@lunora/codegen 1.0.0-alpha.1 → 1.0.0-alpha.11

package/dist/packem_shared/{emitApi-hRVC-kE7.mjs → GENERATED_HEADER-r1OZrKAx.mjs}

@@ -1,5 +1,174 @@
 import { s as sanitizeNamespace } from './paths-BRd6JHuF.mjs';
 
+const LITERAL_VALUE_RE = /^(?:"[^"\\]*"|'[^'\\]*'|-?\d+(?:\.\d+)?|true|false|null)$/u;
+
+const PASS_THROUGH_KINDS = /* @__PURE__ */ new Set(["any", "bigint", "boolean", "date", "id", "null", "number", "storage", "string", "timestamp"]);
+const hasColumnModifier = (node) => node.column !== void 0;
+const emitScalarGuard = (kind, inExpr) => {
+  switch (kind) {
+    case "bigint": {
+      return `if (typeof ${inExpr} !== "bigint") return DEFER;
+`;
+    }
+    case "boolean": {
+      return `if (typeof ${inExpr} !== "boolean") return DEFER;
+`;
+    }
+    case "date":
+    case "number":
+    case "timestamp": {
+      return `if (typeof ${inExpr} !== "number" || !Number.isFinite(${inExpr})) return DEFER;
+`;
+    }
+    case "null": {
+      return `if (${inExpr} !== null) return DEFER;
+`;
+    }
+    // string / id / storage all parse as a bare string at runtime.
+    default: {
+      return `if (typeof ${inExpr} !== "string") return DEFER;
+`;
+    }
+  }
+};
+const compileLiteral = (node, inExpr) => {
+  const literal = node.literalValue?.trim();
+  if (literal === void 0 || !LITERAL_VALUE_RE.test(literal)) {
+    return void 0;
+  }
+  return { out: inExpr, pre: `if (${inExpr} !== ${literal}) return DEFER;
+` };
+};
+const compileNode = (node, inExpr, context) => {
+  if (hasColumnModifier(node)) {
+    return void 0;
+  }
+  if (node.hasRefinement || node.sourceText !== void 0) {
+    return void 0;
+  }
+  if (PASS_THROUGH_KINDS.has(node.kind)) {
+    if (node.kind === "any") {
+      return { out: inExpr, pre: "" };
+    }
+    return { out: inExpr, pre: emitScalarGuard(node.kind, inExpr) };
+  }
+  switch (node.kind) {
+    case "array": {
+      return compileArray(node, inExpr, context);
+    }
+    case "literal": {
+      return compileLiteral(node, inExpr);
+    }
+    case "object": {
+      return compileObject(node, inExpr, context);
+    }
+    default: {
+      return void 0;
+    }
+  }
+};
+const compileArray = (node, inExpr, context) => {
+  const { inner } = node;
+  if (!inner) {
+    return void 0;
+  }
+  const id = context.next();
+  const array = `__arr${String(id)}`;
+  const index = `__i${String(id)}`;
+  const element = `__e${String(id)}`;
+  const innerEmit = compileNode(inner, element, context);
+  if (!innerEmit) {
+    return void 0;
+  }
+  const pre = `if (!Array.isArray(${inExpr})) return DEFER;
+const ${array} = new Array(${inExpr}.length);
+for (let ${index} = 0; ${index} < ${inExpr}.length; ${index}++) {
+const ${element} = ${inExpr}[${index}];
+${innerEmit.pre}${array}[${index}] = ${innerEmit.out};
+}
+`;
+  return { out: array, pre };
+};
+const compileField = (key, node, access, context) => {
+  const keyLiteral = JSON.stringify(key);
+  if (node.kind === "optional") {
+    if (node.hasRefinement || node.sourceText !== void 0 || hasColumnModifier(node)) {
+      return void 0;
+    }
+    const { inner } = node;
+    if (!inner) {
+      return void 0;
+    }
+    const innerEmit = compileNode(inner, access, context);
+    if (!innerEmit) {
+      return void 0;
+    }
+    const id = context.next();
+    const has = `__has${String(id)}`;
+    const value = `__val${String(id)}`;
+    const pre = `let ${has} = false;
+let ${value};
+if (${access} !== undefined) {
+${innerEmit.pre}${value} = ${innerEmit.out};
+${has} = true;
+}
+`;
+    return { entry: `...(${has} ? { ${keyLiteral}: ${value} } : {})`, pre };
+  }
+  const emit = compileNode(node, access, context);
+  if (!emit) {
+    return void 0;
+  }
+  return { entry: `${keyLiteral}: ${emit.out}`, pre: emit.pre };
+};
+const compileFields = (shape, accessFor, context) => {
+  let pre = "";
+  const entries = [];
+  for (const key of Object.keys(shape)) {
+    const node = shape[key];
+    if (!node) {
+      return void 0;
+    }
+    const field = compileField(key, node, accessFor(key), context);
+    if (!field) {
+      return void 0;
+    }
+    pre += field.pre;
+    entries.push(field.entry);
+  }
+  return { entries: entries.join(", "), pre };
+};
+const compileObject = (node, inExpr, context) => {
+  const shape = node.shape ?? {};
+  const fields = compileFields(shape, (key) => `${inExpr}[${JSON.stringify(key)}]`, context);
+  if (!fields) {
+    return void 0;
+  }
+  const id = context.next();
+  const object = `__obj${String(id)}`;
+  const pre = `if (typeof ${inExpr} !== "object" || ${inExpr} === null || Array.isArray(${inExpr})) return DEFER;
+${fields.pre}const ${object} = { ${fields.entries} };
+`;
+  return { out: object, pre };
+};
+const compileArgsValidator = (args) => {
+  let counter = 0;
+  const context = {
+    next: () => {
+      counter += 1;
+      return counter;
+    }
+  };
+  const fields = compileFields(args, (key) => `source[${JSON.stringify(key)}]`, context);
+  if (!fields) {
+    return void 0;
+  }
+  return `(source) => {
+if (typeof source !== "object" || source === null || Array.isArray(source)) return DEFER;
+${fields.pre}return { ${fields.entries} };
+}`;
+};
+
 const GENERATED_HEADER = "// GENERATED by @lunora/codegen — do not edit.\n// Run `lunora codegen` to regenerate.\n\n";
 const baseSpecifiers = (useUmbrella = false) => useUmbrella ? {
   client: "lunorash/client",
@@ -7,17 +176,18 @@ const baseSpecifiers = (useUmbrella = false) => useUmbrella ? {
   server: "lunorash/server",
   serverDataModel: "lunorash/server/data-model",
   serverDrizzle: "lunorash/server/drizzle",
-  serverTypes: "lunorash/server/types"
+  serverTypes: "lunorash/server/types",
+  values: "lunorash/values"
 } : {
   client: "@lunora/client",
   do: "@lunora/do",
   server: "@lunora/server",
   serverDataModel: "@lunora/server/data-model",
   serverDrizzle: "@lunora/server/drizzle",
-  serverTypes: "@lunora/server/types"
+  serverTypes: "@lunora/server/types",
+  values: "@lunora/values"
 };
 const IDENTIFIER_RE = /^[A-Za-z_$][\w$]*$/u;
-const LITERAL_VALUE_RE = /^(?:"[^"\\]*"|'[^'\\]*'|-?\d+(?:\.\d+)?|true|false|null)$/u;
 const IMPORT_PATH_RE = /^[\w./-]+$/u;
 const assertIdentifier = (value, context) => {
   if (!IDENTIFIER_RE.test(value)) {
@@ -469,6 +639,17 @@ const renderFunctionRegistry = (functions, migrations) => {
   const migrationEntries = migrations.map(
     (migration) => `    ${JSON.stringify(migration.id)}: ${aliasByPath.get(migration.filePath) ?? ""}.${migration.exportName} as unknown as RegisteredDataMigration,`
   ).join("\n");
+  const installLines = functions.map((definition) => {
+    if (definition.lifecycle || Object.keys(definition.args).length === 0) {
+      return void 0;
+    }
+    const compiled = compileArgsValidator(definition.args);
+    if (compiled === void 0) {
+      return void 0;
+    }
+    const alias = aliasByPath.get(definition.filePath) ?? "";
+    return `installCompiledValidatorMap(${alias}.${definition.exportName}.args, ${compiled});`;
+  }).filter((line) => line !== void 0).join("\n");
   return {
     dispatchBody: dispatchEntries.length > 0 ? `
 ${dispatchEntries}
@@ -476,6 +657,7 @@ ${dispatchEntries}
     importBlock: importLines.length > 0 ? `${importLines}
 
 ` : "",
+    installBlock: installLines,
     migrationBody: migrationEntries.length > 0 ? `
 ${migrationEntries}
 ` : ""
@@ -539,6 +721,8 @@ const emitServer = ({
   hasKv = false,
   hasPayments = false,
   hasPipelines = false,
+  hasR2sql = false,
+  queues = [],
   schema,
   storageRuleBuckets = [],
   useUmbrella = false,
@@ -572,6 +756,11 @@ const emitServer = ({
       assertIdentifier(workflow.bindingName, `workflow binding "${workflow.bindingName}"`);
       return `    /** Workflow binding for the \`${workflow.exportName}\` workflow. */
     readonly ${workflow.bindingName}?: unknown;`;
+    }),
+    ...queues.map((queue) => {
+      assertIdentifier(queue.bindingName, `queue binding "${queue.bindingName}"`);
+      return `    /** Queue producer binding for the \`${queue.exportName}\` queue. */
+    readonly ${queue.bindingName}?: unknown;`;
     })
   ].join("\n");
   const envBlock = `
@@ -594,7 +783,7 @@ ${envBindingFields}` : ""}
 /** Alias for {@link CloudflareBindings} — the typed shape of \`env\`. */
 export type Env = CloudflareBindings;`;
   const kvContextField = hasKv ? `
-    readonly kv: import("@lunora/kv").Kv;` : "";
+    readonly kv: import("@lunora/bindings/kv").Kv;` : "";
   const hyperdriveActionField = hasHyperdrive ? `
     /**
      * External database access via Hyperdrive. Non-deterministic — available only in actions. Writes here are NOT tracked by Lunora live queries; subscriptions will not re-run on external DB changes.
@@ -605,13 +794,18 @@ export type Env = CloudflareBindings;`;
     readonly browser: import("@lunora/browser").Browser;` : "";
   const imagesActionField = hasImages ? `
     /** Cloudflare Images transforms (resize/format/optimize). Non-deterministic — available only in actions. */
-    readonly images: import("@lunora/images").Images;` : "";
+    readonly images: import("@lunora/bindings/images").Images;` : "";
   const analyticsContextField = hasAnalytics ? `
     /** Analytics Engine telemetry sink. Fire-and-forget and sampled; do not read it back in-handler. */
-    readonly analytics: import("@lunora/analytics").AnalyticsClient;` : "";
+    readonly analytics: import("@lunora/bindings/analytics").AnalyticsClient;` : "";
   const pipelinesActionField = hasPipelines ? `
     /** Pipelines ingestion sink (durable, R2-backed). Fire-and-forget and batched; do not read it back in-handler. */
-    readonly pipelines: import("@lunora/pipelines").PipelineClient;` : "";
+    readonly pipelines: import("@lunora/bindings/pipelines").PipelineClient;` : "";
+  const r2sqlActionField = hasR2sql ? `
+    /**
+     * R2 SQL over Apache Iceberg tables (window functions, DISTINCT, set operations). Non-deterministic — available only in actions. Reads here are NOT tracked by Lunora live queries.
+     */
+    readonly r2sql: import("@lunora/bindings/r2sql").R2SqlClient;` : "";
   const hasWorkflows = workflows.length > 0;
   const workflowsTypeImport = hasWorkflows ? `import type { WorkflowHandle } from "@lunora/workflow";
 import type * as lunoraWorkflowDefinitions from "../workflows.js";
@@ -632,6 +826,21 @@ ${workflows.map((workflow) => `    get(name: ${JSON.stringify(workflow.exportNam
   const workflowsOmit = hasWorkflows ? ` | "workflows"` : "";
   const workflowsContextField = hasWorkflows ? `
     readonly workflows: LunoraWorkflows;` : "";
+  const hasQueues = queues.length > 0;
+  const queuesTypeImport = hasQueues ? `import type { QueueProducer } from "@lunora/queue";
+import type * as lunoraQueueDefinitions from "../queues.js";
+` : "";
+  const queuesTypeBlock = hasQueues ? `
+
+/** Message body type carried by a \`defineQueue\` definition (its phantom \`__lunoraBody\`). */
+type QueueBodyOf<Definition> = Definition extends { __lunoraBody?: infer Body } ? (unknown extends Body ? unknown : NonNullable<Body>) : unknown;
+
+/** This project's declared queues, addressable from \`ctx.queues\` by their \`lunora/queues.ts\` export name. */
+export interface LunoraQueues {
+${queues.map((queue) => `    readonly ${queue.exportName}: QueueProducer<QueueBodyOf<typeof lunoraQueueDefinitions.${queue.exportName}>>;`).join("\n")}
+}` : "";
+  const queuesContextField = hasQueues ? `
+    readonly queues: LunoraQueues;` : "";
   const server = `${GENERATED_HEADER}import { createPolicyDsl, initLunora, v as vBase } from "${base.server}";
 import type {
     ActionBuilder,
@@ -653,11 +862,11 @@ import type {
 } from "${base.server}";
 
 import type { DataModel, DatabaseReaderFacade, DatabaseWriterFacade, Doc, Id as IdOfTable, OrmReader, OrmWriter, Relations, TableName } from "./dataModel.js";
-${aiTypeImport}${paymentsTypeImport}${containersTypeImport}${workflowsTypeImport}
+${aiTypeImport}${paymentsTypeImport}${containersTypeImport}${workflowsTypeImport}${queuesTypeImport}
 export type { DataModel, Doc, Id, TableName } from "./dataModel.js";
 
 /** Storage buckets this schema declares (\`v.storage("name")\`), narrowing \`ctx.storage.bucket(name)\`. */
-export type StorageBucketName = ${storageBucketUnion};${envBlock}${workflowsTypeBlock}
+export type StorageBucketName = ${storageBucketUnion};${envBlock}${workflowsTypeBlock}${queuesTypeBlock}
 
 /**
  * Project-typed contexts. The base contexts from \`@lunora/server\` are
@@ -695,13 +904,13 @@ export interface QueryCtx extends Omit<QueryCtxBase, "db" | "storage"> {
 export interface MutationCtx extends Omit<MutationCtxBase, "db" | "storage"${workflowsOmit}> {
     readonly db: Omit<DatabaseWriter, "query" | "get"> & DatabaseWriterFacade & { query: TypedTableQuery; get: TypedTableGet };
     readonly orm: OrmWriter;
-    readonly storage: ReadOnlyStorage<StorageBucketName>;${kvContextField}${analyticsContextField}${workflowsContextField}
+    readonly storage: ReadOnlyStorage<StorageBucketName>;${kvContextField}${analyticsContextField}${workflowsContextField}${queuesContextField}
 }
 
 export interface ActionCtx extends Omit<ActionCtxBase, "db" | "storage"${workflowsOmit}> {
     readonly db: Omit<DatabaseWriter, "query" | "get"> & DatabaseWriterFacade & { query: TypedTableQuery; get: TypedTableGet };
     readonly orm: OrmWriter;
-    readonly storage: StorageBase<StorageBucketName>;${aiActionField}${paymentsActionField}${containersActionField}${kvContextField}${hyperdriveActionField}${browserActionField}${imagesActionField}${analyticsContextField}${pipelinesActionField}${workflowsContextField}
+    readonly storage: StorageBase<StorageBucketName>;${aiActionField}${paymentsActionField}${containersActionField}${kvContextField}${hyperdriveActionField}${browserActionField}${imagesActionField}${analyticsContextField}${pipelinesActionField}${r2sqlActionField}${workflowsContextField}${queuesContextField}
 }
 
 /**
@@ -771,10 +980,21 @@ const renderLifecycleManifest = (functions) => {
   }
   return manifest;
 };
-const emitFunctions = (functions, migrations = []) => {
+const emitFunctions = (functions, migrations = [], useUmbrella = false) => {
   const hasFunctions = functions.length > 0;
-  const { dispatchBody, importBlock, migrationBody } = renderFunctionRegistry(functions, migrations);
+  const base = baseSpecifiers(useUmbrella);
+  const { dispatchBody, importBlock, installBlock, migrationBody } = renderFunctionRegistry(functions, migrations);
   const lifecycleHooks = renderLifecycleManifest(functions);
+  const compiledArgsImport = installBlock.length > 0 ? `import { DEFER_VALIDATION as DEFER, installCompiledValidatorMap } from "${base.values}";
+` : "";
+  const compiledArgsInstall = installBlock.length > 0 ? `
+/**
+ * AOT-compiled argument validators (Worker-safe, no \`eval\`). Each is installed
+ * onto its function's live \`.args\` object and consulted by the interpreted
+ * parser as a zero-allocation fast path; anything it can't model is deferred.
+ */
+${installBlock}
+` : "";
   const caller = renderCaller(functions);
   const callerTypes = caller.types ? `
 ${caller.types}
@@ -789,7 +1009,7 @@ ${caller.implementation}
   const callRegisteredHelper = hasFunctions ? `${CALL_REGISTERED_HELPER}
 
 ` : "";
-  return `${GENERATED_HEADER}${importBlock}import type { ActionCtx, MutationCtx, QueryCtx } from "./server.js";
+  return `${GENERATED_HEADER}${importBlock}${compiledArgsImport}import type { ActionCtx, MutationCtx, QueryCtx } from "./server.js";
 ${dataModelImport}
 /**
  * Single registered function, narrowed to the shape \`handleRpc\` needs.
@@ -815,7 +1035,7 @@ export interface RegisteredLunoraFunction {
  * emits (\`api[namespace][fn].__lunoraRef === "namespace:fn"\`).
  */
 export const LUNORA_FUNCTIONS: Record<string, RegisteredLunoraFunction> = {${dispatchBody}};
-
+${compiledArgsInstall}
 /**
  * Connection-lifecycle manifest: the function paths the generated ShardDO
  * dispatches when a client's WebSocket connects (\`connect\`) or disconnects
@@ -1036,7 +1256,7 @@ const emitKvFragments = (hasKv) => {
     kv?: (env: Record<string, unknown>) => KVNamespaceLike;`,
     contextField: `
                 kv,`,
-    importLines: [`import type { Kv, KVNamespaceLike } from "@lunora/kv";`, `import { createKv } from "@lunora/kv";`],
+    importLines: [`import type { Kv, KVNamespaceLike } from "@lunora/bindings/kv";`, `import { createKv } from "@lunora/bindings/kv";`],
     stub: `
 const kvStub: Kv = {
     delete: async () => {
@@ -1076,8 +1296,8 @@ const emitAnalyticsFragments = (hasAnalytics) => {
     contextField: `
                 analytics,`,
     importLines: [
-      `import type { AnalyticsClient, AnalyticsEngineDatasetLike } from "@lunora/analytics";`,
-      `import { createAnalytics } from "@lunora/analytics";`
+      `import type { AnalyticsClient, AnalyticsEngineDatasetLike } from "@lunora/bindings/analytics";`,
+      `import { createAnalytics } from "@lunora/bindings/analytics";`
     ],
     stub: `
 const analyticsStub: AnalyticsClient = {
@@ -1106,7 +1326,7 @@ const emitImagesFragments = (hasImages) => {
     // ActionCtx-only: woven onto the action ctx object, never query/mutation.
     contextField: `
                 images,`,
-    importLines: [`import type { Images, ImagesBindingLike } from "@lunora/images";`, `import { createImages } from "@lunora/images";`],
+    importLines: [`import type { Images, ImagesBindingLike } from "@lunora/bindings/images";`, `import { createImages } from "@lunora/bindings/images";`],
     stub: `
 const imagesStub: Images = {
     info: async () => {
@@ -1183,17 +1403,96 @@ const browserStub: Browser = {
 `
   };
 };
-const emitContainers = (containers) => {
+const emitR2sqlFragments = (hasR2sql) => {
+  if (!hasR2sql) {
+    return EMPTY_HELPER_FRAGMENTS;
+  }
+  const r2sqlMissing = `throw new Error("ctx.r2sql: no R2 SQL credentials found. Set \\\`R2_SQL_TOKEN\\\`, \\\`R2_SQL_ACCOUNT_ID\\\` (or \\\`CLOUDFLARE_ACCOUNT_ID\\\`), and \\\`R2_SQL_BUCKET\\\` in your env/.dev.vars, or pass an \\\`r2sql\\\` config thunk to createShardDO().");`;
+  return {
+    build: `
+            const r2sqlEnv = env as Record<string, unknown>;
+            const r2sqlAccountId = (r2sqlEnv.R2_SQL_ACCOUNT_ID ?? r2sqlEnv.CLOUDFLARE_ACCOUNT_ID) as string | undefined;
+            const r2sqlToken = r2sqlEnv.R2_SQL_TOKEN as string | undefined;
+            const r2sqlBucket = r2sqlEnv.R2_SQL_BUCKET as string | undefined;
+            const r2sql: R2SqlClient = config.r2sql
+                ? config.r2sql(env)
+                : r2sqlAccountId && r2sqlToken && r2sqlBucket
+                  ? createR2Sql({ accountId: r2sqlAccountId, apiToken: r2sqlToken, bucket: r2sqlBucket })
+                  : r2sqlStub;
+`,
+    configField: `
+    r2sql?: (env: Record<string, unknown>) => R2SqlClient;`,
+    // ActionCtx-only: attached via the \`ctx.r2sql = r2sql\` assignment in the
+    // \`isAction\` block, never the every-ctx object literal.
+    contextField: "",
+    importLines: [`import type { R2SqlClient } from "@lunora/bindings/r2sql";`, `import { createR2Sql } from "@lunora/bindings/r2sql";`],
+    // The stub is typed `R2SqlClient`, so TS flags a missing method at build
+    // time — but it must stay structurally in sync with that interface
+    // (`@lunora/bindings/r2sql` client.ts) when a method is added there.
+    stub: `
+const r2sqlStub: R2SqlClient = {
+    describe: async () => {
+        ${r2sqlMissing}
+    },
+    explain: async () => {
+        ${r2sqlMissing}
+    },
+    from: () => {
+        ${r2sqlMissing}
+    },
+    query: async () => {
+        ${r2sqlMissing}
+    },
+    showDatabases: async () => {
+        ${r2sqlMissing}
+    },
+    showTables: async () => {
+        ${r2sqlMissing}
+    },
+};
+`
+  };
+};
+const emitPipelinesFragments = (hasPipelines) => {
+  if (!hasPipelines) {
+    return EMPTY_HELPER_FRAGMENTS;
+  }
+  const pipelinesMissing = `throw new Error("ctx.pipelines: no Pipelines binding found. Add a \\\`pipelines\\\` binding (env.PIPELINES) to wrangler.jsonc, or pass \\\`pipelines\\\` to createShardDO().");`;
+  return {
+    build: `
+            const pipelinesBinding = config.pipelines?.(env) ?? (env as Record<string, unknown>).PIPELINES;
+            const pipelines: PipelineClient = pipelinesBinding ? createPipelines({ binding: pipelinesBinding as PipelineBindingLike }) : pipelinesStub;
+`,
+    configField: `
+    pipelines?: (env: Record<string, unknown>) => PipelineBindingLike;`,
+    // ActionCtx-only: attached via the \`ctx.pipelines = pipelines\` assignment
+    // in the \`isAction\` block, never the every-ctx object literal.
+    contextField: "",
+    importLines: [
+      `import type { PipelineBindingLike, PipelineClient } from "@lunora/bindings/pipelines";`,
+      `import { createPipelines } from "@lunora/bindings/pipelines";`
+    ],
+    stub: `
+const pipelinesStub: PipelineClient = {
+    send: async () => {
+        ${pipelinesMissing}
+    },
+};
+`
+  };
+};
+const emitContainers = (containers, jurisdiction) => {
   if (containers.length === 0) {
     return "";
   }
+  const jurisdictionArgument = jurisdiction ? `, ${JSON.stringify(jurisdiction)}` : "";
   const classes = containers.map((container) => {
     assertIdentifier(container.exportName, `container export "${container.exportName}"`);
     assertIdentifier(container.className, `container class "${container.className}"`);
     return `/** Container DO for the \`${container.exportName}\` definition (binding \`${container.bindingName}\`). */
 export class ${container.className} extends LunoraContainer {
     public constructor(ctx: ConstructorParameters<typeof LunoraContainer>[0], env: Record<string, unknown>) {
-        super(ctx, env, ${container.exportName}, "${container.exportName}");
+        super(ctx, env, ${container.exportName}, "${container.exportName}"${jurisdictionArgument});
     }
 }
 `;
@@ -1212,7 +1511,7 @@ import { ${imports} } from "../containers.js";
 
 ${classes}`;
 };
-const emitContainerFragments = (containers) => {
+const emitContainerFragments = (containers, jurisdiction) => {
   if (containers.length === 0) {
     return { build: "", contextField: "", importLines: [], specs: "" };
   }
@@ -1225,8 +1524,11 @@ const emitContainerFragments = (containers) => {
     return `    { binding: "${container.bindingName}", exportName: "${container.exportName}"${maxInstances} },`;
   }).join("\n");
   return {
+    // Schema `.jurisdiction("…")` pins every container DO this shard reaches
+    // to the data-residency region; the arg is omitted when undeclared so
+    // existing generated output is unchanged.
     build: `
-            const containers = createContainerContext(env, LUNORA_CONTAINERS);
+            const containers = createContainerContext(env, LUNORA_CONTAINERS${jurisdiction ? `, ${JSON.stringify(jurisdiction)}` : ""});
 `,
     contextField: `
                 containers,`,
@@ -1279,6 +1581,32 @@ type WorkflowOutputOf<Definition> = Definition extends { __output?: infer Output
 
 ${classes}`;
 };
+const emitQueues = (queues) => {
+  const pushQueues = queues.filter((queue) => queue.mode === "push");
+  if (pushQueues.length === 0) {
+    return "";
+  }
+  for (const queue of pushQueues) {
+    assertIdentifier(queue.exportName, `queue export "${queue.exportName}"`);
+  }
+  const imports = pushQueues.map((queue) => queue.exportName).join(", ");
+  const entries = pushQueues.map((queue) => `    ${JSON.stringify(queue.name)}: { definition: ${queue.exportName}, exportName: ${JSON.stringify(queue.exportName)} },`).join("\n");
+  return `${GENERATED_HEADER}/**
+ * Push-consumer registry for the queues declared in \`lunora/queues.ts\`. The
+ * composed worker's \`queue(batch, env, ctx)\` entry routes each delivered batch
+ * by \`batch.queue\` to the matching \`defineQueue\` handler. Wired automatically
+ * by \`defineApp\` — you don't import this directly.
+ */
+import type { QueueRegistry } from "@lunora/queue";
+
+import { ${imports} } from "../queues.js";
+
+/** Stable wrangler queue name → { definition, exportName } for batch routing. */
+export const LUNORA_QUEUE_REGISTRY: QueueRegistry = {
+${entries}
+};
+`;
+};
 const emitWorkflowFragments = (workflows) => {
   if (workflows.length === 0) {
     return { build: "", contextField: "", importLines: [], specs: "" };
@@ -1304,6 +1632,31 @@ ${specEntries}
 `
   };
 };
+const emitQueueFragments = (queues) => {
+  if (queues.length === 0) {
+    return { build: "", contextField: "", importLines: [], specs: "" };
+  }
+  for (const queue of queues) {
+    assertIdentifier(queue.exportName, `queue export "${queue.exportName}"`);
+    assertIdentifier(queue.bindingName, `queue binding "${queue.bindingName}"`);
+  }
+  const specEntries = queues.map((queue) => `    { binding: "${queue.bindingName}", exportName: "${queue.exportName}", name: ${JSON.stringify(queue.name)} },`).join("\n");
+  return {
+    build: `
+            const queues = createQueueContext(env, LUNORA_QUEUES);
+`,
+    contextField: `
+                queues,`,
+    importLines: [`import type { QueueBindingSpec } from "@lunora/queue";`, `import { createQueueContext } from "@lunora/queue";`],
+    // eslint-disable-next-line no-secrets/no-secrets -- the emitted readonly-array type annotation is dense generated TS, not a credential
+    specs: `
+/** Wiring specs for \`ctx.queues\` (codegen-derived from \`lunora/queues.ts\`). */
+const LUNORA_QUEUES: ReadonlyArray<QueueBindingSpec> = [
+${specEntries}
+];
+`
+  };
+};
 const emitWorkflowsMetadataFragments = (workflows) => {
   if (workflows.length === 0) {
     return { constant: "", override: "" };
@@ -1330,6 +1683,33 @@ const LUNORA_WORKFLOWS_INFO: WorkflowsResult = ${JSON.stringify(metadata, void 0
 `
   };
 };
+const emitQueuesMetadataFragments = (queues) => {
+  if (queues.length === 0) {
+    return { constant: "", override: "" };
+  }
+  const metadata = {
+    queues: queues.map((queue) => {
+      return {
+        binding: queue.bindingName,
+        ...queue.tuning.deadLetterQueue === void 0 ? {} : { deadLetterQueue: queue.tuning.deadLetterQueue },
+        exportName: queue.exportName,
+        mode: queue.mode,
+        name: queue.name
+      };
+    })
+  };
+  return {
+    constant: `
+/** Read-only declared-queue metadata (discovered from \`lunora/queues.ts\`) served via \`__lunora_admin__:listQueues\` for the studio's queues view. */
+const LUNORA_QUEUES_INFO: QueuesResult = ${JSON.stringify(metadata, void 0, 4)};
+`,
+    override: `
+        protected override queuesMetadata(): QueuesResult {
+            return LUNORA_QUEUES_INFO;
+        }
+`
+  };
+};
 const emitPaymentFragments = (hasPayments) => {
   if (!hasPayments) {
     return { build: "", configField: "", contextField: "", imports: [], stub: "" };
@@ -1385,13 +1765,14 @@ const paymentStub: LunoraPayment = {
 `
   };
 };
-const buildDoTypeImports = (hasVectors, hasWorkflows) => [
+const buildDoTypeImports = (hasVectors, hasWorkflows, hasQueues) => [
   "AdvisoryFinding",
   "DatabaseWriterLike",
   "DataMigrationLike",
   "LogSink",
   "MaskPoliciesResult",
   "MigrationRunResult",
+  ...hasQueues ? ["QueuesResult"] : [],
   "RunShardApplyCdcArgs",
   "RunShardMigrationArgs",
   "RlsPoliciesResult",
@@ -1420,7 +1801,10 @@ const emitShard = ({
   hasImages = false,
   hasKv = false,
   hasPayments = false,
+  hasPipelines = false,
+  hasR2sql = false,
   maskMetadata,
+  queues = [],
   rlsMetadata,
   schema,
   storageRules,
@@ -1435,12 +1819,15 @@ const emitShard = ({
   const imagesFragments = emitImagesFragments(hasImages);
   const hyperdriveFragments = emitHyperdriveFragments(hasHyperdrive);
   const browserFragments = emitBrowserFragments(hasBrowser);
+  const r2sqlFragments = emitR2sqlFragments(hasR2sql);
+  const pipelinesFragments = emitPipelinesFragments(hasPipelines);
+  const { build: queuesBuild, contextField: queuesContextField, importLines: queueImportLines, specs: queueSpecs } = emitQueueFragments(queues);
   const {
     build: containersBuild,
     contextField: containersContextField,
     importLines: containerImportLines,
     specs: containerSpecs
-  } = emitContainerFragments(containers);
+  } = emitContainerFragments(containers, schema.jurisdiction);
   const {
     build: workflowsBuild,
     contextField: workflowsContextField,
@@ -1461,12 +1848,14 @@ const emitShard = ({
   const studioFeaturesData = studioFeatures ?? {
     mail: false,
     payments: false,
+    queues: false,
     scheduler: false,
     storage: false,
     vectors: false,
     workflows: false
   };
   const { constant: workflowsMetadataConst, override: workflowsMetadataOverride } = emitWorkflowsMetadataFragments(workflows);
+  const { constant: queuesMetadataConst, override: queuesMetadataOverride } = emitQueuesMetadataFragments(queues);
   const hasVectors = schema.vectorIndexes.length > 0;
   const hasGlobalTables = schema.tables.some((table) => table.shardMode === "global");
   const hasHyperdriveGlobal = schema.tables.some((table) => table.shardMode === "global" && table.globalBackend === "hyperdrive");
@@ -1481,23 +1870,24 @@ const emitShard = ({
   const tableIndexes = buildTableIndexes(schema);
   const tableColumns = buildTableColumns(schema);
   const storageColumns = buildStorageColumns(schema);
-  const doTypeImports = buildDoTypeImports(hasVectors, workflows.length > 0);
+  const doTypeImports = buildDoTypeImports(hasVectors, workflows.length > 0, queues.length > 0);
   const relationFanout = emitRelationFanout(hasGlobalTables);
   const importLines = [
     `import type { ${doTypeImports.join(", ")} } from "${base.do}";`,
     `import { applyCdcChanges, createShardCtxDb, runDataMigration, runShardMigrations, ${relationFanout.importFragment}ShardDO as ShardDOBase } from "${base.do}";`,
-    // `asBucketStorage` (the bucket-aware `ctx.storage` wrapper) lives in
+    // `asBucketStorage` (the bucket-aware `ctx.storage` wrapper) and
+    // `createSecrets` (the `ctx.secrets` core built-in) live in
     // `@lunora/server`, the single source — imported here rather than stamped
     // inline into every generated shard.
-    `import { asBucketStorage } from "${base.server}";`
+    `import { asBucketStorage, createSecrets } from "${base.server}";`
   ];
   if (hasTables) {
     importLines.push(`import { bindOrm, bindTableFacade } from "${base.server}";`);
   }
   if (hasVectors) {
     importLines.push(
-      `import type { SchemaLike as VectorSchemaLike, VectorizeIndexLike, VectorSearchLike } from "@lunora/vectors";`,
-      `import { createContextVectors, createVectors, createVectorSyncHook } from "@lunora/vectors";`
+      `import type { SchemaLike as VectorSchemaLike, VectorizeIndexLike, VectorSearchLike } from "@lunora/bindings/vectors";`,
+      `import { createContextVectors, createVectors, createVectorSyncHook } from "@lunora/bindings/vectors";`
     );
   }
   if (hasAi) {
@@ -1509,8 +1899,11 @@ const emitShard = ({
     ...imagesFragments.importLines,
     ...hyperdriveFragments.importLines,
     ...browserFragments.importLines,
+    ...r2sqlFragments.importLines,
+    ...pipelinesFragments.importLines,
     ...containerImportLines,
     ...workflowImportLines,
+    ...queueImportLines,
     ...paymentsImports,
     ``,
     `import schema from "../schema.js";`,
@@ -1652,17 +2045,23 @@ ${schema.tables.map(
     (table) => `            facade[${JSON.stringify(table.name)}] = bindTableFacade(db, ${JSON.stringify(table.name)});`
   ).join("\n")}
 ` : "";
-  const everyContextBuild = `${kvFragments.build}${analyticsFragments.build}`;
-  const everyContextField = `${kvFragments.contextField}${analyticsFragments.contextField}`;
-  const actionOnlyHasAny = hasImages || hasHyperdrive || hasBrowser;
+  const secretsBuild = `
+            const secrets = createSecrets(env);
+`;
+  const everyContextBuild = `${kvFragments.build}${analyticsFragments.build}${secretsBuild}`;
+  const everyContextField = `${kvFragments.contextField}${analyticsFragments.contextField}
+                secrets,`;
+  const actionOnlyHasAny = hasImages || hasHyperdrive || hasBrowser || hasR2sql || hasPipelines;
   const actionOnlyBlock = actionOnlyHasAny ? `
             // ActionCtx-only helpers (external, non-deterministic I/O): constructed
             // and attached only for an \`action\` so query/mutation ctx never carry them.
             if (isAction) {
-${imagesFragments.build}${hyperdriveFragments.build}${browserFragments.build}${[
+${imagesFragments.build}${hyperdriveFragments.build}${browserFragments.build}${r2sqlFragments.build}${pipelinesFragments.build}${[
     ...hasImages ? ["                ctx.images = images;"] : [],
     ...hasHyperdrive ? ["                ctx.sql = sql;"] : [],
-    ...hasBrowser ? ["                ctx.browser = browser;"] : []
+    ...hasBrowser ? ["                ctx.browser = browser;"] : [],
+    ...hasR2sql ? ["                ctx.r2sql = r2sql;"] : [],
+    ...hasPipelines ? ["                ctx.pipelines = pipelines;"] : []
   ].join("\n")}
             }
 ` : "";
@@ -1702,14 +2101,14 @@ const LUNORA_STORAGE_RULES: StorageRulesResult = ${JSON.stringify(storageRulesDa
 
 /** Which optional package-backed features this app wires up (discovered from imports / \`ctx.*\` reads / schema signals) served via \`__lunora_admin__:studioFeatures\` so the studio hides nav pages whose package isn't enabled. */
 const LUNORA_STUDIO_FEATURES: StudioFeaturesResult = ${JSON.stringify(studioFeaturesData, void 0, 4)};
-${workflowsMetadataConst}${containerSpecs}${workflowSpecs}
+${workflowsMetadataConst}${queuesMetadataConst}${containerSpecs}${workflowSpecs}${queueSpecs}
 export interface ShardDOConfig {
     /** Opt into change-data-capture: records a post-image to \`__cdc_log\` on every write (backs streaming export + replay-PITR). */
     cdc?: boolean;
     /** Optional telemetry sink. When supplied, each \`ctx.log.*\` call is forwarded to \`sink.onLog\`. Pass the SAME sink you give \`createWorker({ observability })\` (which drives \`onRpc\`) to route both RPC and log events. */
     observability?: (env: Record<string, unknown>) => LogSink | undefined;
     scheduler?: (env: Record<string, unknown>) => unknown;
-    storage?: (env: Record<string, unknown>) => unknown;${vectorsConfigField}${aiConfigField}${kvFragments.configField}${analyticsFragments.configField}${imagesFragments.configField}${hyperdriveFragments.configField}${browserFragments.configField}${paymentsConfigField}${d1ConfigField}${hyperdriveGlobalConfigField}
+    storage?: (env: Record<string, unknown>) => unknown;${vectorsConfigField}${aiConfigField}${kvFragments.configField}${analyticsFragments.configField}${imagesFragments.configField}${hyperdriveFragments.configField}${browserFragments.configField}${r2sqlFragments.configField}${pipelinesFragments.configField}${paymentsConfigField}${d1ConfigField}${hyperdriveGlobalConfigField}
 }
 
 const schedulerStub = {
@@ -1747,7 +2146,7 @@ const storageStub = {
         throw new Error("ctx.storage: no storage configured. Pass \`storage\` to createShardDO().");
     },
 };
-${globalDatabaseStub}${vectorsStub}${aiStub}${kvFragments.stub}${analyticsFragments.stub}${imagesFragments.stub}${hyperdriveFragments.stub}${browserFragments.stub}${paymentStub}${bindTableHelper}
+${globalDatabaseStub}${vectorsStub}${aiStub}${kvFragments.stub}${analyticsFragments.stub}${imagesFragments.stub}${hyperdriveFragments.stub}${browserFragments.stub}${r2sqlFragments.stub}${pipelinesFragments.stub}${paymentStub}${bindTableHelper}
 // Bound in-process \`ctx.run*\` composition depth so a self- or cyclically-
 // referencing call fails loudly with a clear error instead of overflowing the
 // stack. Tracked across the awaited handler chain (one DO invocation is
@@ -1892,7 +2291,7 @@ ${relationFanout.override}
         protected override studioFeatures(): StudioFeaturesResult {
             return LUNORA_STUDIO_FEATURES;
         }
-${workflowsMetadataOverride}
+${workflowsMetadataOverride}${queuesMetadataOverride}
         protected override advisories(): AdvisoryFinding[] {
             return LUNORA_ADVISORIES;
         }
@@ -2126,7 +2525,7 @@ ${workflowsMetadataOverride}
             // dispatch path) fall back to the per-request fields as before.
             const userId = options.identity ? options.identity.userId : this.getCurrentUserId();
             const identity = options.identity ? options.identity.identity : this.getCurrentIdentity();
-${vectorsBuild}${aiBuild}${everyContextBuild}${containersBuild}${workflowsBuild}
+${vectorsBuild}${aiBuild}${everyContextBuild}${containersBuild}${workflowsBuild}${queuesBuild}
             const scheduler = (config.scheduler?.(env) ?? schedulerStub) as SchedulerLike;
             // Build the storage adapter once and share it between \`ctx.storage\`
             // and \`ctx.db.system._storage\` so both read the same R2 binding. The
@@ -2149,6 +2548,14 @@ ${facadeBlock}${paymentsBuild}
                 warn: (...args: unknown[]) => { this.recordUserLog(logFunctionPath, "warn", args, observability); },
             };
 
+            // \`ctx.now\`: the wall-clock instant (epoch ms) this function began,
+            // captured ONCE so the whole handler body sees a single stable value.
+            // Query/mutation handlers must be deterministic (they may be re-run on
+            // OCC retry / subscription re-eval), so they must read time through
+            // \`ctx.now\` instead of \`Date.now()\` — the \`nondeterministic_query_mutation\`
+            // advisor flags the latter. Actions may still use ambient \`Date.now()\`.
+            const now = Date.now();
+
             const ctx: Record<string, unknown> = {
                 auth: {
                     getIdentity: async () => identity ?? null,
@@ -2157,9 +2564,10 @@ ${facadeBlock}${paymentsBuild}
                 db,
                 fetch: globalThis.fetch.bind(globalThis),
                 ip: this.getCurrentIp(),
-                log,${ormContextField}
+                log,
+                now,${ormContextField}
                 scheduler,
-                storage,${vectorsContextField}${aiContextField}${everyContextField}${paymentsContextField}${containersContextField}${workflowsContextField}
+                storage,${vectorsContextField}${aiContextField}${everyContextField}${paymentsContextField}${containersContextField}${workflowsContextField}${queuesContextField}
             };
 ${isActionLine}${actionOnlyBlock}
             ctx.runAction = (reference: FunctionReference, fnArgs: Record<string, unknown>) => dispatchRun("action", reference.__lunoraRef, fnArgs, ctx);
@@ -2423,4 +2831,4 @@ const emitWranglerCronTriggers = (crons) => {
   return triggers;
 };
 
-export { GENERATED_HEADER, buildStorageColumns, emitApi, emitContainers, emitCrons, emitDataModel, emitDrizzleSchema, emitFunctions, emitSeed, emitServer, emitShard, emitVectors, emitWorkflows, emitWranglerCronTriggers };
+export { GENERATED_HEADER, buildStorageColumns, emitApi, emitContainers, emitCrons, emitDataModel, emitDrizzleSchema, emitFunctions, emitQueues, emitSeed, emitServer, emitShard, emitVectors, emitWorkflows, emitWranglerCronTriggers };