@lunora/runtime 1.0.0-alpha.55 → 1.0.0-alpha.57

package/dist/index.d.mts

@@ -1,5 +1,6 @@
-import { RankDirection, RankPageRow, DatabaseWriterLike } from '@lunora/shard-engine';
+import { RankDirection, RankPageRow, DatabaseWriterLike, CrossShardReadArgs, QueryPage } from '@lunora/shard-engine';
 export type { RankDirection as RankPageDirection, RankPageRowKey as RankPageKey, RankPageRow, ShardRankPageResult } from '@lunora/shard-engine';
+import { ShardDirectory } from '@lunora/platform';
 import { R2SqlClient } from '@lunora/bindings/r2sql';
 import { WorkflowsRestClient } from '@lunora/workflow';
 import { LunoraError as LunoraError$1, ErrorBody } from '@lunora/errors';
@@ -607,6 +608,7 @@ type DurableObjectJurisdiction = "eu" | "fedramp" | "us";
  * unit-test doubles without coupling to `@cloudflare/workers-types`.
  */
 interface ShardNamespaceLike {
+  /** Materialize a stub from an opaque id. */
   get: (id: unknown) => {
     fetch: (request: Request) => Promise<Response>;
   };
@@ -618,6 +620,7 @@ interface ShardNamespaceLike {
   getByName?: (name: string) => {
     fetch: (request: Request) => Promise<Response>;
   };
+  /** Cloudflare's `DurableObjectNamespace` spelling of `idForName`. */
   idFromName: (name: string) => unknown;
   /**
    * Derive a jurisdiction-restricted subnamespace. Every ID and stub created
@@ -628,6 +631,24 @@ interface ShardNamespaceLike {
    */
   jurisdiction?: (jurisdiction: DurableObjectJurisdiction) => ShardNamespaceLike;
 }
+/**
+ * What a fan-out entry point accepts: a Cloudflare binding **or** a
+ * `@lunora/platform` `ShardDirectory`.
+ *
+ * The two shapes differ by one method name — the contract spells `idFromName`
+ * as `idForName` — and that one letter made every entry point
+ * (`QueryCoordinator.fanOut`, the `orchestrate*` family) reject a fully
+ * conforming directory. A porting blocker, found by construction the first time
+ * `@lunora/platform-node` fanned out.
+ *
+ * It is a **union, not a loosened `ShardNamespaceLike`**. Making `get` and
+ * `idFromName` optional on that interface fixed fan-out and broke everything
+ * else: it is the projection of a real `DurableObjectNamespace`, so ~74 call
+ * sites and every app's `env.SHARD` inherited two members that were suddenly
+ * `possibly undefined`. Widening the input is what was wanted; widening the
+ * binding type was collateral.
+ */
+type ShardNamespaceInput = ShardDirectory | ShardNamespaceLike;
 interface ResolvedShard {
   fetch: (request: Request) => Promise<Response>;
 }
@@ -648,7 +669,7 @@ declare const applyJurisdiction: (namespace: ShardNamespaceLike, jurisdiction?:
  * else `idFromName` + `get` — but the preference now lives in one place (the
  * contract's `resolveShard`) rather than being restated per resolution path.
  */
-declare const resolveShard: (namespace: ShardNamespaceLike, shardKey: string) => ResolvedShard;
+declare const resolveShard: (namespace: ShardNamespaceInput, shardKey: string) => ResolvedShard;
 /**
  * Source of "which shard keys exist for a given table right now". Returning
  * an empty array is valid — the coordinator will respond with the merge
@@ -933,43 +954,43 @@ interface RankPageFanOutResult {
   shards: ReadonlyArray<ShardRankPageOutcome>;
 }
 interface QueryCoordinator {
-  fanOut: <T = unknown>(namespace: ShardNamespaceLike, request: FanOutRequest) => Promise<FanOutResult<T>>;
+  fanOut: <T = unknown>(namespace: ShardNamespaceInput, request: FanOutRequest) => Promise<FanOutResult<T>>;
   /**
    * Fan the `__lunora_admin__:applyCdc` admin RPC out by forwarding each
    * pre-bucketed per-shard batch of CDC changes, rolling up the applied/failed
    * counts. The replay half of point-in-time recovery.
    */
-  orchestrateApplyCdc: (namespace: ShardNamespaceLike, request: ApplyCdcFanOutRequest) => Promise<ApplyCdcFanOutResult>;
+  orchestrateApplyCdc: (namespace: ShardNamespaceInput, request: ApplyCdcFanOutRequest) => Promise<ApplyCdcFanOutResult>;
   /**
    * Fan the `__lunora_admin__:cdcSync` admin RPC out to every live shard,
    * each resumed from its own cursor in `request.cursors` (shardKey → seq).
    * Returns the per-shard change pages plus their new cursors so the caller
    * can checkpoint each shard independently — the streaming-export feed.
    */
-  orchestrateCdcSync: (namespace: ShardNamespaceLike, request: CdcSyncFanOutRequest) => Promise<CdcSyncFanOutResult>;
+  orchestrateCdcSync: (namespace: ShardNamespaceInput, request: CdcSyncFanOutRequest) => Promise<CdcSyncFanOutResult>;
   /**
    * Fan an export admin RPC out to every live shard, returning the
    * per-shard `{rows}` payloads alongside any per-shard errors. Each shard
    * returns a JSON envelope (not a streaming body) so this method is the
    * collector — the worker assembles the NDJSON stream.
    */
-  orchestrateExport: (namespace: ShardNamespaceLike, request: ExportFanOutRequest) => Promise<ExportFanOutResult>;
+  orchestrateExport: (namespace: ShardNamespaceInput, request: ExportFanOutRequest) => Promise<ExportFanOutResult>;
   /**
    * Fan an import admin RPC out by routing each row to its owning shard. The
    * shard registry resolves which shards exist; rows whose table has a
    * `shardBy(field)` are bucketed using that field's value as the shard key,
    * other tables fall back to the runtime's default `__root__` shard.
    */
-  orchestrateImport: (namespace: ShardNamespaceLike, request: ImportFanOutRequest) => Promise<ImportFanOutResult>;
+  orchestrateImport: (namespace: ShardNamespaceInput, request: ImportFanOutRequest) => Promise<ImportFanOutResult>;
   /** Fan a migration admin RPC out to every live shard of a table and roll up the per-shard outcomes. */
-  orchestrateMigration: (namespace: ShardNamespaceLike, request: MigrationFanOutRequest) => Promise<MigrationFanOutResult>;
+  orchestrateMigration: (namespace: ShardNamespaceInput, request: MigrationFanOutRequest) => Promise<MigrationFanOutResult>;
   /**
    * Fan the `__lunora_admin__:rankBefore` admin RPC out to every live shard of
    * a table and roll up the per-shard `{before, total}` payloads into the
    * global rank (`{position: Σbefore + 1, total: Σtotal}`). The cross-shard
    * `rank()` path for a partition that spans shards.
    */
-  orchestrateRank: (namespace: ShardNamespaceLike, request: RankFanOutRequest) => Promise<RankFanOutResult>;
+  orchestrateRank: (namespace: ShardNamespaceInput, request: RankFanOutRequest) => Promise<RankFanOutResult>;
   /**
    * Page a ranked query across every live shard of a `.shardBy(...)` table.
    * Fans `__lunora_admin__:rankPage` out to each shard, gathers each shard's
@@ -980,7 +1001,7 @@ interface QueryCoordinator {
    * consumed from it — pages never drop or duplicate a row at a shard
    * boundary. The cross-shard `rankPage()` path (PLAN5 §7.1 / PLAN2 #3).
    */
-  orchestrateRankPage: (namespace: ShardNamespaceLike, request: RankPageFanOutRequest) => Promise<RankPageFanOutResult>;
+  orchestrateRankPage: (namespace: ShardNamespaceInput, request: RankPageFanOutRequest) => Promise<RankPageFanOutResult>;
   /**
    * Fan the `__lunora_admin__:getMetrics` admin RPC out to every live shard of
    * a table and collect each shard's lifetime `requests` total into a per-shard
@@ -989,7 +1010,7 @@ interface QueryCoordinator {
    * skew, so this fans the cheap metrics read out and returns the whole shard
    * set's request volumes (a failed shard surfaces as `requests: 0`).
    */
-  orchestrateShardTraffic: (namespace: ShardNamespaceLike, request: ShardTrafficFanOutRequest) => Promise<ShardTrafficFanOutResult>;
+  orchestrateShardTraffic: (namespace: ShardNamespaceInput, request: ShardTrafficFanOutRequest) => Promise<ShardTrafficFanOutResult>;
   readonly registry: ShardRegistry;
 }
 /**
@@ -3306,6 +3327,13 @@ interface WorkerOptions {
    * every live shard for the table) and a per-shard gate is not
    * sufficient to authorize it. Apps that need client-driven fan-out
    * must opt in explicitly via this callback.
+   *
+   * SCOPE: this gate is TABLE-granular — it decides whether the caller may fan
+   * this function out over this table at all, never which ROWS come back. Row
+   * filtering is RLS's job and stays RLS's job on the fan-out path too: the
+   * reserved `__lunora_relation__:read` hop carries the child's read policy as
+   * data (`where` + `relationPolicies`) so each shard applies it. Do not read
+   * an `authorizeFanOut: () => true` as "this caller may see every row".
    */
   authorizeFanOut?: (identity: ResolvedIdentity | null, table: string, functionPath: string) => boolean | Promise<boolean>;
   /**
@@ -3567,17 +3595,24 @@ interface WorkerOptions {
    */
   queue?: QueueConsumerHandler;
   /**
-   * Enforce the ephemeral WS admin token: when `true`,
-   * the worker's WS admin gate rejects the raw master admin token in the
-   * `?token=` query parameter — only a short-lived sub-token minted by
-   * `POST /_lunora/admin/ws-token` (or the master token in the
-   * `Authorization` HEADER, which never leaks via URLs) authorizes. Off by
-   * default (the master token in `?token=` keeps working); also settable per
-   * deployment via `env.LUNORA_REQUIRE_EPHEMERAL_WS_TOKEN`
-   * (`1`/`true`/`on`/`yes`/`enabled`), which the shard/relay Durable Objects
-   * honor for their own upgrade gate too. Flipping it on is the step that
-   * actually closes the URL/log leak — do so once every studio the
-   * deployment uses mints ephemeral tokens.
+   * Enforce the ephemeral WS admin token: the worker's WS admin gate rejects
+   * the raw master admin token in the `?token=` query parameter — only a
+   * short-lived sub-token minted by `POST /_lunora/admin/ws-token` (or the
+   * master token in the `Authorization` HEADER, which never leaks via URLs)
+   * authorizes.
+   *
+   * **On by default**: a query string lands in access logs, browser history and
+   * `Referer`, so the master admin credential must not ride one. The studio
+   * mints and sends the ephemeral token already.
+   *
+   * To opt back out for a legacy client that still puts the master token in a
+   * URL, set **`env.LUNORA_REQUIRE_EPHEMERAL_WS_TOKEN`** to
+   * `0`/`false`/`off`/`no`/`disabled`. That is the knob to use: it is read
+   * independently by the worker AND by the shard/relay Durable Objects, so the
+   * whole deployment agrees. This code-level option only governs the WORKER's
+   * gate — a DO stamps its own socket from `env` alone, so setting `false` here
+   * without the env var yields a socket the worker admits and the DO marks
+   * non-admin (admin subscriptions then return nothing).
    */
   requireEphemeralWsToken?: boolean;
   /**
@@ -3967,15 +4002,16 @@ declare const createLunoraHandler: (options?: LunoraHandlerOptions) => ((request
 /** Re-exported helper so callers can roundtrip envelopes in tests. */
 declare const defineRpcEnvelope: (envelope: RpcEnvelope) => RpcEnvelope;
 /**
- * Reader / counter capabilities, typed against the SAME canonical
- * `DatabaseWriterLike` the `@lunora/d1` ctx-db derives its `crossShardReader` /
- * `crossShardCounter` options from (`DatabaseWriterLike["findMany"]` /
- * `["count"]`) — so the pair drops straight into `createD1CtxDb` with no cast and
- * no structural drift. The import is type-only: `@lunora/runtime` keeps no hard
- * (value) dependency on `@lunora/do`.
+ * Reader / counter capabilities, typed against the SAME canonical shard-engine
+ * types the `@lunora/d1` ctx-db derives its `crossShardReader` /
+ * `crossShardCounter` options from — so the pair drops straight into
+ * `createD1CtxDb` with no cast and no structural drift. The reader takes
+ * {@link CrossShardReadArgs} (not `QueryArgs`) because the hop is a JSON envelope
+ * and the RLS filters must travel as data. The import is type-only:
+ * `@lunora/runtime` keeps no hard (value) dependency on `@lunora/do`.
  */
 type CrossShardCounter = DatabaseWriterLike["count"];
-type CrossShardReader = DatabaseWriterLike["findMany"];
+type CrossShardReader = (table: string, args: CrossShardReadArgs) => Promise<QueryPage>;
 interface CrossShardRelationOptions {
   /**
    * `fetch` used for the worker subrequest. Defaults to `globalThis.fetch`.
@@ -4656,4 +4692,4 @@ interface ShardClient {
  */
 declare const createShardClient: (namespace: ShardNamespaceLike, options?: ShardClientOptions) => ShardClient;
 declare const VERSION: string;
-export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthConfigInfo, type AuthImpersonation, type AuthPage, type AuthSession, type AuthUser, type AuthUserFieldSpec, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_LOG_COLUMNS, DEFAULT_LOG_LIMIT, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportBatch, type ExportChange, type ExportCursorStore, type ExportFanOutRequest, type ExportFanOutResult, type ExportSink, type ExportTapFailure, type ExportTapResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, HEALTH_PATH, HEALTH_READY_PATH, type HealthAuthPosture, type HealthBody, type HealthCheckReport, type HealthProbe, type HealthProbeKind, type HealthProbeResult, type HealthRouteDeps, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type KvIntrospector, type KvKeyEntry, type KvKeyListResult, type KvNamespaceSummary, type KvValueResult, LOG_ARCHIVE_NOT_CONFIGURED, LOG_ARCHIVE_PATH, type ListAuthUsersOptions, type LogArchiveConfig, type LogEvent, type LogFields, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MemoizeIdentityOptions, type MergeStrategy, type MetricEvent, type MetricKind, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type NotifySubscriptionDevice, type NotifySubscriptionStoreLike, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type OtlpResourceAttributes, type OtlpSinkOptions, type PipelineLike, type PipelineLogColumnMap, type PipelineLogCursor, type PipelineLogField, type PipelineLogPage, type PipelineLogQuery, type PipelineLogReader, type PipelineLogReaderOptions, type PipelineLogRow, type PipelineLogSinkOptions, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type RateLimiterLike, type ResolvedSecurity, type ResolvedShard, type RestInvoke, type RestRateLimit, type RestRegistryEntry, type RestRegistryLike, type RestRoute, type RestRouteDeps, type Route, type RpcContext, type RpcEnvelope, type RunExportTapOptions, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardCallArgs, type ShardCallOptions, type ShardCallReturn, type ShardCallerIdentity, type ShardClient, type ShardClientOptions, type ShardError, type ShardExportOutcome, type ShardFunctionReference, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type SpanEvent, type StorageListFunction as StorageListFn, type StorageObject, type TraceSamplingConfig, type TraceTrustSignal, type TrustInboundTraceContext, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, applyRestCache, argsFromQuery, buildHealthRoutes, buildRestRoutes, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createKvCursorStore, createLunoraHandler, createMemoryCursorStore, createPipelineLogReader, createQueryCoordinator, createRestRateLimit, createShardClient, createStaticShardRegistry, createWorker, d1Probe, decorateResponse, defineExportSink, defineRpcEnvelope, durableObjectProbe, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, memoizeIdentity, memoizeIdentityPerRequest, mergeStrategyForAggregate, otlpSink, pipelineLogSink, presenceProbe, r2Sink, readShardKey, requestCarriesCredentials, resolveLogArchiveFromEnv, resolveLunoraOptions, resolveSecurity, resolveShard, restCacheHeaders, restSurfaceFromRegistry, routeIdentityResolvers, runExportTap, sanitizeChange, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookExportSink, webhookSink, withFrameworkWorker };
+export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthConfigInfo, type AuthImpersonation, type AuthPage, type AuthSession, type AuthUser, type AuthUserFieldSpec, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_LOG_COLUMNS, DEFAULT_LOG_LIMIT, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportBatch, type ExportChange, type ExportCursorStore, type ExportFanOutRequest, type ExportFanOutResult, type ExportSink, type ExportTapFailure, type ExportTapResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, HEALTH_PATH, HEALTH_READY_PATH, type HealthAuthPosture, type HealthBody, type HealthCheckReport, type HealthProbe, type HealthProbeKind, type HealthProbeResult, type HealthRouteDeps, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type KvIntrospector, type KvKeyEntry, type KvKeyListResult, type KvNamespaceSummary, type KvValueResult, LOG_ARCHIVE_NOT_CONFIGURED, LOG_ARCHIVE_PATH, type ListAuthUsersOptions, type LogArchiveConfig, type LogEvent, type LogFields, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MemoizeIdentityOptions, type MergeStrategy, type MetricEvent, type MetricKind, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type NotifySubscriptionDevice, type NotifySubscriptionStoreLike, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type OtlpResourceAttributes, type OtlpSinkOptions, type PipelineLike, type PipelineLogColumnMap, type PipelineLogCursor, type PipelineLogField, type PipelineLogPage, type PipelineLogQuery, type PipelineLogReader, type PipelineLogReaderOptions, type PipelineLogRow, type PipelineLogSinkOptions, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type RateLimiterLike, type ResolvedSecurity, type ResolvedShard, type RestInvoke, type RestRateLimit, type RestRegistryEntry, type RestRegistryLike, type RestRoute, type RestRouteDeps, type Route, type RpcContext, type RpcEnvelope, type RunExportTapOptions, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardCallArgs, type ShardCallOptions, type ShardCallReturn, type ShardCallerIdentity, type ShardClient, type ShardClientOptions, type ShardError, type ShardExportOutcome, type ShardFunctionReference, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceInput, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type SpanEvent, type StorageListFunction as StorageListFn, type StorageObject, type TraceSamplingConfig, type TraceTrustSignal, type TrustInboundTraceContext, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, applyRestCache, argsFromQuery, buildHealthRoutes, buildRestRoutes, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createKvCursorStore, createLunoraHandler, createMemoryCursorStore, createPipelineLogReader, createQueryCoordinator, createRestRateLimit, createShardClient, createStaticShardRegistry, createWorker, d1Probe, decorateResponse, defineExportSink, defineRpcEnvelope, durableObjectProbe, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, memoizeIdentity, memoizeIdentityPerRequest, mergeStrategyForAggregate, otlpSink, pipelineLogSink, presenceProbe, r2Sink, readShardKey, requestCarriesCredentials, resolveLogArchiveFromEnv, resolveLunoraOptions, resolveSecurity, resolveShard, restCacheHeaders, restSurfaceFromRegistry, routeIdentityResolvers, runExportTap, sanitizeChange, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookExportSink, webhookSink, withFrameworkWorker };

package/dist/index.d.ts

@@ -1,5 +1,6 @@
-import { RankDirection, RankPageRow, DatabaseWriterLike } from '@lunora/shard-engine';
+import { RankDirection, RankPageRow, DatabaseWriterLike, CrossShardReadArgs, QueryPage } from '@lunora/shard-engine';
 export type { RankDirection as RankPageDirection, RankPageRowKey as RankPageKey, RankPageRow, ShardRankPageResult } from '@lunora/shard-engine';
+import { ShardDirectory } from '@lunora/platform';
 import { R2SqlClient } from '@lunora/bindings/r2sql';
 import { WorkflowsRestClient } from '@lunora/workflow';
 import { LunoraError as LunoraError$1, ErrorBody } from '@lunora/errors';
@@ -607,6 +608,7 @@ type DurableObjectJurisdiction = "eu" | "fedramp" | "us";
  * unit-test doubles without coupling to `@cloudflare/workers-types`.
  */
 interface ShardNamespaceLike {
+  /** Materialize a stub from an opaque id. */
   get: (id: unknown) => {
     fetch: (request: Request) => Promise<Response>;
   };
@@ -618,6 +620,7 @@ interface ShardNamespaceLike {
   getByName?: (name: string) => {
     fetch: (request: Request) => Promise<Response>;
   };
+  /** Cloudflare's `DurableObjectNamespace` spelling of `idForName`. */
   idFromName: (name: string) => unknown;
   /**
    * Derive a jurisdiction-restricted subnamespace. Every ID and stub created
@@ -628,6 +631,24 @@ interface ShardNamespaceLike {
    */
   jurisdiction?: (jurisdiction: DurableObjectJurisdiction) => ShardNamespaceLike;
 }
+/**
+ * What a fan-out entry point accepts: a Cloudflare binding **or** a
+ * `@lunora/platform` `ShardDirectory`.
+ *
+ * The two shapes differ by one method name — the contract spells `idFromName`
+ * as `idForName` — and that one letter made every entry point
+ * (`QueryCoordinator.fanOut`, the `orchestrate*` family) reject a fully
+ * conforming directory. A porting blocker, found by construction the first time
+ * `@lunora/platform-node` fanned out.
+ *
+ * It is a **union, not a loosened `ShardNamespaceLike`**. Making `get` and
+ * `idFromName` optional on that interface fixed fan-out and broke everything
+ * else: it is the projection of a real `DurableObjectNamespace`, so ~74 call
+ * sites and every app's `env.SHARD` inherited two members that were suddenly
+ * `possibly undefined`. Widening the input is what was wanted; widening the
+ * binding type was collateral.
+ */
+type ShardNamespaceInput = ShardDirectory | ShardNamespaceLike;
 interface ResolvedShard {
   fetch: (request: Request) => Promise<Response>;
 }
@@ -648,7 +669,7 @@ declare const applyJurisdiction: (namespace: ShardNamespaceLike, jurisdiction?:
  * else `idFromName` + `get` — but the preference now lives in one place (the
  * contract's `resolveShard`) rather than being restated per resolution path.
  */
-declare const resolveShard: (namespace: ShardNamespaceLike, shardKey: string) => ResolvedShard;
+declare const resolveShard: (namespace: ShardNamespaceInput, shardKey: string) => ResolvedShard;
 /**
  * Source of "which shard keys exist for a given table right now". Returning
  * an empty array is valid — the coordinator will respond with the merge
@@ -933,43 +954,43 @@ interface RankPageFanOutResult {
   shards: ReadonlyArray<ShardRankPageOutcome>;
 }
 interface QueryCoordinator {
-  fanOut: <T = unknown>(namespace: ShardNamespaceLike, request: FanOutRequest) => Promise<FanOutResult<T>>;
+  fanOut: <T = unknown>(namespace: ShardNamespaceInput, request: FanOutRequest) => Promise<FanOutResult<T>>;
   /**
    * Fan the `__lunora_admin__:applyCdc` admin RPC out by forwarding each
    * pre-bucketed per-shard batch of CDC changes, rolling up the applied/failed
    * counts. The replay half of point-in-time recovery.
    */
-  orchestrateApplyCdc: (namespace: ShardNamespaceLike, request: ApplyCdcFanOutRequest) => Promise<ApplyCdcFanOutResult>;
+  orchestrateApplyCdc: (namespace: ShardNamespaceInput, request: ApplyCdcFanOutRequest) => Promise<ApplyCdcFanOutResult>;
   /**
    * Fan the `__lunora_admin__:cdcSync` admin RPC out to every live shard,
    * each resumed from its own cursor in `request.cursors` (shardKey → seq).
    * Returns the per-shard change pages plus their new cursors so the caller
    * can checkpoint each shard independently — the streaming-export feed.
    */
-  orchestrateCdcSync: (namespace: ShardNamespaceLike, request: CdcSyncFanOutRequest) => Promise<CdcSyncFanOutResult>;
+  orchestrateCdcSync: (namespace: ShardNamespaceInput, request: CdcSyncFanOutRequest) => Promise<CdcSyncFanOutResult>;
   /**
    * Fan an export admin RPC out to every live shard, returning the
    * per-shard `{rows}` payloads alongside any per-shard errors. Each shard
    * returns a JSON envelope (not a streaming body) so this method is the
    * collector — the worker assembles the NDJSON stream.
    */
-  orchestrateExport: (namespace: ShardNamespaceLike, request: ExportFanOutRequest) => Promise<ExportFanOutResult>;
+  orchestrateExport: (namespace: ShardNamespaceInput, request: ExportFanOutRequest) => Promise<ExportFanOutResult>;
   /**
    * Fan an import admin RPC out by routing each row to its owning shard. The
    * shard registry resolves which shards exist; rows whose table has a
    * `shardBy(field)` are bucketed using that field's value as the shard key,
    * other tables fall back to the runtime's default `__root__` shard.
    */
-  orchestrateImport: (namespace: ShardNamespaceLike, request: ImportFanOutRequest) => Promise<ImportFanOutResult>;
+  orchestrateImport: (namespace: ShardNamespaceInput, request: ImportFanOutRequest) => Promise<ImportFanOutResult>;
   /** Fan a migration admin RPC out to every live shard of a table and roll up the per-shard outcomes. */
-  orchestrateMigration: (namespace: ShardNamespaceLike, request: MigrationFanOutRequest) => Promise<MigrationFanOutResult>;
+  orchestrateMigration: (namespace: ShardNamespaceInput, request: MigrationFanOutRequest) => Promise<MigrationFanOutResult>;
   /**
    * Fan the `__lunora_admin__:rankBefore` admin RPC out to every live shard of
    * a table and roll up the per-shard `{before, total}` payloads into the
    * global rank (`{position: Σbefore + 1, total: Σtotal}`). The cross-shard
    * `rank()` path for a partition that spans shards.
    */
-  orchestrateRank: (namespace: ShardNamespaceLike, request: RankFanOutRequest) => Promise<RankFanOutResult>;
+  orchestrateRank: (namespace: ShardNamespaceInput, request: RankFanOutRequest) => Promise<RankFanOutResult>;
   /**
    * Page a ranked query across every live shard of a `.shardBy(...)` table.
    * Fans `__lunora_admin__:rankPage` out to each shard, gathers each shard's
@@ -980,7 +1001,7 @@ interface QueryCoordinator {
    * consumed from it — pages never drop or duplicate a row at a shard
    * boundary. The cross-shard `rankPage()` path (PLAN5 §7.1 / PLAN2 #3).
    */
-  orchestrateRankPage: (namespace: ShardNamespaceLike, request: RankPageFanOutRequest) => Promise<RankPageFanOutResult>;
+  orchestrateRankPage: (namespace: ShardNamespaceInput, request: RankPageFanOutRequest) => Promise<RankPageFanOutResult>;
   /**
    * Fan the `__lunora_admin__:getMetrics` admin RPC out to every live shard of
    * a table and collect each shard's lifetime `requests` total into a per-shard
@@ -989,7 +1010,7 @@ interface QueryCoordinator {
    * skew, so this fans the cheap metrics read out and returns the whole shard
    * set's request volumes (a failed shard surfaces as `requests: 0`).
    */
-  orchestrateShardTraffic: (namespace: ShardNamespaceLike, request: ShardTrafficFanOutRequest) => Promise<ShardTrafficFanOutResult>;
+  orchestrateShardTraffic: (namespace: ShardNamespaceInput, request: ShardTrafficFanOutRequest) => Promise<ShardTrafficFanOutResult>;
   readonly registry: ShardRegistry;
 }
 /**
@@ -3306,6 +3327,13 @@ interface WorkerOptions {
    * every live shard for the table) and a per-shard gate is not
    * sufficient to authorize it. Apps that need client-driven fan-out
    * must opt in explicitly via this callback.
+   *
+   * SCOPE: this gate is TABLE-granular — it decides whether the caller may fan
+   * this function out over this table at all, never which ROWS come back. Row
+   * filtering is RLS's job and stays RLS's job on the fan-out path too: the
+   * reserved `__lunora_relation__:read` hop carries the child's read policy as
+   * data (`where` + `relationPolicies`) so each shard applies it. Do not read
+   * an `authorizeFanOut: () => true` as "this caller may see every row".
    */
   authorizeFanOut?: (identity: ResolvedIdentity | null, table: string, functionPath: string) => boolean | Promise<boolean>;
   /**
@@ -3567,17 +3595,24 @@ interface WorkerOptions {
    */
   queue?: QueueConsumerHandler;
   /**
-   * Enforce the ephemeral WS admin token: when `true`,
-   * the worker's WS admin gate rejects the raw master admin token in the
-   * `?token=` query parameter — only a short-lived sub-token minted by
-   * `POST /_lunora/admin/ws-token` (or the master token in the
-   * `Authorization` HEADER, which never leaks via URLs) authorizes. Off by
-   * default (the master token in `?token=` keeps working); also settable per
-   * deployment via `env.LUNORA_REQUIRE_EPHEMERAL_WS_TOKEN`
-   * (`1`/`true`/`on`/`yes`/`enabled`), which the shard/relay Durable Objects
-   * honor for their own upgrade gate too. Flipping it on is the step that
-   * actually closes the URL/log leak — do so once every studio the
-   * deployment uses mints ephemeral tokens.
+   * Enforce the ephemeral WS admin token: the worker's WS admin gate rejects
+   * the raw master admin token in the `?token=` query parameter — only a
+   * short-lived sub-token minted by `POST /_lunora/admin/ws-token` (or the
+   * master token in the `Authorization` HEADER, which never leaks via URLs)
+   * authorizes.
+   *
+   * **On by default**: a query string lands in access logs, browser history and
+   * `Referer`, so the master admin credential must not ride one. The studio
+   * mints and sends the ephemeral token already.
+   *
+   * To opt back out for a legacy client that still puts the master token in a
+   * URL, set **`env.LUNORA_REQUIRE_EPHEMERAL_WS_TOKEN`** to
+   * `0`/`false`/`off`/`no`/`disabled`. That is the knob to use: it is read
+   * independently by the worker AND by the shard/relay Durable Objects, so the
+   * whole deployment agrees. This code-level option only governs the WORKER's
+   * gate — a DO stamps its own socket from `env` alone, so setting `false` here
+   * without the env var yields a socket the worker admits and the DO marks
+   * non-admin (admin subscriptions then return nothing).
    */
   requireEphemeralWsToken?: boolean;
   /**
@@ -3967,15 +4002,16 @@ declare const createLunoraHandler: (options?: LunoraHandlerOptions) => ((request
 /** Re-exported helper so callers can roundtrip envelopes in tests. */
 declare const defineRpcEnvelope: (envelope: RpcEnvelope) => RpcEnvelope;
 /**
- * Reader / counter capabilities, typed against the SAME canonical
- * `DatabaseWriterLike` the `@lunora/d1` ctx-db derives its `crossShardReader` /
- * `crossShardCounter` options from (`DatabaseWriterLike["findMany"]` /
- * `["count"]`) — so the pair drops straight into `createD1CtxDb` with no cast and
- * no structural drift. The import is type-only: `@lunora/runtime` keeps no hard
- * (value) dependency on `@lunora/do`.
+ * Reader / counter capabilities, typed against the SAME canonical shard-engine
+ * types the `@lunora/d1` ctx-db derives its `crossShardReader` /
+ * `crossShardCounter` options from — so the pair drops straight into
+ * `createD1CtxDb` with no cast and no structural drift. The reader takes
+ * {@link CrossShardReadArgs} (not `QueryArgs`) because the hop is a JSON envelope
+ * and the RLS filters must travel as data. The import is type-only:
+ * `@lunora/runtime` keeps no hard (value) dependency on `@lunora/do`.
  */
 type CrossShardCounter = DatabaseWriterLike["count"];
-type CrossShardReader = DatabaseWriterLike["findMany"];
+type CrossShardReader = (table: string, args: CrossShardReadArgs) => Promise<QueryPage>;
 interface CrossShardRelationOptions {
   /**
    * `fetch` used for the worker subrequest. Defaults to `globalThis.fetch`.
@@ -4656,4 +4692,4 @@ interface ShardClient {
  */
 declare const createShardClient: (namespace: ShardNamespaceLike, options?: ShardClientOptions) => ShardClient;
 declare const VERSION: string;
-export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthConfigInfo, type AuthImpersonation, type AuthPage, type AuthSession, type AuthUser, type AuthUserFieldSpec, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_LOG_COLUMNS, DEFAULT_LOG_LIMIT, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportBatch, type ExportChange, type ExportCursorStore, type ExportFanOutRequest, type ExportFanOutResult, type ExportSink, type ExportTapFailure, type ExportTapResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, HEALTH_PATH, HEALTH_READY_PATH, type HealthAuthPosture, type HealthBody, type HealthCheckReport, type HealthProbe, type HealthProbeKind, type HealthProbeResult, type HealthRouteDeps, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type KvIntrospector, type KvKeyEntry, type KvKeyListResult, type KvNamespaceSummary, type KvValueResult, LOG_ARCHIVE_NOT_CONFIGURED, LOG_ARCHIVE_PATH, type ListAuthUsersOptions, type LogArchiveConfig, type LogEvent, type LogFields, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MemoizeIdentityOptions, type MergeStrategy, type MetricEvent, type MetricKind, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type NotifySubscriptionDevice, type NotifySubscriptionStoreLike, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type OtlpResourceAttributes, type OtlpSinkOptions, type PipelineLike, type PipelineLogColumnMap, type PipelineLogCursor, type PipelineLogField, type PipelineLogPage, type PipelineLogQuery, type PipelineLogReader, type PipelineLogReaderOptions, type PipelineLogRow, type PipelineLogSinkOptions, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type RateLimiterLike, type ResolvedSecurity, type ResolvedShard, type RestInvoke, type RestRateLimit, type RestRegistryEntry, type RestRegistryLike, type RestRoute, type RestRouteDeps, type Route, type RpcContext, type RpcEnvelope, type RunExportTapOptions, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardCallArgs, type ShardCallOptions, type ShardCallReturn, type ShardCallerIdentity, type ShardClient, type ShardClientOptions, type ShardError, type ShardExportOutcome, type ShardFunctionReference, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type SpanEvent, type StorageListFunction as StorageListFn, type StorageObject, type TraceSamplingConfig, type TraceTrustSignal, type TrustInboundTraceContext, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, applyRestCache, argsFromQuery, buildHealthRoutes, buildRestRoutes, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createKvCursorStore, createLunoraHandler, createMemoryCursorStore, createPipelineLogReader, createQueryCoordinator, createRestRateLimit, createShardClient, createStaticShardRegistry, createWorker, d1Probe, decorateResponse, defineExportSink, defineRpcEnvelope, durableObjectProbe, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, memoizeIdentity, memoizeIdentityPerRequest, mergeStrategyForAggregate, otlpSink, pipelineLogSink, presenceProbe, r2Sink, readShardKey, requestCarriesCredentials, resolveLogArchiveFromEnv, resolveLunoraOptions, resolveSecurity, resolveShard, restCacheHeaders, restSurfaceFromRegistry, routeIdentityResolvers, runExportTap, sanitizeChange, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookExportSink, webhookSink, withFrameworkWorker };
+export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthConfigInfo, type AuthImpersonation, type AuthPage, type AuthSession, type AuthUser, type AuthUserFieldSpec, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_LOG_COLUMNS, DEFAULT_LOG_LIMIT, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportBatch, type ExportChange, type ExportCursorStore, type ExportFanOutRequest, type ExportFanOutResult, type ExportSink, type ExportTapFailure, type ExportTapResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, HEALTH_PATH, HEALTH_READY_PATH, type HealthAuthPosture, type HealthBody, type HealthCheckReport, type HealthProbe, type HealthProbeKind, type HealthProbeResult, type HealthRouteDeps, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type KvIntrospector, type KvKeyEntry, type KvKeyListResult, type KvNamespaceSummary, type KvValueResult, LOG_ARCHIVE_NOT_CONFIGURED, LOG_ARCHIVE_PATH, type ListAuthUsersOptions, type LogArchiveConfig, type LogEvent, type LogFields, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MemoizeIdentityOptions, type MergeStrategy, type MetricEvent, type MetricKind, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type NotifySubscriptionDevice, type NotifySubscriptionStoreLike, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type OtlpResourceAttributes, type OtlpSinkOptions, type PipelineLike, type PipelineLogColumnMap, type PipelineLogCursor, type PipelineLogField, type PipelineLogPage, type PipelineLogQuery, type PipelineLogReader, type PipelineLogReaderOptions, type PipelineLogRow, type PipelineLogSinkOptions, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type RateLimiterLike, type ResolvedSecurity, type ResolvedShard, type RestInvoke, type RestRateLimit, type RestRegistryEntry, type RestRegistryLike, type RestRoute, type RestRouteDeps, type Route, type RpcContext, type RpcEnvelope, type RunExportTapOptions, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardCallArgs, type ShardCallOptions, type ShardCallReturn, type ShardCallerIdentity, type ShardClient, type ShardClientOptions, type ShardError, type ShardExportOutcome, type ShardFunctionReference, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceInput, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type SpanEvent, type StorageListFunction as StorageListFn, type StorageObject, type TraceSamplingConfig, type TraceTrustSignal, type TrustInboundTraceContext, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, applyRestCache, argsFromQuery, buildHealthRoutes, buildRestRoutes, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createKvCursorStore, createLunoraHandler, createMemoryCursorStore, createPipelineLogReader, createQueryCoordinator, createRestRateLimit, createShardClient, createStaticShardRegistry, createWorker, d1Probe, decorateResponse, defineExportSink, defineRpcEnvelope, durableObjectProbe, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, memoizeIdentity, memoizeIdentityPerRequest, mergeStrategyForAggregate, otlpSink, pipelineLogSink, presenceProbe, r2Sink, readShardKey, requestCarriesCredentials, resolveLogArchiveFromEnv, resolveLunoraOptions, resolveSecurity, resolveShard, restCacheHeaders, restSurfaceFromRegistry, routeIdentityResolvers, runExportTap, sanitizeChange, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookExportSink, webhookSink, withFrameworkWorker };

package/dist/index.mjs

@@ -1 +1 @@
-import{toAirbyteMessages as t,toFivetranResponse as a}from"./packem_shared/toAirbyteMessages-DTk8e2f9.mjs";import{composeWorker as i,createLunoraHandler as n,createWorker as p,defineRpcEnvelope as m,resolveLunoraOptions as c,withFrameworkWorker as R}from"./packem_shared/composeWorker-DCZ854Rw.mjs";import{createCrossShardRelationCapabilities as S}from"./packem_shared/createCrossShardRelationCapabilities-BokiysHJ.mjs";import{DEFAULT_REGISTRY_CACHE_TTL_MS as f,SHARD_REGISTRY_DO_NAME as l,createDynamicShardRegistry as x}from"./packem_shared/DEFAULT_REGISTRY_CACHE_TTL_MS-CXdcx3iw.mjs";import{LunoraError as y,toErrorResponse as C}from"./packem_shared/LunoraError-C08OP5Uq.mjs";import{createKvCursorStore as g,createMemoryCursorStore as u,defineExportSink as T,r2Sink as A,runExportTap as h,sanitizeChange as k,webhookExportSink as O}from"./packem_shared/createKvCursorStore-C24tEuYk.mjs";import{HEALTH_PATH as v,HEALTH_READY_PATH as I,buildHealthRoutes as b,d1Probe as F,durableObjectProbe as P,presenceProbe as D}from"./packem_shared/HEALTH_PATH-CmjJOkwf.mjs";import{LOG_ARCHIVE_PATH as G,resolveLogArchiveFromEnv as U}from"./packem_shared/LOG_ARCHIVE_PATH-5vxNUndx.mjs";import{memoizeIdentity as w,memoizeIdentityPerRequest as z}from"./packem_shared/memoizeIdentity-CX3xEPYw.mjs";import{e as W,a as Y}from"./packem_shared/observability-DWlkDJJw.mjs";import{analyticsEngineSink as K,combineSinks as Q,consoleSink as X,otlpSink as j,pipelineLogSink as J,sentrySink as B,webhookSink as Z}from"./packem_shared/analyticsEngineSink-iIRy11I9.mjs";import{D as ee,a as re,c as oe}from"./packem_shared/pipeline-log-reader-FF1V32O2.mjs";import{createQueryCoordinator as ae,createStaticShardRegistry as se,mergeStrategyForAggregate as ie}from"./packem_shared/createQueryCoordinator-NT5oasVP.mjs";import{applyJurisdiction as pe,resolveShard as me}from"./packem_shared/applyJurisdiction-8bzZjAPR.mjs";import{R as Re,d as Ee,o as Se}from"./packem_shared/rest-cache-5unAzdFN.mjs";import{g as fe,E as le,U as xe,p as _e,y as ye}from"./packem_shared/rest-routes--GsO-U9C.mjs";import{decorateResponse as Le,enforceOrigin as ge,handleCorsPreflight as ue,resolveSecurity as Te}from"./packem_shared/decorateResponse-C6TZSzID.mjs";import{createShardClient as he}from"./packem_shared/createShardClient-D4mXb3vL.mjs";import{LOG_ARCHIVE_NOT_CONFIGURED as Oe}from"./packem_shared/LOG_ARCHIVE_NOT_CONFIGURED-CDpi4yFD.mjs";import{NOOP_EXECUTION_CONTEXT as ve}from"./packem_shared/NOOP_EXECUTION_CONTEXT-YmXqH-jH.mjs";import{composeIdentityResolvers as be,routeIdentityResolvers as Fe}from"./packem_shared/composeIdentityResolvers-DlBbYmBJ.mjs";const e="0.0.0";export{ee as DEFAULT_LOG_COLUMNS,re as DEFAULT_LOG_LIMIT,f as DEFAULT_REGISTRY_CACHE_TTL_MS,v as HEALTH_PATH,I as HEALTH_READY_PATH,Oe as LOG_ARCHIVE_NOT_CONFIGURED,G as LOG_ARCHIVE_PATH,y as LunoraError,ve as NOOP_EXECUTION_CONTEXT,l as SHARD_REGISTRY_DO_NAME,e as VERSION,K as analyticsEngineSink,pe as applyJurisdiction,Re as applyRestCache,fe as argsFromQuery,b as buildHealthRoutes,le as buildRestRoutes,Q as combineSinks,be as composeIdentityResolvers,i as composeWorker,X as consoleSink,S as createCrossShardRelationCapabilities,x as createDynamicShardRegistry,g as createKvCursorStore,n as createLunoraHandler,u as createMemoryCursorStore,oe as createPipelineLogReader,ae as createQueryCoordinator,xe as createRestRateLimit,he as createShardClient,se as createStaticShardRegistry,p as createWorker,F as d1Probe,Le as decorateResponse,T as defineExportSink,m as defineRpcEnvelope,P as durableObjectProbe,W as emitLogEvent,Y as emitRpcEvent,ge as enforceOrigin,ue as handleCorsPreflight,w as memoizeIdentity,z as memoizeIdentityPerRequest,ie as mergeStrategyForAggregate,j as otlpSink,J as pipelineLogSink,D as presenceProbe,A as r2Sink,_e as readShardKey,Ee as requestCarriesCredentials,U as resolveLogArchiveFromEnv,c as resolveLunoraOptions,Te as resolveSecurity,me as resolveShard,Se as restCacheHeaders,ye as restSurfaceFromRegistry,Fe as routeIdentityResolvers,h as runExportTap,k as sanitizeChange,B as sentrySink,t as toAirbyteMessages,C as toErrorResponse,a as toFivetranResponse,O as webhookExportSink,Z as webhookSink,R as withFrameworkWorker};
+import{toAirbyteMessages as t,toFivetranResponse as a}from"./packem_shared/toAirbyteMessages-DTk8e2f9.mjs";import{composeWorker as i,createLunoraHandler as n,createWorker as p,defineRpcEnvelope as m,resolveLunoraOptions as c,withFrameworkWorker as R}from"./packem_shared/composeWorker-DxXwbTng.mjs";import{createCrossShardRelationCapabilities as S}from"./packem_shared/createCrossShardRelationCapabilities-CQfrCIWR.mjs";import{DEFAULT_REGISTRY_CACHE_TTL_MS as f,SHARD_REGISTRY_DO_NAME as l,createDynamicShardRegistry as x}from"./packem_shared/DEFAULT_REGISTRY_CACHE_TTL_MS-CCDyswsf.mjs";import{LunoraError as y,toErrorResponse as C}from"./packem_shared/LunoraError-ByasbDmd.mjs";import{createKvCursorStore as g,createMemoryCursorStore as u,defineExportSink as T,r2Sink as A,runExportTap as h,sanitizeChange as k,webhookExportSink as O}from"./packem_shared/createKvCursorStore-C24tEuYk.mjs";import{HEALTH_PATH as v,HEALTH_READY_PATH as I,buildHealthRoutes as b,d1Probe as F,durableObjectProbe as P,presenceProbe as D}from"./packem_shared/HEALTH_PATH-BuLCcWNS.mjs";import{LOG_ARCHIVE_PATH as G,resolveLogArchiveFromEnv as U}from"./packem_shared/LOG_ARCHIVE_PATH-CuHKuDCS.mjs";import{memoizeIdentity as w,memoizeIdentityPerRequest as z}from"./packem_shared/memoizeIdentity-CX3xEPYw.mjs";import{e as W,a as Y}from"./packem_shared/observability-DWlkDJJw.mjs";import{analyticsEngineSink as K,combineSinks as Q,consoleSink as X,otlpSink as j,pipelineLogSink as J,sentrySink as B,webhookSink as Z}from"./packem_shared/analyticsEngineSink-iIRy11I9.mjs";import{D as ee,a as re,c as oe}from"./packem_shared/pipeline-log-reader-FF1V32O2.mjs";import{createQueryCoordinator as ae,createStaticShardRegistry as se,mergeStrategyForAggregate as ie}from"./packem_shared/createQueryCoordinator-BkPfcxUG.mjs";import{applyJurisdiction as pe,resolveShard as me}from"./packem_shared/applyJurisdiction-Dsm_m5zW.mjs";import{R as Re,d as Ee,o as Se}from"./packem_shared/rest-cache-5unAzdFN.mjs";import{g as fe,E as le,U as xe,p as _e,y as ye}from"./packem_shared/rest-routes-BqldHiaH.mjs";import{decorateResponse as Le,enforceOrigin as ge,handleCorsPreflight as ue,resolveSecurity as Te}from"./packem_shared/decorateResponse-DBIWsRSZ.mjs";import{createShardClient as he}from"./packem_shared/createShardClient-BYYzDbMc.mjs";import{LOG_ARCHIVE_NOT_CONFIGURED as Oe}from"./packem_shared/LOG_ARCHIVE_NOT_CONFIGURED-CDpi4yFD.mjs";import{NOOP_EXECUTION_CONTEXT as ve}from"./packem_shared/NOOP_EXECUTION_CONTEXT-YmXqH-jH.mjs";import{composeIdentityResolvers as be,routeIdentityResolvers as Fe}from"./packem_shared/composeIdentityResolvers-DwE0Jbww.mjs";const e="0.0.0";export{ee as DEFAULT_LOG_COLUMNS,re as DEFAULT_LOG_LIMIT,f as DEFAULT_REGISTRY_CACHE_TTL_MS,v as HEALTH_PATH,I as HEALTH_READY_PATH,Oe as LOG_ARCHIVE_NOT_CONFIGURED,G as LOG_ARCHIVE_PATH,y as LunoraError,ve as NOOP_EXECUTION_CONTEXT,l as SHARD_REGISTRY_DO_NAME,e as VERSION,K as analyticsEngineSink,pe as applyJurisdiction,Re as applyRestCache,fe as argsFromQuery,b as buildHealthRoutes,le as buildRestRoutes,Q as combineSinks,be as composeIdentityResolvers,i as composeWorker,X as consoleSink,S as createCrossShardRelationCapabilities,x as createDynamicShardRegistry,g as createKvCursorStore,n as createLunoraHandler,u as createMemoryCursorStore,oe as createPipelineLogReader,ae as createQueryCoordinator,xe as createRestRateLimit,he as createShardClient,se as createStaticShardRegistry,p as createWorker,F as d1Probe,Le as decorateResponse,T as defineExportSink,m as defineRpcEnvelope,P as durableObjectProbe,W as emitLogEvent,Y as emitRpcEvent,ge as enforceOrigin,ue as handleCorsPreflight,w as memoizeIdentity,z as memoizeIdentityPerRequest,ie as mergeStrategyForAggregate,j as otlpSink,J as pipelineLogSink,D as presenceProbe,A as r2Sink,_e as readShardKey,Ee as requestCarriesCredentials,U as resolveLogArchiveFromEnv,c as resolveLunoraOptions,Te as resolveSecurity,me as resolveShard,Se as restCacheHeaders,ye as restSurfaceFromRegistry,Fe as routeIdentityResolvers,h as runExportTap,k as sanitizeChange,B as sentrySink,t as toAirbyteMessages,C as toErrorResponse,a as toFivetranResponse,O as webhookExportSink,Z as webhookSink,R as withFrameworkWorker};

package/dist/packem_shared/{DEFAULT_REGISTRY_CACHE_TTL_MS-CXdcx3iw.mjs → DEFAULT_REGISTRY_CACHE_TTL_MS-CCDyswsf.mjs}

@@ -1 +1 @@
-import{LunoraError as n}from"./LunoraError-C08OP5Uq.mjs";import{applyJurisdiction as S,resolveShard as _}from"./applyJurisdiction-8bzZjAPR.mjs";const m="__lunora_shard_registry__",f=3e4,g="https://shard-registry.internal",l=async r=>await r.json(),T=r=>{const w=r.instanceName??m,o=r.cacheTtlMs??f,a=new Map,p=S(r.namespace,r.jurisdiction);let c;const d=()=>(c??=_(p,w),c),h=async(t,e)=>d().fetch(new Request(`${g}${t}`,{body:JSON.stringify(e),headers:{"content-type":"application/json"},method:"POST"})),y=async t=>d().fetch(new Request(`${g}${t}`,{method:"GET"}));return{invalidate(t){t===void 0?a.clear():a.delete(t)},async listShardKeys(t){const e=Date.now(),s=a.get(t);if(s&&s.expiresAt>e)return s.shardKeys;const i=await y(`/list?table=${encodeURIComponent(t)}`);if(!i.ok)throw new n(`shard registry /list returned ${String(i.status)}`);const{shardKeys:u}=await l(i);return o>0&&a.set(t,{expiresAt:e+o,shardKeys:u}),u},async register(t,e){const s=await h("/register",{shardKey:e,table:t});if(!s.ok)throw new n(`shard registry /register returned ${String(s.status)}`);a.delete(t)},async snapshot(){const t=await y("/snapshot");if(!t.ok)throw new n(`shard registry /snapshot returned ${String(t.status)}`);const{tables:e}=await l(t);return e},async unregister(t,e){const s=await h("/unregister",{shardKey:e,table:t});if(!s.ok)throw new n(`shard registry /unregister returned ${String(s.status)}`);a.delete(t)}}};export{f as DEFAULT_REGISTRY_CACHE_TTL_MS,m as SHARD_REGISTRY_DO_NAME,T as createDynamicShardRegistry};
+import{LunoraError as n}from"./LunoraError-ByasbDmd.mjs";import{applyJurisdiction as S,resolveShard as _}from"./applyJurisdiction-Dsm_m5zW.mjs";const m="__lunora_shard_registry__",f=3e4,g="https://shard-registry.internal",l=async r=>await r.json(),T=r=>{const w=r.instanceName??m,o=r.cacheTtlMs??f,a=new Map,p=S(r.namespace,r.jurisdiction);let c;const d=()=>(c??=_(p,w),c),h=async(t,e)=>d().fetch(new Request(`${g}${t}`,{body:JSON.stringify(e),headers:{"content-type":"application/json"},method:"POST"})),y=async t=>d().fetch(new Request(`${g}${t}`,{method:"GET"}));return{invalidate(t){t===void 0?a.clear():a.delete(t)},async listShardKeys(t){const e=Date.now(),s=a.get(t);if(s&&s.expiresAt>e)return s.shardKeys;const i=await y(`/list?table=${encodeURIComponent(t)}`);if(!i.ok)throw new n(`shard registry /list returned ${String(i.status)}`);const{shardKeys:u}=await l(i);return o>0&&a.set(t,{expiresAt:e+o,shardKeys:u}),u},async register(t,e){const s=await h("/register",{shardKey:e,table:t});if(!s.ok)throw new n(`shard registry /register returned ${String(s.status)}`);a.delete(t)},async snapshot(){const t=await y("/snapshot");if(!t.ok)throw new n(`shard registry /snapshot returned ${String(t.status)}`);const{tables:e}=await l(t);return e},async unregister(t,e){const s=await h("/unregister",{shardKey:e,table:t});if(!s.ok)throw new n(`shard registry /unregister returned ${String(s.status)}`);a.delete(t)}}};export{f as DEFAULT_REGISTRY_CACHE_TTL_MS,m as SHARD_REGISTRY_DO_NAME,T as createDynamicShardRegistry};

package/dist/packem_shared/{HEALTH_PATH-CmjJOkwf.mjs → HEALTH_PATH-BuLCcWNS.mjs}

@@ -1 +1 @@
-import{LunoraError as k}from"./LunoraError-C08OP5Uq.mjs";import{t as H}from"./method-guard-CfF0J5OT.mjs";import{resolveShard as R}from"./applyJurisdiction-8bzZjAPR.mjs";const T="/_lunora/health",P="/_lunora/health/ready",_=a=>a==="liveness"?["liveness"]:a==="readiness"?["readiness"]:["liveness","readiness"];class j{#e=new Map;addChecker(e,s,t){this.#e.set(e,{run:s,types:t.type})}async getReport(e){const s=[...this.#e].filter(([,r])=>e===void 0||r.types.includes(e)),t=await Promise.all(s.map(async([r,o])=>[r,await o.run()]));return{healthy:t.every(([,r])=>r.health.healthy),report:Object.fromEntries(t)}}}const N=a=>{const e=new j,s=new Set;for(const t of a)t.critical&&s.add(t.name),e.addChecker(t.name,async()=>{let r;try{r=await t.check()}catch(o){r={healthy:!1,message:o instanceof Error?o.message:"probe failed"}}return{health:{healthy:r.healthy,...r.message===void 0?{}:{message:r.message}}}},{type:_(t.kind)});return{criticalNames:s,registry:e}},S=(a,e)=>{const s=a.includes(":")?a.slice(0,a.indexOf(":")):"probe",t=(e.get(s)??0)+1;return e.set(s,t),t===1?s:`${s}#${String(t)}`},C=(a,e)=>a?"unhealthy":e?"degraded":"healthy",O=(a,e,s,t,r)=>{const o=[];let d=!1,u=!1;const m=new Map;for(const[h,c]of Object.entries(a)){const n=e.has(h),i=c.health.healthy;u=u||!i,d=d||!i&&n;const l=s==="admin"?h:S(h,m);o.push({critical:n,...s==="admin"&&c.health.message!==void 0?{message:c.health.message}:{},name:l,status:i?"up":"down"})}return o.sort((h,c)=>h.name.localeCompare(c.name)),{anyCriticalDown:d,body:{appName:t,appVersion:r,checks:o,status:C(d,u),timestamp:new Date().toISOString()}}},q=a=>{const{appName:e="lunora",appVersion:s="0.0.0",auth:t="public",cacheTtlMs:r,isAdmin:o,resolveProbes:d}=a,u=n=>r!==void 0?r:n==="readiness"?0:t==="public"?5e3:0,m={},h=n=>{if(t==="admin"&&!o(n))throw new k("health endpoint requires a valid admin bearer",{code:"ADMIN_FORBIDDEN",status:403})},c=async(n,i,l)=>{const f=H(n,["GET","HEAD"]);if(f)return f;h(n);const y=u(l);if(y>0){const p=m[l];if(p!==void 0&&Date.now()<p.expiresAt)return Response.json(p.body,{headers:{"cache-control":"no-store"},status:p.down?503:200})}const{criticalNames:w,registry:v}=N(d(i)),{healthy:E,report:A}=await v.getReport(l==="readiness"?"readiness":void 0),{anyCriticalDown:D,body:g}=O(A,w,t,e,s),b=l==="readiness"?!E:D;return y>0&&(m[l]={body:g,down:b,expiresAt:Date.now()+y}),Response.json(g,{headers:{"cache-control":"no-store"},status:b?503:200})};return{[T]:(n,i)=>c(n,i,"aggregate"),[P]:(n,i)=>c(n,i,"readiness")}},I=(a,e,s)=>({check:async()=>{try{return await R(e,s).fetch(new Request("https://shard.internal/_lunora/status",{method:"GET"})),{healthy:!0}}catch{return{healthy:!1,message:"durable object unreachable"}}},critical:!0,name:a}),$=(a,e)=>({check:async()=>{try{return await e.prepare("SELECT 1").first(),{healthy:!0}}catch{return{healthy:!1,message:"d1 query failed"}}},critical:!0,name:a}),B=(a,e)=>({check:()=>e?{healthy:!0}:{healthy:!1,message:"binding not configured"},critical:!1,name:a});export{T as HEALTH_PATH,P as HEALTH_READY_PATH,q as buildHealthRoutes,$ as d1Probe,I as durableObjectProbe,B as presenceProbe};
+import{LunoraError as k}from"./LunoraError-ByasbDmd.mjs";import{t as H}from"./method-guard-rzvo19pa.mjs";import{resolveShard as R}from"./applyJurisdiction-Dsm_m5zW.mjs";const T="/_lunora/health",P="/_lunora/health/ready",_=a=>a==="liveness"?["liveness"]:a==="readiness"?["readiness"]:["liveness","readiness"];class j{#e=new Map;addChecker(e,s,t){this.#e.set(e,{run:s,types:t.type})}async getReport(e){const s=[...this.#e].filter(([,r])=>e===void 0||r.types.includes(e)),t=await Promise.all(s.map(async([r,o])=>[r,await o.run()]));return{healthy:t.every(([,r])=>r.health.healthy),report:Object.fromEntries(t)}}}const N=a=>{const e=new j,s=new Set;for(const t of a)t.critical&&s.add(t.name),e.addChecker(t.name,async()=>{let r;try{r=await t.check()}catch(o){r={healthy:!1,message:o instanceof Error?o.message:"probe failed"}}return{health:{healthy:r.healthy,...r.message===void 0?{}:{message:r.message}}}},{type:_(t.kind)});return{criticalNames:s,registry:e}},S=(a,e)=>{const s=a.includes(":")?a.slice(0,a.indexOf(":")):"probe",t=(e.get(s)??0)+1;return e.set(s,t),t===1?s:`${s}#${String(t)}`},C=(a,e)=>a?"unhealthy":e?"degraded":"healthy",O=(a,e,s,t,r)=>{const o=[];let d=!1,u=!1;const m=new Map;for(const[h,c]of Object.entries(a)){const n=e.has(h),i=c.health.healthy;u=u||!i,d=d||!i&&n;const l=s==="admin"?h:S(h,m);o.push({critical:n,...s==="admin"&&c.health.message!==void 0?{message:c.health.message}:{},name:l,status:i?"up":"down"})}return o.sort((h,c)=>h.name.localeCompare(c.name)),{anyCriticalDown:d,body:{appName:t,appVersion:r,checks:o,status:C(d,u),timestamp:new Date().toISOString()}}},q=a=>{const{appName:e="lunora",appVersion:s="0.0.0",auth:t="public",cacheTtlMs:r,isAdmin:o,resolveProbes:d}=a,u=n=>r!==void 0?r:n==="readiness"?0:t==="public"?5e3:0,m={},h=n=>{if(t==="admin"&&!o(n))throw new k("health endpoint requires a valid admin bearer",{code:"ADMIN_FORBIDDEN",status:403})},c=async(n,i,l)=>{const f=H(n,["GET","HEAD"]);if(f)return f;h(n);const y=u(l);if(y>0){const p=m[l];if(p!==void 0&&Date.now()<p.expiresAt)return Response.json(p.body,{headers:{"cache-control":"no-store"},status:p.down?503:200})}const{criticalNames:w,registry:v}=N(d(i)),{healthy:E,report:A}=await v.getReport(l==="readiness"?"readiness":void 0),{anyCriticalDown:D,body:g}=O(A,w,t,e,s),b=l==="readiness"?!E:D;return y>0&&(m[l]={body:g,down:b,expiresAt:Date.now()+y}),Response.json(g,{headers:{"cache-control":"no-store"},status:b?503:200})};return{[T]:(n,i)=>c(n,i,"aggregate"),[P]:(n,i)=>c(n,i,"readiness")}},I=(a,e,s)=>({check:async()=>{try{return await R(e,s).fetch(new Request("https://shard.internal/_lunora/status",{method:"GET"})),{healthy:!0}}catch{return{healthy:!1,message:"durable object unreachable"}}},critical:!0,name:a}),$=(a,e)=>({check:async()=>{try{return await e.prepare("SELECT 1").first(),{healthy:!0}}catch{return{healthy:!1,message:"d1 query failed"}}},critical:!0,name:a}),B=(a,e)=>({check:()=>e?{healthy:!0}:{healthy:!1,message:"binding not configured"},critical:!1,name:a});export{T as HEALTH_PATH,P as HEALTH_READY_PATH,q as buildHealthRoutes,$ as d1Probe,I as durableObjectProbe,B as presenceProbe};

package/dist/packem_shared/{LOG_ARCHIVE_PATH-5vxNUndx.mjs → LOG_ARCHIVE_PATH-CuHKuDCS.mjs}

@@ -1 +1 @@
-import{createR2Sql as f}from"@lunora/bindings/r2sql";import{LOG_ARCHIVE_NOT_CONFIGURED as _}from"./LOG_ARCHIVE_NOT_CONFIGURED-CDpi4yFD.mjs";import{L as l,c as h}from"./pipeline-log-reader-FF1V32O2.mjs";import{LunoraError as c}from"./LunoraError-C08OP5Uq.mjs";import{r as E}from"./method-guard-CfF0J5OT.mjs";const g="/_lunora/admin/logs/archive",A="LUNORA_LOG_ARCHIVE_TABLE",T="LUNORA_LOG_ARCHIVE_NAMESPACE",Q=e=>{if(typeof e!="object"||e===null)return;const t=e,o=t[A];if(typeof o!="string"||o==="")return;const n=t[T];return{table:o,...typeof n=="string"&&n!==""?{namespace:n}:{}}},O=new Set(l),b=e=>typeof e=="string"&&e!==""?e:void 0,C=(e,t)=>{if(e!==void 0){if(typeof e!="string"||!O.has(e))throw new c(`logs archive: invalid \`${t}\` — expected one of ${l.join(", ")}`,{code:"BAD_REQUEST",status:400});return e}},u=(e,t)=>{if(e!==void 0){if(typeof e!="number"||!Number.isFinite(e))throw new c(`logs archive: invalid \`${t}\` — expected a finite number`,{code:"BAD_REQUEST",status:400});return e}},I=e=>{const t={},o=r=>{const i=b(e[r]);i!==void 0&&(t[r]=i)},n=r=>{const i=C(e[r],r);i!==void 0&&(t[r]=i)},s=r=>{const i=u(e[r],r);i!==void 0&&(t[r]=i)};o("functionPath"),o("functionPathPrefix"),o("traceId"),o("shardKey"),o("userId"),n("level"),n("minLevel"),s("sinceTs"),s("untilTs"),s("limit");const a=e.cursor;if(typeof a=="object"&&a!==null){const r=u(a.ts,"cursor.ts");r!==void 0&&(t.cursor={ts:r})}return t},S=e=>{const t=e.R2_SQL_ACCOUNT_ID??e.CLOUDFLARE_ACCOUNT_ID,o=e.R2_SQL_TOKEN,n=e.R2_SQL_BUCKET,s=[];if((t===void 0||t==="")&&s.push("R2_SQL_ACCOUNT_ID"),(o===void 0||o==="")&&s.push("R2_SQL_TOKEN"),(n===void 0||n==="")&&s.push("R2_SQL_BUCKET"),s.length>0)throw new c(`log archive not configured (missing ${s.join(", ")}). The Pipeline must write to an R2 Data Catalog (Iceberg) table, and R2_SQL_ACCOUNT_ID / R2_SQL_TOKEN / R2_SQL_BUCKET must be set — see the observability docs.`,{code:_,status:400});return{accountId:t,apiToken:o,bucket:n}},P=e=>{const{createReader:t=h,readJsonBody:o,requireAdminOption:n}=e,s=async(a,r)=>{E(a,"POST","Log-archive");const i=n(a,e.logArchive,{code:_,message:"log archive requires a `logArchive` config (an R2 Data Catalog table) on the worker — see the observability docs"}),{accountId:d,apiToken:p,bucket:m}=S(r??{}),v=I(await o(a)),L=f({accountId:d,apiToken:p,bucket:m}),R=await t(L,{columnMap:i.columnMap,namespace:i.namespace,table:i.table}).query(v);return Response.json(R,{headers:{"content-type":"application/json"},status:200})};return{[g]:s}};export{_ as LOG_ARCHIVE_NOT_CONFIGURED,g as LOG_ARCHIVE_PATH,P as buildLogArchiveAdminRoutes,Q as resolveLogArchiveFromEnv};
+import{createR2Sql as f}from"@lunora/bindings/r2sql";import{LOG_ARCHIVE_NOT_CONFIGURED as _}from"./LOG_ARCHIVE_NOT_CONFIGURED-CDpi4yFD.mjs";import{L as l,c as h}from"./pipeline-log-reader-FF1V32O2.mjs";import{LunoraError as c}from"./LunoraError-ByasbDmd.mjs";import{r as E}from"./method-guard-rzvo19pa.mjs";const g="/_lunora/admin/logs/archive",A="LUNORA_LOG_ARCHIVE_TABLE",T="LUNORA_LOG_ARCHIVE_NAMESPACE",Q=e=>{if(typeof e!="object"||e===null)return;const t=e,o=t[A];if(typeof o!="string"||o==="")return;const n=t[T];return{table:o,...typeof n=="string"&&n!==""?{namespace:n}:{}}},O=new Set(l),b=e=>typeof e=="string"&&e!==""?e:void 0,C=(e,t)=>{if(e!==void 0){if(typeof e!="string"||!O.has(e))throw new c(`logs archive: invalid \`${t}\` — expected one of ${l.join(", ")}`,{code:"BAD_REQUEST",status:400});return e}},u=(e,t)=>{if(e!==void 0){if(typeof e!="number"||!Number.isFinite(e))throw new c(`logs archive: invalid \`${t}\` — expected a finite number`,{code:"BAD_REQUEST",status:400});return e}},I=e=>{const t={},o=r=>{const i=b(e[r]);i!==void 0&&(t[r]=i)},n=r=>{const i=C(e[r],r);i!==void 0&&(t[r]=i)},s=r=>{const i=u(e[r],r);i!==void 0&&(t[r]=i)};o("functionPath"),o("functionPathPrefix"),o("traceId"),o("shardKey"),o("userId"),n("level"),n("minLevel"),s("sinceTs"),s("untilTs"),s("limit");const a=e.cursor;if(typeof a=="object"&&a!==null){const r=u(a.ts,"cursor.ts");r!==void 0&&(t.cursor={ts:r})}return t},S=e=>{const t=e.R2_SQL_ACCOUNT_ID??e.CLOUDFLARE_ACCOUNT_ID,o=e.R2_SQL_TOKEN,n=e.R2_SQL_BUCKET,s=[];if((t===void 0||t==="")&&s.push("R2_SQL_ACCOUNT_ID"),(o===void 0||o==="")&&s.push("R2_SQL_TOKEN"),(n===void 0||n==="")&&s.push("R2_SQL_BUCKET"),s.length>0)throw new c(`log archive not configured (missing ${s.join(", ")}). The Pipeline must write to an R2 Data Catalog (Iceberg) table, and R2_SQL_ACCOUNT_ID / R2_SQL_TOKEN / R2_SQL_BUCKET must be set — see the observability docs.`,{code:_,status:400});return{accountId:t,apiToken:o,bucket:n}},P=e=>{const{createReader:t=h,readJsonBody:o,requireAdminOption:n}=e,s=async(a,r)=>{E(a,"POST","Log-archive");const i=n(a,e.logArchive,{code:_,message:"log archive requires a `logArchive` config (an R2 Data Catalog table) on the worker — see the observability docs"}),{accountId:d,apiToken:p,bucket:m}=S(r??{}),v=I(await o(a)),L=f({accountId:d,apiToken:p,bucket:m}),R=await t(L,{columnMap:i.columnMap,namespace:i.namespace,table:i.table}).query(v);return Response.json(R,{headers:{"content-type":"application/json"},status:200})};return{[g]:s}};export{_ as LOG_ARCHIVE_NOT_CONFIGURED,g as LOG_ARCHIVE_PATH,P as buildLogArchiveAdminRoutes,Q as resolveLogArchiveFromEnv};

package/dist/packem_shared/{LunoraError-C08OP5Uq.mjs → LunoraError-ByasbDmd.mjs}

@@ -1 +1 @@
-import{toErrorBody as t,LunoraError as n}from"@lunora/errors";const a=e=>{const{body:o,redacted:r,status:s}=t(e,{fallbackCode:"INTERNAL",redactedMessage:"Internal error"});return r&&console.error("[lunora] internal error:",e),Response.json({error:o},{headers:{"content-type":"application/json"},status:s})};class u extends n{constructor(o,r){super(r?.code??"INTERNAL",o,{cause:r?.cause,status:r?.status})}toResponse(){return a(this)}}export{u as LunoraError,a as toErrorResponse};
+import{LunoraError as t,toErrorBody as n}from"@lunora/errors";const a=e=>{const{body:o,redacted:r,status:s}=n(e,{fallbackCode:"INTERNAL",redactedMessage:"Internal error"});return r&&console.error("[lunora] internal error:",e),Response.json({error:o},{headers:{"content-type":"application/json"},status:s})};class u extends t{constructor(o,r){super(r?.code??"INTERNAL",o,{cause:r?.cause,status:r?.status})}toResponse(){return a(this)}}export{u as LunoraError,a as toErrorResponse};

package/dist/packem_shared/applyJurisdiction-Dsm_m5zW.mjs

@@ -0,0 +1 @@
+import{resolveShard as u}from"@lunora/platform";const d=new WeakMap,a=o=>typeof o.idFromName=="function",s=o=>{if(!a(o))return o;const e=o,t=d.get(o);if(t!==void 0)return t;const r=typeof e.jurisdiction=="function"?i=>s(e.jurisdiction(i)):void 0,n=typeof e.getByName=="function"?{get:i=>e.get(i),getByName:i=>e.getByName(i),idForName:i=>e.idFromName(i),jurisdiction:r}:{get:i=>e.get(i),idForName:i=>e.idFromName(i),jurisdiction:r};return d.set(o,n),n},m=(o,e)=>{if(e===void 0)return o;if(typeof o.jurisdiction!="function")throw new TypeError(`@lunora/runtime: Durable Object namespace does not support jurisdiction("${e}") — update @cloudflare/workers-types or remove the jurisdiction option`);return o.jurisdiction(e)},p=(o,e)=>u(s(o),e);export{m as applyJurisdiction,p as resolveShard};

package/dist/packem_shared/{argsFromQuery-Cp8uiYaU.mjs → argsFromQuery-nMGzM5bK.mjs}

@@ -1 +1 @@
-import"./rest-cache-5unAzdFN.mjs";import{g as t,E as o,U as i,p as m,y as R}from"./rest-routes--GsO-U9C.mjs";import"./method-guard-CfF0J5OT.mjs";export{t as argsFromQuery,o as buildRestRoutes,i as createRestRateLimit,m as readShardKey,R as restSurfaceFromRegistry};
+import"./rest-cache-5unAzdFN.mjs";import{g as t,E as o,U as i,p as m,y as R}from"./rest-routes-BqldHiaH.mjs";import"./method-guard-rzvo19pa.mjs";export{t as argsFromQuery,o as buildRestRoutes,i as createRestRateLimit,m as readShardKey,R as restSurfaceFromRegistry};

package/dist/packem_shared/{composeIdentityResolvers-DlBbYmBJ.mjs → composeIdentityResolvers-DwE0Jbww.mjs}

@@ -1 +1 @@
-import{LunoraError as c}from"./LunoraError-C08OP5Uq.mjs";const u=(r,n={})=>{const t=n.onError??"fail-closed";return async(o,e)=>{for(const i of r){let s;try{s=await i(o,e)}catch(a){if(t==="skip")continue;throw a}if(s)return s}return null}},d=r=>{const n=Object.keys(r).filter(t=>t!=="*").toSorted((t,o)=>o.length-t.length);return(t,o)=>{const{pathname:e}=new URL(t.url),i=n.find(a=>e===a||e.startsWith(a.endsWith("/")?a:`${a}/`)),s=i===void 0?r["*"]:r[i];return s===void 0?null:s(t,o)}},f=(r,n)=>n===void 0||r===void 0?r:async(t,o)=>{const e=await r(t,o);if(!e)return e;const i=n.validate(e);if(i.ok)return e;if(n.onInvalid==="reject")throw new c(`identity claims failed the declared contract: ${i.error}`,{code:"UNAUTHENTICATED",status:401});return null};export{u as composeIdentityResolvers,d as routeIdentityResolvers,f as wrapResolverWithContract};
+import{LunoraError as c}from"./LunoraError-ByasbDmd.mjs";const u=(r,n={})=>{const t=n.onError??"fail-closed";return async(o,e)=>{for(const i of r){let s;try{s=await i(o,e)}catch(a){if(t==="skip")continue;throw a}if(s)return s}return null}},d=r=>{const n=Object.keys(r).filter(t=>t!=="*").toSorted((t,o)=>o.length-t.length);return(t,o)=>{const{pathname:e}=new URL(t.url),i=n.find(a=>e===a||e.startsWith(a.endsWith("/")?a:`${a}/`)),s=i===void 0?r["*"]:r[i];return s===void 0?null:s(t,o)}},f=(r,n)=>n===void 0||r===void 0?r:async(t,o)=>{const e=await r(t,o);if(!e)return e;const i=n.validate(e);if(i.ok)return e;if(n.onInvalid==="reject")throw new c(`identity claims failed the declared contract: ${i.error}`,{code:"UNAUTHENTICATED",status:401});return null};export{u as composeIdentityResolvers,d as routeIdentityResolvers,f as wrapResolverWithContract};