tag = resolveX402Charge(envelope, options);
-    {
-      const rpcStartedAt = Date.now();
-      const { observability } = options;
-      const requestMeta = requestTelemetryMeta(request);
-      const sinkContext = buildSinkContext(env, request, context && ((promise) => context.waitUntil?.(promise)));
-      if (envelope.fanOut) {
-        const coordinator = options.queryCoordinator;
-        if (!coordinator) {
-          throw new LunoraError("RPC envelope set `fanOut` but no `queryCoordinator` is configured on the worker", {
-            code: "BAD_REQUEST",
-            status: 400
-          });
-        }
-        try {
-          const result = await coordinator.fanOut(shardDO, {
-            args: envelope.args ?? {},
-            fanOut: envelope.fanOut,
-            functionPath: envelope.functionPath,
-            headers: forwardedHeaders
-          });
-          emitRpcEvent(
-            observability,
-            {
-              durationMs: Date.now() - rpcStartedAt,
-              fanOut: {
-                failed: result.failed,
-                shards: result.ok + result.failed,
-                table: envelope.fanOut.table
-              },
-              functionPath: envelope.functionPath,
-              ...requestMeta,
-              ok: true
-            },
-            sinkContext
-          );
-          return Response.json(result, {
-            headers: { "content-type": "application/json" },
-            status: 200
-          });
-        } catch (error) {
-          emitRpcEvent(
-            observability,
-            {
-              ...buildErrorEvent(envelope.functionPath, Date.now() - rpcStartedAt, error, { fanOut: { table: envelope.fanOut.table } }),
-              ...requestMeta
-            },
-            sinkContext
-          );
-          throw error;
-        }
-      }
-      const shardKey = envelope.shardKey ?? defaultShard;
-      const dispatch = () => dispatchSingleShard(request, envelope.functionPath, envelope.args ?? {}, shardKey, forwardedHeaders, sinkContext);
-      if (x402Tag && options.x402Charge) {
-        return options.x402Charge(request, { functionPath: envelope.functionPath, price: x402Tag.price }, dispatch);
-      }
-      return dispatch();
-    }
-  };
-  const handleBatchRpc = async (request, env, context) => {
-    if (request.method !== "POST") {
-      throw new LunoraError("RPC batch endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    const text = await readBodyTextWithLimit(request);
-    let body;
-    try {
-      body = JSON.parse(text);
-    } catch {
-      throw new LunoraError("RPC batch body must be valid JSON", { code: "BAD_REQUEST", status: 400 });
-    }
-    if (typeof body !== "object" || body === null || Array.isArray(body)) {
-      throw new LunoraError("RPC batch body must be an object", { code: "BAD_REQUEST", status: 400 });
-    }
-    const { calls } = body;
-    if (!Array.isArray(calls)) {
-      throw new LunoraError("RPC batch `calls` must be an array", { code: "BAD_REQUEST", status: 400 });
-    }
-    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
-    const groups = groupBatchCallsByShard(calls, defaultShard);
-    for (const entries of groups.values()) {
-      for (const entry of entries) {
-        if (options.functions?.[entry.functionPath]?.x402) {
-          throw new LunoraError(
-            `paid (\`.x402\`) function "${entry.functionPath}" cannot be called in a batch; dispatch it individually over ${RPC_PATH}`,
-            {
-              code: "BAD_REQUEST",
-              status: 400
-            }
-          );
-        }
-      }
-    }
-    await Promise.all(
-      [...groups.entries()].flatMap(
-        ([shardKey, entries]) => entries.map((entry) => authorizeRpcEnvelope({ functionPath: entry.functionPath, shardKey }, identity))
-      )
-    );
-    const { observability } = options;
-    const sinkContext = buildSinkContext(env, request, context && ((promise) => context.waitUntil?.(promise)));
-    const requestMeta = requestTelemetryMeta(request);
-    const results = [];
-    const bookmarks = [];
-    const slotError = (entry, status, code, message) => {
-      return { body: { error: { code, message } }, id: entry.id, status };
-    };
-    const failSubBatch = (entries, status, code, message, eventFor) => {
-      for (const entry of entries) {
-        emitRpcEvent(observability, eventFor(entry), sinkContext);
-        results.push(slotError(entry, status, code, message));
-      }
-    };
-    const emitEntryEvents = (entries, shardKey, durationMs, statusById, fallbackStatus) => {
-      for (const entry of entries) {
-        const status = statusById.get(entry.id) ?? fallbackStatus;
-        const ok = status < 400;
-        emitRpcEvent(
-          observability,
-          {
-            durationMs,
-            functionPath: entry.functionPath,
-            ...requestMeta,
-            ok,
-            shardKey,
-            ...ok ? {} : { error: { code: "SHARD_ERROR", message: `batched call returned ${String(status)}`, status } }
-          },
-          sinkContext
-        );
-      }
-    };
-    await Promise.all(
-      [...groups.entries()].map(async ([shardKey, entries]) => {
-        const headers = new Headers(forwardedHeaders);
-        headers.set("content-type", "application/json");
-        const subRequest = new Request("https://shard.internal/rpc-batch", { body: JSON.stringify({ calls: entries }), headers, method: "POST" });
-        const subStartedAt = Date.now();
-        let response;
-        try {
-          response = await forwardToShard(shardDO, shardKey, subRequest);
-        } catch (error) {
-          const durationMs2 = Date.now() - subStartedAt;
-          const { body: errorBody } = toErrorBody(error, { fallbackCode: "SHARD_UNAVAILABLE", redactedMessage: "shard unavailable" });
-          failSubBatch(entries, 502, errorBody.code, errorBody.message, (entry) => {
-            return {
-              ...buildErrorEvent(entry.functionPath, durationMs2, error, { shardKey }),
-              ...requestMeta
-            };
-          });
-          return;
-        }
-        const durationMs = Date.now() - subStartedAt;
-        const bookmark = response.headers.get("x-d1-bookmark");
-        if (bookmark) {
-          bookmarks.push(bookmark);
-        }
-        let parsed;
-        try {
-          parsed = await response.json();
-        } catch {
-          const message = `shard batch returned a non-JSON response (${String(response.status)})`;
-          failSubBatch(entries, response.status, "SHARD_ERROR", message, (entry) => {
-            return {
-              durationMs,
-              error: { code: "SHARD_ERROR", message, status: response.status },
-              functionPath: entry.functionPath,
-              ...requestMeta,
-              ok: false,
-              shardKey
-            };
-          });
-          return;
-        }
-        const entryResults = Array.isArray(parsed.results) ? parsed.results : [];
-        const statusById = new Map(entryResults.map((entry) => [entry.id, entry.status ?? response.status]));
-        const seenIds = new Set(entryResults.map((entry) => entry.id));
-        emitEntryEvents(entries, shardKey, durationMs, statusById, response.status);
-        results.push(...entryResults);
-        for (const entry of entries) {
-          if (!seenIds.has(entry.id)) {
-            results.push(slotError(entry, response.status, "SHARD_ERROR", `shard batch omitted result for call ${String(entry.id)}`));
-          }
-        }
-      })
-    );
-    const responseHeaders = { "content-type": "application/json" };
-    const [onlyBookmark] = bookmarks;
-    if (bookmarks.length === 1 && onlyBookmark !== void 0) {
-      responseHeaders["x-d1-bookmark"] = onlyBookmark;
-    }
-    return Response.json({ results }, { headers: responseHeaders, status: 200 });
-  };
-  const serverQuery = async (request, env, reference, args = {}, callOptions = {}) => {
-    try {
-      const functionPath = reference.__lunoraRef;
-      if (typeof functionPath !== "string") {
-        throw new LunoraError("serverQuery: expected a function reference from the generated `api`", { code: "BAD_REQUEST", status: 400 });
-      }
-      const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
-      await authorizeRpcEnvelope({ functionPath, shardKey: callOptions.shardKey }, identity);
-      const shardKey = callOptions.shardKey ?? defaultShard;
-      const serverSinkContext = buildSinkContext(env, request, callOptions.waitUntil);
-      return await dispatchSingleShard(request, functionPath, args, shardKey, forwardedHeaders, serverSinkContext);
-    } catch (error) {
-      return toErrorResponse(error);
-    }
-  };
-  const MAX_PRUNE_PAGES = 1e3;
-  const pruneBackups = async (store, prefix) => {
-    const retain = options.backupRetain;
-    if (retain === void 0 || retain <= 0) {
-      return;
-    }
-    const manifestKeys = [];
-    let cursor;
-    for (let page = 0; page < MAX_PRUNE_PAGES; page += 1) {
-      const listing = await store.list({ cursor, prefix });
-      for (const object of listing.objects) {
-        if (object.key.endsWith(".manifest.json")) {
-          manifestKeys.push(object.key);
-        }
-      }
-      if (!listing.truncated || listing.cursor === void 0) {
-        break;
-      }
-      cursor = listing.cursor;
-    }
-    const stale = manifestKeys.toSorted((a, b) => b.localeCompare(a)).slice(retain);
-    await Promise.all(
-      stale.flatMap((manifestKey) => {
-        const ndjsonKey = manifestKey.slice(0, -".manifest.json".length);
-        return [store.delete(manifestKey), store.delete(ndjsonKey)];
-      })
-    );
-  };
-  const runScheduledBackup = async (controller) => {
-    const store = options.backupStore;
-    const coordinator = options.queryCoordinator;
-    if (!store) {
-      throw new LunoraError("scheduled backup requires a `backupStore` on the worker", { code: "BACKUP_NOT_CONFIGURED", status: 500 });
-    }
-    if (!coordinator) {
-      throw new LunoraError("scheduled backup requires a `queryCoordinator` on the worker", { code: "BACKUP_NOT_CONFIGURED", status: 500 });
-    }
-    const adminToken = effectiveAdminToken();
-    if (!adminToken || adminToken.length === 0) {
-      throw new LunoraError("scheduled backup requires an `adminToken` (or `env.LUNORA_ADMIN_TOKEN`) to authenticate the per-shard export gate", {
-        code: "BACKUP_NOT_CONFIGURED",
-        status: 500
-      });
-    }
-    const forwardedHeaders = { authorization: `Bearer ${adminToken}`, "content-type": "application/json" };
-    const tables = options.backupTables;
-    let rows = 0;
-    let bytes = 0;
-    const parts = [];
-    const writeRow = (row) => {
-      const line = `${JSON.stringify(row)}
-`;
-      rows += 1;
-      bytes += NDJSON_ENCODER.encode(line).byteLength;
-      parts.push(line);
-    };
-    await streamExportRows(options, coordinator, forwardedHeaders, tables, writeRow, shardDO);
-    const prefix = options.backupPrefix ?? "backups/";
-    const timestamp = new Date(controller.scheduledTime).toISOString();
-    const fileKey = `${prefix}lunora-backup-${timestamp.replaceAll(/[.:]/gu, "-")}.ndjson`;
-    const manifestKey = `${fileKey}.manifest.json`;
-    await store.put(fileKey, new Blob(parts, { type: "application/x-ndjson" }), {
-      httpMetadata: { contentType: "application/x-ndjson" }
-    });
-    const manifest = {
-      bytes,
-      createdAt: timestamp,
-      cron: controller.cron,
-      file: fileKey,
-      id: timestamp,
-      rows,
-      scheduledTime: controller.scheduledTime,
-      ...tables ? { tables: tables.join(",") } : {}
-    };
-    await store.put(manifestKey, `${JSON.stringify(manifest, void 0, 2)}
-`, { httpMetadata: { contentType: "application/json" } });
-    await pruneBackups(store, prefix);
-  };
-  const handleScheduled = async (controller, env, context) => {
-    resolveAdminTokenFromEnv(env);
-    const errors = [];
-    const toError = (error) => error instanceof Error ? error : new Error(String(error));
-    const userHandler = options.crons?.[controller.cron];
-    if (userHandler) {
-      try {
-        await userHandler(controller, env, context);
-      } catch (error) {
-        errors.push(toError(error));
-      }
-    }
-    await runCronJobs(controller.cron, env, errors, toError);
-    if (options.backupStore && options.backupCron !== void 0 && options.backupCron === controller.cron) {
-      try {
-        await runScheduledBackup(controller);
-      } catch (error) {
-        errors.push(toError(error));
-      }
-    }
-    const [first] = errors;
-    if (errors.length === 1 && first) {
-      throw first;
-    }
-    if (errors.length > 1) {
-      throw new AggregateError(errors, `scheduled("${controller.cron}") had ${String(errors.length)} failure(s)`);
-    }
-  };
-  const recordAuthAttempt = async (env, outcome) => {
-    try {
-      const envRecord = env ?? {};
-      const adminBearer = options.adminToken ?? (typeof envRecord["LUNORA_ADMIN_TOKEN"] === "string" ? envRecord["LUNORA_ADMIN_TOKEN"] : void 0);
-      if (!adminBearer || adminBearer.length === 0) {
-        return;
-      }
-      const recordRequest = new Request("https://shard.internal/rpc", {
-        body: JSON.stringify({ args: { outcome }, functionPath: RECORD_AUTH_EVENT_OP }),
-        headers: { authorization: `Bearer ${adminBearer}`, "content-type": "application/json" },
-        method: "POST"
-      });
-      await forwardToShard(shardDO, defaultShard, recordRequest);
-    } catch {
-    }
-  };
-  const dispatchAuth = async (request, env, url, context) => {
-    if (!options.authHandler) {
-      return void 0;
-    }
-    const authResponse = await options.authHandler(request);
-    if (!authResponse) {
-      return void 0;
-    }
-    const basePath = options.authBasePath ?? DEFAULT_AUTH_BASE_PATH;
-    if (isAuthAttemptPath(url.pathname, basePath)) {
-      context.waitUntil?.(recordAuthAttempt(env, authResponse.status >= 400 ? "fail" : "ok"));
-    }
-    return authResponse;
-  };
-  const invokeExposed = async ({ args, env, functionPath, request, shardKey, waitUntil }) => {
-    const envelope = { functionPath, ...shardKey === void 0 ? {} : { shardKey } };
-    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
-    await authorizeRpcEnvelope(envelope, identity);
-    const resolvedShardKey = shardKey ?? defaultShard;
-    const restSinkContext = buildSinkContext(env, request, waitUntil);
-    const dispatch = () => dispatchSingleShard(request, functionPath, args, resolvedShardKey, forwardedHeaders, restSinkContext);
-    const x402Tag = resolveX402Charge(envelope, options);
-    if (x402Tag && options.x402Charge) {
-      return options.x402Charge(request, { functionPath, price: x402Tag.price }, dispatch);
-    }
-    return dispatch();
-  };
-  const restRoutes = buildRestRoutes({
-    functions: options.functions ?? {},
-    invoke: invokeExposed,
-    readJsonBody: readJsonBodyWithLimit,
-    ...options.restRateLimit ? { rateLimit: options.restRateLimit } : {}
-  });
-  const customRoutes = options.routes !== void 0 && Object.keys(options.routes).length > 0 ? options.routes : void 0;
-  const internalRoutes = {
-    [STATUS_PATH]: (request) => {
-      if (request.method !== "GET" && request.method !== "HEAD") {
-        return new Response(void 0, { headers: { allow: "GET, HEAD" }, status: 405 });
-      }
-      return Response.json({ ok: true }, { headers: { "cache-control": "no-store" } });
-    },
-    [WS_PATH]: (request, env, url) => handleWebSocketUpgrade(request, env, url),
-    [RPC_PATH]: (request, env, _url, context) => handleRpc(request, env, context),
-    [RPC_BATCH_PATH]: (request, env, _url, context) => handleBatchRpc(request, env, context),
-    [SCHEDULER_DISPATCH_PATH]: (request, env) => handleSchedulerDispatch(request, env),
-    [CRON_JOBS_RUN_PATH]: (request, env) => handleRunCronJob(request, env),
-    // Mint a short-lived HMAC-signed WS admin sub-token. Gated by the master
-    // admin bearer (header) / `adminGate`; the studio then sends the minted
-    // token — not the master credential — in the WS `?token=`
-    // query string. Signed with the master token itself, so both isolates
-    // verify statelessly and rotating `LUNORA_ADMIN_TOKEN` invalidates every
-    // outstanding sub-token. `no-store` keeps the token out of caches.
-    [ADMIN_WS_TOKEN_PATH]: async (request) => {
-      if (request.method !== "POST") {
-        throw new LunoraError("ws-token endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-      }
-      assertAdminAuthorized(request);
-      const signingSecret = effectiveAdminToken();
-      if (signingSecret === void 0) {
-        throw new LunoraError("ws-token minting requires a configured admin token", { code: "ADMIN_TOKEN_NOT_CONFIGURED", status: 400 });
-      }
-      const minted = await mintWsAdminToken(signingSecret);
-      return Response.json(minted, { headers: { "cache-control": "no-store" } });
-    },
-    // Extracted handler clusters built above, merged in (mirroring the auth
-    // plane below): orchestration (migrate / rank / rankpage / shard-traffic /
-    // pitr), data-movement (export / import / sync / connector-sync / apply),
-    // scheduled, storage, vector, and the static-introspection reads
-    // (functions / cron-jobs / openapi / openrpc / global tables).
-    ...orchestrationAdminRoutes,
-    ...dataMovementAdminRoutes,
-    ...scheduledAdminRoutes,
-    ...workflowsAdminRoutes,
-    ...storageAdminRoutes,
-    ...vectorAdminRoutes,
-    ...kvAdminRoutes,
-    ...logArchiveAdminRoutes,
-    ...introspectionAdminRoutes,
-    // `/_lunora/health` + `/_lunora/health/ready` — public (or admin-gated)
-    // liveness/readiness probes; not under the admin prefix, so `applyAdminGate`
-    // never runs on them (the handler self-gates when `auth: "admin"`).
-    ...healthRoutes,
-    // `/_lunora/rest/<namespace>/<fn>` — the opt-in public REST surface, one
-    // route per `.expose({ rest: true })` procedure (default-closed). Routes
-    // THROUGH the procedure, so auth/RLS/validators are enforced at the shard.
-    ...restRoutes,
-    // `/_lunora/admin/auth/*` — the whole user-management plane, one route per
-    // `AuthAdmin` op, dispatched by the descriptor table in `./auth-admin-routes`.
-    ...buildAuthAdminRoutes({
-      assertAdmin: assertAdminAuthorized,
-      getAuthAdmin: () => options.authAdmin,
-      parsePaging,
-      queryParameter,
-      readJsonBody: readJsonBodyWithLimit
-    })
-  };
-  let resolvedSecurity = resolveSecurity(options.security);
-  let securityEnvResolved = false;
-  const ensureSecurityResolved = (env) => {
-    if (!securityEnvResolved) {
-      securityEnvResolved = true;
-      resolvedSecurity = resolveSecurity(options.security, env ?? {});
-    }
-  };
-  const applyAdminGate = async (request, pathname) => {
-    if (options.adminGate === void 0 || !isAdminPath(pathname)) {
-      return;
-    }
-    try {
-      if (await options.adminGate(request)) {
-        accessAdminGrants.add(request);
-      }
-    } catch {
-    }
-  };
-  const handle = async (request, env, context) => {
-    const url = new URL(request.url);
-    if (request.method === "POST" || request.method === "PUT") {
-      const contentLength = Number(request.headers.get("content-length") ?? "");
-      const maxBodyBytes = url.pathname === KV_VALUE_PATH ? KV_VALUE_MAX_BODY_BYTES : MAX_BODY_BYTES;
-      if (Number.isFinite(contentLength) && contentLength > maxBodyBytes) {
-        throw new LunoraError("Body too large", { code: "PAYLOAD_TOO_LARGE", status: 413 });
-      }
-    }
-    const authResponse = await dispatchAuth(request, env, url, context);
-    if (authResponse) {
-      return authResponse;
-    }
-    if (customRoutes) {
-      const methodAndPath = `${request.method} ${url.pathname}`;
-      const route = customRoutes[methodAndPath] ?? customRoutes[url.pathname];
-      if (route) {
-        return route(request, env, context);
-      }
-    }
-    const internalRoute = internalRoutes[url.pathname];
-    if (internalRoute) {
-      await applyAdminGate(request, url.pathname);
-      return internalRoute(request, env, url, context);
-    }
-    if (options.voiceAgents !== void 0 && url.pathname.startsWith(VOICE_PATH_PREFIX)) {
-      return handleVoiceUpgrade(request, env, url);
-    }
-    const httpRouteResponse = await dispatchHttpRoute(request, env, context);
-    if (httpRouteResponse) {
-      return httpRouteResponse;
-    }
-    return new Response("Not found", { status: 404 });
-  };
-  return {
-    async fetch(request, env, context) {
-      if (options.passThroughOnException) {
-        context.passThroughOnException?.();
-      }
-      ensureSecurityResolved(env);
-      resolveAdminTokenFromEnv(env);
-      const preflight = handleCorsPreflight(request, resolvedSecurity);
-      if (preflight) {
-        return preflight;
-      }
-      const blocked = enforceOrigin(request, resolvedSecurity);
-      if (blocked) {
-        return decorateResponse(blocked, request, resolvedSecurity);
-      }
-      try {
-        const response = await handle(request, env, context);
-        return decorateResponse(response, request, resolvedSecurity);
-      } catch (error) {
-        return decorateResponse(toErrorResponse(error), request, resolvedSecurity);
-      }
-    },
-    async queue(batch, env, context) {
-      await options.queue?.(batch, env, context);
-    },
-    async scheduled(controller, env, context) {
-      await handleScheduled(controller, env, context);
-    },
-    serverQuery
-  };
-};
-const composeWorker = (options) => createWorker(options);
-const toHttpRouter = (handler) => typeof handler === "function" ? { fetch: handler } : handler;
-const hasLunoraCrons = (options) => Boolean(options.crons ?? options.cronJobs ?? options.backupCron);
-const withFrameworkWorker = (host, optionsInput) => {
-  const httpRouter = toHttpRouter(host);
-  const hostScheduled = typeof host === "object" && typeof host.scheduled === "function" ? host.scheduled : void 0;
-  const build = (options) => {
-    const lunora = composeWorker({ ...options, httpRouter });
-    if (hostScheduled !== void 0 && !hasLunoraCrons(options)) {
-      return {
-        ...lunora,
-        scheduled: async (controller, env, context) => {
-          await hostScheduled(controller, env, context);
-        }
-      };
-    }
-    return lunora;
-  };
-  if (typeof optionsInput !== "function") {
-    return build(optionsInput);
-  }
-  const optionsFactory = optionsInput;
-  return {
-    fetch: (request, env, context) => build(optionsFactory(env)).fetch(request, env, context),
-    queue: (batch, env, context) => build(optionsFactory(env)).queue?.(batch, env, context) ?? Promise.resolve(),
-    scheduled: (controller, env, context) => build(optionsFactory(env)).scheduled(controller, env, context),
-    serverQuery: (request, env, reference, args, options) => build(optionsFactory(env)).serverQuery(request, env, reference, args, options)
-  };
-};
-const resolveLunoraOptions = (options, env) => {
-  if (typeof options === "function") {
-    return options(env);
-  }
-  const shardDO = options.shardDO ?? env?.SHARD;
-  if (!shardDO) {
-    throw new LunoraError(
-      "@lunora/runtime: no shard Durable Object namespace found. Bind `SHARD` in wrangler.jsonc, or pass `createLunoraHandler({ shardDO: env.MY_SHARD })`."
-    );
-  }
-  return { ...options, shardDO };
-};
-const createLunoraHandler = (options = {}) => (request, env, context) => createWorker(resolveLunoraOptions(options, env)).fetch(request, env, context ?? NOOP_EXECUTION_CONTEXT);
-const defineRpcEnvelope = (envelope) => envelope;
-
-export { GET_AUTH_AUDIT_LOG_OP, NOOP_EXECUTION_CONTEXT, composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, probeRelayCount, resolveLunoraOptions, withFrameworkWorker };