@lunora/codegen 1.0.0-alpha.13 → 1.0.0-alpha.130

package/dist/packem_shared/emitApp-D-mz_p6P.mjs

@@ -0,0 +1,646 @@
+import{A as S,G as D}from"./emit-GW3Jf9w0.mjs";const E=e=>`has${e.charAt(0).toUpperCase()}${e.slice(1)}`,v=S.map(({appMethod:e,key:t})=>[E(t),e.method,e.configKey,e.doc]),m=e=>v.some(([t])=>e[t]),A=e=>e?['import * as lunoraIdentityContract from "../identity.js";']:[],R=(e,t)=>e?['import type { CreateAccessResolverOptions } from "@lunora/cloudflare-access";',`import { createAccessResolver${t?", composeResolvers":""} } from "@lunora/cloudflare-access";`]:[],x=e=>e?['import { createKvIntrospectorFromEnv } from "@lunora/bindings/kv";']:[],C=e=>e?['import notifyConfig from "../notify.js";']:[],k=e=>(e.emailAgents?.length??0)>0,O=e=>k(e)?['import { dispatchAgentEmail } from "@lunora/agent/inbound";']:[],T=e=>k(e)?['import * as lunoraAgentDefinitions from "../agents.js";']:[],L=e=>{const{hasAccess:t,hasAuth:a,hasFramework:r,hasGlobal:n,hasHyperdriveGlobal:o,hasKv:c,hasQueue:s,hasScheduler:d,hasStorage:h,hasWorkflow:u,useUmbrella:l,wantsOpenApi:p,wantsOpenRpc:b}=e,i=l?"lunorash/runtime":"@lunora/runtime",g=["ExecutionContextLike","HttpRouterLike","LunoraWorker","Route","ScheduledControllerLike","ShardNamespaceLike","WorkerOptions"];n&&g.push("GlobalIntrospector","AdminTableResolver"),r&&g.push("FrameworkHostHandler");const w=[...n||o?["createCrossShardRelationCapabilities"]:[],"createWorker","resolveLogArchiveFromEnv",...r?["withFrameworkWorker"]:[]].join(", ");return[...a?['import type { AuthNamespaceLike, LunoraAuth, LunoraAuthOptions } from "@lunora/auth";','import { createAuth, createAuthAdmin, createAuthAuditReader, createDoAuthWiring, d1Executor, ensureMigrated, handleAuthRequest, lunoraD1Adapter } from "@lunora/auth";']:[],...R(t,a),...n?['import type { D1CtxDbOptions, D1DatabaseLike, D1Exec } from "@lunora/d1";','import { applyCdcChanges, createD1CtxDb, exportGlobalRows, facetGlobalColumn, importGlobalRows, listGlobalTables, readD1CdcChanges, readGlobalTablePage, retryingExec } from "@lunora/d1";']:[],...o?['import type { HyperdriveEngine } from "@lunora/hyperdrive/global";','import { createHyperdriveGlobalCtxDb } from "@lunora/hyperdrive/global";','import type { SqlCtxDbOptions, SqlExec } from "@lunora/sql-store";']:[],...x(c),...d?['import type { DurableObjectNamespaceLike } from "@lunora/scheduler";','import { createScheduler } from "@lunora/scheduler";']:[],...h?['import type { R2BucketLike, Storage } from "@lunora/storage";','import { createBucketStorage, createStorage } from "@lunora/storage";']:[],...u?['import { createWorkflowsRestClient } from "@lunora/workflow";']:[],...O(e),`import type { ${[...g].toSorted((f,y)=>f.localeCompare(y)).join(", ")} } from "${i}";`,`import { ${w} } from "${i}";`,"",...A(e.identity),...T(e),...n||o?['import schema from "../schema.js";']:[],...C(e.hasNotify),'import { LUNORA_CRONS } from "./crons.js";','import { LUNORA_FUNCTIONS } from "./functions.js";',...s?['import { createQueueCaptureSink, dispatchQueueBatch, shouldCaptureQueue } from "@lunora/queue";','import { LUNORA_QUEUE_REGISTRY } from "./queues.js";']:[],...p?['import { openApiSpec } from "./openapi.js";']:[],...b?['import { openRpcSpec } from "./openrpc.js";']:[],'import { createShardDO } from "./shard.js";']},q=e=>[...e.hasStorage?[`/** \`.storage(...)\` declaration — one bucket (required) plus optional extra named buckets and signed-URL config. Backs \`ctx.storage\` AND the studio file browser. */
+interface StorageDeclaration<Env> {
+    /** The default R2 bucket binding (the bare \`ctx.storage\`). */
+    bucket: Selector<Env, R2BucketLike>;
+    /** Extra named buckets, reached via \`ctx.storage.bucket("name")\` and the studio's bucket picker. */
+    buckets?: Record<string, Selector<Env, R2BucketLike>>;
+    /** Public base URL signed/public object URLs resolve against. */
+    publicBaseUrl?: Selector<Env, string>;
+    /** HMAC secret for signed URLs. */
+    signingSecret?: Selector<Env, string>;
+}`]:[],...e.hasScheduler?["/** `.scheduler(...)` declaration — the `SchedulerDO` namespace plus the worker origin its callbacks dispatch back to. Backs `ctx.scheduler` AND the studio's scheduled-jobs view. */\ninterface SchedulerDeclaration<Env> {\n    /** The `SchedulerDO` namespace binding (typically `env.SCHEDULER`). */\n    namespace: Selector<Env, DurableObjectNamespaceLike & ShardNamespaceLike>;\n    /** The worker origin the `SchedulerDO` dispatches HTTP job callbacks back to. */\n    origin?: Selector<Env, string>;\n}"]:[],...e.hasGlobal?["/** `.global(...)` declaration — the D1 binding backing `.global()` tables. Backs cross-tenant `ctx.db` reads/writes AND the studio's global data browser. */\ninterface GlobalDeclaration<Env> {\n    /** The D1 binding (typically `env.DB`). */\n    d1: Selector<Env, D1DatabaseLike>;\n    /** The worker origin used to fan reverse cross-backend relations across shards. Without it, such a relation throws a clear error. */\n    origin?: Selector<Env, string>;\n}"]:[],...e.hasHyperdriveGlobal?['/** `.hyperdriveGlobal(...)` declaration — backs `.global({ backend: "hyperdrive" })` tables on a Postgres/MySQL database via Hyperdrive. Stays reactive: the writer is injected as `globalDb` and the broadcast hook drives live queries. */\ninterface HyperdriveGlobalDeclaration<Env> {\n    /** The Hyperdrive engine — selects the Postgres or MySQL dialect. */\n    engine: HyperdriveEngine;\n    /** Build the `SqlExec` from `env` — e.g. `buildPgExec(fromPostgresJs(postgres(env.HYPERDRIVE.connectionString)))`. Cache the driver on the DO instance; rebuild lazily after hibernation. */\n    exec: (env: Env) => SqlExec;\n    /** The worker origin used to fan reverse cross-backend relations across shards. Without it, such a relation throws a clear error. */\n    origin?: Selector<Env, string>;\n}']:[],...e.hasAuth?['/** `.auth(...)` declaration — better-auth options plus the storage the adapter reads. Give it `d1` (the default) or `namespace` (a Durable Object that hosts the auth tables), never both. The builder owns the lazy build + `ensureMigrated` dance and wires `authHandler` / `resolveIdentity` / `authAdmin`. */\ninterface AuthDeclaration<Env> {\n    /** The D1 binding the auth SQL adapter is wired over (via `lunoraD1Adapter`). Omit only when using `namespace`. */\n    d1?: Selector<Env, unknown>;\n    /** Shared secret the worker presents on the object\'s internal session route. REQUIRED with `namespace`: the binding is reachable from any worker bound to it, so the secret — not the binding — is the authorization boundary. Without it identity resolution fails closed. */\n    internalSecret?: Selector<Env, string>;\n    /** Name of the Durable Object instance holding the auth tables. Defaults to `"auth"`. Set it to run separate auth objects (per deployment, per tenant) off one namespace. */\n    objectName?: Selector<Env, string>;\n    /** The auth Durable Object namespace — the DO-backed mode. Needed for `@better-auth/scim`, which requires native transactions that D1 has none of. The object owns the auth tables, so `/api/auth/*` and identity resolution both go through it. Typed as `AuthNamespaceLike` because `createDoAuthWiring` resolves through `idFromName` + `get` and has no `getByName` fallback — both members are load-bearing here, and `ShardNamespaceLike` leaves both optional. */\n    namespace?: Selector<Env, AuthNamespaceLike>;\n    /** Build the better-auth options from `env` (secret, plugins, email/password, …). */\n    options: (env: Env) => LunoraAuthOptions;\n}']:[]],I=e=>[...e.hasAccess?["    private accessSelector?: Selector<Env, CreateAccessResolverOptions | undefined>;"]:[],"    private adminToken?: Selector<Env, string>;",...e.hasAuth?["    private authDeclaration?: AuthDeclaration<Env>;"]:[],"    private cdcEnabled = false;","    private readonly extendFns: ((env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>)[] = [];",...e.hasGlobal?["    private globalDeclaration?: GlobalDeclaration<Env>;"]:[],...e.hasHyperdriveGlobal?["    private hyperdriveGlobalDeclaration?: HyperdriveGlobalDeclaration<Env>;"]:[],"    private httpRouterApp?: HttpRouterLike;","    private readonly routeMap: Record<string, Route> = {};",...e.hasScheduler?["    private schedulerDeclaration?: SchedulerDeclaration<Env>;"]:[],...m(e)?["    private readonly shardExtras: Partial<ShardConfig> = {};"]:[],"    private shardSelector?: Selector<Env, ShardNamespaceLike>;",...e.hasStorage?["    private storageDeclaration?: StorageDeclaration<Env>;"]:[]],G=e=>v.filter(([t])=>e[t]).map(([,t,a,r])=>`    /** ${r} */
+    public ${t}(factory: NonNullable<ShardConfig["${a}"]>): this {
+        this.shardExtras.${a} = factory;
+
+        return this;
+    }`),N=e=>[...e.hasAccess?["    /** Wire Cloudflare Access (Zero Trust) — feeds the verified Access identity into `ctx.auth` / RLS via `resolveIdentity`. Call it with no argument when the Access policy is attached to the Worker (the identity arrives on the execution context; nothing to configure); pass `teamDomain` + `aud` for a hostname-scoped Access application, whose `Cf-Access-Jwt-Assertion` JWT is verified against your team JWKS. When `.auth(...)` is also configured, Access is composed ahead of it (Access wins when it authenticated the caller; everyone else falls through to the app session). */\n    public access(selector?: Selector<Env, CreateAccessResolverOptions>): this {\n        this.accessSelector = selector ?? (() => undefined);\n\n        return this;\n    }"]:[],`    /** Bearer token gating the \`/_lunora/admin/*\` endpoints the studio calls. */
+    public admin(selector: Selector<Env, string>): this {
+        this.adminToken = selector;
+
+        return this;
+    }`,"    /**\n     * Opt into change-data-capture: every write records a post-image to `__cdc_log` — on this shard AND, when the app has `.global()` tables, on the global backend. Backs streaming export, replay-PITR, and the `.global()` half of `defineShape` replication (whose poll tick asks the global changelog which tables moved). Off by default: it costs a changelog row per write, which an app using none of the above should not pay.\n     *\n     * REQUIRED for a shard-local `defineShape`: those replicate out of `__cdc_log`, and a `shape_subscribe` is refused with `SHAPE_REQUIRES_CDC` without it.\n     *\n     * It also changes how fresh a `.global()` shape is against writes made OUTSIDE `ctx.db` — an admin import, a PITR replay, an external ETL job, or a predicate over wall clock. With CDC off the poll re-reads every shape every 2s. With it on the poll asks the global changelog which tables moved and skips the rest, so a change the changelog never saw waits for the 30s unconditional resync instead. Writes through `ctx.db` are unaffected: they append, so the poll sees them on the next tick either way.\n     */\n    public cdc(enabled = true): this {\n        this.cdcEnabled = enabled;\n\n        return this;\n    }",...e.hasAuth?['    /** Wire better-auth — the builder lazily builds the instance, runs `ensureMigrated`, and dispatches `/api/auth/*` inside the worker (instrumented for the auth-failure SLO). Pass `d1` for the D1-backed default, or `namespace` + `internalSecret` to host the auth tables in a Durable Object (what `@better-auth/scim` needs). */\n    public auth(declaration: AuthDeclaration<Env>): this {\n        // Reject the ambiguous and the empty shapes here rather than at the first\n        // request: with neither storage set, auth would silently never answer, and\n        // with both it is unclear which one owns the tables.\n        if (declaration.d1 && declaration.namespace) {\n            throw new Error(".auth(): pass either `d1` or `namespace`, not both — they are two different homes for the same tables.");\n        }\n\n        if (!declaration.d1 && !declaration.namespace) {\n            throw new Error(".auth(): needs `d1` (D1-backed) or `namespace` (Durable-Object-backed) to know where the auth tables live.");\n        }\n\n        if (declaration.namespace && !declaration.internalSecret) {\n            throw new Error(\n                ".auth(): `namespace` requires `internalSecret` — the auth DO binding is reachable from any worker bound to it, so identity resolution is gated on a shared secret and would otherwise fail closed on every request.",\n            );\n        }\n\n        this.authDeclaration = declaration;\n\n        return this;\n    }']:[],"    /** Escape hatch — merge raw `WorkerOptions` (anything not yet sugared) over the derived options at build time. The second `derived` argument is a snapshot of the options assembled so far (after `.auth(...)` etc.), so you can compose rather than clobber — e.g. wrap `derived.resolveIdentity` instead of replacing it. */\n    public extend(fn: (env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>): this {\n        this.extendFns.push(fn);\n\n        return this;\n    }",...e.hasGlobal?[`    /** Back \`.global()\` (cross-tenant) tables with D1 — wires \`ctx.db\` routing, the studio global browser, and reverse cross-shard relations. */
+    public global(declaration: GlobalDeclaration<Env>): this {
+        this.globalDeclaration = declaration;
+
+        return this;
+    }`]:[],...e.hasHyperdriveGlobal?[`    /** Back \`.global({ backend: "hyperdrive" })\` tables with a Postgres/MySQL database via Hyperdrive — wires reactive \`ctx.db\` routing through the shared store core. */
+    public hyperdriveGlobal(declaration: HyperdriveGlobalDeclaration<Env>): this {
+        this.hyperdriveGlobalDeclaration = declaration;
+
+        return this;
+    }`]:[],`    /** Cloudflare Email Routing entry — exposes the top-level \`email\` handler. */
+    public onEmail(handler: (env: Env) => (message: unknown, env: unknown, context: ExecutionContextLike) => Promise<void>): this {
+        this.emailHandler = handler;
+
+        return this;
+    }`,"    /** Mount a whole HTTP app (`httpRouter()` from `@lunora/server`, or anything with a `fetch`) ahead of Lunora's own routes. Use this for a multi-endpoint hono app with its own CORS + error handling; `.route()` is for one-off endpoints. */\n    public httpRouter(app: HttpRouterLike): this {\n        this.httpRouterApp = app;\n\n        return this;\n    }",`    /** Mount a custom HTTP route (e.g. an asset-serving or test endpoint). Key is \`"METHOD path"\`, \`"path"\`, or a path prefix matched by the runtime. */
+    public route(key: string, handler: Route): this {
+        this.routeMap[key] = handler;
+
+        return this;
+    }`,...e.hasScheduler?[`    /** Wire the \`SchedulerDO\` — backs \`ctx.scheduler\` and the studio's scheduled-jobs view. */
+    public scheduler(declaration: SchedulerDeclaration<Env>): this {
+        this.schedulerDeclaration = declaration;
+
+        return this;
+    }`]:[],`    /** The shard Durable Object namespace (typically \`env.SHARD\`) — required: every app routes RPC + WebSocket traffic through it. */
+    public shard(selector: Selector<Env, ShardNamespaceLike>): this {
+        this.shardSelector = selector;
+
+        return this;
+    }`,...e.hasStorage?[`    /** Wire R2 storage — backs \`ctx.storage\` (incl. multi-bucket) and the studio file browser, from one declaration. */
+    public storage(declaration: StorageDeclaration<Env>): this {
+        this.storageDeclaration = declaration;
+
+        return this;
+    }`]:[],...G(e)],j=e=>{const t=r=>e.hasScheduler?`
+                              ...(this.schedulerDeclaration ? { scheduler: this.resolveScheduler(env) as unknown as ${r}["scheduler"] } : {}),`:"",a=["            cdc: this.cdcEnabled,",...e.hasGlobal?[`            ...(this.globalDeclaration
+                ? {
+                      d1: (rawEnv: Record<string, unknown>, request?: { bookmark?: string; cdc?: boolean; cdcRetentionMs?: number; identity?: Record<string, unknown>; onBookmark?: (bookmark: string | undefined) => void; userId?: string | null }) => {
+                          const env = rawEnv as Env;
+                          const database = this.globalDeclaration?.d1(env);
+
+                          if (!database) {
+                              return undefined;
+                          }
+
+                          const origin = this.globalDeclaration?.origin?.(env);
+                          const crossShard = origin
+                              ? createCrossShardRelationCapabilities({ identity: request?.identity, origin, userId: request?.userId ?? undefined })
+                              : undefined;
+
+                          return createD1CtxDb({
+                              ...(crossShard ? { crossShardCounter: crossShard.crossShardCounter, crossShardReader: crossShard.crossShardReader } : {}),${t("D1CtxDbOptions")}
+                              ...(request?.cdcRetentionMs === undefined ? {} : { cdcRetentionMs: request.cdcRetentionMs }),
+                              auth: { identity: request?.identity ?? null, userId: request?.userId ?? null },
+                              // Forwarded from the shard's own \`cdc\` config, so ONE
+                              // switch governs both changelogs. Built without it, the
+                              // global \`__cdc_log\` is never written and the shape
+                              // poll's changed-tables fast path is unreachable.
+                              cdc: request?.cdc ?? false,
+                              exec: buildExec(database, request?.bookmark, request?.onBookmark),
+                              schema: schema as unknown as D1CtxDbOptions["schema"],
+                          });
+                      },
+                  }
+                : {}),`]:[],...e.hasHyperdriveGlobal?[`            ...(this.hyperdriveGlobalDeclaration
+                ? {
+                      hyperdriveGlobal: (rawEnv: Record<string, unknown>, request?: { cdc?: boolean; cdcRetentionMs?: number; identity?: Record<string, unknown>; userId?: string | null }) => {
+                          const env = rawEnv as Env;
+                          const exec = this.hyperdriveGlobalDeclaration?.exec(env) as SqlExec | undefined;
+
+                          if (!exec) {
+                              return undefined;
+                          }
+
+                          const origin = this.hyperdriveGlobalDeclaration?.origin?.(env);
+                          const crossShard = origin
+                              ? createCrossShardRelationCapabilities({ identity: request?.identity, origin, userId: request?.userId ?? undefined })
+                              : undefined;
+
+                          return createHyperdriveGlobalCtxDb({
+                              ...(crossShard ? { crossShardCounter: crossShard.crossShardCounter, crossShardReader: crossShard.crossShardReader } : {}),${t("SqlCtxDbOptions")}
+                              ...(request?.cdcRetentionMs === undefined ? {} : { cdcRetentionMs: request.cdcRetentionMs }),
+                              auth: { identity: request?.identity ?? null, userId: request?.userId ?? null },
+                              // See the D1 twin: one \`cdc\` switch, both changelogs.
+                              cdc: request?.cdc ?? false,
+                              engine: this.hyperdriveGlobalDeclaration?.engine as HyperdriveEngine,
+                              exec,
+                              schema: schema as unknown as SqlCtxDbOptions["schema"],
+                          });
+                      },
+                  }
+                : {}),`]:[],...e.hasScheduler?[`            ...(this.schedulerDeclaration
+                ? {
+                      scheduler: (rawEnv: Record<string, unknown>) => this.resolveScheduler(rawEnv as Env),
+                  }
+                : {}),`]:[],...e.hasStorage?["            ...(this.storageDeclaration ? { storage: (rawEnv: Record<string, unknown>) => this.resolveStorage(rawEnv as Env) } : {}),"]:[],...m(e)?["            ...this.shardExtras,"]:[]];return a.length>0?`
+${a.join(`
+`)}
+        `:""},B=e=>[...e.hasScheduler?[`        if (this.schedulerDeclaration) {
+            options.schedulerDO = this.schedulerDeclaration.namespace(env);
+        }`]:[],...e.hasWorkflow?[`        options.workflowsClient = (workflowEnv) => {
+            const source = workflowEnv as Record<string, unknown>;
+            const accountId = source["CLOUDFLARE_ACCOUNT_ID"];
+            const apiToken = source["CLOUDFLARE_API_TOKEN"];
+
+            return typeof accountId === "string" && accountId !== "" && typeof apiToken === "string" && apiToken !== ""
+                ? createWorkflowsRestClient({ accountId, apiToken })
+                : undefined;
+        };`]:[],...e.hasGlobal?[`        if (this.globalDeclaration) {
+            const database = this.globalDeclaration.d1(env);
+
+            if (database) {
+                options.d1 = database;
+                options.globalIntrospector = buildGlobalIntrospector(database);
+                // \`resolveTableSharding\`/\`importGlobals\` wire the admin bulk-import
+                // endpoint: without the former, EVERY row (including a \`.global()\`
+                // table's) routes to the default shard, so a global table is never
+                // recognised as global and the latter is never reached — the
+                // endpoint answers 200 with \`inserted: {}\` for a write that never
+                // happened. Both are mechanical over the schema this file already
+                // imports, so there is nothing project-specific to configure.
+                options.resolveTableSharding = buildTableShardingResolver();
+                options.importGlobals = buildGlobalImporter(database, this.cdcEnabled);
+                // The read/replay half of the same admin plane. Each one is the
+                // only reason its endpoint can see the global storage plane at
+                // all, and every one of them fails SILENTLY when unset — export
+                // and \`lunora backup create\` answer 200 having written only
+                // shard-local rows (an export→import round trip then restores
+                // cleanly minus every global row), CDC sync answers with only
+                // shard changes, and point-in-time apply reports
+                // \`globalApplied: 0\`. Nothing here is project-specific either.
+                options.exportGlobals = buildGlobalExporter(database);
+                options.syncGlobals = buildGlobalCdcSync(database);
+                options.applyGlobals = buildGlobalCdcApplier(database, this.cdcEnabled);
+            }
+        }`]:[],...e.hasStorage?[`        if (this.storageDeclaration) {
+            Object.assign(options, this.buildStorageAdmin(env));
+            options.storage = (rawEnv: unknown) => this.resolveStorage(rawEnv as Env);
+        }`]:[],...e.hasKv?["        options.kvIntrospector = createKvIntrospectorFromEnv(env);"]:[],...e.hasNotify?["        options.notifySubscriptionStore = notifyConfig.store ? notifyConfig.store(env as Record<string, unknown>) : undefined;"]:[],"        options.logArchive = resolveLogArchiveFromEnv(env);",...e.hasAuth?[`        // Captured before the branch so the narrowing survives — reading
+        // \`this.authDeclaration.namespace\` again below would be optional all over again.
+        const authDeclaration = this.authDeclaration;
+        const authNamespace = authDeclaration?.namespace;
+        const authD1 = authDeclaration?.d1;
+
+        if (authDeclaration && authNamespace) {
+            // DO-backed mode. The auth tables live inside the object and DO storage is
+            // unreachable from here, so better-auth runs in there and this worker talks
+            // to it. \`createDoAuthWiring\` is a tested function in \`@lunora/auth\` rather
+            // than more emitted code: request-path logic in generated output can only be
+            // typechecked, never unit-tested.
+            const authWiring = createDoAuthWiring({
+                internalSecret: authDeclaration.internalSecret?.(env),
+                namespace: authNamespace(env),
+                objectName: authDeclaration.objectName?.(env),
+            });
+
+            options.authHandler = authWiring.authHandler;
+            options.resolveIdentity = authWiring.resolveIdentity;
+            // The audit log lives in the object like every other auth table, so the feed
+            // reads through it rather than querying D1.
+            options.authAuditReader = authWiring.auditReader;
+            // \`authAdmin\` stays D1-only: its ~30 methods read the auth tables directly
+            // from the worker, which DO storage does not allow. The studio's auth pages
+            // therefore report "not configured" in this mode rather than silently
+            // returning empty data.
+        } else if (authDeclaration && authD1) {
+            options.authHandler = (request) => {
+                const auth = getAuth();
+
+                return auth ? handleAuthRequest(auth, request) : Promise.resolve(undefined);
+            };
+            options.resolveIdentity = async (request) => {
+                const auth = getAuth();
+
+                if (!auth) {
+                    return null;
+                }
+
+                const session = await auth.api.getSession({ headers: (request as Request).headers });
+
+                return session?.user?.id ? { userId: session.user.id } : null;
+            };
+            const authInstance = getAuth();
+
+            options.authAdmin = authInstance ? createAuthAdmin(authInstance) : undefined;
+            options.authAuditReader = createAuthAuditReader(d1Executor(authD1(env) as never));
+        }`]:[],...e.hasAccess?[e.hasAuth?`        if (this.accessSelector) {
+            const accessResolver = createAccessResolver(this.accessSelector(env));
+            const fallback = options.resolveIdentity;
+
+            options.resolveIdentity = fallback ? composeResolvers(accessResolver, fallback) : accessResolver;
+        }`:`        if (this.accessSelector) {
+            options.resolveIdentity = createAccessResolver(this.accessSelector(env));
+        }`]:[],...e.voiceAgents&&e.voiceAgents.length>0?[`        options.voiceAgents = {
+${e.voiceAgents.map(t=>`            ${JSON.stringify(t.exportName)}: (env as Record<string, unknown>)[${JSON.stringify(t.bindingName)}] as ShardNamespaceLike,`).join(`
+`)}
+        };`]:[]],W=e=>["            cronJobs: LUNORA_CRONS,","            functions: LUNORA_FUNCTIONS,",...e.identity?[`            identity: lunoraIdentityContract.${e.identity.exportName},`]:[],...e.jurisdiction?[`            jurisdiction: ${JSON.stringify(e.jurisdiction)},`]:[],...e.wantsOpenApi?["            openApiSpec,"]:[],...e.wantsOpenRpc?["            openRpcSpec,"]:[],...e.hasQueue?["            queue: (batch: unknown, queueEnv: unknown, _context: ExecutionContextLike): Promise<void> =>","                dispatchQueueBatch(batch as Parameters<typeof dispatchQueueBatch>[0], LUNORA_QUEUE_REGISTRY, {","                    capture: shouldCaptureQueue(queueEnv as Record<string, unknown>)",`                        ? createQueueCaptureSink(queueEnv as Record<string, unknown>${e.jurisdiction?`, { jurisdiction: ${JSON.stringify(e.jurisdiction)} }`:""})`,"                        : undefined,","                    env: queueEnv as Record<string, unknown>,","                }),"]:[],"            ...(this.httpRouterApp ? { httpRouter: this.httpRouterApp } : {}),","            routes: this.routeMap,","            shardDO: this.shardSelector?.(env) ?? (undefined as unknown as ShardNamespaceLike),"],$=e=>e.hasScheduler?`
+    /** Resolve the \`SchedulerDO\`-backed scheduler for this env; \`undefined\` until both the namespace and origin are wired. */
+    private resolveScheduler(env: Env): ReturnType<typeof createScheduler> | undefined {
+        const namespace = this.schedulerDeclaration?.namespace(env);
+        const origin = this.schedulerDeclaration?.origin?.(env);
+
+        return namespace && origin ? createScheduler({${e.jurisdiction?` jurisdiction: ${JSON.stringify(e.jurisdiction)},`:""} namespace, originUrl: origin }) : undefined;
+    }
+`:"",P=e=>e?`
+    /** Resolve the storage capability (single or multi-bucket) for the DO side. */
+    private resolveStorage(env: Env): Storage | undefined {
+        const declaration = this.storageDeclaration;
+
+        if (!declaration) {
+            return undefined;
+        }
+
+        const defaultBucket = declaration.bucket(env);
+
+        if (!defaultBucket) {
+            return undefined;
+        }
+
+        const make = (bucket: R2BucketLike): Storage =>
+            createStorage({ bucket, publicBaseUrl: declaration.publicBaseUrl?.(env), signingSecret: declaration.signingSecret?.(env) });
+        const extraEntries = Object.entries(declaration.buckets ?? {})
+            .map(([name, selector]) => [name, selector(env)] as const)
+            .filter((entry): entry is [string, R2BucketLike] => Boolean(entry[1]));
+
+        if (extraEntries.length === 0) {
+            return make(defaultBucket);
+        }
+
+        const map: Record<string, Storage> = { default: make(defaultBucket) };
+
+        for (const [name, bucket] of extraEntries) {
+            map[name] = make(bucket);
+        }
+
+        return createBucketStorage(map, { default: "default" });
+    }
+
+    /** Derive the studio file-browser admin functions from the same buckets \`.storage()\` declared. */
+    private buildStorageAdmin(env: Env): Partial<WorkerOptions> {
+        const declaration = this.storageDeclaration;
+
+        if (!declaration) {
+            return {};
+        }
+
+        const defaultBucket = declaration.bucket(env);
+
+        if (!defaultBucket) {
+            return {};
+        }
+
+        const make = (bucket: R2BucketLike): Storage =>
+            createStorage({ bucket, publicBaseUrl: declaration.publicBaseUrl?.(env), signingSecret: declaration.signingSecret?.(env) });
+        // Held separately from the map so \`pick\`'s fallback is a plain binding:
+        // under \`noUncheckedIndexedAccess\` a \`Record<string, Storage>\` lookup —
+        // including \`buckets.default\` — widens to \`Storage | undefined\`, which
+        // would not satisfy \`pick\`'s declared \`Storage\` return.
+        const fallbackStorage = make(defaultBucket);
+        const buckets: Record<string, Storage> = { default: fallbackStorage };
+
+        for (const [name, selector] of Object.entries(declaration.buckets ?? {})) {
+            const bucket = selector(env);
+
+            if (bucket) {
+                buckets[name] = make(bucket);
+            }
+        }
+
+        const pick = (name?: string): Storage => buckets[name !== undefined && name !== "" ? name : "default"] ?? fallbackStorage;
+        const hasSigning = Boolean(declaration.publicBaseUrl?.(env) && declaration.signingSecret?.(env));
+
+        return {
+            storageBuckets: Object.keys(buckets),
+            storageDelete: (key: string, opts?: { bucket?: string }) => pick(opts?.bucket).delete(key),
+            storageDownload: (key: string, opts?: { bucket?: string }) => pick(opts?.bucket).download(key),
+            storageList: (prefix?: string, opts?: { bucket?: string; cursor?: string; limit?: number }) => pick(opts?.bucket).list(prefix, opts),
+            storageSignedUrl: hasSigning
+                ? (key: string, opts?: { bucket?: string; contentType?: string; expiresInSeconds?: number; method?: "GET" | "PUT" }) =>
+                      pick(opts?.bucket).getSignedUrl(key, { contentType: opts?.contentType, expiresInSeconds: opts?.expiresInSeconds, method: opts?.method })
+                : undefined,
+            storageUpload: (key: string, body: ArrayBuffer, opts?: { bucket?: string; contentType?: string; sha256?: string }) => pick(opts?.bucket).upload(key, body, opts),
+        };
+    }
+`:"",H=e=>e?`
+/**
+ * Adapt the raw D1 binding to \`@lunora/d1\`'s \`D1Exec\` (reads via \`all\`, writes via \`run\`, and — when the binding exposes it — several writes in one round trip via \`batch\`).
+ *
+ * Opens a D1 Sessions API session pinned to \`bookmark\` (the caller's own
+ * last-known write, when supplied) so reads observe it — read-your-writes
+ * across replicas. \`onBookmark\`, when supplied, is invoked with the bookmark
+ * produced by each write so the caller (the generated DO) can record it via
+ * \`setOutboundBookmark\` and echo \`x-d1-bookmark\` on the response.
+ *
+ * Wrapped in \`retryingExec\` so D1's documented baseline of transient failures
+ * (storage-object resets, isolate memory evictions, dropped connections) does
+ * not surface on every \`.global()\` read. Only statements that are provably
+ * read-only retry; writes — including the \`UPDATE … RETURNING\` the store's
+ * optimistic-concurrency check issues through \`all\` — pass straight through,
+ * because a transient error never says whether the write applied.
+ */
+const buildExec = (database: D1DatabaseLike, bookmark?: string, onBookmark?: (bookmark: string | undefined) => void): D1Exec => {
+    // Real D1 always exposes \`withSession\`; guarded the same way as \`batch\`
+    // below so a hand-rolled test double that omits it keeps working via
+    // \`prepare()\` straight on the raw binding — today's behaviour. With no
+    // inbound bookmark, \`"first-unconstrained"\` is the documented no-op
+    // equivalent (lowest latency, may read any replica) — see \`D1Client.withSession\`.
+    const session = typeof database.withSession === "function" ? database.withSession(bookmark ?? "first-unconstrained") : undefined;
+    const target = session ?? database;
+    const batchFn = target.batch;
+
+    return retryingExec({
+        all: async (sql, parameters) => {
+            const result = await target
+                .prepare(sql)
+                .bind(...parameters)
+                .all<Record<string, unknown>>();
+
+            return result.results;
+        },
+        // D1's own \`batch\` runs the whole array as one atomic SQLite
+        // transaction. Guarded because \`batch\` is optional in the structural
+        // type (test doubles may omit it) — real D1 always has it; a double
+        // without it still works through the store's sequential fallback.
+        // Invoked via \`.call(target, ...)\` rather than \`target.batch(...)\`
+        // directly so TS can narrow the captured \`batchFn\` across the closure
+        // boundary (a property-access narrowing like
+        // \`hasBatch = typeof target.batch === "function"\` does not survive
+        // into a nested arrow function); \`.call\` still binds \`this\` to
+        // \`target\`, so the real workerd \`D1Database\`/session doesn't throw
+        // \`TypeError: Illegal invocation\` the way a detached
+        // \`const fn = target.batch; fn(...)\` capture would.
+        batch: batchFn
+            ? async (statements) => {
+                  await batchFn.call(
+                      target,
+                      statements.map(({ params, sql }) => target.prepare(sql).bind(...params)),
+                  );
+                  onBookmark?.(session?.getBookmark() ?? undefined);
+              }
+            : undefined,
+        run: async (sql, parameters) => {
+            await target
+                .prepare(sql)
+                .bind(...parameters)
+                .run();
+            onBookmark?.(session?.getBookmark() ?? undefined);
+        },
+    });
+};
+
+/** Introspect \`.global()\` (D1-backed) tables for the studio's global data browser. */
+const buildGlobalIntrospector = (database: D1DatabaseLike): GlobalIntrospector => {
+    const exec = buildExec(database);
+
+    return {
+        facetColumn: (options) => facetGlobalColumn(exec, schema as never, options),
+        listTables: () => listGlobalTables(exec, schema as never),
+        readTablePage: (options) => readGlobalTablePage(exec, schema as never, options),
+    };
+};
+
+/**
+ * \`resolveTableSharding\` for the admin bulk-import endpoint: a lookup over each
+ * table's declared \`shardMode\` (\`defineTable(...).global()\` / \`.shardBy(field)\`
+ * already record exactly this shape on the table) — mechanical, nothing to
+ * configure per project. \`undefined\` for a table the schema doesn't declare, so
+ * the import endpoint's own unknown-table handling still applies.
+ */
+const buildTableShardingResolver = (): AdminTableResolver => (table) => {
+    const declared = (schema as unknown as D1CtxDbOptions["schema"]).tables[table];
+
+    return declared?.shardMode ? { mode: declared.shardMode } : undefined;
+};
+
+/**
+ * \`importGlobals\` for the admin bulk-import endpoint: routes \`.global()\` rows
+ * through the same D1 writer \`.global()\` reads/writes already use, via
+ * \`@lunora/d1\`'s \`importGlobalRows\`. Mirrors \`runShardImport\`'s shard-local
+ * twin (\`createShardCtxDb\` + \`importShardRows\`) — same \`{ rows, startLine }\`
+ * shape, same trusted-import \`allowExplicitId\` semantics, forwarded as-is.
+ *
+ * Passes each row's own \`line\` through rather than dropping it: the caller
+ * (\`@lunora/runtime\`'s NDJSON import stream) already carries the row's true
+ * physical source line, and global rows are typically interspersed with
+ * shard-local ones it filtered out before calling here — a single
+ * \`startLine\` plus positional counting would mis-attribute every row after
+ * the first gap. \`importGlobalRows\` prefers \`row.line\` when present and
+ * falls back to the position-derived count otherwise.
+ */
+const buildGlobalImporter =
+    (database: D1DatabaseLike, cdc: boolean) =>
+    (request: { rows: ReadonlyArray<{ doc: Record<string, unknown>; line: number; table: string }>; startLine?: number }) => {
+        const exec = buildExec(database);
+        // Same reason the PITR applier carries it: a bulk import that skips the
+        // changelog restores rows no downstream consumer is ever told about.
+        const writer = createD1CtxDb({ cdc, exec, schema: schema as unknown as D1CtxDbOptions["schema"] });
+
+        return importGlobalRows(writer, schema as unknown as D1CtxDbOptions["schema"], {
+            exec,
+            rows: request.rows.map((row) => ({ doc: row.doc, line: row.line, table: row.table })),
+            startLine: request.startLine,
+        });
+    };
+
+/**
+ * \`exportGlobals\` for the admin export endpoint (and the scheduled R2 backup,
+ * which drains the same stream): the read twin of {@link buildGlobalImporter},
+ * over the same D1 handle. \`@lunora/d1\`'s \`exportGlobalRows\` keyset-paginates
+ * each table and provisions the schema's global tables first, so a table that
+ * was never written exports as empty instead of throwing \`no such table\`.
+ *
+ * \`tables\` is forwarded as-is: the runtime passes an empty array for "every
+ * table" (its \`tables === undefined\` case), which is exactly what
+ * \`selectGlobalTables\` reads an empty allowlist as.
+ */
+const buildGlobalExporter =
+    (database: D1DatabaseLike) =>
+    (request: { tables: ReadonlyArray<string> }) =>
+        exportGlobalRows(buildExec(database), schema as unknown as D1CtxDbOptions["schema"], { tables: request.tables });
+
+/**
+ * \`syncGlobals\` for the admin CDC sync + warehouse-connector endpoints: pages
+ * the global \`__cdc_log\` past \`sinceSeq\`, the global-plane twin of the shard's
+ * \`runShardCdcSync\`.
+ *
+ * Probes \`sqlite_master\` first, exactly as the shard twin does. The changelog
+ * table is only created when the global writer runs with CDC enabled, so on
+ * every other app a straight read would throw \`no such table: __cdc_log\` and
+ * turn "nothing has changed yet" into a 500. Absent log ⇒ an empty page that
+ * leaves the caller's cursor where it was.
+ */
+const buildGlobalCdcSync =
+    (database: D1DatabaseLike) =>
+    async (request: { limit?: number; sinceSeq: number }): Promise<{ changes: ReadonlyArray<Record<string, unknown>>; cursor: number }> => {
+        const exec = buildExec(database);
+        const present = await exec.all(\`SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?\`, ["__cdc_log"]);
+
+        if (present.length === 0) {
+            return { changes: [], cursor: request.sinceSeq };
+        }
+
+        const page = await readD1CdcChanges(exec, { limit: request.limit, sinceSeq: request.sinceSeq });
+
+        // \`as unknown as\`, because \`CdcChange\` is an interface and interfaces carry
+        // no implicit index signature — the shapes are otherwise identical.
+        return { changes: page.changes as unknown as ReadonlyArray<Record<string, unknown>>, cursor: page.cursor };
+    };
+
+/**
+ * \`applyGlobals\` for the admin point-in-time-recovery apply endpoint: replays a
+ * batch of global CDC changes through the same D1 writer \`.global()\` writes go
+ * through, and reports how many were replayed.
+ *
+ * \`applyCdcChanges\` is order-sensitive and idempotent per row (insert, falling
+ * back to replace on conflict), so the batch is handed over untouched — the
+ * caller already emits it in commit order. The changes arrive as plain parsed
+ * JSON off the wire, hence the cast to the replayer's own change shape.
+ *
+ * The writer carries the app's own \`cdc\` setting, so a replay APPENDS to the
+ * global changelog like any other write. Built without it the restored rows
+ * reach the tables and nothing else: a warehouse connector's cursor walks past a
+ * range that has no entries and its mirror silently diverges from the database,
+ * with nothing on either side able to notice — and every live \`.global()\` shape
+ * misses the restore until the next unconditional resync.
+ */
+const buildGlobalCdcApplier =
+    (database: D1DatabaseLike, cdc: boolean) =>
+    async (request: { changes: ReadonlyArray<Record<string, unknown>> }): Promise<number> => {
+        const writer = createD1CtxDb({ cdc, exec: buildExec(database), schema: schema as unknown as D1CtxDbOptions["schema"] });
+
+        await applyCdcChanges(writer, request.changes as unknown as Parameters<typeof applyCdcChanges>[1]);
+
+        return request.changes.length;
+    };
+`:"",_=e=>[...e.hasAuth?["AuthDeclaration"]:[],"ComposedApp",...e.hasGlobal?["GlobalDeclaration"]:[],...e.hasScheduler?["SchedulerDeclaration"]:[],"Selector",...e.hasStorage?["StorageDeclaration"]:[]].toSorted((t,a)=>t.localeCompare(a)).join(", "),F=e=>{const{hasAuth:t}=e,a=q(e),r=B(e),n=t?`        let auth: LunoraAuth | null = null;
+`:"",o=t?`
+        const ensureAuth = async (env: Env): Promise<void> => {
+            if (!this.authDeclaration || auth) {
+                return;
+            }
+
+            const d1 = this.authDeclaration.d1;
+
+            // DO-backed mode builds no instance here: better-auth runs inside the
+            // object, which materialises its own schema (the Kysely migrator below is
+            // dialect-bound and cannot target DO storage).
+            if (!d1) {
+                return;
+            }
+
+            auth = createAuth({ ...this.authDeclaration.options(env), database: lunoraD1Adapter(d1(env) as never) });
+            // Apply the better-auth schema lazily on first request (raw-D1 Kysely
+            // migrator). For production run the migrate command ahead of deploy.
+            await ensureMigrated(createAuth({ ...this.authDeclaration.options(env), database: d1(env) as never }));
+        };
+`:"",c=t?`
+                await ensureAuth(env);`:"",s=t?"() => auth":"() => null",d=t?"getAuth: () => LunoraAuth | null":"_getAuth: () => null",h=e.hasFramework?`        const buildWorker = (env: Env): LunoraWorker =>
+            host ? withFrameworkWorker(host, (hostEnv) => this.buildWorkerOptions(hostEnv as Env, ${s})) : createWorker(this.buildWorkerOptions(env, ${s}));`:`        const buildWorker = (env: Env): LunoraWorker => createWorker(this.buildWorkerOptions(env, ${s}));`,u=e.hasFramework?"host?: FrameworkHostHandler":"",l=e.emailAgents??[],p=l.length>0?`        composed.email = dispatchAgentEmail([
+${l.map(i=>`            { agent: lunoraAgentDefinitions.${i.exportName}, binding: ${JSON.stringify(i.bindingName)} },`).join(`
+`)}
+        ]);
+
+`:"",b=`    /** Materialise the standalone Cloudflare worker + \`ShardDO\` class. */
+    public build(): ComposedApp {
+        return this.assemble();
+    }${e.hasFramework?"\n\n    /** Compose Lunora's realtime plane INTO a meta-framework's Cloudflare handler (SvelteKit/Astro/Nuxt). The framework `host` serves everything except the reserved `/_lunora/*` endpoints; pass the adapter-emitted worker (e.g. SvelteKit's `_worker.js`, Astro's `handle`). */\n    public buildFrameworkWorker(host: FrameworkHostHandler): ComposedApp {\n        return this.assemble(host);\n    }":""}`;return`${D}${L(e).join(`
+`)}
+
+/** Read a value off the per-request \`env\`. Returns \`undefined\` to leave the capability unconfigured (its \`ctx.*\`/admin surface stays a clear-error stub). */
+type Selector<Env, T> = (env: Env) => T | undefined;
+${m(e)?"\n/** The generated `createShardDO` config — the long-tail `.ai()` / `.kv()` / … methods pass straight through to it. */\ntype ShardConfig = NonNullable<Parameters<typeof createShardDO>[0]>;\n":""}
+${a.join(`
+
+`)}${a.length>0?`
+
+`:""}/** The composed app: a Cloudflare module worker (\`fetch\` / \`scheduled\` / optional \`email\`) plus the \`ShardDO\` class binding. */
+interface ComposedApp extends LunoraWorker {
+    /** Cloudflare Email Routing entry — present only when \`.onEmail(...)\` was configured. */
+    email?: (message: unknown, env: unknown, context: ExecutionContextLike) => Promise<void>;
+    /** The generated shard Durable Object class — re-export it as a named export so wrangler can bind it. */
+    ShardDO: ReturnType<typeof createShardDO>;
+}
+
+/**
+ * Fluent worker-composition builder. Records each capability declaration, then
+ * \`.build()\` fans them into the DO-side \`createShardDO\` factory and the
+ * worker-side \`createWorker\` options — constructing the worker lazily on the
+ * first request so per-isolate singletons are built once.
+ */
+class AppBuilder<Env extends object> {
+${I(e).join(`
+`)}
+
+    private emailHandler?: (env: Env) => (message: unknown, env: unknown, context: ExecutionContextLike) => Promise<void>;
+
+${N(e).join(`
+
+`)}
+
+${b}
+
+    /** Build the shard DO + compose the worker (standalone or framework-hosted), wrapping the lazy per-isolate singletons + auth init. */
+    private assemble(${u}): ComposedApp {
+        const ShardDO = createShardDO({${j(e)}});
+
+        // Per-isolate singletons: the worker (and auth instance) are expensive to
+        // build, so the first request constructs them and every later request on
+        // the same isolate reuses them.
+        let worker: LunoraWorker | null = null;
+${n}${o}
+${h}
+
+        const composed: ComposedApp = {
+            ShardDO,
+            fetch: async (request: Request, rawEnv: unknown, context: ExecutionContextLike): Promise<Response> => {
+                const env = rawEnv as Env;${c}
+                worker ??= buildWorker(env);
+
+                return worker.fetch(request, rawEnv, context);
+            },
+            scheduled: async (controller: ScheduledControllerLike, rawEnv: unknown, context: ExecutionContextLike): Promise<void> => {
+                worker ??= buildWorker(rawEnv as Env);
+
+                return worker.scheduled(controller, rawEnv, context);
+            },
+            serverQuery: (request, rawEnv, reference, args, options) => {
+                worker ??= buildWorker(rawEnv as Env);
+
+                return worker.serverQuery(request, rawEnv, reference, args, options);
+            },${e.hasQueue?`
+            queue: async (batch: unknown, rawEnv: unknown, context: ExecutionContextLike): Promise<void> => {
+                worker ??= buildWorker(rawEnv as Env);
+
+                return worker.queue?.(batch, rawEnv, context);
+            },`:""}
+        };
+
+${p}        if (this.emailHandler) {
+            const handler = this.emailHandler;
+
+            composed.email = (message, rawEnv, context) => handler(rawEnv as Env)(message, rawEnv, context);
+        }
+
+        return composed;
+    }
+${$(e)}${P(e.hasStorage)}
+    /** Fan the recorded declarations into the worker-side \`createWorker\` options. */
+    private buildWorkerOptions(env: Env, ${d}): WorkerOptions {
+        const options: WorkerOptions = {
+${W(e).join(`
+`)}
+        };
+
+        if (this.adminToken) {
+            options.adminToken = this.adminToken(env);
+        }
+
+${r.join(`
+
+`)}${r.length>0?`
+
+`:""}        for (const fn of this.extendFns) {
+            Object.assign(options, fn(env, { ...options }));
+        }
+
+        return options;
+    }
+}
+${H(e.hasGlobal)}
+/**
+ * Start composing the app. Chain the capability methods, then \`.build()\`.
+ *
+ * \`Env\` is constrained to \`object\`, not \`Record<string, unknown>\`: an \`interface Env\`
+ * — which is what wrangler's generated \`worker-configuration.d.ts\` gives you, and
+ * what any app with its own bindings declares — is NOT assignable to an index
+ * signature, so the stricter bound forced every real app to write
+ * \`type AppEnv = Env & Record<string, unknown>\`. The builder only ever reads \`env\`
+ * through the selectors you pass it, so the looser bound costs nothing.
+ */
+const defineApp = <Env extends object>(): AppBuilder<Env> => new AppBuilder<Env>();
+
+export { AppBuilder, defineApp };
+export type { ${_(e)} };
+`};export{F as emitApp};