@lunora/codegen 1.0.0-alpha.13 → 1.0.0-alpha.131

package/dist/packem_shared/emit-GW3Jf9w0.mjs

@@ -0,0 +1,2268 @@
+import{agentComponent as st}from"@lunora/agent/component";import{LunoraError as te}from"@lunora/errors";import{serializeSchemaSnapshot as yn,hashSchemaSnapshot as wn}from"./SCHEMA_SNAPSHOT_VERSION-CftvRWB8.mjs";import{s as N}from"./paths-C-9fwEgQ.mjs";const it=[{contextProperty:"access",key:"access",moduleSpecifier:"@lunora/cloudflare-access"},{appMethod:{configKey:"ai",doc:"Override the Workers AI binding backing `ctx.ai` (defaults to `env.AI`).",method:"ai"},contextProperty:"ai",key:"ai",moduleSpecifier:"@lunora/ai"},{appMethod:{configKey:"analytics",doc:"Override the Analytics Engine dataset backing `ctx.analytics` (defaults to `env.ANALYTICS`).",method:"analytics"},contextProperty:"analytics",key:"analytics",moduleSpecifier:"@lunora/bindings/analytics",serverCtxField:{field:`
+    /** Analytics Engine telemetry sink. Fire-and-forget and sampled; do not read it back in-handler. */
+    readonly analytics: import("@lunora/bindings/analytics").AnalyticsClient;`,tier:"every"}},{appMethod:{configKey:"browser",doc:"Override the Browser Rendering binding backing `ctx.browser` (defaults to `env.BROWSER`).",method:"browser"},contextProperty:"browser",key:"browser",moduleSpecifier:"@lunora/browser",serverCtxField:{field:`
+    /** Browser Rendering (screenshots/PDF/scrape). Non-deterministic — available only in actions. */
+    readonly browser: import("@lunora/browser").Browser;`,tier:"action"}},{contextProperty:"containers",key:"container",moduleSpecifier:"@lunora/container"},{contextProperty:"flags",key:"flags",moduleSpecifier:"@lunora/flags"},{appMethod:{configKey:"sql",doc:"Wire the Hyperdrive SQL client backing `ctx.sql` — build it with `createHyperdrive` + `fromPostgresJs`/`fromNodePg`/`fromMysql2`.",method:"hyperdrive"},contextProperty:"sql",key:"hyperdrive",moduleSpecifier:"@lunora/hyperdrive",serverCtxField:{field:`
+    /**
+     * External database access via Hyperdrive. Non-deterministic — available only in actions. Writes here are NOT tracked by Lunora live queries; subscriptions will not re-run on external DB changes.
+     */
+    readonly sql: import("@lunora/hyperdrive").SqlClient;`,tier:"action"}},{appMethod:{configKey:"images",doc:"Override the Images binding backing `ctx.images` (defaults to `env.IMAGES`).",method:"images"},contextProperty:"images",key:"images",moduleSpecifier:"@lunora/bindings/images",serverCtxField:{field:`
+    /** Cloudflare Images transforms (resize/format/optimize). Non-deterministic — available only in actions. */
+    readonly images: import("@lunora/bindings/images").Images;`,tier:"action"}},{appMethod:{configKey:"kv",doc:"Override the Workers KV binding backing `ctx.kv` (defaults to `env.KV`).",method:"kv"},contextProperty:"kv",key:"kv",moduleSpecifier:"@lunora/bindings/kv",serverCtxField:{field:`
+    readonly kv: import("@lunora/bindings/kv").Kv;`,tier:"every"}},{key:"mail",moduleSpecifier:"@lunora/mail"},{contextProperty:"notify",key:"notify",moduleSpecifier:"@lunora/notify"},{appMethod:{configKey:"payment",doc:"Wire the payment options backing `ctx.payments`.",method:"payment"},contextProperty:"payments",key:"payments",moduleSpecifier:"@lunora/payment"},{appMethod:{configKey:"x402",doc:"Wire the x402 agent-wallet pay rail backing `ctx.x402` — a payment-enabled `fetch` that answers `402` challenges under a mandatory spend policy (ActionCtx-only; spends real funds).",method:"x402"},contextProperty:"x402",key:"x402",moduleSpecifier:"@lunora/x402/pay"},{contextProperty:"pipelines",key:"pipelines",moduleSpecifier:"@lunora/bindings/pipelines",serverCtxField:{field:`
+    /** Pipelines ingestion sink (durable, R2-backed). Fire-and-forget and batched; do not read it back in-handler. */
+    readonly pipelines: import("@lunora/bindings/pipelines").PipelineClient;`,tier:"action"}},{appMethod:{configKey:"r2sql",doc:"Wire the R2 SQL client backing `ctx.r2sql` — build it with `createR2Sql({ accountId, apiToken, bucket })` (defaults to env `R2_SQL_TOKEN` / `R2_SQL_ACCOUNT_ID` / `R2_SQL_BUCKET`).",method:"r2sql"},contextProperty:"r2sql",key:"r2sql",moduleSpecifier:"@lunora/bindings/r2sql",serverCtxField:{field:`
+    /**
+     * R2 SQL over Apache Iceberg tables (window functions, DISTINCT, set operations). Non-deterministic — available only in actions. Reads here are NOT tracked by Lunora live queries.
+     */
+    readonly r2sql: import("@lunora/bindings/r2sql").R2SqlClient;`,tier:"action"}},{contextProperty:"scheduler",key:"scheduler",moduleSpecifier:"@lunora/scheduler"},{contextProperty:"storage",key:"storage",moduleSpecifier:"@lunora/storage"},{appMethod:{configKey:"vectors",doc:"Wire the Vectorize index map backing `ctx.vectors`.",method:"vectors"},contextProperty:"vectors",key:"vectors",moduleSpecifier:"@lunora/bindings/vectors"},{contextProperty:"workflows",key:"workflows",moduleSpecifier:"@lunora/workflow"}],kn=it,xn=new Map(kn.flatMap(e=>e.serverCtxField?[[e.key,e.serverCtxField]]:[])),Hr=it.flatMap(e=>"appMethod"in e?[{appMethod:e.appMethod,key:e.key}]:[]),lt=/^(?:"(?:[^"\\]|\\(?:["\\/bfnrt]|u[0-9A-Fa-f]{4}))*"|'[^'\\]*'|-?\d+(?:\.\d+)?|true|false|null)$/u,vn=new Set(["any","bigint","boolean","date","id","null","number","storage","string","timestamp"]),ct=e=>e.column!==void 0,Rn=(e,t)=>{switch(e){case"bigint":return`if (typeof ${t} !== "bigint") return DEFER;
+`;case"boolean":return`if (typeof ${t} !== "boolean") return DEFER;
+`;case"date":case"number":case"timestamp":return`if (typeof ${t} !== "number" || !Number.isFinite(${t})) return DEFER;
+`;case"null":return`if (${t} !== null) return DEFER;
+`;default:return`if (typeof ${t} !== "string") return DEFER;
+`}},Sn=(e,t)=>{const n=e.literalValue?.trim();if(!(n===void 0||!lt.test(n)))return{out:t,pre:`if (${t} !== ${n}) return DEFER;
+`}},Ke=(e,t,n)=>{if(!ct(e)&&!(e.hasRefinement||e.sourceText!==void 0)){if(vn.has(e.kind))return e.kind==="any"?{out:t,pre:""}:{out:t,pre:Rn(e.kind,t)};switch(e.kind){case"array":return $n(e,t,n);case"literal":return Sn(e,t);case"object":return An(e,t,n);default:return}}},$n=(e,t,n)=>{const{inner:r}=e;if(!r)return;const o=n.next(),s=`__arr${String(o)}`,i=`__i${String(o)}`,a=`__e${String(o)}`,c=Ke(r,a,n);if(!c)return;const d=`if (!Array.isArray(${t})) return DEFER;
+const ${s} = new Array(${t}.length);
+for (let ${i} = 0; ${i} < ${t}.length; ${i}++) {
+const ${a} = ${t}[${i}];
+${c.pre}${s}[${i}] = ${c.out};
+}
+`;return{out:s,pre:d}},Nn=(e,t,n,r)=>{const o=JSON.stringify(e);if(t.kind==="optional"){if(t.hasRefinement||t.sourceText!==void 0||ct(t))return;const{inner:i}=t;if(!i)return;const a=Ke(i,n,r);if(!a)return;const c=r.next(),d=`__has${String(c)}`,p=`__val${String(c)}`,m=`let ${d} = false;
+let ${p};
+if (${n} !== undefined) {
+${a.pre}${p} = ${a.out};
+${d} = true;
+}
+`;return{entry:`...(${d} ? { ${o}: ${p} } : {})`,pre:m}}const s=Ke(t,n,r);if(s)return{entry:`${o}: ${s.out}`,pre:s.pre}},Tn=new Set(Object.getOwnPropertyNames(Object.prototype)),dt=(e,t,n)=>{let r="";const o=[];for(const s of Object.keys(e)){const i=e[s];if(!i)return;const a=JSON.stringify(s);let c=`${t}[${a}]`;if(Tn.has(s)){const p=`__f${String(n.next())}`;r+=`const ${p} = Object.hasOwn(${t}, ${a}) ? ${t}[${a}] : undefined;
+`,c=p}const d=Nn(s,i,c,n);if(!d)return;r+=d.pre,o.push(d.entry)}return{entries:o.join(", "),pre:r}},ut=e=>{const t=`Object.getPrototypeOf(${e})`;return`if (${t} !== Object.prototype && ${t} !== null) return DEFER;
+`},An=(e,t,n)=>{const r=e.shape??{},o=dt(r,t,n);if(!o)return;const s=n.next(),i=`__obj${String(s)}`,a=`if (typeof ${t} !== "object" || ${t} === null || Array.isArray(${t})) return DEFER;
+${ut(t)}${o.pre}const ${i} = { ${o.entries} };
+`;return{out:i,pre:a}},On=e=>{let t=0;const r=dt(e,"source",{next:()=>(t+=1,t)});if(r)return`(source) => {
+if (typeof source !== "object" || source === null || Array.isArray(source)) return DEFER;
+${ut("source")}${r.pre}return { ${r.entries} };
+}`},$=`// GENERATED by @lunora/codegen — do not edit.
+// Run \`lunora codegen\` to regenerate.
+
+`,ne=(e=!1)=>e?{client:"lunorash/client",do:"lunorash/do",flags:"lunorash/flags",server:"lunorash/server",serverDataModel:"lunorash/server/data-model",serverDrizzle:"lunorash/server/drizzle",serverTypes:"lunorash/server/types",values:"lunorash/values"}:{client:"@lunora/client",do:"@lunora/do",flags:"@lunora/flags",server:"@lunora/server",serverDataModel:"@lunora/server/data-model",serverDrizzle:"@lunora/server/drizzle",serverTypes:"@lunora/server/types",values:"@lunora/values"},pt=/^[A-Za-z_$][\w$]*$/u,In=/^[\w./-]+$/u,g=(e,t)=>{if(!pt.test(e))throw new te("INTERNAL",`@lunora/codegen: ${t} is not a valid JS identifier: ${JSON.stringify(e)}`)},Ue=e=>e.charAt(0).toUpperCase()+e.slice(1),D=e=>pt.test(e)?e:JSON.stringify(e),Cn={any:"unknown",bigint:"bigint",boolean:"boolean",bytes:"ArrayBuffer",date:"number",geoPoint:"{ lat: number; lng: number }",null:"null",number:"number",storage:"string",string:"string",timestamp:"number"},Ln=e=>{if(e===void 0)return"unknown";if(!lt.test(e))throw new te("INTERNAL",`@lunora/codegen: v.literal() argument is not a parseable string/number/boolean/null literal: ${JSON.stringify(e)}`);return e},A=e=>{const t=Cn[e.kind];if(t!==void 0)return t;switch(e.kind){case"array":return`Array<${e.inner?A(e.inner):"unknown"}>`;case"from":return e.tsType??"unknown";case"id":{const n=e.tableName??"_unknown_";return g(n,"v.id() table name"),`Id<"${n}">`}case"literal":return Ln(e.literalValue);case"object":return e.shape?`{ ${Object.entries(e.shape).map(([r,o])=>ht(r,o)).join("; ")} }`:"Record<string, unknown>";case"optional":return`${e.inner?A(e.inner):"unknown"} | undefined`;case"record":{const n=e.keyType?A(e.keyType):"string",r=e.valueType?A(e.valueType):"unknown";return`Record<${n}, ${r}>`}case"union":return e.members&&e.members.length>0?e.members.map(n=>A(n)).join(" | "):"never";default:return"unknown"}},ht=(e,t)=>{const n=D(e);if(t.kind==="optional"){const r=t.inner?A(t.inner):"unknown";return`${n}?: ${r}`}return`${n}: ${A(t)}`},we=e=>{const t=Object.entries(e);return t.length===0?"{}":`{ ${t.map(([n,r])=>ht(n,r)).join("; ")} }`},mt=e=>e.kind==="optional"||!!e.column?.hasDefault,re=e=>e.kind==="optional"&&e.inner?e.inner:e,_n=e=>{g(e.name,"table name");const t=Object.entries(e.shape).map(([r,o])=>{const s=re(o),i=A(s),a=D(r);return mt(o)?`    ${a}?: ${i};`:`    ${a}: ${i};`}).join(`
+`),n=t?`
+${t}
+`:"";return`export interface Insert_${e.name} {
+    _id?: Id<"${e.name}">;
+    _creationTime?: number;${n}}`},Qe="schema",Gr=e=>{for(const u of e.tables)g(u.name,"table name");const t=e.tables.map(u=>`"${u.name}"`).join(" | ")||"never",n=e.tables.filter(u=>u.extensionKey===void 0).map(u=>`"${u.name}"`).join(" | ")||"never",r=e.tables.map(u=>{const l=Object.entries(u.shape).map(([R,x])=>{const I=D(R);if(x.kind==="optional"){const T=x.inner?A(x.inner):"unknown";return`    ${I}?: ${T};`}return`    ${I}: ${A(x)};`}).join(`
+`),f=l?`
+${l}
+`:"",k=u.commitOrdered===!0?`
+    _commitSeq: number;`:"";return`export interface Doc_${u.name} {
+    _id: Id<"${u.name}">;
+    _creationTime: number;${k}${f}}`}).join(`
+
+`),o=e.tables.map(u=>`    ${u.name}: Doc_${u.name};`).join(`
+`),s=e.tables.map(u=>{const l=u.indexes.map(f=>JSON.stringify(f.name)).join(" | ");return`    ${u.name}: ${l||"never"};`}).join(`
+`),i=e.tables.map(u=>{const l=u.searchIndexes.map(f=>JSON.stringify(f.name)).join(" | ");return`    ${u.name}: ${l||"never"};`}).join(`
+`),a=e.tables.map(u=>{const l=u.rankIndexes.map(f=>JSON.stringify(f.name)).join(" | ");return`    ${u.name}: ${l||"never"};`}).join(`
+`),c=e.tables.map(u=>{const l=u.shardMode==="global"?"":(u.geoIndexes??[]).map(f=>JSON.stringify(f.name)).join(" | ");return`    ${u.name}: ${l||"never"};`}).join(`
+`),d=e.vectorIndexes.map(u=>JSON.stringify(u.name)).join(" | ")||"never",p=e.tables.map(u=>_n(u)).join(`
+
+`),m=e.tables.map(u=>`    ${u.name}: Insert_${u.name};`).join(`
+`),y=e.tables.map(u=>{const l=u.relations.map(f=>(g(f.table,"relation target table"),`        ${D(f.name)}: ${f.kind==="one"?"OneRelation":"ManyRelation"}<"${f.table}">;`)).join(`
+`);return l?`    ${u.name}: {
+${l}
+    };`:`    ${u.name}: {};`}).join(`
+`);return E(`${$}export type TableName = ${t};
+
+/**
+ * The tables **this app declared** — every {@link TableName} except those an add-on
+ * contributed through \`defineSchema(...).extend(...)\`.
+ *
+ * An add-on's tables are real tables and stay in \`TableName\` (they are queryable,
+ * they appear in \`DataModel\`), but an app enumerating "my tables" should not have to
+ * know they exist: an account-deletion sweep, an export, a migration allowlist, or a
+ * helper generic over a table union is about the app's own data, and every add-on
+ * added or removed would otherwise silently change the correct answer.
+ *
+ * \`\`\`ts
+ * // Doesn't need to mention \`ratelimit_buckets\`, and won't drift when an add-on lands.
+ * const EXPORTED: readonly AppTableName[] = ["nodes", "tagColors"];
+ * \`\`\`
+ */
+export type AppTableName = ${n};
+
+export type Id<TName extends string> = string & { readonly __table: TName };
+
+${r}
+
+export interface DataModel {
+${o}
+}
+
+export type Doc<T extends keyof DataModel> = DataModel[T];
+
+/**
+ * Per-table index name union. \`never\` for tables without secondary indexes.
+ * Used by \`TableReader.withIndex()\` to constrain callers to declared names.
+ */
+export interface IndexNamesByTable {
+${s}
+}
+
+export type IndexName<T extends keyof DataModel> = IndexNamesByTable[T];
+
+/** Per-table search-index name union. \`never\` for tables without searchIndex. */
+export interface SearchIndexNamesByTable {
+${i}
+}
+
+export type SearchIndexName<T extends keyof DataModel> = SearchIndexNamesByTable[T];
+
+/** Per-table rank-index name union. \`never\` for tables without a rankIndex. */
+export interface RankIndexNamesByTable {
+${a}
+}
+
+export type RankIndexName<T extends keyof DataModel> = RankIndexNamesByTable[T];
+
+/** Per-table geo-index name union. \`never\` for tables without a geoIndex. */
+export interface GeoIndexNamesByTable {
+${c}
+}
+
+export type GeoIndexName<T extends keyof DataModel> = GeoIndexNamesByTable[T];
+
+/** Union of declared vector index names. \`never\` when none are declared. */
+export type VectorIndexName = ${d};
+
+${p}
+
+/** Per-table insert shape, accepted by \`ctx.db.<table>.insert(...)\`. */
+export interface InsertModel {
+${m}
+}
+
+export type Insert<T extends keyof DataModel> = InsertModel[T];
+
+/**
+ * Phantom relation descriptors. They carry the relation kind and target table
+ * as type parameters only — there is no runtime value — so the \`with\` argument
+ * and its return type can be inferred from {@link Relations}.
+ */
+export interface OneRelation<Target extends keyof DataModel> {
+    readonly __relationKind: "one";
+    readonly __target: Target;
+}
+
+export interface ManyRelation<Target extends keyof DataModel> {
+    readonly __relationKind: "many";
+    readonly __target: Target;
+}
+
+/** Per-table relation map keyed by accessor name. \`{}\` for tables with none. */
+export interface Relations {
+${y}
+}
+
+`,Qe)},Dn=/import\("(?<spec>(?:\.\.?\/)*_generated\/[^"]+)"\)/gu,gt=/^(?:\.\.?\/)*_generated\//u,ft=/\.[A-Za-z]\w*$/u,En=e=>e.replaceAll(Dn,(t,n)=>{const r=n.replace(gt,"./");return`import("${ft.test(r)?r:`${r}.js`}")`}),Pn=/import\("(?<spec>\.\.?\/[^"]+)"\)/gu,Fn=/^(?:\.\.?\/)+/u,Mn=e=>{const t=[];for(const n of e.split("/"))if(!(n===""||n===".")){if(n===".."&&t.length>0&&t.at(-1)!==".."){t.pop();continue}t.push(n)}return t.join("/")},Bn=(e,t)=>e.replaceAll(Pn,(n,r)=>{if(gt.test(r.replace(Fn,"")))return n;const o=t.includes("/")?t.slice(0,t.lastIndexOf("/")):"",i=`../${Mn(`${o}/${r}`)}`;return`import("${ft.test(i)?i:`${i}.js`}")`}),E=(e,t)=>En(Bn(e,t)),jn=["client","do","errors","flags","observability","platform","ratelimit","runtime","server","values"],qn=new RegExp(String.raw`import\("@lunora/(?<pkg>${jn.join("|")})(?<subpath>/[^"]*)?"\)`,"gu"),Wn={flags:new Set(["/web"]),platform:new Set},bt=(e,t)=>t?e.replaceAll(qn,(n,r,o)=>{const s=Wn[r];return o&&s&&!s.has(o)?n:`import("lunorash/${r}${o??""}")`}):e,Ve=e=>["Doc","Id"].filter(t=>new RegExp(String.raw`\b${t}<`,"u").test(e)),yt=e=>e.output===void 0||e.output.kind==="any"||e.kind==="stream"?e.returnType:A(e.output),He=e=>{const t=new Map;for(const n of e){const r=t.get(n.filePath)??[];r.push(n),t.set(n.filePath,r)}return[...t.entries()].toSorted(([n],[r])=>n.localeCompare(r))},ot=e=>{const t=([n,r])=>{const o=r.toSorted((s,i)=>s.exportName.localeCompare(i.exportName)).map(s=>{const i=E(we(s.args),s.filePath),a=E(yt(s),s.filePath);return`        ${s.exportName}: FunctionReference<"${s.kind}", ${i}, ${a}>;`}).join(`
+`);return`    ${D(N(n))}: {
+${o}
+    };`};return He(e).map(n=>t(n)).join(`
+`)},Un=(e,t)=>{if(e.length===0&&t.length===0)return{block:"",importLine:""};const n=[];let r="";if(e.length>0&&(r+="\n/** Params type carried by a `defineWorkflow` definition (its phantom `__params`). */\ntype WorkflowParamsOf<Definition> = Definition extends { __params?: infer Params } ? (unknown extends Params ? Record<string, unknown> : Params) : Record<string, unknown>;\n"),r+=`
+/** A typed reference to a durable workflow, addressable for \`cronJobs()\` targets. Mirrors \`@lunora/scheduler\`'s \`WorkflowReference\` structurally. */
+export interface WorkflowReference<Params = Record<string, unknown>> {
+    readonly isLunoraWorkflow: true;
+    readonly __params?: Params;
+    readonly binding: string;
+    readonly name: string;
+}
+`,e.length>0){const o=[...e].toSorted((a,c)=>a.exportName.localeCompare(c.exportName)),s=o.map(a=>`    ${a.exportName}: WorkflowReference<WorkflowParamsOf<typeof lunoraWorkflowDefinitions.${a.exportName}>>;`).join(`
+`),i=o.map(a=>`    ${a.exportName}: { isLunoraWorkflow: true, binding: ${JSON.stringify(a.bindingName)}, name: ${JSON.stringify(a.exportName)} },`).join(`
+`);r+=`
+/** This project's durable workflows, addressable as typed references (e.g. \`crons.daily("digest", …, workflows.digestPipeline, params)\`). */
+export interface WorkflowsRef {
+${s}
+}
+
+export const workflows: WorkflowsRef = {
+${i}
+};
+`,n.push(`import type * as lunoraWorkflowDefinitions from "../workflows.js";
+`)}if(t.length>0){const o=[...t].toSorted((a,c)=>a.exportName.localeCompare(c.exportName)),s=o.map(a=>`    ${a.exportName}: WorkflowReference<AgentRunInput>;`).join(`
+`),i=o.map(a=>`    ${a.exportName}: { isLunoraWorkflow: true, binding: ${JSON.stringify(a.bindingName)}, name: ${JSON.stringify(a.name)} },`).join(`
+`);r+=`
+/** This project's durable agents, addressable as typed references for \`cronJobs()\` — each fire starts a fresh agent run (e.g. \`crons.daily("sweep", …, agents.support, { input, threadKey })\`). */
+export interface AgentsRef {
+${s}
+}
+
+export const agents: AgentsRef = {
+${i}
+};
+`,n.push(`import type { AgentRunInput } from "@lunora/agent";
+`)}return{block:r,importLine:n.join("")}},Kn=()=>Object.keys(st().functions).toSorted((e,t)=>e.localeCompare(t)),wt=e=>new Set(e.filter(t=>N(t.filePath)==="agents").map(t=>t.exportName)),Qn=()=>new Set(Object.entries(st().functions).filter(([,e])=>e.visibility==="internal").map(([e])=>e)),Vn=(e,t)=>{const n={importLine:"",lines:"",prelude:""};if(e.length===0)return n;const r=wt(t),o=Qn(),s=t.find(a=>N(a.filePath)==="agents"&&o.has(a.exportName));if(s)throw new te("INTERNAL",`@lunora/codegen: "agents:${s.exportName}" is reserved for the durable agent loop's internal dispatch — rename the "${s.exportName}" export in ${s.filePath}`);const i=Kn().filter(a=>!r.has(a));return i.length===0?n:{importLine:`import { agentComponent } from "@lunora/agent/component";
+`,lines:i.map(a=>`    "agents:${a}": lunoraAgentRuntimeFunctions.${a} as unknown as RegisteredLunoraFunction,`).join(`
+`),prelude:`
+/**
+ * The \`@lunora/agent\` runtime component — auto-registered because \`lunora/agents.ts\`
+ * declares agents. The durable loop dispatches the internal mutations; clients
+ * subscribe to the public queries (\`agents:agentMessages\` is the live thread view).
+ */
+const lunoraAgentRuntimeFunctions = agentComponent().functions;
+`}},Hn=(e,t)=>{if(!e)return{importLine:"",lines:"",prelude:""};const n=t.find(r=>N(r.filePath)==="sandbox"&&r.exportName==="invoke");if(n)throw new te("INTERNAL",`@lunora/codegen: "sandbox:invoke" is reserved for the batteries-included sandbox tool dispatcher (browserTool/containerTool) — rename the "invoke" export in ${n.filePath}`);return{importLine:`import { sandboxComponent } from "@lunora/agent/component";
+`,lines:'    "sandbox:invoke": lunoraSandbox.invoke as unknown as RegisteredLunoraFunction,',prelude:"\n/**\n * The `@lunora/agent` sandbox dispatcher — auto-registered because `lunora/`\n * imports a sandbox tool (`browserTool`/`containerTool`). The batteries-included\n * tools dispatch to this internal action, which runs on an action ctx carrying\n * `ctx.browser` + `ctx.containers` (the durable tool step itself has neither).\n */\nconst lunoraSandbox = sandboxComponent();\n"}},Gn=(e,t)=>{if(e.length===0)return[];const n=wt(t),r=[{args:{key:{kind:"string"},limit:{inner:{kind:"number"},kind:"optional"}},exportName:"agentMessages",filePath:"agents",kind:"query",returnType:"Record<string, unknown>[]"},{args:{decision:{kind:"union",members:[{kind:"literal",literalValue:'"approve"'},{kind:"literal",literalValue:'"reject"'}]},instanceId:{kind:"string"},note:{inner:{kind:"string"},kind:"optional"},threadKey:{kind:"string"},toolCallId:{kind:"string"}},exportName:"agentResolveApproval",filePath:"agents",kind:"mutation",returnType:"{ resolved: boolean }"},{args:{agent:{kind:"string"},input:{kind:"string"},threadKey:{kind:"string"},title:{inner:{kind:"string"},kind:"optional"}},exportName:"agentRun",filePath:"agents",kind:"mutation",returnType:"{ id: string; threadKey: string }"},{args:{key:{kind:"string"}},exportName:"agentState",filePath:"agents",kind:"query",returnType:"Record<string, unknown> | undefined"},{args:{key:{kind:"string"}},exportName:"agentThread",filePath:"agents",kind:"query",returnType:"Record<string, unknown> | undefined"}];for(const o of e)o.voice&&r.push({args:{threadKey:{kind:"string"}},exportName:`${o.exportName}Voice`,filePath:"agents",kind:"stream",returnType:"Record<string, unknown>"});return r.filter(o=>!n.has(o.exportName))},Jn=(e,t)=>{if(e.length===0)return[];const n=new Set(t.filter(r=>N(r.filePath)==="mutators").map(r=>r.exportName));return e.filter(r=>!n.has(r.exportName)).map(r=>({args:r.args,exportName:r.exportName,filePath:r.filePath,kind:"mutation",returnType:r.returnType}))},zn=e=>{const t=e.filter(i=>i.stream);if(t.length===0)return{block:"",body:""};const n=He(t),r=n.map(([i,a])=>{const c=a.map(d=>{const p=E(d.chunkType??"unknown",d.filePath),m=E(we(d.searchParams),d.filePath),y=E(we(d.params),d.filePath);return`        ${D(d.exportName)}: HttpStreamRef<${p}, ${m}, ${y}>;`}).join(`
+`);return`    ${D(N(i))}: {
+${c}
+    };`}).join(`
+`),o=n.map(([i,a])=>{const c=a.map(d=>`        ${D(d.exportName)}: { method: ${JSON.stringify(d.method)}, path: ${JSON.stringify(d.path)} },`).join(`
+`);return`    ${D(N(i))}: {
+${c}
+    },`}).join(`
+`);return{block:`
+/** This project's HTTP-SSE stream routes (\`httpRoute.<verb>(path).stream()\`), addressable as typed references for \`client.httpStream\` / \`useHttpStream\`. */
+export interface HttpStreamsRef {
+${r}
+}
+
+export const httpStreams: HttpStreamsRef = {
+${o}
+};
+`,body:r}},Jr=e=>{const{agents:t=[],functions:n,httpRoutes:r=[],mutators:o=[],useUmbrella:s=!1,workflows:i=[]}=e,a=ne(s),c=[...n.filter(v=>v.visibility!=="internal"),...Gn(t,n),...Jn(o,n)],d=n.filter(v=>v.visibility==="internal"),p=ot(c),m=ot(d),y=zn(r),u=`${p}
+${m}
+${y.body}`,l=Ve(u),f=l.length>0?`
+import type { ${l.join(", ")} } from "./dataModel.js";
+`:"",k=p?`
+${p}
+`:"",R=m?`
+${m}
+`:"",x=Un(i,t),I=`export interface ApiTypes {${k}}
+
+export const api = anyApi as unknown as ApiTypes;
+
+/** Internal functions — callable only server-side via \`ctx.run*\`, never from a client. */
+export interface InternalApiTypes {${R}}
+
+export const internal = anyApi as unknown as InternalApiTypes;
+${x.block}${y.block}`,T=[...I.includes("FunctionReference<")?["FunctionReference"]:[],...y.block===""?[]:["HttpStreamRef"]],_=T.length>0?`import type { ${T.join(", ")} } from "${a.client}";
+`:"";return bt(`${$}import { anyApi } from "${a.client}";
+${_}${x.importLine}${f}
+${I}`,s)},zr=e=>e?`${$}import { createSeedClient as createSeedClientBase } from "@lunora/seed";
+import type { SeedClient, SeedClientOptions } from "@lunora/seed";
+
+import schema from "../schema.js";
+import type { InsertModel } from "./dataModel.js";
+
+/**
+ * Schema-aware seed client with this project's \`InsertModel\` and runtime schema
+ * pre-bound. Each table is a method; call it with a count, a range, explicit
+ * partial rows, or per-field overrides. Foreign keys connect to rows seeded
+ * earlier in the run, and FK-parent tables are seeded automatically.
+ * @example
+ * const seed = createSeedClient({ seed: 1 });
+ * const { users } = await seed.users(5);
+ * const { posts } = await seed.posts((x) => x([10, 20]));
+ */
+export const createSeedClient = (options?: SeedClientOptions): SeedClient<InsertModel> => createSeedClientBase<InsertModel>(schema, options);
+`:"",Yr=(e,t,n=!1)=>{if(e.length===0||!t)return"";const r=ne(n),o=c=>c.table===void 0?"Row":`Doc<${JSON.stringify(c.table)}> & Row`,s=e.map(c=>{g(c.exportName,"shape export name");const d=o(c),p=E(we(c.args),c.filePath),m=Object.keys(c.args).length>0,y=m?`        args: ${p};`:`        args?: ${p};`,u=m?`(args: ${p}) => void`:`(args?: ${p}) => void`,l=`${c.exportName}CollectionOptions`;return`/** Options for the \`${c.exportName}\` shape binding. */
+export interface ${Ue(l)} {
+${y}
+    /**
+     * Share the optimistic-overlay gate with other collections + mutators on this
+     * shard. Defaults to the shared per-shard registry, which is almost always what
+     * you want — pass one only to isolate this collection's gate.
+     */
+    checkpoints?: CheckpointRegistry;
+    /** The Lunora client to subscribe through. */
+    client: LunoraClient;
+    /** Row key extractor — defaults to \`row._id\`. Override when the app keys rows by a natural column. */
+    getKey?: (row: ${d}) => string;
+    /** \`"eager"\` starts syncing at creation; \`"lazy"\` (default) on the first subscriber. */
+    load?: "eager" | "lazy";
+    /** Notified when the underlying subscription errors; the collection always leaves \`loading\`. */
+    onError?: (error: SubscriptionError) => void;
+    /** Routes the subscription to a shard's DO. **Required for a \`.shardBy()\` table** — without it the watermark lands in the default bucket. */
+    shardKey?: string;
+}
+
+/**
+ * Collection options for the \`${c.exportName}\` replication shape: \`config\` for
+ * \`createCollection\`, plus the \`checkpoints\` registry to hand \`bindMutators\` and
+ * \`scope\` to re-point the subscription.
+ */
+export const ${c.exportName}CollectionOptions = (options: ${Ue(l)}): LunoraCollectionOptions<${d}> =>
+    lunoraCollectionOptions<${d}>({
+        client: options.client,
+        ...(options.checkpoints === undefined ? {} : { checkpoints: options.checkpoints }),
+        ...(options.getKey === undefined ? {} : { getKey: options.getKey }),
+        ...(options.load === undefined ? {} : { load: options.load }),
+        ...(options.onError === undefined ? {} : { onError: options.onError }),
+        ...(options.shardKey === undefined ? {} : { shardKey: options.shardKey }),
+        shape: { args: options.args, name: ${JSON.stringify(c.exportName)}, ...(options.shardKey === undefined ? {} : { shardKey: options.shardKey }) },
+    });
+
+/** Live collection for the \`${c.exportName}\` shape, with its sync controls. */
+export const ${c.exportName}Collection = (
+    options: ${Ue(l)},
+): { checkpoints: CheckpointRegistry; collection: Collection<${d}, string>; scope: ${u} } => {
+    const { checkpoints, config, scope } = ${c.exportName}CollectionOptions(options);
+
+    return { checkpoints, collection: createCollection(config), scope };
+};`}).join(`
+
+`),i=Ve(s),a=i.length>0?`import type { ${i.join(", ")} } from "./dataModel.js";
+`:"";return`${$}import type { LunoraClient, SubscriptionError } from "${r.client}";
+import { lunoraCollectionOptions } from "@lunora/db/collections";
+import type { CheckpointRegistry, LunoraCollectionOptions, Row } from "@lunora/db";
+import type { Collection } from "@tanstack/db";
+import { createCollection } from "@tanstack/db";
+${a}
+${s}
+`},Yn=(e,t)=>`lunora_${N(e)}_${String(t)}`,Xn=`const callRegistered = async <R>(context: CallerCtx, functionPath: string, args: Record<string, unknown> | undefined): Promise<R> => {
+    const registered = LUNORA_FUNCTIONS[functionPath];
+
+    if (!registered) {
+        throw new LunoraError("FUNCTION_NOT_FOUND", \`function not registered: \${functionPath}\`);
+    }
+
+    return (await registered.handler(context, args ?? {})) as R;
+};`,Zn=(e,t,n=[],r=[])=>{const o=new Map,s=l=>{o.has(l)||o.set(l,Yn(l,o.size))};for(const l of e)s(l.filePath);for(const l of t)s(l.filePath);for(const l of n)s(l.filePath);for(const l of r)s(l.filePath);const i=[...o.entries()].map(([l,f])=>{if(!In.test(l))throw new te("INTERNAL",`@lunora/codegen: refusing to emit import for unsafe file path: ${JSON.stringify(l)}`);return`import * as ${f} from "../${l}.js";`}).join(`
+`),a=e.map(l=>`    "${N(l.filePath)}:${l.exportName}": ${o.get(l.filePath)??""}.${l.exportName} as unknown as RegisteredLunoraFunction,`).join(`
+`),c=t.map(l=>`    ${JSON.stringify(l.id)}: ${o.get(l.filePath)??""}.${l.exportName} as unknown as RegisteredDataMigration,`).join(`
+`),d=n.map(l=>`    "${N(l.filePath)}:${l.exportName}": ${o.get(l.filePath)??""}.${l.exportName} as unknown as RegisteredLunoraFunction,`).join(`
+`),p=r.map(l=>`    "${l.exportName}": ${o.get(l.filePath)??""}.${l.exportName} as unknown as RegisteredShape,`).join(`
+`),m=n.map(l=>`${N(l.filePath)}:${l.exportName}`),y=[a,d].filter(l=>l.length>0).join(`
+`),u=e.map(l=>{if(l.lifecycle||Object.keys(l.args).length===0)return;const f=On(l.args);return f===void 0?void 0:`installCompiledValidatorMap(${o.get(l.filePath)??""}.${l.exportName}.args, ${f});`}).filter(l=>l!==void 0).join(`
+`);return{dispatchBody:y.length>0?`
+${y}
+`:"",importBlock:i.length>0?`${i}
+
+`:"",installBlock:u,migrationBody:c.length>0?`
+${c}
+`:"",mutatorPaths:m,shapeBody:p.length>0?`
+${p}
+`:""}},er=e=>{const t=He(e),n=t.map(([o,s])=>{const i=s.map(a=>{const c=E(we(a.args),a.filePath),d=c==="{}"?"?":"",p=E(yt(a),a.filePath);return a.kind==="stream"?`        ${a.exportName}: (args${d}: ${c}) => Promise<AsyncIterable<${p}>>;`:`        ${a.exportName}: (args${d}: ${c}) => Promise<${p}>;`}).join(`
+`);return`    ${D(N(o))}: {
+${i}
+    };`}).join(`
+`);return{implementation:t.map(([o,s])=>{const i=N(o),a=s.map(c=>`        ${c.exportName}: (args) => callRegistered(context, "${i}:${c.exportName}", args),`).join(`
+`);return`    ${D(i)}: {
+${a}
+    },`}).join(`
+`),types:n}},tr=(e,t=[])=>{const n=new Set;for(const r of e.tables)for(const o of Object.values(r.shape)){const s=re(o);s.kind==="storage"&&typeof s.bucket=="string"&&s.bucket!==""&&n.add(s.bucket)}for(const r of t)r!==""&&r!=="default"&&n.add(r);return["default",...[...n].toSorted((r,o)=>r.localeCompare(o))]},Xr=({agents:e=[],containers:t=[],env:n,hasAccessFacade:r=!1,hasAi:o=!1,hasAnalytics:s=!1,hasBrowser:i=!1,hasFlags:a=!1,hasHyperdrive:c=!1,hasImages:d=!1,hasKv:p=!1,hasNotify:m=!1,hasPayments:y=!1,hasPipelines:u=!1,hasR2sql:l=!1,hasX402:f=!1,identity:k,queues:R=[],schema:x,storageRuleBuckets:I=[],useUmbrella:T=!1,workflows:_=[]}={})=>{const v=ne(T),w=tr(x??{tables:[]},I).map(h=>JSON.stringify(h)).join(" | "),M=o?`import type { LunoraAi } from "@lunora/ai";
+`:"",oe=o?`
+    readonly ai: LunoraAi;`:"",B=y?`import type { LunoraPayment } from "@lunora/payment";
+`:"",ae=y?`
+    readonly payments: LunoraPayment;`:"",se=f?`import type { X402Pay } from "@lunora/x402/pay";
+`:"",W=f?`
+    readonly x402: X402Pay;`:"",C=t.length>0?`import type { ContainerAccessor } from "@lunora/container";
+`:"",X=t.length>0?`
+    readonly containers: {${t.map(h=>`
+        readonly ${h.exportName}: ContainerAccessor;`).join("")}
+    };`:"",L=[...o?["    /** Workers AI binding (the conventional `env.AI`), narrowing `ctx.ai`. */\n    readonly AI?: unknown;"]:[],...t.map(h=>(g(h.bindingName,`container binding "${h.bindingName}"`),`    /** Durable Object namespace for the \`${h.exportName}\` container. */
+    readonly ${h.bindingName}?: unknown;`)),..._.map(h=>(g(h.bindingName,`workflow binding "${h.bindingName}"`),`    /** Workflow binding for the \`${h.exportName}\` workflow. */
+    readonly ${h.bindingName}?: unknown;`)),...R.map(h=>(g(h.bindingName,`queue binding "${h.bindingName}"`),`    /** Queue producer binding for the \`${h.exportName}\` queue. */
+    readonly ${h.bindingName}?: unknown;`)),...e.map(h=>(g(h.bindingName,`agent binding "${h.bindingName}"`),`    /** Workflow binding for the \`${h.exportName}\` agent. */
+    readonly ${h.bindingName}?: unknown;`))].join(`
+`),S=`
+
+/**
+ * This project's Cloudflare bindings, as far as codegen can discover them from
+ * \`lunora/\` source — the container/workflow Durable Object namespaces and the
+ * conventional Workers AI binding. Bindings the config layer reconciles from
+ * user-named wrangler config (R2/KV/D1/\`services\`/queues/…) aren't statically
+ * visible here, so the open index signature keeps them reachable (cast at the
+ * use site). Service bindings (\`env.<SERVICE>.fetch(...)\` / RPC stubs) live
+ * under this signature too — Lunora can't type a third-party worker's RPC
+ * surface, so treat them as \`Fetcher\`/\`Service<unknown>\` and cast.
+ */
+export interface CloudflareBindings {
+    readonly [binding: string]: unknown;${L?`
+${L}`:""}
+}
+
+/** Alias for {@link CloudflareBindings} — the typed shape of \`env\`. */
+export type Env = CloudflareBindings;`,j=(h,Me)=>Me?xn.get(h)?.field??"":"",ie=j("kv",p),le=j("analytics",s),$e=j("hyperdrive",c),Ne=j("browser",i),Te=j("images",d),ce=j("pipelines",u),V=j("r2sql",l),F=(x?.vectorIndexes.length??0)>0,H=F?' | "vectors"':"",Z=F?`
+    readonly vectors: VectorSearch<VectorIndexName>;`:"",de=F?`
+    readonly vectors: VectorSearchReader<VectorIndexName>;`:"",G=F?`import type { VectorSearch, VectorSearchReader } from "${v.server}";
+import type { VectorIndexName } from "./dataModel.js";
+`:"",U=r?`
+    /** Verified Cloudflare Access identity — a synchronous facade over the resolved claims (email / groups / hasGroup / claims). Anonymous when no Access token is present. */
+    readonly access: import("@lunora/cloudflare-access/context").AccessFacade;`:"",K=a?`
+    /** Feature-flag evaluation (OpenFeature). Reads are memoized per request; evaluations never throw — a provider error resolves to the supplied default. */
+    readonly flags: import("${v.flags}").LunoraFlags;`:"",Q=m?`
+    /** Multi-channel notifications (@lunora/notify): send / chat / inApp / webhook plus the push device sub-facade. Sends are external I/O — confine them to action handlers. */
+    readonly notify: import("@lunora/notify").LunoraNotify;
+    /** Device push sub-facade — the same object as ctx.notify.push (register / send / broadcast). Sends belong in action handlers. */
+    readonly push: import("@lunora/notify").LunoraPush;`:"",q=_.length>0,ee=q?`import type { WorkflowHandle } from "@lunora/workflow";
+import type * as lunoraWorkflowDefinitions from "../workflows.js";
+`:"",Ae=q?`
+
+/** Params type carried by a \`defineWorkflow\` definition (its phantom \`__params\`). */
+type WorkflowParamsOf<Definition> = Definition extends { __params?: infer Params }
+    ? unknown extends Params
+        ? Record<string, unknown>
+        : NonNullable<Params>
+    : Record<string, unknown>;
+
+/** This project's declared workflows, addressable from \`ctx.workflows\` by their \`lunora/workflows.ts\` export name. */
+export interface LunoraWorkflows {
+${_.map(h=>`    get(name: ${JSON.stringify(h.exportName)}): WorkflowHandle<WorkflowParamsOf<typeof lunoraWorkflowDefinitions.${h.exportName}>>;`).join(`
+`)}
+}`:"",ke=q?' | "workflows"':"",xe=q?`
+    readonly workflows: LunoraWorkflows;`:"",ue=R.length>0,Oe=ue?`import type { QueueProducer } from "@lunora/queue";
+import type * as lunoraQueueDefinitions from "../queues.js";
+`:"",Ie=ue?`
+
+/** Message body type carried by a \`defineQueue\` definition (its phantom \`__lunoraBody\`). */
+type QueueBodyOf<Definition> = Definition extends { __lunoraBody?: infer Body } ? (unknown extends Body ? unknown : NonNullable<Body>) : unknown;
+
+/** This project's declared queues, addressable from \`ctx.queues\` by their \`lunora/queues.ts\` export name. */
+export interface LunoraQueues {
+${R.map(h=>`    readonly ${h.exportName}: QueueProducer<QueueBodyOf<typeof lunoraQueueDefinitions.${h.exportName}>>;`).join(`
+`)}
+}`:"",ve=ue?`
+    readonly queues: LunoraQueues;`:"",pe=e.length>0,Ce=pe?`import type { AgentHandle } from "@lunora/agent";
+`:"",Le=pe?`
+
+/** This project's declared agents, addressable from \`ctx.agents\` by their \`lunora/agents.ts\` export name. */
+export interface LunoraAgents {
+${e.map(h=>(g(h.exportName,`agent export "${h.exportName}"`),`    readonly ${h.exportName}: AgentHandle;`)).join(`
+`)}
+}`:"",Re=pe?`
+    readonly agents: LunoraAgents;`:"",_e=k?`import type { InferIdentity } from "${v.server}";
+import type * as lunoraIdentityContract from "../identity.js";
+`:"",De=k?`
+
+/** This app's declared identity claim contract (\`defineIdentity\` in \`lunora/identity.ts\`) — the typed shape of \`ctx.auth.getIdentity()\`, the RLS policy \`ctx.auth.identity\`, and the \`authorizeShard\`/\`authorizeFanOut\` identity argument. */
+export type Identity = InferIdentity<typeof lunoraIdentityContract.${k.exportName}>;
+
+/** \`ctx.auth\` narrowed so \`getIdentity()\` resolves the declared {@link Identity} contract instead of the untyped claim bag. */
+type NarrowedAuth = Omit<QueryCtxBase["auth"], "getIdentity"> & { getIdentity: () => Promise<Identity | null> };`:"",he=k?' | "auth"':"",me=k?`
+    readonly auth: NarrowedAuth;`:"",Ee=k?", Identity":"",Pe=n?`import type * as lunoraEnvContract from "../env.js";
+`:"",Fe=n?`
+
+/** This app's declared env contract (\`defineEnv\` in \`lunora/env.ts\`) — the validated, coercion-aware shape of \`ctx.env\`. */
+export type LunoraEnv = ReturnType<typeof lunoraEnvContract.${n.exportName}>;`:"",ge=n?' | "env"':"",fe=n?"\n    /** Validated, typed environment declared by `defineEnv` in `lunora/env.ts` — parsed & coercion-aware config values (`ctx.env.STRIPE_KEY`); a missing or invalid value throws at read time. */\n    readonly env: LunoraEnv;":"";return`${$}import { createPolicyDsl, defineMutator as defineMutatorBase, initLunora, v as vBase } from "${v.server}";
+import type {
+    ActionBuilder,
+    ActionCtx as ActionCtxBase,
+    ColumnValidator,
+    DatabaseReader,
+    DatabaseWriter,
+    EmptyArgs,
+    InternalActionBuilder,
+    InternalMutationBuilder,
+    InternalQueryBuilder,
+    MutationBuilder,
+    MutationCtx as MutationCtxBase,
+    MutationStorage,
+    MutatorDefinition,
+    QueryBuilder,
+    QueryCtx as QueryCtxBase,
+    ReadOnlyStorage,
+    RegisteredMutator,
+    Storage as StorageBase,
+    TableReader,
+    Validator,
+} from "${v.server}";
+
+import type {
+    DatabaseReaderFacade as DatabaseReaderFacadeOf,
+    DatabaseWriterFacade as DatabaseWriterFacadeOf,
+    LoadWith as LoadWithOf,
+    TableReaderFacade as TableReaderFacadeOf,
+    TableWriterFacade as TableWriterFacadeOf,
+    WithArg as WithArgOf,
+} from "${v.serverDataModel}";
+
+export type {
+    AggregateOp,
+    GroupByEntry,
+    OrderBy,
+    QueryArgs,
+    QueryPage,
+    RankPage,
+    RankResult,
+    RestrictableQueryOptions,
+    RestrictableQueryOptionsOf,
+    SearchFilterBuilder,
+    SearchReader,
+    TableAggregateOptions,
+    TableAggregateOptionsOf,
+    TableGroupByOptions,
+    TableGroupByOptionsOf,
+    TableRankOptions,
+    TableRankPageOptions,
+    Where,
+    WhereOf,
+    WhereOperators,
+} from "${v.serverDataModel}";
+
+import type { DataModel, Doc, GeoIndexNamesByTable, Id as IdOfTable, IndexNamesByTable, Insert, InsertModel, RankIndexNamesByTable, Relations, SearchIndexNamesByTable, TableName } from "./dataModel.js";
+${G}${M}${B}${se}${C}${ee}${Oe}${Ce}${_e}${Pe}
+export type { AppTableName, DataModel, Doc, Id, TableName } from "./dataModel.js";
+
+/**
+ * The query-DSL bindings: \`@lunora/server/data-model\`'s generics parameterized
+ * over this project's \`DataModel\` / \`InsertModel\` / \`Relations\` / index maps.
+ *
+ * They live here rather than in \`dataModel.ts\` because they are the half that
+ * needs the SERVER package. Keeping \`dataModel.ts\` free of it lets a sibling
+ * package — a web app, another Worker — compile \`api.ts\` for its \`Doc\`/\`Id\`
+ * types without installing a server dependency to do it.
+ */
+
+/** The \`with\` argument for table \`T\` — see \`@lunora/server/data-model\`. */
+export type WithArg<T extends keyof DataModel> = WithArgOf<DataModel, Relations, T>;
+
+/** \`Doc<T>\` narrowed to exactly the relations requested in the with-arg \`W\`. */
+export type LoadWith<T extends keyof DataModel, W> = LoadWithOf<DataModel, Relations, T, W>;
+
+/** Read-only typed table accessor exposed on \`QueryCtx.db.<table>\`. */
+export type TableReaderFacade<T extends keyof DataModel> = TableReaderFacadeOf<DataModel, Relations, RankIndexNamesByTable, SearchIndexNamesByTable, T, GeoIndexNamesByTable>;
+
+/** Read-write typed table accessor exposed on \`MutationCtx.db.<table>\` / \`ActionCtx.db.<table>\`. */
+export type TableWriterFacade<T extends keyof DataModel> = TableWriterFacadeOf<DataModel, InsertModel, Relations, RankIndexNamesByTable, SearchIndexNamesByTable, T, GeoIndexNamesByTable>;
+
+/** Per-table read facade — \`ctx.db.<table>\` on a \`QueryCtx\`. */
+export type DatabaseReaderFacade = DatabaseReaderFacadeOf<DataModel, Relations, RankIndexNamesByTable, SearchIndexNamesByTable, GeoIndexNamesByTable>;
+
+/** Per-table read-write facade — \`ctx.db.<table>\` on a \`MutationCtx\` / \`ActionCtx\`. */
+export type DatabaseWriterFacade = DatabaseWriterFacadeOf<DataModel, InsertModel, Relations, RankIndexNamesByTable, SearchIndexNamesByTable, GeoIndexNamesByTable>;
+
+/** Insert builder returned by \`ctx.orm.insert(table)\`. */
+export interface OrmInsertBuilder<T extends keyof DataModel> {
+    values: (values: Insert<T>) => Promise<IdOfTable<T>>;
+}
+
+/** Replace builder returned by \`ctx.orm.replace(table, id)\` — swaps the whole document. */
+export interface OrmReplaceBuilder<T extends keyof DataModel> {
+    with: (values: Insert<T>) => Promise<void>;
+}
+
+/** Update builder returned by \`ctx.orm.update(table, id)\` — patches the named fields. */
+export interface OrmUpdateBuilder<T extends keyof DataModel> {
+    set: (values: Partial<Insert<T>>) => Promise<void>;
+}
+
+/** Read-only ORM surface — \`ctx.orm\` on a \`QueryCtx\`. Mirrors \`ctx.db\` reads under a kitcn-style \`query\` namespace. */
+export interface OrmReader {
+    query: DatabaseReaderFacade;
+}
+
+/** Read-write ORM surface — \`ctx.orm\` on a \`MutationCtx\` / \`ActionCtx\`. Writes are addressed by id, like \`ctx.db\`. */
+export interface OrmWriter extends OrmReader {
+    delete: <T extends keyof DataModel>(table: T, id: IdOfTable<T>) => Promise<void>;
+    insert: <T extends keyof DataModel>(table: T) => OrmInsertBuilder<T>;
+    replace: <T extends keyof DataModel>(table: T, id: IdOfTable<T>) => OrmReplaceBuilder<T>;
+    update: <T extends keyof DataModel>(table: T, id: IdOfTable<T>) => OrmUpdateBuilder<T>;
+}
+
+/** Storage buckets this schema declares (\`v.storage("name")\`), narrowing \`ctx.storage.bucket(name)\`. */
+export type StorageBucketName = ${w};${S}${Ae}${Ie}${Le}${De}${Fe}
+
+/**
+ * Project-typed contexts. The base contexts from \`@lunora/server\` are
+ * untyped against the schema; here \`db\` is widened to the generated per-table
+ * facade (\`ctx.db.<table>.findMany(...)\`) while keeping the legacy structural
+ * \`db.get\`/\`db.query\` surface for back-compat, and \`storage\` is narrowed so
+ * \`ctx.storage.bucket(name)\` autocompletes the declared buckets.
+ */
+/**
+ * The Convex-style fluent reader \`ctx.db.query(table)\`, bound to this schema:
+ * a table-name literal narrows the row type, so \`.collect()\` / \`.first()\` /
+ * \`.take()\` (and the \`.withIndex()\` / \`.filter()\` / \`.order()\` chain) resolve
+ * as \`Doc<table>\` with no \`as unknown as Doc<...>\` casts. The per-table accessor
+ * \`ctx.db.<table>\` stays available alongside it via the facade.
+ *
+ * Intersected with the wide \`(string) => TableReader\` signature so the bound
+ * \`ctx.db\` is still structurally assignable to schema-agnostic consumers that
+ * call \`db.query(someString)\` (e.g. \`@lunora/ratelimit\`'s \`createDbStore\`).
+ *
+ * The three index-name unions are what make \`.withIndex("by_TYPO")\` a compile
+ * error: each resolves to the table's declared names, or \`never\` when it
+ * declares none of that kind. Without them a renamed or dropped index left
+ * every call site typechecking, and the query either threw at runtime or
+ * degraded silently to a full table scan.
+ */
+type TypedTableQuery = (<T extends TableName>(
+    table: T,
+) => TableReader<Doc<T>, IndexNamesByTable[T], SearchIndexNamesByTable[T], GeoIndexNamesByTable[T]>) &
+    ((table: string) => TableReader);
+
+/**
+ * The point read \`ctx.db.get(id)\`, bound to this schema: an \`Id<"table">\`
+ * carries its table name, so the resolved document is typed \`Doc<table>\` (or
+ * \`null\` when absent) with no \`as Doc<...>\` cast. Mirrors {@link TypedTableQuery}.
+ */
+type TypedTableGet = <T extends TableName>(id: IdOfTable<T>) => Promise<Doc<T> | null>;
+
+/**
+ * Resolves the \`asId\` table argument: a literal in {@link TableName} passes through, a
+ * genuinely-wide \`string\` (a computed name) passes through, and any OTHER literal
+ * collapses to \`never\` so it fails to typecheck.
+ *
+ * The \`string extends T\` arm is what distinguishes "the caller passed a computed
+ * string" from "the caller passed a misspelled literal" — only the wide \`string\` type
+ * is a supertype of \`string\`.
+ */
+type AsIdTable<T extends string> = T extends TableName ? T : string extends T ? T : never;
+
+/**
+ * The id parse boundary \`ctx.db.asId(table, id)\`, bound to this schema: a misspelled
+ * table literal is a compile error rather than a call that hands back a confidently-
+ * branded id for a table that does not exist. Mirrors {@link TypedTableQuery} /
+ * {@link TypedTableGet}.
+ *
+ * Deliberately NOT an intersection with a wide \`(string, string) => string\` overload:
+ * overload resolution would fall through to it for a bad literal, silently restoring
+ * the very typo hole this narrowing exists to close. {@link AsIdTable} instead keeps a
+ * computed table name working — and keeps \`ctx.db\` structurally assignable to
+ * schema-agnostic consumers — without accepting an invalid literal.
+ */
+type TypedAsId = <T extends string>(tableName: AsIdTable<T>, id: string) => IdOfTable<T & TableName>;
+
+export interface QueryCtx extends Omit<QueryCtxBase, "db" | "storage"${H}${he}${ge}> {
+    readonly db: Omit<DatabaseReader, "asId" | "query" | "get"> & DatabaseReaderFacade & { asId: TypedAsId; query: TypedTableQuery; get: TypedTableGet };
+    readonly orm: OrmReader;
+    readonly storage: ReadOnlyStorage<StorageBucketName>;${de}${U}${ie}${K}${Q}${le}${fe}${me}
+}
+
+export interface MutationCtx extends Omit<MutationCtxBase, "db" | "storage"${H}${ke}${he}${ge}> {
+    readonly db: Omit<DatabaseWriter, "asId" | "query" | "get"> & DatabaseWriterFacade & { asId: TypedAsId; query: TypedTableQuery; get: TypedTableGet };
+    readonly orm: OrmWriter;
+    readonly storage: MutationStorage<StorageBucketName>;${Z}${U}${ie}${K}${Q}${le}${fe}${xe}${ve}${Re}${me}
+}
+
+export interface ActionCtx extends Omit<ActionCtxBase, "db" | "storage"${H}${ke}${he}${ge}> {
+    readonly db: Omit<DatabaseWriter, "asId" | "query" | "get"> & DatabaseWriterFacade & { asId: TypedAsId; query: TypedTableQuery; get: TypedTableGet };
+    readonly orm: OrmWriter;
+    readonly storage: StorageBase<StorageBucketName>;${Z}${U}${oe}${ae}${W}${X}${ie}${K}${Q}${$e}${Ne}${Te}${le}${ce}${V}${fe}${xe}${ve}${Re}${me}
+}
+
+/**
+ * Procedure builders bound to this project's typed contexts. Chain
+ * \`.input({...})\` to declare args, \`.use(middleware)\` for rate limiting / RLS /
+ * masking (each middleware may refine \`ctx\`), then the terminal
+ * \`.query()\` / \`.mutation()\` / \`.action()\` with a \`({ ctx, args }) => ...\`
+ * handler. \`.output(validator)\` and (queries) \`.stream()\` are also available.
+ */
+const lunoraBuilders = initLunora.dataModel<DataModel>().create();
+
+/** \`query\` builder bound to this project's typed {@link QueryCtx}. */
+export const query = lunoraBuilders.query as unknown as QueryBuilder<QueryCtx, EmptyArgs>;
+
+/** \`mutation\` builder bound to this project's typed {@link MutationCtx}. */
+export const mutation = lunoraBuilders.mutation as unknown as MutationBuilder<MutationCtx, EmptyArgs>;
+
+/** \`action\` builder bound to this project's typed {@link ActionCtx}. */
+export const action = lunoraBuilders.action as unknown as ActionBuilder<ActionCtx, EmptyArgs>;
+
+/** \`internalQuery\` builder bound to this project's typed {@link QueryCtx} — never exposed on \`api\`. */
+export const internalQuery = lunoraBuilders.internalQuery as unknown as InternalQueryBuilder<QueryCtx, EmptyArgs>;
+
+/** \`internalMutation\` builder bound to this project's typed {@link MutationCtx} — never exposed on \`api\`. */
+export const internalMutation = lunoraBuilders.internalMutation as unknown as InternalMutationBuilder<MutationCtx, EmptyArgs>;
+
+/** \`internalAction\` builder bound to this project's typed {@link ActionCtx} — never exposed on \`api\`. */
+export const internalAction = lunoraBuilders.internalAction as unknown as InternalActionBuilder<ActionCtx, EmptyArgs>;
+
+/**
+ * \`defineMutator\` bound to this project's typed {@link MutationCtx} — declare
+ * custom mutators (\`lunora/mutators.ts\`) with it instead of importing from
+ * \`${v.server}\`, and the authoritative \`server\` impl's \`ctx\` carries the
+ * schema-typed \`ctx.db\` (\`ctx.db.query("nodes")\` resolves \`Doc<"nodes">\`,
+ * \`ctx.db.patch(id, …)\` takes an \`Id<"nodes">\`) with no hand-written ctx type and
+ * no \`as unknown as\` cast. Runtime-identical to the package export; only the
+ * context type narrows, so discovery finds a mutator authored either way.
+ * @example
+ * export const setText = defineMutator({
+ *     args: { id: v.id("nodes"), text: v.string() },
+ *     server: async (ctx, args) => { await ctx.db.patch(args.id, { text: args.text }); },
+ * });
+ */
+export const defineMutator = defineMutatorBase as unknown as <Args extends Record<string, Validator> = Record<string, Validator>, ClientTx = unknown, R = unknown>(
+    definition: MutatorDefinition<Args, MutationCtx, ClientTx, R>,
+) => RegisteredMutator<Args, MutationCtx, ClientTx, R>;
+
+/**
+ * \`definePolicy\` bound to THIS schema's {@link DataModel} + {@link Relations}.
+ * Import it from here (\`./_generated/server\`) instead of \`@lunora/server\` to get
+ * a relation-aware RLS authoring surface: \`table\` autocompletes to a real table
+ * name and the \`when\` predicate type-checks against the table's columns **and**
+ * its declared relations — \`{ author: { is: {...} } }\`, \`{ posts: { some: {...} } }\`,
+ * etc. (the \`@lunora/do\` pre-resolver resolves relation predicates on reads).
+ * Runtime-identical to \`@lunora/server\`'s \`definePolicy\`; only the types narrow,
+ * so the \`rls()\` chain discovers a policy authored either way the same.
+ */
+export const definePolicy = createPolicyDsl<DataModel, Relations${Ee}>();
+
+/**
+ * The validator builder \`v\`, with \`v.id(...)\` constrained to THIS schema's
+ * table names — so the argument autocompletes and returns a precise
+ * \`Id<"table">\`. Identical to \`@lunora/server\`'s \`v\` at runtime; the only
+ * difference is the tightened \`id\` type.
+ *
+ * Import \`v\` from here (\`./_generated/server\`) in your queries/mutations/actions
+ * to get table-name autocomplete. \`lunora/schema.ts\` can't use it — it is the
+ * file that defines the table names, so they aren't known yet there; pass the
+ * names as string literals and the generated \`Id<"table">\` types still catch a
+ * typo wherever the id is used.
+ */
+export const v = vBase as unknown as Omit<typeof vBase, "id"> & {
+    id: <T extends TableName>(table: T) => ColumnValidator<IdOfTable<T>, IdOfTable<T>>;
+};
+`},nr=e=>{const t={connect:[],disconnect:[],init:[],reactor:[]};for(const n of e)n.lifecycle&&t[n.lifecycle].push(`${N(n.filePath)}:${n.exportName}`);return t},Zr=e=>{const{agents:t=[],functions:n,migrations:r=[],mutators:o=[],shapes:s=[],useUmbrella:i=!1,usesSandbox:a=!1}=e,c=n.length>0,d=ne(i),{dispatchBody:p,importBlock:m,installBlock:y,migrationBody:u,mutatorPaths:l,shapeBody:f}=Zn(n,r,o,s),k=Vn(t,n),R=Hn(a,n),x=[k.lines,R.lines].filter(S=>S.length>0).join(`
+`);let I=p;x.length>0&&(I=p.length>0?`${p.trimEnd()}
+${x}
+`:`
+${x}
+`);const T=nr(n),_=s.length>0?`import type { RegisteredShape } from "${d.server}";
+`:"",v=s.length>0?`
+/**
+ * Replication-shape registry — one entry per \`defineShape\` in \`lunora/shapes.ts\`.
+ * The generated ShardDO's \`resolveShape\` override looks a shape up by name and
+ * evaluates its trusted \`compileWhere(ctx, args)\` to authorize + scope a
+ * \`shape_subscribe\` (reads-as-permissions).
+ */
+export const LUNORA_SHAPES: Record<string, RegisteredShape> = {${f}};
+`:"",w=l.length>0?`
+/**
+ * Custom-mutator function paths — the \`LUNORA_FUNCTIONS\` keys the generated
+ * ShardDO's \`isCustomMutator\` override routes through the client-watermark push
+ * protocol (\`x-lunora-client-id\`/\`x-lunora-client-seq\` ordering).
+ */
+export const LUNORA_MUTATOR_PATHS: ReadonlySet<string> = new Set([${l.map(S=>JSON.stringify(S)).join(", ")}]);
+`:"",M=y.length>0?`import { DEFER_VALIDATION as DEFER, installCompiledValidatorMap } from "${d.values}";
+`:"",oe=y.length>0?`
+/**
+ * AOT-compiled argument validators (Worker-safe, no \`eval\`). Each is installed
+ * onto its function's live \`.args\` object and consulted by the interpreted
+ * parser as a zero-allocation fast path; anything it can't model is deferred.
+ */
+${y}
+`:"",B=er(n),ae=B.types?`
+${B.types}
+`:"",se=B.implementation?`
+${B.implementation}
+`:"",W=Ve(B.types),C=W.length>0?`import type { ${W.join(", ")} } from "./dataModel.js";
+`:"",X=c?"context":"_context",L=c?`${Xn}
+
+`:"";return bt(`${$}${m}${k.importLine}${R.importLine}${M}${_}import { LunoraError } from "${d.server}";
+import type { ActionCtx, MutationCtx, QueryCtx } from "./server.js";
+${C}
+/**
+ * Single registered function, narrowed to the shape \`handleRpc\` needs.
+ * The real argument validators / return types are checked elsewhere — at
+ * the dispatch site we erase to \`unknown\` so a single map can host every
+ * registered function.
+ */
+export interface RegisteredLunoraFunction {
+    kind: "action" | "mutation" | "query" | "stream";
+    args: Record<string, unknown>;
+    /**
+     * Present on a \`"stream"\` declared \`durable\`: its run is persisted and
+     * survives the socket that opened it. Absent on every other kind, and on an
+     * ephemeral stream.
+     */
+    durable?: { ttlMs?: number };
+    /**
+     * For \`"action" | "mutation" | "query"\` the handler is awaited and its result returned.
+     * For \`"stream"\` the handler returns an \`AsyncIterable\` synchronously and takes an
+     * \`AbortSignal\` as a third argument — the runtime drives it frame-by-frame.
+     */
+    handler: ((context: unknown, args: Record<string, unknown>) => Promise<unknown> | unknown) | ((context: unknown, args: Record<string, unknown>, signal?: AbortSignal) => AsyncIterable<unknown>);
+    /**
+     * The lifecycle moment a hook fires on, when this registration came from
+     * \`onConnect\`/\`onDisconnect\`/\`onShardInit\`/\`onQueryChange\`. Read at
+     * dispatch to decide whether the function runs system-trusted: \`init\` and
+     * \`reactor\` have no caller identity, so RLS has no user to scope to.
+     */
+    lifecycle?: "connect" | "disconnect" | "init" | "reactor";
+    /** \`"internal"\` functions are rejected on the external RPC path; absence === public. */
+    visibility?: "internal" | "public";
+}
+${k.prelude}${R.prelude}
+/**
+ * Static dispatch table. The key matches the \`__lunoraRef\` the client
+ * emits (\`api[namespace][fn].__lunoraRef === "namespace:fn"\`).
+ */
+export const LUNORA_FUNCTIONS: Record<string, RegisteredLunoraFunction> = {${I}};
+${oe}${v}${w}
+/**
+ * Lifecycle manifest: the function paths the generated ShardDO dispatches when a
+ * client's WebSocket connects (\`connect\`) or disconnects (\`disconnect\`), once
+ * per Durable Object instance before any handler runs (\`init\`), and after a
+ * write flush when a watched read's result changed (\`reactor\`). Each path also
+ * resolves through {@link LUNORA_FUNCTIONS}. The socket sides run under the
+ * socket's verified identity; \`init\` and \`reactor\` have no caller, so they run
+ * anonymous — all via system dispatch.
+ */
+export const LUNORA_LIFECYCLE_HOOKS: { connect: readonly string[]; disconnect: readonly string[]; init: readonly string[]; reactor: readonly string[] } = {
+    connect: [${T.connect.map(S=>JSON.stringify(S)).join(", ")}],
+    disconnect: [${T.disconnect.map(S=>JSON.stringify(S)).join(", ")}],
+    init: [${T.init.map(S=>JSON.stringify(S)).join(", ")}],
+    reactor: [${T.reactor.map(S=>JSON.stringify(S)).join(", ")}],
+};
+
+/**
+ * Resolve and invoke a registered function from an external caller. Throws a
+ * LunoraError-shaped object (404) when the path is unknown — the runtime's
+ * structural error mapper turns that into the right HTTP status. Internal
+ * functions are treated as not-found so their existence never leaks to clients.
+ */
+export const dispatchLunoraFunction = async (functionPath: string, context: unknown, args: Record<string, unknown>): Promise<unknown> => {
+    const registered = LUNORA_FUNCTIONS[functionPath];
+
+    if (!registered || registered.visibility === "internal") {
+        throw new LunoraError("FUNCTION_NOT_FOUND", \`function not registered: \${functionPath}\`);
+    }
+
+    return registered.handler(context, args);
+};
+
+/**
+ * A handler context accepted by {@link createCaller}. The runtime context the
+ * shard DO builds is uniform across kinds, so any handler's \`ctx\` works here.
+ */
+export type CallerCtx = ActionCtx | MutationCtx | QueryCtx;
+
+/**
+ * Typed, in-process server-to-server caller. Every registered function — public
+ * *and* internal — is reachable; each call dispatches against the same shard
+ * with the supplied \`context\`, exactly like \`ctx.runQuery\`/\`runMutation\`/
+ * \`runAction\` but without re-stating the function path.
+ */
+export interface Caller {${ae}}
+
+${L}/** Build a {@link Caller} bound to \`context\` (typically a handler's \`ctx\`). */
+export const createCaller = (${X}: CallerCtx): Caller => ({${se}});
+
+/**
+ * Single registered data migration, narrowed to the shape the per-shard runner
+ * consumes. \`up\`/\`down\` are erased to a structural transform; the authoring
+ * validation lives in \`defineMigration\`.
+ */
+export interface RegisteredDataMigration {
+    batchSize?: number;
+    down?: (document: Record<string, unknown>) => Record<string, unknown> | undefined;
+    id: string;
+    table: string;
+    up: (document: Record<string, unknown>) => Record<string, unknown> | undefined;
+}
+
+/**
+ * Registry of online data migrations keyed by \`defineMigration\`'s \`id\`. The
+ * shard DO's admin RPC and the CLI resolve migrations to run through this map.
+ */
+export const LUNORA_MIGRATIONS: Record<string, RegisteredDataMigration> = {${u}};
+`,i)},rr=e=>{const t={};for(const n of e.tables){const r={};for(const[o,s]of Object.entries(n.shape)){const i=re(s);i.kind==="id"&&i.tableName!==void 0&&(r[o]=i.tableName)}Object.keys(r).length>0&&(t[n.name]=r)}return t},or=e=>{const t={};for(const n of e.tables){const r=[];for(const[o,s]of Object.entries(n.shape))re(s).kind==="storage"&&r.push(o);r.length>0&&(t[n.name]=r)}return t},ar=e=>{const t={};for(const n of e.tables){const r=[...n.indexes.map(o=>({fields:[...o.fields],name:o.name,type:"index",...o.unique===!0?{unique:!0}:{}})),...n.searchIndexes.map(o=>({fields:[o.field,...o.filterFields??[]],name:o.name,type:"search"})),...(n.geoIndexes??[]).map(o=>({fields:[o.field],name:o.name,type:"geo"})),...n.rankIndexes.map(o=>({fields:o.sortBy.map(s=>s.field),name:o.name,type:"rank"})),...n.vectorIndexes.map(o=>({fields:o.field===void 0?[]:[o.field],name:o.name,type:"vector"}))];r.length>0&&(t[n.name]=r)}return t},sr=e=>{const t=[];for(const n of e.tables)!n.ttl||n.shardMode==="global"||t.push({...n.ttl.after===void 0?{}:{after:n.ttl.after},field:n.ttl.field,...n.softDelete?{softDeleteField:n.softDelete.field}:{},table:n.name});return t},ir=e=>{if(e.kind!=="union"||e.members===void 0||e.members.length===0)return;const t=[];for(const n of e.members){if(n.kind!=="literal"||n.literalValue===void 0)return;try{const r=JSON.parse(n.literalValue);if(typeof r!="string")return;t.push(r)}catch{return}}return t},lr=(e,t)=>{const n=re(t),r={name:e,optional:mt(t),type:n.kind};n.kind==="id"&&n.tableName!==void 0&&(r.ref=n.tableName),n.kind==="storage"&&(r.isStorage=!0,n.bucket!==void 0&&(r.bucket=n.bucket));const o=ir(n);return o!==void 0&&(r.enumValues=o),n.column?.notNull===!1&&(r.nullable=!0),r},cr=e=>{const t={};for(const n of e.tables){const r=[{name:"_id",optional:!1,pk:!0,type:"id"},{name:"_creationTime",optional:!1,type:"number"},...n.commitOrdered===!0?[{name:"_commitSeq",optional:!1,type:"number"}]:[]];for(const[o,s]of Object.entries(n.shape))r.push(lr(o,s));t[n.name]=r}return t},dr=e=>e?{importFragment:"serveRelationFanout, ",override:`
+        protected override async runRelationFanoutRead(functionPath: string, args: Record<string, unknown>): Promise<unknown> {
+            this.ensureMigrated();
+
+            const { db } = this.buildCtx({ functionPath }) as { db: DatabaseWriterLike };
+
+            return serveRelationFanout(schema as unknown as SchemaLike, db, functionPath, args);
+        }
+`}:{importFragment:"",override:""},ur=e=>{if(!e)return{build:"",configField:"",contextField:"",stub:""};const t='throw new Error("ctx.ai: no AI binding found. Add an \\`ai\\` binding (env.AI) to wrangler.jsonc, or pass \\`ai\\` to createShardDO().");';return{build:`
+            const aiBinding = config.ai?.(env) ?? (env as Record<string, unknown>).AI;
+            // Correlate AI-Gateway-routed calls with the Lunora trace: thread the
+            // function path + trace id into createAi, which folds them into the
+            // gateway's native \`metadata\` only when a gateway is configured (absent
+            // otherwise). Mirror the tracer's anchor guard — a deferred subscription
+            // re-run must not borrow a concurrent dispatch's trace, so read
+            // \`getCurrentTrace()\` only on the synchronous (non-threaded-identity) path.
+            const aiTrace = options.identity ? undefined : this.getCurrentTrace();
+            const ai: LunoraAi = aiBinding
+                ? createAi({ binding: aiBinding as AiBindingLike, env: env as Record<string, unknown>, metadata: { functionPath: options.functionPath, traceId: aiTrace?.traceId } })
+                : aiStub;
+`,configField:`
+    ai?: (env: Record<string, unknown>) => AiBindingLike;`,contextField:`
+                ai,`,stub:`
+const aiStub: LunoraAi = {
+    embeddingModel: () => {
+        ${t}
+    },
+    model: () => {
+        ${t}
+    },
+    run: async () => {
+        ${t}
+    },
+    // workersai is a callable-with-properties; a bare throwing arrow isn't
+    // structurally assignable, so cast it. Never invoked (the stub throws first).
+    workersai: (() => {
+        ${t}
+    }) as unknown as LunoraAi["workersai"],
+};
+`}},O=(e,t,n,{cast:r="",sync:o=[]}={})=>{const s=n.map(i=>`    ${i}: ${o.includes(i)?"":"async "}() => {
+        ${t}
+    },`).join(`
+`);return`
+const ${e} = {
+${s}
+}${r};
+`},P={build:"",configField:"",contextField:"",importLines:[],stub:""},pr=e=>e?{build:`
+            const kvBinding = config.kv?.(env) ?? (env as Record<string, unknown>).KV;
+            // KV is not this shard's SQLite, so nothing appends a \`__cdc_log\` entry
+            // when a value changes — a subscription that read one can never be proven
+            // current on reconnect and must re-snapshot. Reads only; \`put\`/\`delete\`
+            // are writes and stay unstamped.
+            const kv: Kv = markUnvouchableReads(kvBinding ? createKv({ namespace: kvBinding as KVNamespaceLike }) : kvStub, options.onRead, [
+                "get",
+                "getRaw",
+                "getWithMetadata",
+                "list",
+            ]);
+`,configField:`
+    kv?: (env: Record<string, unknown>) => KVNamespaceLike;`,contextField:`
+                kv,`,importLines:['import type { Kv, KVNamespaceLike } from "@lunora/bindings/kv";','import { createKv } from "@lunora/bindings/kv";'],stub:O("kvStub: Kv",'throw new Error("ctx.kv: no KV binding found. Add a \\`kv_namespaces\\` binding (env.KV) to wrangler.jsonc, or pass \\`kv\\` to createShardDO().");',["delete","get","getRaw","getWithMetadata","list","put"])}:P,hr=(e,t)=>e?{build:`
+            const flags: import("${t}").LunoraFlags = createFlags(flagsConfig, env, {
+                provider: () => config.flags?.(env),
+                targetingKey: () => flagsConfig.identify?.({ identity: identity ?? null, userId: userId ?? null }),
+            });
+`,configField:`
+    flags?: (env: Record<string, unknown>) => import("${t}").Provider;`,contextField:`
+                flags,`,importLines:[`import { createFlags } from "${t}";`,'import flagsConfig from "../flags.js";'],stub:""}:P,mr=e=>e?{build:`
+            const { notify, push } = createNotify(notifyConfig, env, { log, metrics });
+`,configField:"",contextField:`
+                notify,
+                push,`,importLines:['import { createNotify } from "@lunora/notify";','import notifyConfig from "../notify.js";'],stub:""}:P,gr=e=>e?{build:`
+            const envConfig = lunoraEnvContract.${e.exportName}(env);
+`,configField:"",contextField:`
+                env: envConfig,`,importLines:['import * as lunoraEnvContract from "../env.js";'],stub:""}:P,fr=e=>e?{build:`
+            const access = accessFacade(identity, userId);
+`,configField:"",contextField:`
+                access,`,importLines:['import { accessFacade } from "@lunora/cloudflare-access/context";'],stub:""}:P,br=(e,t,n)=>{if(!t)return{constant:"",evaluateOverride:"",subscriptionOverride:""};const r=a=>`
+            const env = (this.env ?? {}) as Record<string, unknown>;
+            const flags: import("${n}").LunoraFlags = createFlags(flagsConfig, env, {
+                provider: () => config.flags?.(env),
+                targetingKey: ${a},
+            });`,o=`
+/** Statically-discovered feature flags (\`ctx.flags.<type>("key")\` reads) served via \`__lunora_admin__:listFlags\` + the reactive \`__lunora_flags__:\` channel. */
+const LUNORA_FLAG_KEYS: ReadonlyArray<{ key: string; type: "boolean" | "number" | "object" | "string" }> = ${JSON.stringify(e,void 0,4)};
+`,s=`
+        protected override async evaluateFlags(context?: Record<string, unknown>): Promise<FlagsResult> {${r("undefined")}
+            const evalContext = context as import("${n}").EvaluationContext | undefined;
+            const evaluations: FlagsResult["flags"] = [];
+
+            for (const entry of LUNORA_FLAG_KEYS) {
+                // eslint-disable-next-line no-await-in-loop -- flags evaluate sequentially; each shares the single memoized provider client
+                const details =
+                    entry.type === "boolean"
+                        ? await flags.details.boolean(entry.key, false, evalContext)
+                        : entry.type === "number"
+                          ? await flags.details.number(entry.key, 0, evalContext)
+                          : entry.type === "string"
+                            ? await flags.details.string(entry.key, "", evalContext)
+                            : await flags.details.object(entry.key, {}, evalContext);
+
+                evaluations.push({ errorCode: details.errorCode, key: entry.key, reason: details.reason, type: entry.type, value: details.value, variant: details.variant });
+            }
+
+            return { configured: true, flags: evaluations };
+        }
+`,i=`
+        protected override runFlagSubscriptionRead(_functionPath: string, args: Record<string, unknown>, identity?: { identity?: Record<string, unknown>; userId?: string }): Promise<unknown> {${r("() => flagsConfig.identify?.({ identity: identity?.identity ?? null, userId: identity?.userId ?? null })")}
+            const key = typeof args.key === "string" ? args.key : "";
+
+            // SECURITY: the reactive channel is public (any socket, no auth). Serve
+            // ONLY statically-discovered flag keys — an arbitrary client-supplied key
+            // would let a subscriber probe the value of internal/unreleased flags the
+            // app never exposes. Unknown key ⇒ the "nothing to deliver" sentinel.
+            // eslint-disable-next-line unicorn/no-null -- the base hook's "nothing to deliver" sentinel
+            if (key.length === 0 || !LUNORA_FLAG_KEYS.some((entry) => entry.key === key)) {
+                return Promise.resolve(null);
+            }
+
+            // SECURITY: evaluate under the socket's server-verified identity ONLY
+            // (the targetingKey resolved above). Client-supplied targeting context is
+            // NOT honored on this public channel — otherwise a subscriber could spoof
+            // targeting attributes (e.g. plan/role) to unlock a flag gated on them.
+            const context = undefined;
+
+            if (args.type === "number") {
+                return flags.number(key, typeof args.default === "number" ? args.default : 0, context);
+            }
+
+            if (args.type === "string") {
+                return flags.string(key, typeof args.default === "string" ? args.default : "", context);
+            }
+
+            if (args.type === "object") {
+                return flags.object(key, (args.default ?? {}) as import("${n}").JsonValue, context);
+            }
+
+            return flags.boolean(key, typeof args.default === "boolean" ? args.default : false, context);
+        }
+`;return{constant:o,evaluateOverride:s,subscriptionOverride:i}},yr=e=>e?{build:`
+            const analyticsBinding = config.analytics?.(env) ?? (env as Record<string, unknown>).ANALYTICS;
+            const analytics: AnalyticsClient = analyticsBinding ? createAnalytics(analyticsBinding as AnalyticsEngineDatasetLike) : analyticsStub;
+`,configField:`
+    analytics?: (env: Record<string, unknown>) => AnalyticsEngineDatasetLike;`,contextField:`
+                analytics,`,importLines:['import type { AnalyticsClient, AnalyticsEngineDatasetLike } from "@lunora/bindings/analytics";','import { createAnalytics } from "@lunora/bindings/analytics";'],stub:O("analyticsStub: AnalyticsClient",'throw new Error("ctx.analytics: no Analytics Engine binding found. Add an \\`analytics_engine_datasets\\` binding (env.ANALYTICS) to wrangler.jsonc, or pass \\`analytics\\` to createShardDO().");',["track","writeDataPoint"],{sync:["track","writeDataPoint"]})}:P,wr=e=>e?{build:`
+            const imagesBinding = config.images?.(env) ?? (env as Record<string, unknown>).IMAGES;
+            const images: Images = imagesBinding ? createImages({ binding: imagesBinding as ImagesBindingLike }) : imagesStub;
+`,configField:`
+    images?: (env: Record<string, unknown>) => ImagesBindingLike;`,contextField:`
+                images,`,importLines:['import type { Images, ImagesBindingLike } from "@lunora/bindings/images";','import { createImages } from "@lunora/bindings/images";'],stub:O("imagesStub: Images",'throw new Error("ctx.images: no Images binding found. Add an \\`images\\` binding (env.IMAGES) to wrangler.jsonc, or pass \\`images\\` to createShardDO().");',["info","transform"])}:P,kr=e=>e?{build:`
+            const sql: SqlClient = config.sql ? config.sql(env) : sqlStub;
+`,configField:`
+    sql?: (env: Record<string, unknown>) => SqlClient;`,contextField:`
+                sql,`,importLines:['import type { SqlClient } from "@lunora/hyperdrive";'],stub:O("sqlStub: SqlClient",'throw new Error("ctx.sql: provide a \\`sql\\` config thunk that builds a SqlClient from your driver, e.g. \\`sql: (env) => fromPostgresJs(postgres(env.HYPERDRIVE.connectionString))\\`.");',["query"])}:P,xr=e=>e?{build:`
+            const browser: Browser = config.browser ? config.browser(env) : browserStub;
+`,configField:`
+    browser?: (env: Record<string, unknown>) => Browser;`,contextField:`
+                browser,`,importLines:['import type { Browser } from "@lunora/browser";'],stub:O("browserStub: Browser","throw new Error(\"ctx.browser: provide a \\`browser\\` config thunk, e.g. \\`browser: (env) => createBrowser({ binding: env.BROWSER, launch })\\` with \\`import { launch } from '@cloudflare/playwright'\\`. Session reuse (connect/sessions) additionally needs those two exports passed the same way.\");",["connect","content","launch","pdf","scrape","screenshot","sessions"])}:P,vr=e=>e?{build:`
+            const r2sqlEnv = env as Record<string, unknown>;
+            const r2sqlAccountId = (r2sqlEnv.R2_SQL_ACCOUNT_ID ?? r2sqlEnv.CLOUDFLARE_ACCOUNT_ID) as string | undefined;
+            const r2sqlToken = r2sqlEnv.R2_SQL_TOKEN as string | undefined;
+            const r2sqlBucket = r2sqlEnv.R2_SQL_BUCKET as string | undefined;
+            const r2sql: R2SqlClient = config.r2sql
+                ? config.r2sql(env)
+                : r2sqlAccountId && r2sqlToken && r2sqlBucket
+                  ? createR2Sql({ accountId: r2sqlAccountId, apiToken: r2sqlToken, bucket: r2sqlBucket })
+                  : r2sqlStub;
+`,configField:`
+    r2sql?: (env: Record<string, unknown>) => R2SqlClient;`,contextField:"",importLines:['import type { R2SqlClient } from "@lunora/bindings/r2sql";','import { createR2Sql } from "@lunora/bindings/r2sql";'],stub:O("r2sqlStub: R2SqlClient",'throw new Error("ctx.r2sql: no R2 SQL credentials found. Set \\`R2_SQL_TOKEN\\`, \\`R2_SQL_ACCOUNT_ID\\` (or \\`CLOUDFLARE_ACCOUNT_ID\\`), and \\`R2_SQL_BUCKET\\` in your env/.dev.vars, or pass an \\`r2sql\\` config thunk to createShardDO().");',["describe","explain","from","query","showDatabases","showTables"],{sync:["from"]})}:P,Rr=e=>e?{build:`
+            const pipelinesBinding = config.pipelines?.(env) ?? (env as Record<string, unknown>).PIPELINES;
+            const pipelines: PipelineClient = pipelinesBinding ? createPipelines({ binding: pipelinesBinding as PipelineBindingLike }) : pipelinesStub;
+`,configField:`
+    pipelines?: (env: Record<string, unknown>) => PipelineBindingLike;`,contextField:"",importLines:['import type { PipelineBindingLike, PipelineClient } from "@lunora/bindings/pipelines";','import { createPipelines } from "@lunora/bindings/pipelines";'],stub:O("pipelinesStub: PipelineClient",'throw new Error("ctx.pipelines: no Pipelines binding found. Add a \\`pipelines\\` binding (env.PIPELINES) to wrangler.jsonc, or pass \\`pipelines\\` to createShardDO().");',["send"])}:P,eo=(e,t)=>{if(e.length===0)return"";const n=t?`, ${JSON.stringify(t)}`:"",r=e.map(s=>(g(s.exportName,`container export "${s.exportName}"`),g(s.className,`container class "${s.className}"`),`/** Container DO for the \`${s.exportName}\` definition (binding \`${s.bindingName}\`). */
+export class ${s.className} extends LunoraContainer {
+    public constructor(ctx: ConstructorParameters<typeof LunoraContainer>[0], env: Record<string, unknown>) {
+        super(ctx, env, ${s.exportName}, "${s.exportName}"${n});
+    }
+}
+`)).join(`
+`),o=e.map(s=>s.exportName).join(", ");return`${$}/**
+ * Container-enabled Durable Object classes for the containers declared in
+ * \`lunora/containers.ts\`. Re-export them from your worker entry — wrangler
+ * requires each \`containers[].class_name\` to be exported by the worker:
+ *
+ * \`export * from "./lunora/_generated/containers.js";\`
+ *
+ * \`ContainerProxy\` is re-exported alongside them: the egress-interception path
+ * (\`allowedHosts\`/\`deniedHosts\`/\`interceptHttps\` and the runtime
+ * \`handle.egress\` controls) routes container outbound traffic through this
+ * WorkerEntrypoint, so it too must be exported by the deployed worker.
+ */
+import { LunoraContainer } from "@lunora/container/do";
+
+import { ${o} } from "../containers.js";
+
+export { ContainerProxy } from "@lunora/container/do";
+
+${r}`},Sr=(e,t)=>{if(e.length===0)return{build:"",contextField:"",importLines:[],specs:""};for(const r of e)g(r.exportName,`container export "${r.exportName}"`),g(r.bindingName,`container binding "${r.bindingName}"`);const n=e.map(r=>{const o=r.maxInstances===void 0?"":`, maxInstances: ${String(r.maxInstances)}`;return`    { binding: "${r.bindingName}", exportName: "${r.exportName}"${o} },`}).join(`
+`);return{build:`
+            const containers = createContainerContext(env, LUNORA_CONTAINERS, ${t?JSON.stringify(t):"undefined"}, this.getCurrentTraceparent());
+`,contextField:`
+                containers,`,importLines:['import type { ContainerBindingSpec } from "@lunora/container";','import { createContainerContext } from "@lunora/container";'],specs:`
+/** Wiring specs for \`ctx.containers\` (codegen-derived from \`lunora/containers.ts\`). */
+const LUNORA_CONTAINERS: ReadonlyArray<ContainerBindingSpec> = [
+${n}
+];
+`}},to=e=>{if(e.length===0)return"";const t=e.map(r=>(g(r.exportName,`workflow export "${r.exportName}"`),g(r.className,`workflow class "${r.className}"`),`/** WorkflowEntrypoint for the \`${r.exportName}\` definition (binding \`${r.bindingName}\`). */
+export class ${r.className} extends LunoraWorkflow<WorkflowParamsOf<typeof ${r.exportName}>, WorkflowOutputOf<typeof ${r.exportName}>> {
+    public constructor(ctx: ConstructorParameters<typeof LunoraWorkflow>[0], env: Record<string, unknown>) {
+        super(ctx, env, ${r.exportName}, "${r.exportName}");
+    }
+}
+`)).join(`
+`),n=e.map(r=>r.exportName).join(", ");return`${$}/**
+ * WorkflowEntrypoint classes for the workflows declared in
+ * \`lunora/workflows.ts\`. Re-export them from your worker entry — wrangler
+ * requires each \`workflows[].class_name\` to be exported by the worker:
+ *
+ * \`export * from "./lunora/_generated/workflows.js";\`
+ */
+import LunoraWorkflow from "@lunora/workflow/do";
+
+import { ${n} } from "../workflows.js";
+
+/** Params type carried by a \`defineWorkflow\` definition (its phantom \`__params\`), so each entrypoint keeps the authored \`ctx.params\` type. */
+type WorkflowParamsOf<Definition> = Definition extends { __params?: infer Params }
+    ? unknown extends Params
+        ? Record<string, unknown>
+        : NonNullable<Params>
+    : Record<string, unknown>;
+
+/** Output type carried by a \`defineWorkflow\` definition (its phantom \`__output\`), so each entrypoint keeps the authored return type. */
+type WorkflowOutputOf<Definition> = Definition extends { __output?: infer Output } ? Output : unknown;
+
+${t}`},no=e=>{if(e.length===0)return"";const n=e.filter(a=>a.voice).length>0,r=e.map(a=>{g(a.exportName,`agent export "${a.exportName}"`),g(a.className,`agent class "${a.className}"`);const c=`/** WorkflowEntrypoint for the \`${a.exportName}\` agent (binding \`${a.bindingName}\`). */
+export class ${a.className} extends LunoraWorkflow<AgentRunInput, AgentRunResult> {
+    public constructor(ctx: ConstructorParameters<typeof LunoraWorkflow>[0], env: Record<string, unknown>) {
+        super(ctx, env, compileAgentWorkflow(${a.exportName}, "${a.exportName}"), "${a.exportName}");
+    }
+}
+`;if(!a.voice)return c;const d=a.voiceClassName??"",p=a.voiceBindingName??"";g(d,`agent voice class "${d}"`);const m=`
+/** Voice-session Durable Object for the \`${a.exportName}\` agent (binding \`${p}\`). */
+export class ${d} extends VoiceSessionDO {
+    public constructor(ctx: ConstructorParameters<typeof VoiceSessionDO>[0], env: Record<string, unknown>) {
+        super(ctx, env, ${a.exportName}, "${a.exportName}");
+    }
+}
+`;return`${c}${m}`}).join(`
+`),o=e.map(a=>a.exportName).join(", ");return`${$}/**
+ * WorkflowEntrypoint classes for the agents declared in \`lunora/agents.ts\`.
+ * Each \`defineAgent\` compiles a replay-safe tool-loop onto a Cloudflare
+ * Workflow. Re-export them from your worker entry — wrangler requires each
+ * \`workflows[].class_name\` to be exported by the worker:
+ *
+ * \`export * from "./lunora/_generated/agents.js";\`${n?"\n *\n * Voice-enabled agents ALSO get a `VoiceSessionDO` subclass here — a real\n * Durable Object (unlike the Workflow), so wrangler needs both its\n * `durable_objects` binding and its `class_name` export (the same re-export\n * line covers it).":""}
+ */
+import LunoraWorkflow from "@lunora/workflow/do";
+${n?'import { compileAgentWorkflow, VoiceSessionDO } from "@lunora/agent";':'import { compileAgentWorkflow } from "@lunora/agent";'}
+import type { AgentRunInput, AgentRunResult } from "@lunora/agent";
+
+import { ${o} } from "../agents.js";
+
+${r}`},ro=e=>{const t=e.filter(o=>o.mode==="push");if(t.length===0)return"";for(const o of t)g(o.exportName,`queue export "${o.exportName}"`);const n=t.map(o=>o.exportName).join(", "),r=t.map(o=>`    ${JSON.stringify(o.name)}: { definition: ${o.exportName}, exportName: ${JSON.stringify(o.exportName)} },`).join(`
+`);return`${$}/**
+ * Push-consumer registry for the queues declared in \`lunora/queues.ts\`. The
+ * composed worker's \`queue(batch, env, ctx)\` entry routes each delivered batch
+ * by \`batch.queue\` to the matching \`defineQueue\` handler. Wired automatically
+ * by \`defineApp\` — you don't import this directly.
+ */
+import type { QueueRegistry } from "@lunora/queue";
+
+import { ${n} } from "../queues.js";
+
+/** Stable wrangler queue name → { definition, exportName } for batch routing. */
+export const LUNORA_QUEUE_REGISTRY: QueueRegistry = {
+${r}
+};
+`},$r=e=>{if(e.length===0)return{build:"",contextField:"",importLines:[],specs:""};for(const n of e)g(n.exportName,`workflow export "${n.exportName}"`),g(n.bindingName,`workflow binding "${n.bindingName}"`);const t=e.map(n=>`    { binding: "${n.bindingName}", exportName: "${n.exportName}" },`).join(`
+`);return{build:`
+            const workflows = createWorkflowContext(env, LUNORA_WORKFLOWS);
+`,contextField:`
+                workflows,`,importLines:['import type { WorkflowBindingSpec } from "@lunora/workflow";','import { createWorkflowContext } from "@lunora/workflow";'],specs:`
+/** Wiring specs for \`ctx.workflows\` (codegen-derived from \`lunora/workflows.ts\`). */
+const LUNORA_WORKFLOWS: ReadonlyArray<WorkflowBindingSpec> = [
+${t}
+];
+`}},Nr=e=>{if(e.length===0)return{build:"",contextField:"",importLines:[],specs:""};for(const n of e)g(n.exportName,`queue export "${n.exportName}"`),g(n.bindingName,`queue binding "${n.bindingName}"`);const t=e.map(n=>`    { binding: "${n.bindingName}", exportName: "${n.exportName}", name: ${JSON.stringify(n.name)} },`).join(`
+`);return{build:`
+            const queues = createQueueContext(env, LUNORA_QUEUES);
+`,contextField:`
+                queues,`,importLines:['import type { QueueBindingSpec } from "@lunora/queue";','import { createQueueContext } from "@lunora/queue";'],specs:`
+/** Wiring specs for \`ctx.queues\` (codegen-derived from \`lunora/queues.ts\`). */
+const LUNORA_QUEUES: ReadonlyArray<QueueBindingSpec> = [
+${t}
+];
+`}},Tr=e=>{if(e.length===0)return{build:"",contextField:"",importLines:[],specs:""};for(const n of e)g(n.exportName,`agent export "${n.exportName}"`),g(n.bindingName,`agent binding "${n.bindingName}"`);const t=e.map(n=>`    { binding: "${n.bindingName}", exportName: "${n.exportName}"${n.publicRun===!0?", publicRun: true":""} },`).join(`
+`);return{build:`
+            const agents = createAgentContext(env, LUNORA_AGENTS);
+`,contextField:`
+                agents,`,importLines:['import { createAgentContext } from "@lunora/agent";','import type { AgentBindingSpec } from "@lunora/agent";'],specs:`
+/** Wiring specs for \`ctx.agents\` (codegen-derived from \`lunora/agents.ts\`). */
+const LUNORA_AGENTS: ReadonlyArray<AgentBindingSpec> = [
+${t}
+];
+`}},kt=(e,t,n,r,o)=>({constant:`
+${o}
+const ${e}: ${t} = ${JSON.stringify(r,void 0,4)};
+`,override:`
+        protected override ${n}(): ${t} {
+            return ${e};
+        }
+`}),Ar=e=>{if(e.length===0)return{constant:"",override:""};const t={workflows:e.map(n=>({binding:n.bindingName,className:n.className,exportName:n.exportName,name:n.name}))};return kt("LUNORA_WORKFLOWS_INFO","WorkflowsResult","workflowsMetadata",t,"/** Read-only declared-workflow metadata (discovered from `lunora/workflows.ts`) served via `__lunora_admin__:listWorkflows` for the studio's workflows view. */")},Or=e=>{if(e.length===0)return{constant:"",override:""};const t={queues:e.map(n=>({binding:n.bindingName,...n.tuning.deadLetterQueue===void 0?{}:{deadLetterQueue:n.tuning.deadLetterQueue},exportName:n.exportName,mode:n.mode,name:n.name}))};return kt("LUNORA_QUEUES_INFO","QueuesResult","queuesMetadata",t,"/** Read-only declared-queue metadata (discovered from `lunora/queues.ts`) served via `__lunora_admin__:listQueues` for the studio's queues view. */")},Ir=e=>e?{imports:['import type { LunoraDatabaseLike as LunoraPaymentDbLike, LunoraPayment, PaymentsFromContextOptions } from "@lunora/payment";','import { paymentsFromContext } from "@lunora/payment";'],build:`
+            const payments: LunoraPayment = config.payment
+                ? paymentsFromContext({ auth: { userId: userId ?? null }, db: db as unknown as LunoraPaymentDbLike }, config.payment(env))
+                : paymentStub;
+`,configField:`
+    payment?: (env: Record<string, unknown>) => PaymentsFromContextOptions;`,contextField:`
+                payments,`,stub:O("paymentStub: LunoraPayment",'throw new Error("ctx.payments: no payment configured. Pass \\`payment\\` to createShardDO().");',["attach","cancelSubscription","check","createCheckout","createPortalSession","handleWebhook","listBalances","listSubscriptions","track"],{cast:" as unknown as LunoraPayment",sync:["attach","cancelSubscription","check","createCheckout","createPortalSession","handleWebhook","listBalances","listSubscriptions","track"]})}:{build:"",configField:"",contextField:"",imports:[],stub:""},Cr=e=>e?{imports:['import type { X402Pay, X402PayConfig } from "@lunora/x402/pay";','import { lazyX402Pay } from "@lunora/x402/pay";'],build:`
+            const x402: X402Pay = config.x402
+                ? lazyX402Pay(config.x402(env), { getSecret: (name: string) => secrets.get(name) })
+                : x402Stub;
+`,configField:`
+    x402?: (env: Record<string, unknown>) => X402PayConfig;`,stub:O("x402Stub: X402Pay",'throw new Error("ctx.x402: no pay rail configured. Pass \\`x402\\` to createShardDO().");',["fetch"],{cast:" as unknown as X402Pay",sync:["fetch"]})}:{build:"",configField:"",imports:[],stub:""},Lr=(e,t,n,r,o)=>["AdvisorProcedure","AdvisoryFinding","DatabaseWriterLike","DataMigrationLike","ExportRow",...r?["FlagsResult"]:[],"ImportShardResult","KeyRange","MaskPoliciesResult","MigrationRunResult",...n?["QueuesResult"]:[],"RunShardApplyCdcArgs","RunShardExportArgs","RunShardImportArgs","RunShardMigrationArgs","RlsPoliciesResult","RunShardRankBeforeArgs","RunShardRankPageArgs","RunShardWriteArgs","RunShardWriteResult","SchedulerLike",...o?["SearchBackfillProgress"]:[],"TransactionHeadroomTracker","SchemaLike","ShardDOState","ShardRankPageResult","SqlExec","StorageRulesResult","StudioFeaturesResult","SystemReaderStorageLike","TelemetrySink",...t?["WorkflowsResult"]:[],...e?["WriteHook"]:[]],oo=({advisories:e=[],advisorProcedures:t=[],agents:n=[],containers:r=[],env:o,flagKeys:s=[],hasAccessFacade:i=!1,hasAi:a=!1,hasAnalytics:c=!1,hasBrowser:d=!1,hasFlags:p=!1,hasHyperdrive:m=!1,hasImages:y=!1,hasKv:u=!1,hasNotify:l=!1,hasPayments:f=!1,hasPipelines:k=!1,hasR2sql:R=!1,hasX402:x=!1,maskMetadata:I,mutators:T=[],queues:_=[],rlsMetadata:v,schema:w,schemaSnapshot:M,shapes:oe=[],storageRules:B,studioFeatures:ae,useUmbrella:se=!1,workflows:W=[]})=>{const C=ne(se),X=T.length>0,L=oe.length>0,S=M===void 0?"":yn(M),j=M===void 0?"":`
+/** Structural schema snapshot + its content hash, recorded in the shard's \`__lunora_schema_history\` ledger on cold start so the studio can show a schema-version timeline and diff any two versions. */
+const LUNORA_SCHEMA_SNAPSHOT: { hash: string; json: string } = { hash: ${JSON.stringify(wn(M))}, json: ${JSON.stringify(S)} };
+`,ie=M===void 0?"":", schemaSnapshot: LUNORA_SCHEMA_SNAPSHOT",{build:le,configField:$e,contextField:Ne,stub:Te}=ur(a),ce=fr(i),V=pr(u),F=hr(p,C.flags),H=br(s,p,C.flags),Z=mr(l),de=gr(o),G=yr(c),U=wr(y),K=kr(m),Q=xr(d),q=vr(R),ee=Rr(k),{build:Ae,contextField:ke,importLines:xe,specs:ue}=Nr(_),{build:Oe,contextField:Ie,importLines:ve,specs:pe}=Sr(r,w.jurisdiction),{build:Ce,contextField:Le,importLines:Re,specs:_e}=$r(W),{build:De,contextField:he,importLines:me,specs:Ee}=Tr(n),{build:Pe,configField:Fe,contextField:ge,imports:fe,stub:Je}=Ir(f),{build:h,configField:Me,imports:vt,stub:Rt}=Cr(x),St=e,$t=t,Nt=v??{policies:[],roles:[]},Tt=I??{columns:[]},At=B??{rules:[]},Ot=ae??{analytics:!1,auth:!1,containers:!1,flags:!1,kv:!1,mail:!1,notifications:!1,payments:!1,queues:!1,scheduler:!1,storage:!1,vectors:!1,workflows:!1},{constant:It,override:Ct}=Ar(W),{constant:Lt,override:_t}=Or(_),J=w.vectorIndexes.length>0,ze=new Set(w.tables.filter(b=>typeof b.shardMode=="object"&&b.shardMode.kind==="shardBy").map(b=>b.name)),Se=w.vectorIndexes.some(b=>ze.has(b.table)),be=w.tables.some(b=>b.shardMode==="global"),Be=w.tables.some(b=>b.shardMode==="global"&&b.globalBackend==="hyperdrive"),Ye=w.tables.some(b=>b.shardMode==="global"&&b.globalBackend!=="hyperdrive"),z=w.tables.some(b=>b.externalSource!==void 0),Xe=w.tables.some(b=>b.memory===!0),je=w.tables.some(b=>b.shardMode!=="global"&&b.searchIndexes.length>0);if(Ye&&Be)throw new te("INTERNAL",'lunora codegen: mixing `.global()` (D1) and `.global({ backend: "hyperdrive" })` tables in one app is not supported yet — use a single global backend.');const qe=w.tables.length>0,Dt=rr(w),Et=ar(w),Pt=cr(w),Ft=or(w),Ze=sr(w),et=Lr(J,W.length>0,_.length>0,p,je);L&&et.push("WhereInput");const tt=dr(be),Mt=L?`
+        protected override resolveShape(name: string, args: Record<string, unknown>, identity?: { identity?: Record<string, unknown>; userId?: string }): { columns?: readonly string[]; effectiveWhere?: WhereInput; global?: boolean; table: string } | undefined {
+            const shape = LUNORA_SHAPES[name];
+
+            if (!shape) {
+                return undefined;
+            }
+
+            this.ensureMigrated();
+
+            // Trusted ctx from the socket's OWN verified identity — the client
+            // supplies only the shape name + args; \`compileWhere\` validates the
+            // args then runs the shape's \`where(ctx, args)\` under that identity,
+            // so which rows replicate is a server decision (reads-as-permissions).
+            const ctx = this.buildCtx({ functionPath: \`__shape__:\${name}\`, identity });
+            // \`ownerField\` resolves an \`owner: true\` shape: only here is the table's
+            // \`.ownedBy(field)\` column in scope, so the DO hands it to the shape
+            // rather than every shape restating the ownership check in its \`where\`.
+            const shapeWhere = shape.compileWhere(ctx, args, {
+                ownerField: (schema as unknown as { tables: Record<string, { ownerField?: string }> }).tables[shape.table]?.ownerField,
+            }) as unknown as WhereInput;
+
+            // AND-compose with the table's RLS read base-where. A shape runs no
+            // procedure, so the \`.use(rls(...))\` middleware never fires; without
+            // this merge its reads would bypass every read policy on the table
+            // (rows the caller can't see would replicate). \`composeShapeReadWhere\`
+            // evaluates the table's read policies under this same trusted ctx —
+            // exactly the request-time path — and fails closed under a
+            // \`.rls("required")\` schema for a non-\`.public()\`, policy-less table.
+            const effectiveWhere = composeShapeReadWhere(LUNORA_RLS_READ_REGISTRY, {
+                ctx,
+                identity: identity?.identity ?? null,
+                rlsRequired: (schema as unknown as { rlsMode?: string }).rlsMode === "required",
+                roles: (ctx as { auth?: { roles?: readonly string[] } }).auth?.roles ?? [],
+                shapeWhere,
+                table: shape.table,
+                tablePublic: (schema as unknown as { tables: Record<string, { isPublic?: boolean }> }).tables[shape.table]?.isPublic === true,
+                userId: identity?.userId ?? null,
+            });
+
+            // A live shape pokes only from its OWN shard's op-log, so a \`where()\`
+            // that joins to a \`.shardBy()\` table (rows in another DO) is rejected
+            // here — the first point the compiled predicate + shard modes are both
+            // known. Remedy: denormalize, or move the joined table to \`.global()\`.
+            assertShapeShardable(effectiveWhere, schema as unknown as SchemaLike, shape.table);
+
+            // A \`.global()\` table lives in D1 (no per-DO op-log): flag it so the
+            // base serves it through the latency-tiered poll path (\`readGlobalShapeRows\`)
+            // instead of the CDC poke path.
+            const isGlobal = (schema as unknown as SchemaLike).tables[shape.table]?.shardMode?.kind === "global";
+
+            return { columns: shape.columns, effectiveWhere, global: isGlobal, table: shape.table };
+        }
+`:"",Bt=X?`
+        protected override isCustomMutator(functionPath: string): boolean {
+            return LUNORA_MUTATOR_PATHS.has(functionPath);
+        }
+`:"",jt=L?"\n/** Per-table RLS read policies (hoisted from `.use(rls(...))` chains) the shape resolver AND-merges into each `defineShape` predicate so partial replication honours read policies. */\nconst LUNORA_RLS_READ_REGISTRY = buildRlsReadRegistry(Object.values(LUNORA_FUNCTIONS));\n":"",qt=L?"assertShapeShardable, ":"",ye=[`import type { ${et.join(", ")} } from "${C.do}";`,`import { applyCdcChanges, ${je?"backfillSearchIndexes, ":""}buildReprojectionMigration, ${Xe?"clearMemoryTables, ":""}${qt}createReadFootprint, createShardCtxDb, exportShardRows, importShardRows, ${z?"isSourceDue, pullExternalSourceIncrementalTick, pullExternalSourceTick, ":""}markUnvouchableReads, ${Se?"ROOT_SHARD_NAME, ":""}runDataMigration, runShardMigrations, ${tt.importFragment}ShardDO as ShardDOBase } from "${C.do}";`,...z?[`import type { ExternalSourceLike, SourceClientLike, TraceRefLike } from "${C.do}";`]:[],L?`import { asBucketStorage, buildRlsReadRegistry, composeShapeReadWhere, createSecrets, flushDeferredDeletes, LunoraError, withDeferredDeletes } from "${C.server}";`:`import { asBucketStorage, createSecrets, flushDeferredDeletes, LunoraError, withDeferredDeletes } from "${C.server}";`];qe&&ye.push(`import { bindOrm, bindTableFacade } from "${C.server}";`),J&&ye.push('import type { SchemaLike as VectorSchemaLike, VectorizeIndexLike, VectorSearchLike } from "@lunora/bindings/vectors";','import { createContextVectors, createVectors, createVectorSyncHook } from "@lunora/bindings/vectors";'),a&&ye.push('import type { AiBindingLike, LunoraAi } from "@lunora/ai";','import { createAi } from "@lunora/ai";'),ye.push(...ce.importLines,...V.importLines,...F.importLines,...Z.importLines,...de.importLines,...G.importLines,...U.importLines,...K.importLines,...Q.importLines,...q.importLines,...ee.importLines,...ve,...Re,...xe,...me,...fe,...vt,"",'import schema from "../schema.js";',`import { ${["LUNORA_FUNCTIONS","LUNORA_LIFECYCLE_HOOKS","LUNORA_MIGRATIONS",...X?["LUNORA_MUTATOR_PATHS"]:[],...L?["LUNORA_SHAPES"]:[]].join(", ")} } from "./functions.js";`);const Wt=J?`
+    vectors?: (env: Record<string, unknown>) => Record<string, VectorizeIndexLike>;`:"",Ut=Ye?`
+    d1?: (env: Record<string, unknown>, request?: { bookmark?: string; cdc?: boolean; cdcRetentionMs?: number; identity?: Record<string, unknown>; onBookmark?: (bookmark: string | undefined) => void; userId?: string }) => DatabaseWriterLike | undefined;`:"",Kt=Be?`
+    hyperdriveGlobal?: (env: Record<string, unknown>, request?: { cdc?: boolean; cdcRetentionMs?: number; identity?: Record<string, unknown>; userId?: string }) => DatabaseWriterLike | undefined;`:"",Qt=z?`
+    sourceClient?: (env: Record<string, unknown>, binding: string) => { query: <Row = Record<string, unknown>>(text: string, params?: readonly unknown[]) => Promise<Row[]> } | undefined;`:"",Vt='throw new Error("ctx.db.<globalTable>: no global backend configured. Pass `d1` or `hyperdriveGlobal` to createShardDO().");',Ht='throw new Error("ctx.vectors: no vectors configured. Pass `vectors` to createShardDO().");',Gt='throw new Error("ctx.scheduler: no scheduler configured. Pass `scheduler` to createShardDO().");',Jt='throw new Error("ctx.storage: no storage configured. Pass `storage` to createShardDO().");',zt=be?O("globalDbStub: DatabaseWriterLike",Vt,["aggregate","count","delete","findFirst","findFirstOrThrow","findMany","get","groupBy","insert","normalizeId","patch","query","rank","rankPage","replace"],{sync:["normalizeId","query"]}):"",Yt=J?O("vectorsStub: VectorSearchLike",Ht,["deleteByIds","getByIds","query","upsert","upsertNow"]):"",Xt=Se?`
+                const vectorShardKey = this.currentShardKey();
+`:"",Zt=Se?"namespace: vectorShardKey === ROOT_SHARD_NAME ? undefined : vectorShardKey, ":"",en=Se?`, { namespace: vectorShardKey === ROOT_SHARD_NAME ? undefined : vectorShardKey, shardedIndexNames: [${w.vectorIndexes.filter(b=>ze.has(b.table)).map(b=>JSON.stringify(b.name)).join(", ")}] }`:"",tn=J?`
+            let vectors: VectorSearchLike;
+            let onWrite: WriteHook | undefined;
+
+            if (config.vectors) {
+                const lunora = createVectors({ indexes: config.vectors(env) });
+${Xt}
+                vectors = createContextVectors(lunora${en});
+                onWrite = createVectorSyncHook({ ${Zt}schema: schema as unknown as VectorSchemaLike, vectors });
+            } else {
+                vectors = vectorsStub;
+                onWrite = undefined;
+            }
+
+            // Vectorize lives outside this shard's SQLite, so a query whose result
+            // depends on a similarity search cannot be proven current on reconnect —
+            // an unrelated upsert (or a re-index) moves the matches without touching
+            // \`__cdc_log\`. Wrapped AFTER \`onWrite\` is built so the write-through
+            // vector-sync hook keeps calling the bare facade.
+            vectors = markUnvouchableReads(vectors, options.onRead, ["getByIds", "query"]);
+`:"",nn=`{
+                auth: { identity: identity ?? null, userId: userId ?? null },
+                broadcast: (delta) => {
+                    this.recordChangedTable(delta.table, delta.indexKeys);
+                },
+                cdc: config.cdc ?? false,
+                // A dispatch with NO caller identity runs system-trusted: RLS scopes
+                // rows to a user, and these have no user to scope to. This is the tier
+                // migrations, imports and the external-source poll loop already run in
+                // (see \`adminWriterPrelude\`). Only \`onShardInit\` and \`onQueryChange\`
+                // reach it; \`onConnect\`/\`onDisconnect\` carry a verified identity and
+                // stay guarded like any request.
+                enforceRls: options.trusted !== true,
+                headroom: options.headroom ?? this.transactionHeadroom(),
+                // A live predicate, not a flag: the transaction opens AFTER this ctx
+                // is built (a mutation dispatch wraps the handler), so only a call-time
+                // read reports the truth. \`_commitSeq\` reuses one sequence across
+                // writes only while they commit together — an action is not wrapped, so
+                // each of its writes allocates its own.
+                inTransaction: () => this.isInTransaction(),
+                onIndexUse: this.getCtxDbIndexUseHook(),
+                onRead: options.onRead ?? this.getCtxDbReadHook(),
+                onReadRange: options.onReadRange,${J?`
+                onWrite,`:""}
+                scheduler,
+                schema: schema as unknown as SchemaLike,
+                sql: this.sql as SqlExec,
+                storage,${be?`
+                globalDb,`:""}
+            }`,Y=`            const env = (this.env ?? {}) as Record<string, unknown>;
+            const scheduler = (config.scheduler?.(env) ?? schedulerStub) as SchedulerLike;
+            const writer = createShardCtxDb({
+                broadcast: (delta) => {
+                    this.recordChangedTable(delta.table, delta.indexKeys);
+                },
+                cdc: config.cdc ?? false,
+                // Live predicate, same as the user-facing ctx — see \`databaseOptions\`.
+                inTransaction: () => this.isInTransaction(),
+                scheduler,
+                schema: schema as unknown as SchemaLike,
+                sql: this.sql as SqlExec,
+            });`,rn=J?`
+                vectors,`:"",on=qe?`
+                orm: bindOrm(facade),`:"",We=Be?"config.hyperdriveGlobal":"config.d1",an=be?`            const globalRequest = { ...this.globalCdcOptions(config.cdc ?? false), bookmark: this.getInboundBookmark(), identity, onBookmark: (bookmarkValue: string | undefined) => { this.setOutboundBookmark(bookmarkValue); }, userId };
+            const globalDb: DatabaseWriterLike = ${We}?.(env, globalRequest) ?? globalDbStub;
+`:"",sn=L&&be?`
+        protected override async readGlobalShapeRows(resolved: { columns?: readonly string[]; effectiveWhere?: WhereInput; global?: boolean; table: string }, identity?: { identity?: Record<string, unknown>; userId?: string }): Promise<Array<{ doc: Record<string, unknown>; id: string }>> {
+            const env = this.env as Record<string, unknown>;
+            // A shape read performs no writes, so the widened request only needs
+            // the inbound bookmark (pin the membership drain to the caller's own
+            // prior writes) — no \`onBookmark\` here.
+            const globalRequest = { ...identity, ...this.globalCdcOptions(config.cdc ?? false), bookmark: this.getInboundBookmark() };
+            const globalDb: DatabaseWriterLike = ${We}?.(env, globalRequest) ?? globalDbStub;
+            const rows: Array<{ doc: Record<string, unknown>; id: string }> = [];
+
+            let cursor: null | string = null;
+
+            // Drain every page of the global membership so the seed/diff sees the
+            // full rowset (D1 \`findMany\` is paginated). Stop one row past the cap:
+            // a broad \`.global()\` shape would otherwise materialize an unbounded
+            // array before the caller's \`withinGlobalShapeBound\` check rejects it,
+            // so bail early and let the caller fail it closed.
+            do {
+                // eslint-disable-next-line no-await-in-loop -- sequential page drain to assemble the full membership
+                const page = await globalDb.findMany(resolved.table, { cursor, where: resolved.effectiveWhere });
+
+                for (const doc of page.page) {
+                    rows.push({ doc, id: String((doc as { _id?: unknown })._id) });
+
+                    if (rows.length > ShardDOBase.GLOBAL_SHAPE_MAX_ROWS) {
+                        return rows;
+                    }
+                }
+
+                cursor = page.isDone ? null : page.continueCursor;
+            } while (cursor !== null);
+
+            return rows;
+        }
+
+        protected override async readGlobalChangedTables(sinceSeq: number, cursorOnly?: boolean): Promise<{ cursor: number; floor?: number; tables: string[] } | undefined> {
+            const env = this.env as Record<string, unknown>;
+            // Metadata-only: this asks the global changelog which TABLES moved,
+            // never what changed in them, so it costs one small read per poll tick
+            // for the whole shard — and a tick whose answer omits a shape's table
+            // skips that shape's membership drain entirely.
+            const globalDb: DatabaseWriterLike = ${We}?.(env, { ...this.globalCdcOptions(config.cdc ?? false), bookmark: this.getInboundBookmark() }) ?? globalDbStub;
+
+            return globalDb.cdcChangedTables?.(sinceSeq, { cursorOnly });
+        }
+`:"",ln=z?`
+const sourceClientCache = new WeakMap<object, Map<string, SourceClientLike>>();
+const sourcePollAtCache = new WeakMap<object, Map<string, number>>();
+`:"",cn=`
+        protected override async runShardInit(): Promise<void> {
+            this.ensureMigrated();
+${Xe?`            clearMemoryTables(this.sql as SqlExec, schema as unknown as SchemaLike);
+`:""}
+            await this.dispatchShardInit();
+        }
+`,dn=z?`
+        protected override async pollExternalSources(trace?: TraceRefLike): Promise<number | undefined> {
+            const env = (this.env ?? {}) as Record<string, unknown>;
+            const sourced = Object.entries((schema as unknown as SchemaLike).tables)
+                .map(([table, definition]) => [table, (definition as { externalSource?: ExternalSourceLike }).externalSource] as const)
+                .filter((entry): entry is [string, ExternalSourceLike] => entry[1] !== undefined);
+
+            if (sourced.length === 0) {
+                return undefined;
+            }
+
+            const shardKey = this.currentShardKey();
+            const scheduler = (config.scheduler?.(env) ?? schedulerStub) as SchedulerLike;
+
+            let clients = sourceClientCache.get(this);
+
+            if (clients === undefined) {
+                clients = new Map();
+                sourceClientCache.set(this, clients);
+            }
+
+            let polledAt = sourcePollAtCache.get(this);
+
+            if (polledAt === undefined) {
+                polledAt = new Map();
+                sourcePollAtCache.set(this, polledAt);
+            }
+
+            const now = Date.now();
+            // \`nextDueAt\` tracks the EARLIEST next-due timestamp across every
+            // non-manual source; the shared alarm re-arms there instead of the
+            // fixed 2 s global-shape floor, so a large \`refresh.everyMs\` actually
+            // sleeps until it's due. Stays \`undefined\` when every source is
+            // \`refresh: "manual"\`, so the shared alarm goes idle for this tier.
+            let nextDueAt: number | undefined;
+
+            for (const [table, source] of sourced) {
+                if (source.refresh === "manual") {
+                    continue;
+                }
+
+                if (isSourceDue(source.refresh, polledAt.get(table), now)) {
+                    try {
+                        let client = clients.get(source.binding);
+
+                        if (client === undefined) {
+                            client = config.sourceClient?.(env, source.binding);
+
+                            if (client !== undefined) {
+                                clients.set(source.binding, client);
+                            }
+                        }
+
+                        if (client === undefined) {
+                            // No SqlClient resolved for this binding (host never wired
+                            // \`config.sourceClient\`, or wired it wrong). Surface it in the
+                            // Logs panel and stamp \`polledAt\` so a persistent misconfig backs
+                            // off to \`refresh.everyMs\` instead of retrying every alarm tick.
+                            this.recordExternalSourceError(table, new Error(\`external-source: no sourceClient resolved for binding "\${source.binding}"\`), trace);
+                        } else {
+                            // A FRESH tracker per TABLE, not one shared across the whole
+                            // loop: one table's runaway pull must not spend a budget a
+                            // sibling table needs, and a limit hit here must not block
+                            // that sibling from getting its own full budget this tick.
+                            const writer = createShardCtxDb({
+                                broadcast: (delta) => {
+                                    this.recordChangedTable(delta.table, delta.indexKeys);
+                                },
+                                cdc: config.cdc ?? false,
+                                headroom: this.alarmHeadroom(),
+                                scheduler,
+                                schema: schema as unknown as SchemaLike,
+                                sql: this.sql as SqlExec,
+                            });
+
+                            if (source.mode === "incremental") {
+                                // Incremental (plan 136): pull only rows past the durable
+                                // watermark (or a full-pull seed/reconcile), upsert-only.
+                                // eslint-disable-next-line no-await-in-loop -- one sourced table at a time; sequential keeps the writer transaction simple
+                                await pullExternalSourceIncrementalTick(this.sql as SqlExec, writer, client, table, source, shardKey, now);
+                            } else {
+                                // eslint-disable-next-line no-await-in-loop -- one sourced table at a time; slices are independent but small and sequential keeps the writer transaction simple
+                                await pullExternalSourceTick(this.sql as SqlExec, writer, client, table, source, shardKey);
+                            }
+                        }
+
+                        // Timestamp AFTER the poll finishes, not the batch-start \`now\` — a
+                        // poll that outruns \`everyMs\` must not make \`nextDueAt\` (below)
+                        // stale-immediate and re-arm the alarm in a hammering loop.
+                        polledAt.set(table, Date.now());
+                    } catch (error) {
+                        if (error instanceof LunoraError && error.code === "TRANSACTION_LIMIT_EXCEEDED") {
+                            // Batch full, not a genuine failure. Incremental mode only
+                            // persists its watermark AFTER a full apply (see
+                            // \`pullExternalSourceIncrementalTick\`), so this throw left it
+                            // untouched — the next tick safely re-pulls/re-applies the
+                            // SAME slice (idempotent upsert). Full-pull mode (and an
+                            // incremental source's own occasional full-pull/reconcile
+                            // sweep) has no resumable cursor at all — deliberately not
+                            // inventing one here; a retry just redoes the whole pull,
+                            // safe if wasteful. Either way: warn instead of
+                            // \`recordExternalSourceError\`, and leave \`polledAt\`
+                            // UNCHANGED (skip the stamp below via \`continue\`) so this
+                            // table stays "due" and \`nextPollAlarmTarget\`'s existing
+                            // due-now floor re-arms the shared alarm promptly — not a
+                            // fresh \`setAlarm(now)\`.
+                            this.recordExternalSourceWarning(
+                                table,
+                                \`external-source poll for "\${table}" hit the transaction limit mid-batch; resuming next tick: \${error.message}\`,
+                                trace,
+                            );
+
+                            nextDueAt = nextDueAt === undefined ? now : Math.min(nextDueAt, now);
+
+                            continue;
+                        }
+
+                        this.recordExternalSourceError(table, error, trace);
+                        // Stamp on failure too, so a persistently failing source throttles
+                        // to \`refresh.everyMs\` rather than being hammered every tick.
+                        polledAt.set(table, Date.now());
+                    }
+                }
+
+                // This source's own next-due time, read AFTER the poll-or-skip above
+                // so a just-polled source reports \`now + everyMs\` (its FRESH due
+                // time), not the stale pre-poll one. An omitted \`refresh\` (poll
+                // every tick) is due again immediately.
+                const sourceNextDueAt = source.refresh === undefined ? now : (polledAt.get(table) ?? now) + source.refresh.everyMs;
+
+                nextDueAt = nextDueAt === undefined ? sourceNextDueAt : Math.min(nextDueAt, sourceNextDueAt);
+            }
+
+            return nextDueAt;
+        }
+`:"",nt=Ze.length>0,un=z||nt?`
+        public constructor(state: ShardDOState, env: unknown) {
+            super(state, env);
+${z?`
+            const autoSourced = Object.values((schema as unknown as SchemaLike).tables).some((definition) => {
+                const source = (definition as { externalSource?: ExternalSourceLike }).externalSource;
+
+                return source !== undefined && source.refresh !== "manual";
+            });
+
+            if (autoSourced) {
+                void this.scheduleSourcePoll();
+            }
+`:""}${nt?`
+            if (LUNORA_TTL_SWEEPS.length > 0) {
+                void this.scheduleTtlSweep();
+            }
+`:""}        }
+`:"",pn=qe?`
+            const facade = db as unknown as Record<string, ReturnType<typeof bindTableFacade>>;
+${w.tables.map(b=>`            facade[${JSON.stringify(b.name)}] = bindTableFacade(db, ${JSON.stringify(b.name)});`).join(`
+`)}
+`:"",hn=`${ce.build}${V.build}${F.build}${G.build}${de.build}
+            const secrets = createSecrets(env);
+`,mn=`${ce.contextField}${V.contextField}${F.contextField}${Z.contextField}${G.contextField}${de.contextField}
+                secrets,`,gn=Z.build,rt=y||m||d||R||k||x,fn=rt?`
+            // ActionCtx-only helpers (external, non-deterministic I/O): constructed
+            // and attached only for an \`action\` so query/mutation ctx never carry them.
+            if (isAction) {
+${U.build}${K.build}${Q.build}${q.build}${ee.build}${h}${[...y?["                ctx.images = images;"]:[],...m?["                ctx.sql = sql;"]:[],...d?["                ctx.browser = browser;"]:[],...R?["                ctx.r2sql = r2sql;"]:[],...k?["                ctx.pipelines = pipelines;"]:[],...x?["                ctx.x402 = x402;"]:[]].join(`
+`)}
+            }
+`:"",bn=rt?`            const isAction = LUNORA_FUNCTIONS[options.functionPath ?? ""]?.kind === "action";
+`:"";return`${$}${ye.join(`
+`)}
+
+type FunctionKind = "action" | "mutation" | "query";
+
+interface FunctionReference {
+    __lunoraRef: string;
+}
+
+/** Foreign-key columns per table (\`v.id("target")\` fields) for the data browser. */
+const LUNORA_TABLE_REFS: Record<string, Record<string, string>> = ${JSON.stringify(Dt,void 0,4)};
+
+/** Declared indexes per table (secondary, search, geo, rank, vector) for the schema viewer. */
+const LUNORA_TABLE_INDEXES: Record<string, Array<{ fields: string[]; name: string; type: "geo" | "index" | "rank" | "search" | "vector"; unique?: boolean }>> = ${JSON.stringify(Et,void 0,4)};
+
+/** Columns per table (typed, with PK/FK markers) for the studio's schema diagram, served via \`__lunora_admin__:describeTable\`. */
+const LUNORA_TABLE_COLUMNS: Record<
+    string,
+    Array<{ bucket?: string; enumValues?: string[]; isStorage?: boolean; name: string; nullable?: boolean; optional: boolean; pk?: boolean; ref?: string; type: string }>
+> = ${JSON.stringify(Pt,void 0,4)};
+
+/** Storage-key columns per table (\`v.storage(...)\` fields) for the file browser's records↔files join. */
+const LUNORA_STORAGE_COLUMNS: Record<string, string[]> = ${JSON.stringify(Ft,void 0,4)};
+
+/** Declarative TTL policies (\`.ttl(field, { after? })\`) the DO alarm sweep auto-expires rows for. */
+const LUNORA_TTL_SWEEPS: Array<{ after?: number; field: string; softDeleteField?: string; table: string }> = ${JSON.stringify(Ze,void 0,4)};
+
+/** Static schema advisories (computed by @lunora/advisor at codegen time) served via \`__lunora_admin__:getAdvisories\`. */
+const LUNORA_ADVISORIES: AdvisoryFinding[] = ${JSON.stringify(St,void 0,4)};
+
+/** Every declared procedure (discovered by @lunora/codegen) served via \`__lunora_admin__:getAdvisorProcedures\` — the health map's denominator. */
+const LUNORA_ADVISOR_PROCEDURES: AdvisorProcedure[] = ${JSON.stringify($t,void 0,4)};
+
+/** Read-only RLS metadata (policies + roles discovered from \`.use(rls(...))\` chains) served via \`__lunora_admin__:rlsPolicies\` for the studio's RLS inspector. */
+const LUNORA_RLS_METADATA: RlsPoliciesResult = ${JSON.stringify(Nt,void 0,4)};
+
+/** Read-only masking metadata (table + column + strategy discovered from \`.use(mask(...))\` chains) served via \`__lunora_admin__:maskPolicies\` for the studio's data-browser mask preview. */
+const LUNORA_MASK_METADATA: MaskPoliciesResult = ${JSON.stringify(Tt,void 0,4)};
+
+/** Read-only storage access-rule metadata (discovered from \`.use(storageRules(...))\` chains) served via \`__lunora_admin__:storageRules\` for the studio's access-rules view. */
+const LUNORA_STORAGE_RULES: StorageRulesResult = ${JSON.stringify(At,void 0,4)};
+
+/** Which optional package-backed features this app wires up (discovered from imports / \`ctx.*\` reads / schema signals) served via \`__lunora_admin__:studioFeatures\` so the studio hides nav pages whose package isn't enabled. */
+const LUNORA_STUDIO_FEATURES: StudioFeaturesResult = ${JSON.stringify(Ot,void 0,4)};
+${j}${H.constant}${jt}${It}${Lt}${pe}${_e}${ue}${Ee}
+export interface ShardDOConfig {
+    /** Opt into change-data-capture: records a post-image to \`__cdc_log\` on every write (backs streaming export + replay-PITR). */
+    cdc?: boolean;
+    /** Optional telemetry sink. When supplied, each \`ctx.log.*\` call is forwarded to \`sink.onLog\`. Pass the SAME sink you give \`createWorker({ observability })\` (which drives \`onRpc\`) to route both RPC and log events. */
+    observability?: (env: Record<string, unknown>) => TelemetrySink | undefined;
+    scheduler?: (env: Record<string, unknown>) => unknown;
+    storage?: (env: Record<string, unknown>) => unknown;${Wt}${$e}${V.configField}${F.configField}${G.configField}${U.configField}${K.configField}${Q.configField}${q.configField}${ee.configField}${Fe}${Me}${Ut}${Kt}${Qt}
+}
+${O("schedulerStub",Gt,["cancel","runAfter","runAt"])}${O("storageStub",Jt,["delete","download","getMetadata","getSignedUrl","getUrl","head","list","upload"],{sync:["getUrl"]})}${zt}${ln}${Yt}${Te}${V.stub}${F.stub}${G.stub}${U.stub}${K.stub}${Q.stub}${q.stub}${ee.stub}${Je}${Rt}
+// Bound in-process \`ctx.run*\` composition depth so a self- or cyclically-
+// referencing call fails loudly with a clear error instead of overflowing the
+// stack. Tracked across the awaited handler chain (one DO invocation is
+// single-threaded), so the counter reflects true nesting depth.
+const MAX_RUN_DEPTH = 32;
+let runDepth = 0;
+
+const dispatchRun = async (expected: FunctionKind, functionPath: string, args: Record<string, unknown>, ctx: unknown): Promise<unknown> => {
+    const registered = LUNORA_FUNCTIONS[functionPath];
+
+    if (!registered) {
+        throw new Error(\`unknown function: \${functionPath}\`);
+    }
+
+    if (registered.kind !== expected) {
+        throw new Error(\`ctx.run\${expected[0]!.toUpperCase()}\${expected.slice(1)}: "\${functionPath}" is registered as a \${registered.kind}, not a \${expected}\`);
+    }
+
+    if (runDepth >= MAX_RUN_DEPTH) {
+        throw new LunoraError("RUN_DEPTH_EXCEEDED", \`ctx.run*: composition depth limit (\${MAX_RUN_DEPTH}) exceeded — likely a cyclic runQuery/runMutation\`);
+    }
+
+    runDepth += 1;
+
+    try {
+        return await registered.handler(ctx, args);
+    } finally {
+        runDepth -= 1;
+    }
+};
+
+/**
+ * Build the project's shard Durable Object. Export the result as \`ShardDO\`
+ * from the worker entry so wrangler binds it by name.
+ */
+export const createShardDO = (config: ShardDOConfig = {}): new (state: ShardDOState, env: unknown) => ShardDOBase =>
+    class extends ShardDOBase {${un}
+        private migrated = false;
+
+        public override async handleRpc(functionPath: string, args: Record<string, unknown>, headroom?: TransactionHeadroomTracker): Promise<unknown> {
+            const registered = LUNORA_FUNCTIONS[functionPath];
+
+            // Internal functions are reachable server-side only: via \`ctx.run*\`
+            // composition, or a trusted system dispatch (scheduler/cron, marked by
+            // \`isSystemDispatch()\`). A client RPC never carries that flag, so its
+            // internals stay not-found and never leak across the external boundary.
+            if (!registered || (registered.visibility === "internal" && !this.isSystemDispatch())) {
+                throw new LunoraError("FUNCTION_NOT_FOUND", \`function not registered: \${functionPath}\`);
+            }
+
+            this.ensureMigrated();
+
+            // \`headroom\`, when the caller supplied one, is threaded straight
+            // through to \`buildCtx\` — bypassing its \`this.transactionHeadroom()\`
+            // fallback (the racy shared-field read) entirely for THIS dispatch.
+            // The main \`/rpc\` path always supplies one; \`dispatchLifecycle\` /
+            // \`handleRunAs\` don't mint their own and omit it, so they keep the
+            // prior fallback behavior unchanged.
+            const ctx = this.buildCtx({ functionPath, headroom, trusted: registered.lifecycle === "init" });
+
+            // A mutation's writes must commit all-or-nothing: wrap its dispatch in
+            // the DO's BEGIN/COMMIT span so any throw (a validator, an RLS denial,
+            // an OCC conflict, a failed row mid-\`insertMany\`/\`patchMany\`) rolls
+            // back every write the mutation made. Queries are read-only and actions
+            // do external I/O that can't be rolled back, so both dispatch directly.
+            // \`ctx.run*\` composition runs inside this span (it never re-enters
+            // handleRpc); runInTransaction's own guard rejects accidental nesting.
+            //
+            // The replay bookkeeping (idempotency dedup row + custom-mutator
+            // watermark advance) commits INSIDE this span via
+            // \`commitMutationBookkeeping\`, so the writes, the dedup row, and the
+            // watermark are atomic — a crash can't leave the writes durable without
+            // the replay guard.
+            if (registered.kind === "mutation") {
+                const result = await this.runInTransaction(async () => {
+                    const value = await registered.handler(ctx, args);
+
+                    this.commitMutationBookkeeping(value);
+
+                    return value;
+                });
+
+                // The transaction committed, so the rows are durable and the objects
+                // their deletion orphaned can go. Deliberately AFTER the span, never
+                // inside it: an R2 delete cannot roll back, so a delete issued from
+                // within a transaction that later aborts destroys data the surviving
+                // row still points at. A throw above skips this entirely and the
+                // queue dies with \`ctx\`.
+                //
+                // \`flushDeferredDeletes\` never rejects — the mutation has already
+                // succeeded, so a failed cleanup must not turn into a failed response.
+                // A leaked object is reported through \`ctx.log\` instead, with its key.
+                await this.deferPastResponse(flushDeferredDeletes(ctx));
+
+                return result;
+            }
+
+            const result = await registered.handler(ctx, args);
+
+            // An action is not itself transactional, but \`ctx.runMutation\` runs its
+            // submutations on THIS ctx, so their queued deletes land here — this is
+            // the first point at which those writes are known to have committed. A
+            // dispatch with nothing queued no-ops.
+            await this.deferPastResponse(flushDeferredDeletes(ctx));
+
+            return result;
+        }
+
+        // Only a \`mutation\` may enter the base class's single-writer gate for
+        // mutation-replay dedup — it is \`blockConcurrencyWhile\`, so gating an
+        // action would stall every other dispatch on the shard for the length of
+        // its outbound I/O, on nothing but a caller-supplied header. Unregistered
+        // paths answer \`false\`; \`handleRpc\` above rejects them anyway.
+        protected override isMutationFunction(functionPath: string): boolean {
+            return LUNORA_FUNCTIONS[functionPath]?.kind === "mutation";
+        }
+${tt.override}
+        protected override async executeSubscription(functionPath: string, args: Record<string, unknown>, identity?: { identity?: Record<string, unknown>; userId?: string }): Promise<{ ranges?: Map<string, KeyRange[]>; result: unknown; tables: Set<string> } | null> {
+            const registered = LUNORA_FUNCTIONS[functionPath];
+
+            if (!registered || registered.kind !== "query" || registered.visibility === "internal") {
+                return null;
+            }
+
+            this.ensureMigrated();
+
+            const footprint = createReadFootprint();
+            // Identity is threaded EXPLICITLY from the (deferred/interleaved)
+            // subscription caller — never read from the shared per-request field
+            // here — so a concurrent RPC can't leak its identity into this re-run.
+            const ctx = this.buildCtx({ functionPath, headroom: this.subscriptionHeadroom(), identity, onRead: footprint.onRead, onReadRange: footprint.onReadRange });
+            const result = await registered.handler(ctx, args);
+
+            // Ranges come from THIS run's reads, never a shared field on the DO:
+            // a deferred re-run interleaves with unrelated dispatches.
+            return { ranges: footprint.ranges(), result, tables: footprint.tables };
+        }
+
+        protected override executeStream(functionPath: string, args: Record<string, unknown>): null | { durable?: { ttlMs?: number }; iterator: (signal: AbortSignal) => AsyncIterable<unknown> } {
+            const registered = LUNORA_FUNCTIONS[functionPath];
+
+            if (!registered || registered.kind !== "stream" || registered.visibility === "internal") {
+                return null;
+            }
+
+            this.ensureMigrated();
+
+            return {
+                ...(registered.durable ? { durable: registered.durable as { ttlMs?: number } } : {}),
+                iterator: (signal) => (registered.handler as (context: unknown, args: Record<string, unknown>, signal: AbortSignal) => AsyncIterable<unknown>)(this.buildCtx({ functionPath }), args, signal),
+            };
+        }
+${Bt}${Mt}${sn}${dn}
+        protected override lifecycleHookPaths(event: "connect" | "disconnect" | "init" | "reactor"): readonly string[] {
+            return LUNORA_LIFECYCLE_HOOKS[event];
+        }
+${cn}
+        // One \`onQueryChange\` dispatch. Mirrors \`executeSubscription\` — the
+        // socket-terminated half of the same reactivity — and differs only in who
+        // consumes the result: the base's \`dispatchReactors\` stores the digest as
+        // the new baseline and the footprint as the "should I even re-run this"
+        // gate, instead of pushing a frame down a socket.
+        //
+        // Wrapped in \`runInTransaction\` because a reactor handler is a mutation
+        // and its writes must commit all-or-nothing. Safe to open here: the refresh
+        // drain runs OUTSIDE any dispatch transaction (it is post-flush background
+        // work), so this never nests.
+        //
+        // NO identity is threaded, and the ctx is built \`trusted\`. A reactor fires
+        // because data moved, not because anyone asked, so there is no user for RLS
+        // to scope to — it runs in the same system tier as migrations and the
+        // external-source poll loop. Inheriting the shared per-request identity
+        // would instead run an app's reactor as whichever user happened to write
+        // last, which is worse than running it as nobody.
+        protected override async runReactor(functionPath: string, previousDigest?: string): Promise<{ digest: string; ran: boolean; tables: readonly string[] } | undefined> {
+            const registered = LUNORA_FUNCTIONS[functionPath];
+
+            if (!registered || registered.kind !== "mutation") {
+                return undefined;
+            }
+
+            this.ensureMigrated();
+
+            const footprint = createReadFootprint();
+            const ctx = this.buildCtx({ functionPath, headroom: this.subscriptionHeadroom(), onRead: footprint.onRead, onReadRange: footprint.onReadRange, trusted: true });
+            const outcome = (await this.runInTransaction(async () => registered.handler(ctx, { previousDigest } as unknown as Record<string, unknown>))) as {
+                digest: string;
+                ran: boolean;
+            };
+
+            // A reactor IS a mutation, so its ctx carries the deferred-delete queue
+            // and its transaction has just committed. Without this the queue would
+            // die with \`ctx\` and the objects would leak with nothing to find: no
+            // error, no warning, no failed request — a reactor that reaps orphaned
+            // rows is a textbook use of one.
+            await this.deferPastResponse(flushDeferredDeletes(ctx));
+
+            return { digest: outcome.digest, ran: outcome.ran, tables: [...footprint.tables] };
+        }
+
+
+        protected override tableRefs(table: string): Record<string, string> | undefined {
+            return LUNORA_TABLE_REFS[table];
+        }
+
+        protected override tableIndexes(table: string): Array<{ fields: string[]; name: string; type: "geo" | "index" | "rank" | "search" | "vector"; unique?: boolean }> {
+            return LUNORA_TABLE_INDEXES[table] ?? [];
+        }
+
+        protected override ttlSweeps(): ReadonlyArray<{ after?: number; field: string; softDeleteField?: string; table: string }> {
+            return LUNORA_TTL_SWEEPS;
+        }
+
+        protected override tableColumns(
+            table: string,
+        ): Array<{ bucket?: string; enumValues?: string[]; isStorage?: boolean; name: string; nullable?: boolean; optional: boolean; pk?: boolean; ref?: string; type: string }> {
+            return LUNORA_TABLE_COLUMNS[table] ?? [];
+        }
+
+        protected override storageColumns(): Record<string, string[]> {
+            return LUNORA_STORAGE_COLUMNS;
+        }
+
+        protected override rlsMetadata(): RlsPoliciesResult {
+            return LUNORA_RLS_METADATA;
+        }
+
+        protected override maskMetadata(): MaskPoliciesResult {
+            return LUNORA_MASK_METADATA;
+        }
+
+        protected override storageRulesMetadata(): StorageRulesResult {
+            return LUNORA_STORAGE_RULES;
+        }
+
+        protected override studioFeatures(): StudioFeaturesResult {
+            return LUNORA_STUDIO_FEATURES;
+        }
+${H.evaluateOverride}${H.subscriptionOverride}${Ct}${_t}
+        protected override advisories(): AdvisoryFinding[] {
+            return LUNORA_ADVISORIES;
+        }
+
+        protected override advisorProcedures(): AdvisorProcedure[] {
+            return LUNORA_ADVISOR_PROCEDURES;
+        }
+
+        protected override async runShardDataMigration(args: RunShardMigrationArgs): Promise<MigrationRunResult> {
+            this.ensureMigrated();
+
+            // Falls back to the framework's reserved re-projection backfill
+            // (\`__lunora_reproject__<table>\`), which rewrites rows whose
+            // v.bigint()/v.bytes() columns are still stored in the pre-projection
+            // tagged form. Built here rather than at module scope because it
+            // needs this shard's \`sql\` handle to tell a legacy row from a
+            // current one.
+            const migration = LUNORA_MIGRATIONS[args.id] ?? buildReprojectionMigration(args.id, schema as unknown as SchemaLike, this.sql as SqlExec);
+
+            if (!migration) {
+                throw new LunoraError("MIGRATION_NOT_FOUND", \`data migration "\${args.id}" is not registered\`, { status: 404 });
+            }
+
+${Y}
+
+            return runDataMigration({
+                batchSize: args.batchSize,
+                direction: args.direction,
+                dryRun: args.dryRun,
+                maxBatches: args.maxBatches,
+                migration: migration as unknown as DataMigrationLike,
+                // Flush after each batch so live migrationStatus subscribers see
+                // progress mid-run (the base method records the reserved state
+                // table the raw-SQL progress write is invisible to the tracker).
+                onBatch: () => this.flushMigrationProgress(),
+                sql: this.sql as SqlExec,
+                writer,
+            });
+        }
+
+        protected override async runShardWrite(args: RunShardWriteArgs): Promise<RunShardWriteResult> {
+            const definition = (schema as unknown as SchemaLike).tables[args.table];
+
+            if (!definition) {
+                throw new LunoraError("UNKNOWN_TABLE", \`unknown table: \${args.table}\`, { status: 404 });
+            }
+
+            // \`.global()\` tables live in D1, not this DO's SQLite — editing them
+            // here would corrupt nothing but would fail confusingly, so reject up
+            // front with a clear code the studio can surface.
+            if (definition.shardMode?.kind === "global") {
+                throw new LunoraError("GLOBAL_TABLE_NOT_EDITABLE", \`table "\${args.table}" is global; edit it through D1, not the shard\`, { status: 400 });
+            }
+
+            this.ensureMigrated();
+
+${Y}
+
+            if (args.op === "insert") {
+                const id = await writer.insert(args.table, args.doc ?? {});
+
+                return { id, op: "insert" };
+            }
+
+            if (args.op === "delete") {
+                await writer.delete(args.id ?? "");
+
+                return { id: args.id ?? null, op: "delete" };
+            }
+
+            if (args.op === "replace") {
+                await writer.replace(args.id ?? "", args.doc ?? {});
+
+                return { id: args.id ?? null, op: "replace" };
+            }
+
+            await writer.patch(args.id ?? "", args.doc ?? {});
+
+            return { id: args.id ?? null, op: "patch" };
+        }
+
+        // The base \`ShardDO\` cannot build a schema-aware writer, so its
+        // \`runShardExport\`/\`runShardImport\` return \`[]\` and \`{inserted:{}}\`.
+        // Those are success-shaped: an empty export is what a correct export of
+        // an empty shard looks like, so a backup of a populated sharded schema
+        // reported success and wrote nothing, and an import reported success and
+        // dropped every row. Overriding both here is what makes the two admin
+        // RPCs real for a \`.shardBy()\` table.
+        //
+        // NOTE: the admin export RPC is not paginated — \`parseExportShardArgs\`
+        // takes \`tables\`/\`batchSize\` but no cursor, and the coordinator issues
+        // one call per shard — so the rows are collected into a single response.
+        // \`batchSize\` bounds the SQLite scan page, not the reply. A shard holding
+        // more rows than fit in the DO's memory budget will therefore fail the
+        // export rather than stream it. That is a loud failure where the bug this
+        // replaces was a silent empty one, but a cursor on the RPC is what makes
+        // this a complete backup path for large shards.
+        protected override async runShardExport(args: RunShardExportArgs): Promise<ExportRow[]> {
+            this.ensureMigrated();
+
+${Y}
+
+            const rows: ExportRow[] = [];
+
+            // \`exportShardRows\` walks in keyset batches so a large table does not
+            // materialize at once inside the generator; the admin RPC's response
+            // is a single array, so it is collected here rather than streamed.
+            for await (const row of exportShardRows(writer, schema as unknown as SchemaLike, { batchSize: args.batchSize, tables: args.tables })) {
+                rows.push(row);
+            }
+
+            return rows;
+        }
+
+        protected override async runShardImport(args: RunShardImportArgs): Promise<ImportShardResult> {
+            this.ensureMigrated();
+
+${Y}
+
+            // \`importShardRows\` inserts with \`allowExplicitId\`, so a source
+            // database's \`_id\`s carry across verbatim and every foreign key
+            // referencing them stays valid without a second remapping pass.
+            return importShardRows(writer, schema as unknown as SchemaLike, { rows: args.rows, startLine: args.startLine });
+        }
+
+        protected override async deleteRowThroughWriter(table: string, id: string, headroom?: TransactionHeadroomTracker): Promise<void> {
+            const definition = (schema as unknown as SchemaLike).tables[table];
+
+            if (!definition) {
+                throw new LunoraError("UNKNOWN_TABLE", \`unknown table: \${table}\`, { status: 404 });
+            }
+
+            // \`.global()\` tables live in D1, not this DO's SQLite — the same
+            // guard \`runShardWrite\` applies to single-row edits.
+            if (definition.shardMode?.kind === "global") {
+                throw new LunoraError("GLOBAL_TABLE_NOT_EDITABLE", \`table "\${table}" is global; edit it through D1, not the shard\`, { status: 400 });
+            }
+
+            this.ensureMigrated();
+
+            const env = (this.env ?? {}) as Record<string, unknown>;
+            const scheduler = (config.scheduler?.(env) ?? schedulerStub) as SchedulerLike;
+            const writer = createShardCtxDb({
+                broadcast: (delta) => {
+                    this.recordChangedTable(delta.table, delta.indexKeys);
+                },
+                cdc: config.cdc ?? false,
+                // \`runShardBulkDelete\` (a normal \`/rpc\` dispatch) calls this with no
+                // explicit \`headroom\`, so it falls back to \`this.transactionHeadroom()\`
+                // — the SAME per-dispatch meter every other write goes through, mirroring
+                // \`buildCtx\`'s \`options.headroom ?? this.transactionHeadroom()\`. The TTL
+                // sweep (an alarm work item, no dispatch in flight) passes its own
+                // by-value tracker explicitly instead.
+                headroom: headroom ?? this.transactionHeadroom(),
+                scheduler,
+                schema: schema as unknown as SchemaLike,
+                sql: this.sql as SqlExec,
+            });
+
+            // Routes through the writer (not raw SQL) so FTS / aggregate / rank
+            // shadow tables stay in sync and \`onDelete\` cascades fire — the
+            // bounded loop lives in the base \`runShardBulkDelete\`.
+            await writer.delete(id);
+        }
+
+        protected override async runShardRankBefore(args: RunShardRankBeforeArgs): Promise<{ before: number; total: number }> {
+            this.ensureMigrated();
+
+${Y}
+
+            // \`rankBefore\` is optional on \`DatabaseWriterLike\` (the D1 twin omits it),
+            // but the shard writer from \`createShardCtxDb\` always defines it.
+            if (!writer.rankBefore) {
+                throw new LunoraError("NOT_IMPLEMENTED", "rankBefore is unavailable on the shard writer", { status: 500 });
+            }
+
+            return writer.rankBefore(args.table, args.index, {
+                partitionKey: args.partitionKey,
+                rowId: args.rowId,
+                sortValues: args.sortValues,
+            });
+        }
+
+        protected override async runShardRankPage(args: RunShardRankPageArgs): Promise<ShardRankPageResult> {
+            this.ensureMigrated();
+
+${Y}
+
+            // \`rankPageRows\` is optional on \`DatabaseWriterLike\` (the D1 twin omits it),
+            // but the shard writer from \`createShardCtxDb\` always defines it. The sort
+            // directions live in the schema's rankIndex, so the shard reads them itself;
+            // \`args.directions\` is only the coordinator's comparator hint and isn't forwarded.
+            if (!writer.rankPageRows) {
+                throw new LunoraError("NOT_IMPLEMENTED", "rankPage is unavailable on the shard writer", { status: 500 });
+            }
+
+            return writer.rankPageRows(args.table, args.index, {
+                after: args.after,
+                cursor: args.cursor,
+                partitionKey: args.partitionKey,
+                take: args.take,
+            });
+        }
+
+        protected override async runShardApplyCdc(args: RunShardApplyCdcArgs): Promise<{ applied: number }> {
+            this.ensureMigrated();
+
+${Y}
+
+            await applyCdcChanges(writer, args.changes);
+
+            return { applied: args.changes.length };
+        }
+
+        protected override ensureMigrated(): void {
+            if (this.migrated) {
+                return;
+            }
+
+            runShardMigrations(this.sql as SqlExec, schema as unknown as SchemaLike, { cdc: config.cdc ?? false${ie} });
+            this.migrated = true;
+        }
+${je?`
+        protected override runShardSearchBackfill(options: { maxPages?: number }): SearchBackfillProgress {
+            // Migrations create the fts5 companions; without them every backfill
+            // statement would raise "no such table" on a shard that has never
+            // served a request.
+            this.ensureMigrated();
+
+            return backfillSearchIndexes(this.sql as SqlExec, schema as unknown as SchemaLike, options);
+        }
+`:""}
+        private buildCtx(options: { functionPath?: string; headroom?: TransactionHeadroomTracker; identity?: { identity?: Record<string, unknown>; userId?: string }; onRead?: (table: string, idOrScan?: string) => void; onReadRange?: (range: KeyRange) => void; trusted?: boolean } = {}): unknown {
+            const env = (this.env ?? {}) as Record<string, unknown>;
+            // When the caller threads an explicit identity (subscription seed /
+            // refresh — both run in deferred/interleaved contexts), use it by
+            // value and NEVER read the shared per-request identity field, which a
+            // concurrent RPC may have re-set. Otherwise (the synchronous RPC
+            // dispatch path) fall back to the per-request fields as before.
+            const userId = options.identity ? options.identity.userId : this.getCurrentUserId();
+            const identity = options.identity ? options.identity.identity : this.getCurrentIdentity();
+${tn}${le}${hn}${Oe}${Ce}${Ae}${De}
+            // \`list\`/\`get\` are the two methods \`ctx.db.system.query("_scheduled_functions")\`
+            // reaches through, and pending jobs live in the SchedulerDO — nothing the
+            // CDC changelog records — so reading them must forfeit a delta resume.
+            // The scheduler's own \`runAfter\`/\`runAt\`/\`cancel\` are writes and stay unstamped.
+            const scheduler = markUnvouchableReads((config.scheduler?.(env) ?? schedulerStub) as SchedulerLike, options.onRead, ["get", "list"]);
+            // Build the storage adapter once and share it between \`ctx.storage\`
+            // and \`ctx.db.system._storage\` so both read the same R2 binding. The
+            // \`storageStub\` fallback satisfies SystemReaderStorageLike structurally
+            // (its \`list\`/\`getMetadata\` throw the "no storage configured" error).
+            //
+            // Wrapped BEFORE the split so both consumers share one stamping facade.
+            // Only the methods that actually reach R2 are stamped: \`getUrl\` and
+            // \`getSignedUrl\` build a URL from the configured base (and an HMAC) and
+            // read nothing, and they are what handlers overwhelmingly call — stamping
+            // them would forfeit resumes for a dependency that cannot move the result.
+            // \`bucket\` IS stamped: it hands back a sub-facade this wrapper does not
+            // reach, so the selection is the last point at which the read can be seen.
+            const storage = markUnvouchableReads(asBucketStorage(config.storage?.(env) ?? storageStub) as SystemReaderStorageLike, options.onRead, [
+                "bucket",
+                "download",
+                "getMetadata",
+                "list",
+            ]);
+            // \`ctx.storage.deleteAfterCommit(key)\`, on every dispatch that can host
+            // a MUTATION handler — which is not only a mutation dispatch:
+            // \`ctx.runMutation\` hands the CALLER's ctx to the callee, so a mutation
+            // reached from an action runs on the action's ctx. Wrapping mutations
+            // alone made that composition throw a bare TypeError on a method the
+            // handler's own type promises. Queries stay unwrapped: they cannot host
+            // one, and their ctx is built on the hot subscription path.
+            //
+            // Every dispatch wrapped here also flushes (see \`handleRpc\` and
+            // \`runReactor\`) — a queue nothing drains leaks silently, which is worse
+            // than not having the method at all.
+            //
+            // Wrapped OUTSIDE the read-stamping facade so \`bucket(name)\` still
+            // resolves through it and stays stamped, and applied only to
+            // \`ctx.storage\` so \`ctx.db.system._storage\` (which shares the adapter
+            // above) is untouched.
+            const contextKind = LUNORA_FUNCTIONS[options.functionPath ?? ""]?.kind;
+            const contextStorage = contextKind === "mutation" || contextKind === "action" ? withDeferredDeletes(storage) : storage;
+            // \`ctx.log\`: the DO base builds the attributed logger (structured
+            // fields + \`.with(...)\` child + trace correlation) and routes each call
+            // to the optional \`observability\` sink. It also buffers the line (studio
+            // Logs panel) and emits a structured console event the dev-server formats.
+            //
+            // Resolved BEFORE \`ctx.db\` below, because the database is wrapped in
+            // auto-instrumentation that needs the sink, the trace anchor, and the
+            // dispatch's wide-event handle.
+            const observability = config.observability?.(env);
+            const logFunctionPath = options.functionPath ?? "";
+            const log = this.makeLogger(logFunctionPath, observability);
+            const traceAnchor = this.resolveDispatchAnchor(Boolean(options.identity));
+
+            // \`ctx.span\`: the handle onto the DISPATCH's own span — the wide-event
+            // surface. Attributes attached here accumulate for the whole request
+            // and are folded into the one span it already emits, instead of
+            // becoming N separate log lines. Shares \`traceAnchor\` with \`ctx.trace\`
+            // so both write to the same trace.
+            const span = this.makeDispatchSpan(traceAnchor, observability);
+
+${an}            // \`ctx.db\`, wrapped in automatic instrumentation: by default this
+            // adds aggregate counters (call count, total time, per-operation
+            // breakdown) to the wide event rather than a span per call, so a
+            // handler making hundreds of queries stays readable. See
+            // \`instrumentDatabase\` for the \`"spans"\` / \`"off"\` levels.
+            const db: DatabaseWriterLike = this.instrumentDb(createShardCtxDb(${nn}), logFunctionPath, traceAnchor, observability);
+${pn}${Pe}
+
+            // \`ctx.trace\` / \`ctx.metrics\`: spans and measurements to the same sink.
+            // The trace anchor is threaded explicitly for the same reason \`identity\`
+            // is — a deferred caller (a subscription re-run) must not inherit the
+            // writing mutation's trace from the shared per-request field.
+            const trace = this.makeTracer(logFunctionPath, observability, traceAnchor);
+            const metrics = this.makeMetrics(logFunctionPath, observability);
+${gn}
+            // \`ctx.now\`: the wall-clock instant (epoch ms) this function began,
+            // captured ONCE so the whole handler body sees a single stable value.
+            // Query/mutation handlers must be deterministic (they may be re-run on
+            // OCC retry / subscription re-eval), so they must read time through
+            // \`ctx.now\` instead of \`Date.now()\` — the \`nondeterministic_query_mutation\`
+            // advisor flags the latter. Actions may still use ambient \`Date.now()\`.
+            const now = Date.now();
+
+            const ctx: Record<string, unknown> = {
+                auth: {
+                    getIdentity: async () => identity ?? null,
+                    userId: userId ?? null,
+                },
+                db,
+                // Instrumented \`fetch\`: a CLIENT span per outbound call plus W3C
+                // \`traceparent\` propagation, so time spent in a downstream service
+                // is visible and its spans join this trace. Degrades to the bare
+                // global when no sink is configured.
+                fetch: this.makeFetch(logFunctionPath, traceAnchor, observability),
+                ip: this.getCurrentIp(),
+                log,
+                metrics,
+                now,${on}
+                scheduler,
+                span,
+                storage: contextStorage,
+                trace,${rn}${Ne}${mn}${ge}${Ie}${Le}${ke}${he}
+            };
+${bn}${fn}
+            ctx.runAction = (reference: FunctionReference, fnArgs: Record<string, unknown>) => dispatchRun("action", reference.__lunoraRef, fnArgs, ctx);
+            ctx.runMutation = (reference: FunctionReference, fnArgs: Record<string, unknown>) => dispatchRun("mutation", reference.__lunoraRef, fnArgs, ctx);
+            // \`ctx.runQuery(ref, args, { untracked: true })\` runs the sub-query on
+            // its OWN context, built without the read-footprint hooks — so its
+            // reads never enter this subscription's footprint and a write to the
+            // tables it touched does not re-run us. Everything else is inherited:
+            // \`functionPath\` (log/metric attribution), \`headroom\` (the sub-query
+            // must not escape this dispatch's resource ceiling), and — load-bearing
+            // — the identity BY VALUE. Omitting identity would let \`buildCtx\` fall
+            // back to the shared per-request fields, which a concurrent RPC may
+            // have re-set, and an RLS-scoped sub-query would then read as the wrong
+            // user. A tracked call keeps sharing \`ctx\` exactly as before.
+            ctx.runQuery = (reference: FunctionReference, fnArgs: Record<string, unknown>, runOptions?: { untracked?: boolean }) =>
+                dispatchRun(
+                    "query",
+                    reference.__lunoraRef,
+                    fnArgs,
+                    runOptions?.untracked === true
+                        ? this.buildCtx({ functionPath: options.functionPath, headroom: options.headroom, identity: { identity, userId } })
+                        : ctx,
+                );
+
+            return ctx;
+        }
+    };
+`},Ge=e=>{switch(e.kind){case"array":case"object":case"record":case"union":return{builder:"text",mode:"json",notNull:!0,typeAnnotation:A(e)};case"bigint":return{builder:"blob",mode:"bigint",notNull:!0};case"boolean":return{builder:"integer",mode:"boolean",notNull:!0};case"bytes":return{builder:"blob",mode:"buffer",notNull:!0};case"date":case"timestamp":return{builder:"integer",notNull:!0};case"from":return{builder:"text",notNull:!0,typeAnnotation:A(e)};case"id":return{builder:"text",notNull:!0};case"literal":{const t=e.literalValue??"";return t.startsWith('"')||t.startsWith("'")?{builder:"text",notNull:!0}:t==="true"||t==="false"?{builder:"integer",mode:"boolean",notNull:!0}:t==="null"?{builder:"text",notNull:!0}:{builder:"real",notNull:!0}}case"null":return{builder:"text",notNull:!0};case"number":return{builder:"real",notNull:!0};case"optional":return{...e.inner?Ge(e.inner):{builder:"text",notNull:!1},notNull:!1};case"storage":case"string":return{builder:"text",notNull:!0};default:return{builder:"text",notNull:!0}}},xt=(e,t)=>{const n=re(e);return n.kind==="id"&&n.tableName!==void 0&&t.has(n.tableName)?n.tableName:void 0},_r=(e,t,n)=>{g(e,"drizzle column name");const r=Ge(t),o=r.mode?`, { mode: "${r.mode}" }`:"";let s=`${r.builder}("${e}"${o})`;r.typeAnnotation&&(s+=`.$type<${r.typeAnnotation}>()`);const i=xt(t,n);return i!==void 0&&(s+=`.references((): AnySQLiteColumn => ${i}._id)`),r.notNull&&(s+=".notNull()"),s},Dr=e=>{g(e.name,"drizzle index name");const t=e.unique?"uniqueIndex":"index",n=e.fields.map(r=>(g(r,"drizzle index field"),`t.${r}`)).join(", ");return`    ${e.name}: ${t}("${e.name}").on(${n}),`},Er=(e,t)=>{g(e.name,"table name");const n=['    _id: text("_id").primaryKey(),','    _creationTime: integer("_creationTime").notNull(),',...Object.entries(e.shape).map(([o,s])=>`    ${o}: ${_r(o,s,t)},`)].join(`
+`),r=e.indexes.length>0?`, (t) => ({
+${e.indexes.map(o=>Dr(o)).join(`
+`)}
+})`:"";return`export const ${e.name} = sqliteTable("${e.name}", {
+${n}
+}${r});`},Pr=e=>e.typeAnnotation?.includes('Id<"')??!1,Fr=(e,t)=>{const n=new Set(["integer","sqliteTable","text"]),r=new Set;let o=!1,s=!1;for(const i of e){for(const a of Object.values(i.shape)){const c=Ge(a);n.add(c.builder),s=s||Pr(c),o=o||xt(a,t)!==void 0}for(const a of i.indexes)r.add(a.unique?"uniqueIndex":"index")}return{columns:[...n].toSorted((i,a)=>i.localeCompare(a)),indexes:[...r].toSorted((i,a)=>i.localeCompare(a)),needsAnyColumn:o,needsId:s}},at=(e,t=!1)=>{if(e.length===0)return`${$}export {};
+`;const n=ne(t),r=new Set(e.map(m=>m.name)),{columns:o,indexes:s,needsAnyColumn:i,needsId:a}=Fr(e,r),c=[...s,...o].toSorted((m,y)=>m.localeCompare(y)),d=e.map(m=>Er(m,r)).join(`
+
+`),p=[i?`import type { AnySQLiteColumn } from "${n.serverDrizzle}";
+`:"",a?`import type { Id } from "./dataModel.js";
+`:""].join("");return`${$}import { ${c.join(", ")} } from "${n.serverDrizzle}";
+${p}
+${d}
+`},ao=(e,t=!1)=>{const n=e.tables.filter(o=>o.shardMode==="global"),r=e.tables.filter(o=>o.shardMode!=="global");return{global:E(at(n,t),Qe),shard:E(at(r,t),Qe)}},so=e=>{const t=new Map;for(const i of e){const a=t.get(i.cron);a?a.push(i):t.set(i.cron,[i])}const n=[...t.keys()].map(i=>`    ${JSON.stringify(i)},`).join(`
+`),r=n.length>0?`
+${n}
+`:"",o=[...t.entries()].map(([i,a])=>{const c=a.map(d=>{const p=d.workflow?`workflow: ${JSON.stringify(d.workflow.binding)}`:`functionPath: ${JSON.stringify(d.functionPath)}`;return`        { name: ${JSON.stringify(d.name)}, ${p}, args: ${JSON.stringify(d.args)} },`}).join(`
+`);return`    ${JSON.stringify(i)}: [
+${c}
+    ],`}).join(`
+`),s=o.length>0?`
+${o}
+`:"";return`${$}/**
+ * One scheduled cron invocation. Exactly one target is set: \`functionPath\` is
+ * the \`namespace:fn\` dispatch ref (matches \`__lunoraRef\`), invoked on the
+ * shard; \`workflow\` is a \`WORKFLOW_*\` binding name whose durable workflow is
+ * started fresh per fire. \`args\` are forwarded verbatim (a workflow's become
+ * its \`params\`).
+ */
+export interface LunoraCronJob {
+    args: Record<string, unknown>;
+    functionPath?: string;
+    name: string;
+    workflow?: string;
+}
+
+/**
+ * Deduplicated cron schedules — mirror of wrangler's \`triggers.crons\`. The
+ * Lunora vite plugin keeps \`wrangler.jsonc\` in sync with this array.
+ */
+export const LUNORA_CRON_TRIGGERS: ReadonlyArray<string> = [${r}];
+
+/**
+ * Dispatcher map keyed by cron expression. The Worker's \`scheduled()\` handler
+ * looks up \`event.cron\` here and dispatches every job in the list.
+ */
+export const LUNORA_CRONS: Record<string, ReadonlyArray<LunoraCronJob>> = {${s}};
+`},io=e=>{const t=[...e].toSorted((r,o)=>r.name.localeCompare(o.name)).map(r=>{const o=[`name: ${JSON.stringify(r.name)}`,`table: ${JSON.stringify(r.table)}`];return r.field!==void 0&&o.push(`field: ${JSON.stringify(r.field)}`),r.dimensions!==void 0&&o.push(`dimensions: ${JSON.stringify(r.dimensions)}`),r.metric!==void 0&&o.push(`metric: ${JSON.stringify(r.metric)}`),r.metadata!==void 0&&o.push(`metadata: ${JSON.stringify(r.metadata)}`),`    { ${o.join(", ")} },`}).join(`
+`),n=t.length>0?`
+${t}
+`:"";return`${$}/**
+ * One vector index declared in \`schema.ts\` — an inline \`.vectorize()\` column
+ * or a standalone \`defineVectorIndex()\`. \`field\` is the source column (absent
+ * for a \`select\`-derived Shape B index); \`metadata\` lists the row fields
+ * mirrored into Vectorize for filtering.
+ */
+export interface LunoraVectorIndex {
+    dimensions?: number;
+    field?: string;
+    metadata?: ReadonlyArray<string>;
+    metric?: "cosine" | "dot-product" | "euclidean";
+    name: string;
+    table: string;
+}
+
+/**
+ * Static registry of every vector index in the schema, sorted by name.
+ * Vectorize cannot enumerate indexes at runtime, so the worker passes this to
+ * \`createWorker({ vectorIntrospector })\` to back the studio's vector browser.
+ */
+export const LUNORA_VECTOR_INDEXES: ReadonlyArray<LunoraVectorIndex> = [${n}];
+`},lo=e=>[...new Set(e.map(t=>t.cron))];export{Hr as A,kn as C,$ as G,jn as U,Jr as a,Yr as b,eo as c,so as d,no as e,Gr as f,ao as g,Zr as h,Xr as i,oo as j,io as k,to as l,lo as m,or as n,ro as o,zr as p};