@lunora/codegen 1.0.0-alpha.2 → 1.0.0-alpha.4

package/dist/index.d.mts

@@ -384,6 +384,26 @@ interface NondeterministicCallIR {
   line: number;
 }
 /**
+* One `ctx.r2sql` access lexically inside a `query`/`mutation` handler — the
+* `r2sql_outside_action` advisor lint input. Structurally identical to the
+* advisor's `AdvisorR2sqlCall` (same field set) so values pass straight through
+* `lintSchema` without conversion, exactly as `NondeterministicCallIR` does.
+* Only `query`/`mutation` handlers are recorded; `action(...)` is the intended
+* home for `ctx.r2sql` and is skipped.
+*/
+interface R2sqlCallIR {
+  /** The accessed `ctx.r2sql` surface, e.g. `ctx.r2sql.query` / `ctx.r2sql.from`. */
+  callee: string;
+  /** Export binding name of the function performing the access. */
+  exportName: string;
+  /** Source file relative to the lunora dir, without extension (the api namespace). */
+  file: string;
+  /** Which procedure kind the access lives in — only `query`/`mutation` handlers are recorded. */
+  kind: "mutation" | "query";
+  /** 1-based line of the access, or `0` when unknown. */
+  line: number;
+}
+/**
 * Per-procedure RLS usage snapshot, produced by `discoverRlsProcedures` for the
 * `rls_uncovered_table` advisor lint. Structurally identical to
 * `AdvisorRlsProcedure` (they share the same field set) so values pass straight
@@ -686,7 +706,7 @@ interface ProjectIR {
 * pass straight through without conversion. Returns the findings; surfacing them
 * (console, error overlay, studio Advisors table) is the caller's choice.
 */
-declare const lintSchema: (schema: SchemaIR, queries?: ReadonlyArray<QueryReadIR>, inserts?: ReadonlyArray<InsertWriteIR>, authApiCalls?: ReadonlyArray<AuthApiCallIR>, rlsProcedures?: ReadonlyArray<RlsProcedureIR>, containers?: ReadonlyArray<ContainerIR>, workflows?: ReadonlyArray<WorkflowIR>, workflowCalls?: ReadonlyArray<WorkflowCallIR>, maskProcedures?: ReadonlyArray<MaskProcedureIR>, nondeterministicCalls?: ReadonlyArray<NondeterministicCallIR>, procedureProtections?: ReadonlyArray<ProcedureMiddlewareIR>, argumentValidators?: ReadonlyArray<ArgumentValidatorIR>, secretLiterals?: ReadonlyArray<SecretLiteralIR>, sqlInterpolations?: ReadonlyArray<SqlInterpolationIR>, adminRoutes?: ReadonlyArray<AdminRouteIR>) => Finding[];
+declare const lintSchema: (schema: SchemaIR, queries?: ReadonlyArray<QueryReadIR>, inserts?: ReadonlyArray<InsertWriteIR>, authApiCalls?: ReadonlyArray<AuthApiCallIR>, rlsProcedures?: ReadonlyArray<RlsProcedureIR>, containers?: ReadonlyArray<ContainerIR>, workflows?: ReadonlyArray<WorkflowIR>, workflowCalls?: ReadonlyArray<WorkflowCallIR>, maskProcedures?: ReadonlyArray<MaskProcedureIR>, nondeterministicCalls?: ReadonlyArray<NondeterministicCallIR>, procedureProtections?: ReadonlyArray<ProcedureMiddlewareIR>, argumentValidators?: ReadonlyArray<ArgumentValidatorIR>, secretLiterals?: ReadonlyArray<SecretLiteralIR>, sqlInterpolations?: ReadonlyArray<SqlInterpolationIR>, adminRoutes?: ReadonlyArray<AdminRouteIR>, r2sqlCalls?: ReadonlyArray<R2sqlCallIR>) => Finding[];
 /**
 * Render advisor findings as a single multi-line string for console surfacing:
 * a one-line summary header followed by one `[LEVEL] name: detail` line per
@@ -803,6 +823,19 @@ declare const discoverNondeterministicCalls: (project: Project, lunoraDirectory:
 * dropping the rest keeps the lint input small.
 */
 declare const discoverQueries: (project: Project, lunoraDirectory: string) => QueryReadIR[];
+/**
+* Discover `ctx.r2sql` accesses lexically inside the handler body of every
+* exported `query(...)` / `mutation(...)` registration under the lunora source
+* directory — the `r2sql_outside_action` lint input. `action(...)` (and
+* `stream(...)`) registrations are intentionally skipped: R2 SQL is the
+* external, non-reactive surface that belongs in actions.
+*
+* Traversal is scoped to the handler node (not the whole declaration), mirroring
+* `discoverNondeterministicCalls` — so a `ctx.r2sql` touch in a sibling helper
+* outside the handler is not attributed to the query/mutation. One
+* {@link R2sqlCallIR} is produced per access site.
+*/
+declare const discoverR2sqlCalls: (project: Project, lunoraDirectory: string) => R2sqlCallIR[];
 declare const discoverRlsProcedures: (project: Project, lunoraDirectory: string) => RlsProcedureIR[];
 /**
 * Aggregate the schema-wide RLS metadata the studio's read-only inspector reads:
@@ -877,6 +910,8 @@ interface EmitServerOptions {
   hasPayments?: boolean;
   /** A `lunora/` source uses `@lunora/pipelines` / `ctx.pipelines` — wires `ctx.pipelines` onto ActionCtx only. */
   hasPipelines?: boolean;
+  /** A `lunora/` source uses `@lunora/r2sql` / `ctx.r2sql` — wires `ctx.r2sql` onto ActionCtx only. */
+  hasR2sql?: boolean;
   schema?: SchemaIR;
   storageRuleBuckets?: ReadonlyArray<string>;
   /** The project depends on the `lunora` umbrella — import base packages via its subpaths. */
@@ -893,6 +928,7 @@ declare const emitServer: ({
   hasKv,
   hasPayments,
   hasPipelines,
+  hasR2sql,
   schema,
   storageRuleBuckets,
   useUmbrella,
@@ -941,6 +977,8 @@ interface EmitShardOptions {
   /** A `lunora/` source reads `ctx.kv` — wires `ctx.kv` onto every ctx. */
   hasKv?: boolean;
   hasPayments?: boolean;
+  /** A `lunora/` source reads `ctx.r2sql` (R2 SQL) — wires `ctx.r2sql` onto the ActionCtx only. */
+  hasR2sql?: boolean;
   maskMetadata?: MaskMetadataIR;
   rlsMetadata?: RlsMetadataIR;
   schema: SchemaIR;
@@ -960,6 +998,7 @@ declare const emitShard: ({
   hasImages,
   hasKv,
   hasPayments,
+  hasR2sql,
   maskMetadata,
   rlsMetadata,
   schema,
@@ -1049,6 +1088,8 @@ interface EmitAppOptions {
   hasKv: boolean;
   /** App uses `@lunora/payment` / `ctx.payments` → emit `.payment()`. */
   hasPayments: boolean;
+  /** App uses `@lunora/r2sql` / `ctx.r2sql` → emit `.r2sql()`. */
+  hasR2sql: boolean;
   /** App imports `@lunora/scheduler` / declares crons → emit `.scheduler()`. */
   hasScheduler: boolean;
   /** App uses `@lunora/storage` → emit `.storage()` (DO `ctx.storage` + studio file browser). */
@@ -1470,4 +1511,4 @@ declare const validatorIrToJsonSchema: (validator: ValidatorIR) => JsonSchema;
 */
 declare const LUNORA_ERROR_CODES: ReadonlyArray<string>;
 declare const VERSION = "0.0.0";
-export { type AuthApiCallIR, CONTAINERS_FILENAME, CodegenDiagnosticError, type CodegenOptions, type CodegenResult, type ContainerIR, type CronJobIR, type DriftChange, type EmitAppOptions, type FieldSnapshot, type FunctionIR, GENERATED_HEADER, type HttpRouteIR, type IndexIR, type IndexSnapshot, type InsertWriteIR, LUNORA_ERROR_CODES, type MaskProcedureIR, type MigrationIR, OPENRPC_VERSION, type OpenApiEmitInput, type OpenRpcEmitInput, type ProjectIR, type QueryReadIR, type RelationSnapshot, type RlsMetadataIR, type RlsPolicyIR, type RlsProcedureIR, type RlsRoleIR, SCHEMA_SNAPSHOT_FILENAME, SCHEMA_SNAPSHOT_VERSION, type SchemaDrift, type SchemaDriftDecision, type SchemaIR, type SchemaSnapshot, SchemaSnapshotParseError, type StorageRuleIR, type StorageRulesMetadataIR, type TableIR, type TableSnapshot, VERSION, type ValidatorIR, type VectorIndexIR, WORKFLOWS_FILENAME, type WorkflowIR, buildOpenApiDocument, buildOpenRpcDocument, buildSchemaSnapshot, createCodegenProject, diagnosticAt, diffSchemaSnapshots, discoverAuthApiCalls, discoverContainers, discoverCrons, discoverFunctions, discoverHttpRoutes, discoverInserts, discoverMaskProcedures, discoverMigrations, discoverNondeterministicCalls, discoverQueries, discoverRlsMetadata, discoverRlsProcedures, discoverSchema, discoverStorageRulesMetadata, discoverWorkflows, emitApi, emitApp, emitContainers, emitCrons, emitDataModel, emitDrizzleSchema, emitFunctions, emitOpenApi, emitOpenApiModule, emitOpenRpc, emitOpenRpcModule, emitServer, emitShard, emitVectors, emitWorkflows, emitWranglerCronTriggers, evaluateSchemaDrift, formatAdvisories, lintSchema, parseSchemaSnapshot, refreshCodegenProject, runCodegen, schemaFromIr, serializeSchemaSnapshot, validatorIrToJsonSchema };
+export { type AuthApiCallIR, CONTAINERS_FILENAME, CodegenDiagnosticError, type CodegenOptions, type CodegenResult, type ContainerIR, type CronJobIR, type DriftChange, type EmitAppOptions, type FieldSnapshot, type FunctionIR, GENERATED_HEADER, type HttpRouteIR, type IndexIR, type IndexSnapshot, type InsertWriteIR, LUNORA_ERROR_CODES, type MaskProcedureIR, type MigrationIR, OPENRPC_VERSION, type OpenApiEmitInput, type OpenRpcEmitInput, type ProjectIR, type QueryReadIR, type R2sqlCallIR, type RelationSnapshot, type RlsMetadataIR, type RlsPolicyIR, type RlsProcedureIR, type RlsRoleIR, SCHEMA_SNAPSHOT_FILENAME, SCHEMA_SNAPSHOT_VERSION, type SchemaDrift, type SchemaDriftDecision, type SchemaIR, type SchemaSnapshot, SchemaSnapshotParseError, type StorageRuleIR, type StorageRulesMetadataIR, type TableIR, type TableSnapshot, VERSION, type ValidatorIR, type VectorIndexIR, WORKFLOWS_FILENAME, type WorkflowIR, buildOpenApiDocument, buildOpenRpcDocument, buildSchemaSnapshot, createCodegenProject, diagnosticAt, diffSchemaSnapshots, discoverAuthApiCalls, discoverContainers, discoverCrons, discoverFunctions, discoverHttpRoutes, discoverInserts, discoverMaskProcedures, discoverMigrations, discoverNondeterministicCalls, discoverQueries, discoverR2sqlCalls, discoverRlsMetadata, discoverRlsProcedures, discoverSchema, discoverStorageRulesMetadata, discoverWorkflows, emitApi, emitApp, emitContainers, emitCrons, emitDataModel, emitDrizzleSchema, emitFunctions, emitOpenApi, emitOpenApiModule, emitOpenRpc, emitOpenRpcModule, emitServer, emitShard, emitVectors, emitWorkflows, emitWranglerCronTriggers, evaluateSchemaDrift, formatAdvisories, lintSchema, parseSchemaSnapshot, refreshCodegenProject, runCodegen, schemaFromIr, serializeSchemaSnapshot, validatorIrToJsonSchema };

package/dist/index.d.ts

@@ -384,6 +384,26 @@ interface NondeterministicCallIR {
   line: number;
 }
 /**
+* One `ctx.r2sql` access lexically inside a `query`/`mutation` handler — the
+* `r2sql_outside_action` advisor lint input. Structurally identical to the
+* advisor's `AdvisorR2sqlCall` (same field set) so values pass straight through
+* `lintSchema` without conversion, exactly as `NondeterministicCallIR` does.
+* Only `query`/`mutation` handlers are recorded; `action(...)` is the intended
+* home for `ctx.r2sql` and is skipped.
+*/
+interface R2sqlCallIR {
+  /** The accessed `ctx.r2sql` surface, e.g. `ctx.r2sql.query` / `ctx.r2sql.from`. */
+  callee: string;
+  /** Export binding name of the function performing the access. */
+  exportName: string;
+  /** Source file relative to the lunora dir, without extension (the api namespace). */
+  file: string;
+  /** Which procedure kind the access lives in — only `query`/`mutation` handlers are recorded. */
+  kind: "mutation" | "query";
+  /** 1-based line of the access, or `0` when unknown. */
+  line: number;
+}
+/**
 * Per-procedure RLS usage snapshot, produced by `discoverRlsProcedures` for the
 * `rls_uncovered_table` advisor lint. Structurally identical to
 * `AdvisorRlsProcedure` (they share the same field set) so values pass straight
@@ -686,7 +706,7 @@ interface ProjectIR {
 * pass straight through without conversion. Returns the findings; surfacing them
 * (console, error overlay, studio Advisors table) is the caller's choice.
 */
-declare const lintSchema: (schema: SchemaIR, queries?: ReadonlyArray<QueryReadIR>, inserts?: ReadonlyArray<InsertWriteIR>, authApiCalls?: ReadonlyArray<AuthApiCallIR>, rlsProcedures?: ReadonlyArray<RlsProcedureIR>, containers?: ReadonlyArray<ContainerIR>, workflows?: ReadonlyArray<WorkflowIR>, workflowCalls?: ReadonlyArray<WorkflowCallIR>, maskProcedures?: ReadonlyArray<MaskProcedureIR>, nondeterministicCalls?: ReadonlyArray<NondeterministicCallIR>, procedureProtections?: ReadonlyArray<ProcedureMiddlewareIR>, argumentValidators?: ReadonlyArray<ArgumentValidatorIR>, secretLiterals?: ReadonlyArray<SecretLiteralIR>, sqlInterpolations?: ReadonlyArray<SqlInterpolationIR>, adminRoutes?: ReadonlyArray<AdminRouteIR>) => Finding[];
+declare const lintSchema: (schema: SchemaIR, queries?: ReadonlyArray<QueryReadIR>, inserts?: ReadonlyArray<InsertWriteIR>, authApiCalls?: ReadonlyArray<AuthApiCallIR>, rlsProcedures?: ReadonlyArray<RlsProcedureIR>, containers?: ReadonlyArray<ContainerIR>, workflows?: ReadonlyArray<WorkflowIR>, workflowCalls?: ReadonlyArray<WorkflowCallIR>, maskProcedures?: ReadonlyArray<MaskProcedureIR>, nondeterministicCalls?: ReadonlyArray<NondeterministicCallIR>, procedureProtections?: ReadonlyArray<ProcedureMiddlewareIR>, argumentValidators?: ReadonlyArray<ArgumentValidatorIR>, secretLiterals?: ReadonlyArray<SecretLiteralIR>, sqlInterpolations?: ReadonlyArray<SqlInterpolationIR>, adminRoutes?: ReadonlyArray<AdminRouteIR>, r2sqlCalls?: ReadonlyArray<R2sqlCallIR>) => Finding[];
 /**
 * Render advisor findings as a single multi-line string for console surfacing:
 * a one-line summary header followed by one `[LEVEL] name: detail` line per
@@ -803,6 +823,19 @@ declare const discoverNondeterministicCalls: (project: Project, lunoraDirectory:
 * dropping the rest keeps the lint input small.
 */
 declare const discoverQueries: (project: Project, lunoraDirectory: string) => QueryReadIR[];
+/**
+* Discover `ctx.r2sql` accesses lexically inside the handler body of every
+* exported `query(...)` / `mutation(...)` registration under the lunora source
+* directory — the `r2sql_outside_action` lint input. `action(...)` (and
+* `stream(...)`) registrations are intentionally skipped: R2 SQL is the
+* external, non-reactive surface that belongs in actions.
+*
+* Traversal is scoped to the handler node (not the whole declaration), mirroring
+* `discoverNondeterministicCalls` — so a `ctx.r2sql` touch in a sibling helper
+* outside the handler is not attributed to the query/mutation. One
+* {@link R2sqlCallIR} is produced per access site.
+*/
+declare const discoverR2sqlCalls: (project: Project, lunoraDirectory: string) => R2sqlCallIR[];
 declare const discoverRlsProcedures: (project: Project, lunoraDirectory: string) => RlsProcedureIR[];
 /**
 * Aggregate the schema-wide RLS metadata the studio's read-only inspector reads:
@@ -877,6 +910,8 @@ interface EmitServerOptions {
   hasPayments?: boolean;
   /** A `lunora/` source uses `@lunora/pipelines` / `ctx.pipelines` — wires `ctx.pipelines` onto ActionCtx only. */
   hasPipelines?: boolean;
+  /** A `lunora/` source uses `@lunora/r2sql` / `ctx.r2sql` — wires `ctx.r2sql` onto ActionCtx only. */
+  hasR2sql?: boolean;
   schema?: SchemaIR;
   storageRuleBuckets?: ReadonlyArray<string>;
   /** The project depends on the `lunora` umbrella — import base packages via its subpaths. */
@@ -893,6 +928,7 @@ declare const emitServer: ({
   hasKv,
   hasPayments,
   hasPipelines,
+  hasR2sql,
   schema,
   storageRuleBuckets,
   useUmbrella,
@@ -941,6 +977,8 @@ interface EmitShardOptions {
   /** A `lunora/` source reads `ctx.kv` — wires `ctx.kv` onto every ctx. */
   hasKv?: boolean;
   hasPayments?: boolean;
+  /** A `lunora/` source reads `ctx.r2sql` (R2 SQL) — wires `ctx.r2sql` onto the ActionCtx only. */
+  hasR2sql?: boolean;
   maskMetadata?: MaskMetadataIR;
   rlsMetadata?: RlsMetadataIR;
   schema: SchemaIR;
@@ -960,6 +998,7 @@ declare const emitShard: ({
   hasImages,
   hasKv,
   hasPayments,
+  hasR2sql,
   maskMetadata,
   rlsMetadata,
   schema,
@@ -1049,6 +1088,8 @@ interface EmitAppOptions {
   hasKv: boolean;
   /** App uses `@lunora/payment` / `ctx.payments` → emit `.payment()`. */
   hasPayments: boolean;
+  /** App uses `@lunora/r2sql` / `ctx.r2sql` → emit `.r2sql()`. */
+  hasR2sql: boolean;
   /** App imports `@lunora/scheduler` / declares crons → emit `.scheduler()`. */
   hasScheduler: boolean;
   /** App uses `@lunora/storage` → emit `.storage()` (DO `ctx.storage` + studio file browser). */
@@ -1470,4 +1511,4 @@ declare const validatorIrToJsonSchema: (validator: ValidatorIR) => JsonSchema;
 */
 declare const LUNORA_ERROR_CODES: ReadonlyArray<string>;
 declare const VERSION = "0.0.0";
-export { type AuthApiCallIR, CONTAINERS_FILENAME, CodegenDiagnosticError, type CodegenOptions, type CodegenResult, type ContainerIR, type CronJobIR, type DriftChange, type EmitAppOptions, type FieldSnapshot, type FunctionIR, GENERATED_HEADER, type HttpRouteIR, type IndexIR, type IndexSnapshot, type InsertWriteIR, LUNORA_ERROR_CODES, type MaskProcedureIR, type MigrationIR, OPENRPC_VERSION, type OpenApiEmitInput, type OpenRpcEmitInput, type ProjectIR, type QueryReadIR, type RelationSnapshot, type RlsMetadataIR, type RlsPolicyIR, type RlsProcedureIR, type RlsRoleIR, SCHEMA_SNAPSHOT_FILENAME, SCHEMA_SNAPSHOT_VERSION, type SchemaDrift, type SchemaDriftDecision, type SchemaIR, type SchemaSnapshot, SchemaSnapshotParseError, type StorageRuleIR, type StorageRulesMetadataIR, type TableIR, type TableSnapshot, VERSION, type ValidatorIR, type VectorIndexIR, WORKFLOWS_FILENAME, type WorkflowIR, buildOpenApiDocument, buildOpenRpcDocument, buildSchemaSnapshot, createCodegenProject, diagnosticAt, diffSchemaSnapshots, discoverAuthApiCalls, discoverContainers, discoverCrons, discoverFunctions, discoverHttpRoutes, discoverInserts, discoverMaskProcedures, discoverMigrations, discoverNondeterministicCalls, discoverQueries, discoverRlsMetadata, discoverRlsProcedures, discoverSchema, discoverStorageRulesMetadata, discoverWorkflows, emitApi, emitApp, emitContainers, emitCrons, emitDataModel, emitDrizzleSchema, emitFunctions, emitOpenApi, emitOpenApiModule, emitOpenRpc, emitOpenRpcModule, emitServer, emitShard, emitVectors, emitWorkflows, emitWranglerCronTriggers, evaluateSchemaDrift, formatAdvisories, lintSchema, parseSchemaSnapshot, refreshCodegenProject, runCodegen, schemaFromIr, serializeSchemaSnapshot, validatorIrToJsonSchema };
+export { type AuthApiCallIR, CONTAINERS_FILENAME, CodegenDiagnosticError, type CodegenOptions, type CodegenResult, type ContainerIR, type CronJobIR, type DriftChange, type EmitAppOptions, type FieldSnapshot, type FunctionIR, GENERATED_HEADER, type HttpRouteIR, type IndexIR, type IndexSnapshot, type InsertWriteIR, LUNORA_ERROR_CODES, type MaskProcedureIR, type MigrationIR, OPENRPC_VERSION, type OpenApiEmitInput, type OpenRpcEmitInput, type ProjectIR, type QueryReadIR, type R2sqlCallIR, type RelationSnapshot, type RlsMetadataIR, type RlsPolicyIR, type RlsProcedureIR, type RlsRoleIR, SCHEMA_SNAPSHOT_FILENAME, SCHEMA_SNAPSHOT_VERSION, type SchemaDrift, type SchemaDriftDecision, type SchemaIR, type SchemaSnapshot, SchemaSnapshotParseError, type StorageRuleIR, type StorageRulesMetadataIR, type TableIR, type TableSnapshot, VERSION, type ValidatorIR, type VectorIndexIR, WORKFLOWS_FILENAME, type WorkflowIR, buildOpenApiDocument, buildOpenRpcDocument, buildSchemaSnapshot, createCodegenProject, diagnosticAt, diffSchemaSnapshots, discoverAuthApiCalls, discoverContainers, discoverCrons, discoverFunctions, discoverHttpRoutes, discoverInserts, discoverMaskProcedures, discoverMigrations, discoverNondeterministicCalls, discoverQueries, discoverR2sqlCalls, discoverRlsMetadata, discoverRlsProcedures, discoverSchema, discoverStorageRulesMetadata, discoverWorkflows, emitApi, emitApp, emitContainers, emitCrons, emitDataModel, emitDrizzleSchema, emitFunctions, emitOpenApi, emitOpenApiModule, emitOpenRpc, emitOpenRpcModule, emitServer, emitShard, emitVectors, emitWorkflows, emitWranglerCronTriggers, evaluateSchemaDrift, formatAdvisories, lintSchema, parseSchemaSnapshot, refreshCodegenProject, runCodegen, schemaFromIr, serializeSchemaSnapshot, validatorIrToJsonSchema };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-export { formatAdvisories, lintSchema } from './packem_shared/lintSchema-DicbOHvH.mjs';
+export { formatAdvisories, lintSchema } from './packem_shared/formatAdvisories-8NIv1k0I.mjs';
 export { CodegenDiagnosticError, diagnosticAt } from './packem_shared/CodegenDiagnosticError-54jWDxA9.mjs';
 export { default as discoverAuthApiCalls } from './packem_shared/discoverAuthApiCalls-C35R6z0T.mjs';
 export { CONTAINERS_FILENAME, discoverContainers } from './packem_shared/CONTAINERS_FILENAME-0K-pjNb8.mjs';
@@ -10,16 +10,17 @@ export { default as discoverMaskProcedures } from './packem_shared/discoverMaskP
 export { default as discoverMigrations } from './packem_shared/discoverMigrations-Doj_-BAA.mjs';
 export { default as discoverNondeterministicCalls } from './packem_shared/discoverNondeterministicCalls-4KiPQxQU.mjs';
 export { default as discoverQueries } from './packem_shared/discoverQueries-BkIi0dBD.mjs';
+export { default as discoverR2sqlCalls } from './packem_shared/discoverR2sqlCalls-BpDqvcUn.mjs';
 export { discoverRlsMetadata, default as discoverRlsProcedures } from './packem_shared/discoverRlsMetadata-DpRB1HMe.mjs';
 export { default as discoverSchema } from './packem_shared/discoverSchema-BBulgGbH.mjs';
 export { default as discoverStorageRulesMetadata } from './packem_shared/discoverStorageRulesMetadata-DAqJUxUv.mjs';
-export { WORKFLOWS_FILENAME, discoverWorkflows } from './packem_shared/discoverWorkflows-DRDQdhfq.mjs';
-export { GENERATED_HEADER, emitApi, emitContainers, emitCrons, emitDataModel, emitDrizzleSchema, emitFunctions, emitServer, emitShard, emitVectors, emitWorkflows, emitWranglerCronTriggers } from './packem_shared/emitApi-hRVC-kE7.mjs';
-export { emitApp } from './packem_shared/emitApp-CzZ6GbrD.mjs';
-export { buildOpenApiDocument, emitOpenApi, emitOpenApiModule } from './packem_shared/buildOpenApiDocument-yHVN66Xd.mjs';
-export { OPENRPC_VERSION, buildOpenRpcDocument, emitOpenRpc, emitOpenRpcModule } from './packem_shared/buildOpenRpcDocument-BZGY1-jT.mjs';
-export { SCHEMA_SNAPSHOT_FILENAME, createCodegenProject, refreshCodegenProject, runCodegen } from './packem_shared/createCodegenProject-DGJm0_Pk.mjs';
-export { SCHEMA_SNAPSHOT_VERSION, SchemaSnapshotParseError, buildSchemaSnapshot, diffSchemaSnapshots, evaluateSchemaDrift, parseSchemaSnapshot, serializeSchemaSnapshot } from './packem_shared/buildSchemaSnapshot-DzLDbWk3.mjs';
+export { WORKFLOWS_FILENAME, discoverWorkflows } from './packem_shared/WORKFLOWS_FILENAME-DRDQdhfq.mjs';
+export { GENERATED_HEADER, emitApi, emitContainers, emitCrons, emitDataModel, emitDrizzleSchema, emitFunctions, emitServer, emitShard, emitVectors, emitWorkflows, emitWranglerCronTriggers } from './packem_shared/GENERATED_HEADER-DF1hQcix.mjs';
+export { emitApp } from './packem_shared/emitApp-Ci_hcJNO.mjs';
+export { buildOpenApiDocument, emitOpenApi, emitOpenApiModule } from './packem_shared/buildOpenApiDocument-Cns1EkCQ.mjs';
+export { OPENRPC_VERSION, buildOpenRpcDocument, emitOpenRpc, emitOpenRpcModule } from './packem_shared/OPENRPC_VERSION-C7zKVeKi.mjs';
+export { SCHEMA_SNAPSHOT_FILENAME, createCodegenProject, refreshCodegenProject, runCodegen } from './packem_shared/SCHEMA_SNAPSHOT_FILENAME-C5UlpWKF.mjs';
+export { SCHEMA_SNAPSHOT_VERSION, SchemaSnapshotParseError, buildSchemaSnapshot, diffSchemaSnapshots, evaluateSchemaDrift, parseSchemaSnapshot, serializeSchemaSnapshot } from './packem_shared/SCHEMA_SNAPSHOT_VERSION-DzLDbWk3.mjs';
 export { schemaFromIr } from './packem_shared/schemaFromIr-DTYsLBaA.mjs';
 export { LUNORA_ERROR_CODES, validatorIrToJsonSchema } from './packem_shared/LUNORA_ERROR_CODES-CySpQPD3.mjs';
 

package/dist/packem_shared/{emitApi-hRVC-kE7.mjs → GENERATED_HEADER-DF1hQcix.mjs}

@@ -539,6 +539,7 @@ const emitServer = ({
   hasKv = false,
   hasPayments = false,
   hasPipelines = false,
+  hasR2sql = false,
   schema,
   storageRuleBuckets = [],
   useUmbrella = false,
@@ -612,6 +613,11 @@ export type Env = CloudflareBindings;`;
   const pipelinesActionField = hasPipelines ? `
     /** Pipelines ingestion sink (durable, R2-backed). Fire-and-forget and batched; do not read it back in-handler. */
     readonly pipelines: import("@lunora/pipelines").PipelineClient;` : "";
+  const r2sqlActionField = hasR2sql ? `
+    /**
+     * R2 SQL over Apache Iceberg tables (window functions, DISTINCT, set operations). Non-deterministic — available only in actions. Reads here are NOT tracked by Lunora live queries.
+     */
+    readonly r2sql: import("@lunora/r2sql").R2SqlClient;` : "";
   const hasWorkflows = workflows.length > 0;
   const workflowsTypeImport = hasWorkflows ? `import type { WorkflowHandle } from "@lunora/workflow";
 import type * as lunoraWorkflowDefinitions from "../workflows.js";
@@ -701,7 +707,7 @@ export interface MutationCtx extends Omit<MutationCtxBase, "db" | "storage"${wor
 export interface ActionCtx extends Omit<ActionCtxBase, "db" | "storage"${workflowsOmit}> {
     readonly db: Omit<DatabaseWriter, "query" | "get"> & DatabaseWriterFacade & { query: TypedTableQuery; get: TypedTableGet };
     readonly orm: OrmWriter;
-    readonly storage: StorageBase<StorageBucketName>;${aiActionField}${paymentsActionField}${containersActionField}${kvContextField}${hyperdriveActionField}${browserActionField}${imagesActionField}${analyticsContextField}${pipelinesActionField}${workflowsContextField}
+    readonly storage: StorageBase<StorageBucketName>;${aiActionField}${paymentsActionField}${containersActionField}${kvContextField}${hyperdriveActionField}${browserActionField}${imagesActionField}${analyticsContextField}${pipelinesActionField}${r2sqlActionField}${workflowsContextField}
 }
 
 /**
@@ -1183,6 +1189,56 @@ const browserStub: Browser = {
 `
   };
 };
+const emitR2sqlFragments = (hasR2sql) => {
+  if (!hasR2sql) {
+    return EMPTY_HELPER_FRAGMENTS;
+  }
+  const r2sqlMissing = `throw new Error("ctx.r2sql: no R2 SQL credentials found. Set \\\`R2_SQL_TOKEN\\\`, \\\`R2_SQL_ACCOUNT_ID\\\` (or \\\`CLOUDFLARE_ACCOUNT_ID\\\`), and \\\`R2_SQL_BUCKET\\\` in your env/.dev.vars, or pass an \\\`r2sql\\\` config thunk to createShardDO().");`;
+  return {
+    build: `
+            const r2sqlEnv = env as Record<string, unknown>;
+            const r2sqlAccountId = (r2sqlEnv.R2_SQL_ACCOUNT_ID ?? r2sqlEnv.CLOUDFLARE_ACCOUNT_ID) as string | undefined;
+            const r2sqlToken = r2sqlEnv.R2_SQL_TOKEN as string | undefined;
+            const r2sqlBucket = r2sqlEnv.R2_SQL_BUCKET as string | undefined;
+            const r2sql: R2SqlClient = config.r2sql
+                ? config.r2sql(env)
+                : r2sqlAccountId && r2sqlToken && r2sqlBucket
+                  ? createR2Sql({ accountId: r2sqlAccountId, apiToken: r2sqlToken, bucket: r2sqlBucket })
+                  : r2sqlStub;
+`,
+    configField: `
+    r2sql?: (env: Record<string, unknown>) => R2SqlClient;`,
+    // ActionCtx-only: attached via the \`ctx.r2sql = r2sql\` assignment in the
+    // \`isAction\` block, never the every-ctx object literal.
+    contextField: "",
+    importLines: [`import type { R2SqlClient } from "@lunora/r2sql";`, `import { createR2Sql } from "@lunora/r2sql";`],
+    // The stub is typed `R2SqlClient`, so TS flags a missing method at build
+    // time — but it must stay structurally in sync with that interface
+    // (`@lunora/r2sql` client.ts) when a method is added there.
+    stub: `
+const r2sqlStub: R2SqlClient = {
+    describe: async () => {
+        ${r2sqlMissing}
+    },
+    explain: async () => {
+        ${r2sqlMissing}
+    },
+    from: () => {
+        ${r2sqlMissing}
+    },
+    query: async () => {
+        ${r2sqlMissing}
+    },
+    showDatabases: async () => {
+        ${r2sqlMissing}
+    },
+    showTables: async () => {
+        ${r2sqlMissing}
+    },
+};
+`
+  };
+};
 const emitContainers = (containers) => {
   if (containers.length === 0) {
     return "";
@@ -1420,6 +1476,7 @@ const emitShard = ({
   hasImages = false,
   hasKv = false,
   hasPayments = false,
+  hasR2sql = false,
   maskMetadata,
   rlsMetadata,
   schema,
@@ -1435,6 +1492,7 @@ const emitShard = ({
   const imagesFragments = emitImagesFragments(hasImages);
   const hyperdriveFragments = emitHyperdriveFragments(hasHyperdrive);
   const browserFragments = emitBrowserFragments(hasBrowser);
+  const r2sqlFragments = emitR2sqlFragments(hasR2sql);
   const {
     build: containersBuild,
     contextField: containersContextField,
@@ -1509,6 +1567,7 @@ const emitShard = ({
     ...imagesFragments.importLines,
     ...hyperdriveFragments.importLines,
     ...browserFragments.importLines,
+    ...r2sqlFragments.importLines,
     ...containerImportLines,
     ...workflowImportLines,
     ...paymentsImports,
@@ -1654,15 +1713,16 @@ ${schema.tables.map(
 ` : "";
   const everyContextBuild = `${kvFragments.build}${analyticsFragments.build}`;
   const everyContextField = `${kvFragments.contextField}${analyticsFragments.contextField}`;
-  const actionOnlyHasAny = hasImages || hasHyperdrive || hasBrowser;
+  const actionOnlyHasAny = hasImages || hasHyperdrive || hasBrowser || hasR2sql;
   const actionOnlyBlock = actionOnlyHasAny ? `
             // ActionCtx-only helpers (external, non-deterministic I/O): constructed
             // and attached only for an \`action\` so query/mutation ctx never carry them.
             if (isAction) {
-${imagesFragments.build}${hyperdriveFragments.build}${browserFragments.build}${[
+${imagesFragments.build}${hyperdriveFragments.build}${browserFragments.build}${r2sqlFragments.build}${[
     ...hasImages ? ["                ctx.images = images;"] : [],
     ...hasHyperdrive ? ["                ctx.sql = sql;"] : [],
-    ...hasBrowser ? ["                ctx.browser = browser;"] : []
+    ...hasBrowser ? ["                ctx.browser = browser;"] : [],
+    ...hasR2sql ? ["                ctx.r2sql = r2sql;"] : []
   ].join("\n")}
             }
 ` : "";
@@ -1709,7 +1769,7 @@ export interface ShardDOConfig {
     /** Optional telemetry sink. When supplied, each \`ctx.log.*\` call is forwarded to \`sink.onLog\`. Pass the SAME sink you give \`createWorker({ observability })\` (which drives \`onRpc\`) to route both RPC and log events. */
     observability?: (env: Record<string, unknown>) => LogSink | undefined;
     scheduler?: (env: Record<string, unknown>) => unknown;
-    storage?: (env: Record<string, unknown>) => unknown;${vectorsConfigField}${aiConfigField}${kvFragments.configField}${analyticsFragments.configField}${imagesFragments.configField}${hyperdriveFragments.configField}${browserFragments.configField}${paymentsConfigField}${d1ConfigField}${hyperdriveGlobalConfigField}
+    storage?: (env: Record<string, unknown>) => unknown;${vectorsConfigField}${aiConfigField}${kvFragments.configField}${analyticsFragments.configField}${imagesFragments.configField}${hyperdriveFragments.configField}${browserFragments.configField}${r2sqlFragments.configField}${paymentsConfigField}${d1ConfigField}${hyperdriveGlobalConfigField}
 }
 
 const schedulerStub = {
@@ -1747,7 +1807,7 @@ const storageStub = {
         throw new Error("ctx.storage: no storage configured. Pass \`storage\` to createShardDO().");
     },
 };
-${globalDatabaseStub}${vectorsStub}${aiStub}${kvFragments.stub}${analyticsFragments.stub}${imagesFragments.stub}${hyperdriveFragments.stub}${browserFragments.stub}${paymentStub}${bindTableHelper}
+${globalDatabaseStub}${vectorsStub}${aiStub}${kvFragments.stub}${analyticsFragments.stub}${imagesFragments.stub}${hyperdriveFragments.stub}${browserFragments.stub}${r2sqlFragments.stub}${paymentStub}${bindTableHelper}
 // Bound in-process \`ctx.run*\` composition depth so a self- or cyclically-
 // referencing call fails loudly with a clear error instead of overflowing the
 // stack. Tracked across the awaited handler chain (one DO invocation is
@@ -2149,6 +2209,14 @@ ${facadeBlock}${paymentsBuild}
                 warn: (...args: unknown[]) => { this.recordUserLog(logFunctionPath, "warn", args, observability); },
             };
 
+            // \`ctx.now\`: the wall-clock instant (epoch ms) this function began,
+            // captured ONCE so the whole handler body sees a single stable value.
+            // Query/mutation handlers must be deterministic (they may be re-run on
+            // OCC retry / subscription re-eval), so they must read time through
+            // \`ctx.now\` instead of \`Date.now()\` — the \`nondeterministic_query_mutation\`
+            // advisor flags the latter. Actions may still use ambient \`Date.now()\`.
+            const now = Date.now();
+
             const ctx: Record<string, unknown> = {
                 auth: {
                     getIdentity: async () => identity ?? null,
@@ -2157,7 +2225,8 @@ ${facadeBlock}${paymentsBuild}
                 db,
                 fetch: globalThis.fetch.bind(globalThis),
                 ip: this.getCurrentIp(),
-                log,${ormContextField}
+                log,
+                now,${ormContextField}
                 scheduler,
                 storage,${vectorsContextField}${aiContextField}${everyContextField}${paymentsContextField}${containersContextField}${workflowsContextField}
             };

package/dist/packem_shared/{buildOpenRpcDocument-BZGY1-jT.mjs → OPENRPC_VERSION-C7zKVeKi.mjs}

@@ -1,4 +1,4 @@
-import { GENERATED_HEADER } from './emitApi-hRVC-kE7.mjs';
+import { GENERATED_HEADER } from './GENERATED_HEADER-DF1hQcix.mjs';
 import { s as sanitizeNamespace } from './paths-BRd6JHuF.mjs';
 import { argsObjectSchema, LUNORA_ERROR_CODES } from './LUNORA_ERROR_CODES-CySpQPD3.mjs';
 

package/dist/packem_shared/{createCodegenProject-DGJm0_Pk.mjs → SCHEMA_SNAPSHOT_FILENAME-C5UlpWKF.mjs}

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { Node, SyntaxKind, Project } from 'ts-morph';
-import { lintSchema } from './lintSchema-DicbOHvH.mjs';
+import { lintSchema } from './formatAdvisories-8NIv1k0I.mjs';
 import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall, discoverFunctions } from './discoverFunctions-DEgAcRuD.mjs';
 import discoverAuthApiCalls from './discoverAuthApiCalls-C35R6z0T.mjs';
 import { discoverContainers } from './CONTAINERS_FILENAME-0K-pjNb8.mjs';
@@ -12,16 +12,17 @@ import discoverMaskProcedures, { discoverMaskMetadata } from './discoverMaskProc
 import discoverMigrations from './discoverMigrations-Doj_-BAA.mjs';
 import discoverNondeterministicCalls from './discoverNondeterministicCalls-4KiPQxQU.mjs';
 import discoverQueries from './discoverQueries-BkIi0dBD.mjs';
+import discoverR2sqlCalls from './discoverR2sqlCalls-BpDqvcUn.mjs';
 import discoverRlsProcedures, { discoverRlsMetadata } from './discoverRlsMetadata-DpRB1HMe.mjs';
 import discoverSchema from './discoverSchema-BBulgGbH.mjs';
 import discoverStorageRulesMetadata from './discoverStorageRulesMetadata-DAqJUxUv.mjs';
 import { e as enclosingExportName$1 } from './discover-ast-CT6BgBr4.mjs';
-import { discoverWorkflows } from './discoverWorkflows-DRDQdhfq.mjs';
-import { buildStorageColumns, emitDataModel, emitApi, emitServer, emitFunctions, emitShard, emitContainers, emitWorkflows, emitCrons, emitVectors, emitDrizzleSchema, emitSeed, emitWranglerCronTriggers } from './emitApi-hRVC-kE7.mjs';
-import { emitApp } from './emitApp-CzZ6GbrD.mjs';
-import { buildOpenApiDocument, emitOpenApiModule } from './buildOpenApiDocument-yHVN66Xd.mjs';
-import { buildOpenRpcDocument, emitOpenRpcModule } from './buildOpenRpcDocument-BZGY1-jT.mjs';
-import { buildSchemaSnapshot, serializeSchemaSnapshot } from './buildSchemaSnapshot-DzLDbWk3.mjs';
+import { discoverWorkflows } from './WORKFLOWS_FILENAME-DRDQdhfq.mjs';
+import { buildStorageColumns, emitDataModel, emitApi, emitServer, emitFunctions, emitShard, emitContainers, emitWorkflows, emitCrons, emitVectors, emitDrizzleSchema, emitSeed, emitWranglerCronTriggers } from './GENERATED_HEADER-DF1hQcix.mjs';
+import { emitApp } from './emitApp-Ci_hcJNO.mjs';
+import { buildOpenApiDocument, emitOpenApiModule } from './buildOpenApiDocument-Cns1EkCQ.mjs';
+import { buildOpenRpcDocument, emitOpenRpcModule } from './OPENRPC_VERSION-C7zKVeKi.mjs';
+import { buildSchemaSnapshot, serializeSchemaSnapshot } from './SCHEMA_SNAPSHOT_VERSION-DzLDbWk3.mjs';
 
 const HTTP_VERBS = /* @__PURE__ */ new Set(["delete", "get", "head", "options", "patch", "post", "put"]);
 const TERMINAL_STEPS = /* @__PURE__ */ new Set(["handler", "stream"]);
@@ -246,6 +247,7 @@ const PROBES = {
   mail: { moduleSpecifier: "@lunora/mail" },
   payments: { contextProperty: "payments", moduleSpecifier: "@lunora/payment" },
   pipelines: { contextProperty: "pipelines", moduleSpecifier: "@lunora/pipelines" },
+  r2sql: { contextProperty: "r2sql", moduleSpecifier: "@lunora/r2sql" },
   scheduler: { contextProperty: "scheduler", moduleSpecifier: "@lunora/scheduler" },
   storage: { contextProperty: "storage", moduleSpecifier: "@lunora/storage" },
   vectors: { contextProperty: "vectors", moduleSpecifier: "@lunora/vectors" },
@@ -277,6 +279,7 @@ const discoverFeatureUsage = (project, lunoraDirectory) => {
     mail: false,
     payments: false,
     pipelines: false,
+    r2sql: false,
     scheduler: false,
     storage: false,
     vectors: false,
@@ -364,26 +367,45 @@ const protectPublicFlags = (call) => {
   }
   return { usesCaptcha: Boolean(argument.getProperty("captcha")), usesRateLimit: Boolean(argument.getProperty("rateLimit")) };
 };
+const resolveUseArgumentCall = (argument) => {
+  if (Node.isCallExpression(argument)) {
+    return argument;
+  }
+  if (!Node.isIdentifier(argument)) {
+    return void 0;
+  }
+  const declaration = argument.getSourceFile().getVariableDeclaration(argument.getText());
+  const initializer = declaration?.getInitializer();
+  return initializer && Node.isCallExpression(initializer) ? initializer : void 0;
+};
+const NO_PROTECTIONS = { usesCaptcha: false, usesMask: false, usesRateLimit: false, usesRls: false };
+const useStepProtections = (useArgument) => {
+  const argument = resolveUseArgumentCall(useArgument);
+  const name = argument ? calleeNameOf(argument) : void 0;
+  if (argument && name === "protectPublic") {
+    const bundle = protectPublicFlags(argument);
+    return { ...NO_PROTECTIONS, usesCaptcha: bundle.usesCaptcha, usesRateLimit: bundle.usesRateLimit };
+  }
+  if (name !== void 0 && name in MIDDLEWARE_FLAGS) {
+    return { ...NO_PROTECTIONS, [MIDDLEWARE_FLAGS[name]]: true };
+  }
+  return NO_PROTECTIONS;
+};
 const protectionsInChain = (receiver) => {
-  const protections = { usesCaptcha: false, usesMask: false, usesRateLimit: false, usesRls: false };
+  const protections = { ...NO_PROTECTIONS };
   let node = receiver;
   while (Node.isCallExpression(node)) {
     const chainCallee = node.getExpression();
     if (!Node.isPropertyAccessExpression(chainCallee)) {
       break;
     }
-    if (chainCallee.getName() === "use") {
-      const argument = node.getArguments()[0];
-      if (argument && Node.isCallExpression(argument)) {
-        const name = calleeNameOf(argument);
-        if (name === "protectPublic") {
-          const bundle = protectPublicFlags(argument);
-          protections.usesRateLimit ||= bundle.usesRateLimit;
-          protections.usesCaptcha ||= bundle.usesCaptcha;
-        } else if (name !== void 0 && name in MIDDLEWARE_FLAGS) {
-          protections[MIDDLEWARE_FLAGS[name]] = true;
-        }
-      }
+    const useArgument = chainCallee.getName() === "use" ? node.getArguments()[0] : void 0;
+    if (useArgument) {
+      const step = useStepProtections(useArgument);
+      protections.usesCaptcha ||= step.usesCaptcha;
+      protections.usesMask ||= step.usesMask;
+      protections.usesRateLimit ||= step.usesRateLimit;
+      protections.usesRls ||= step.usesRls;
     }
     node = chainCallee.getExpression();
   }
@@ -723,7 +745,8 @@ const runCodegen = (options) => {
     discoverArgumentValidators(project, lunoraDirectory),
     discoverSecrets(project, lunoraDirectory),
     discoverSqlInterpolation(project, lunoraDirectory),
-    discoverAdminRoutes(project, lunoraDirectory)
+    discoverAdminRoutes(project, lunoraDirectory),
+    discoverR2sqlCalls(project, lunoraDirectory)
   );
   const rlsMetadata = discoverRlsMetadata(project, lunoraDirectory);
   const maskMetadata = discoverMaskMetadata(project, lunoraDirectory);
@@ -737,6 +760,7 @@ const runCodegen = (options) => {
   const hasImages = featureUsage.images;
   const hasAnalytics = featureUsage.analytics;
   const hasPipelines = featureUsage.pipelines;
+  const hasR2sql = featureUsage.r2sql;
   const dependencies = discoverPackageDependencies(options.projectRoot);
   const studioFeatures = buildStudioFeatures(featureUsage, {
     cronCount: crons.length,
@@ -759,6 +783,7 @@ const runCodegen = (options) => {
     hasKv,
     hasPayments,
     hasPipelines,
+    hasR2sql,
     schema,
     storageRuleBuckets: storageRulesMetadata.rules.map((rule) => rule.bucket),
     useUmbrella,
@@ -775,6 +800,7 @@ const runCodegen = (options) => {
     hasImages,
     hasKv,
     hasPayments,
+    hasR2sql,
     maskMetadata,
     rlsMetadata,
     schema,
@@ -809,6 +835,7 @@ const runCodegen = (options) => {
     hasImages,
     hasKv,
     hasPayments,
+    hasR2sql,
     hasScheduler: studioFeatures.scheduler,
     hasStorage: studioFeatures.storage,
     hasVectors: schema.vectorIndexes.length > 0,

package/dist/packem_shared/{buildOpenApiDocument-yHVN66Xd.mjs → buildOpenApiDocument-Cns1EkCQ.mjs}

@@ -1,4 +1,4 @@
-import { GENERATED_HEADER } from './emitApi-hRVC-kE7.mjs';
+import { GENERATED_HEADER } from './GENERATED_HEADER-DF1hQcix.mjs';
 import { s as sanitizeNamespace } from './paths-BRd6JHuF.mjs';
 import { LUNORA_ERROR_CODES, objectSchema, argsObjectSchema, validatorIrToJsonSchema } from './LUNORA_ERROR_CODES-CySpQPD3.mjs';
 

package/dist/packem_shared/discoverR2sqlCalls-BpDqvcUn.mjs

@@ -0,0 +1,80 @@
+import { Node, SyntaxKind } from 'ts-morph';
+import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall } from './discoverFunctions-DEgAcRuD.mjs';
+
+const handlerOf = (call, receiver) => {
+  if (receiver) {
+    const handler = call.getArguments()[0];
+    return handler && (Node.isArrowFunction(handler) || Node.isFunctionExpression(handler)) ? handler : void 0;
+  }
+  const first = call.getArguments()[0];
+  if (!first || !Node.isObjectLiteralExpression(first)) {
+    return void 0;
+  }
+  const handlerProperty = first.getProperty("handler");
+  if (!handlerProperty || !Node.isPropertyAssignment(handlerProperty)) {
+    return void 0;
+  }
+  const initializer = handlerProperty.getInitializer();
+  return initializer && (Node.isArrowFunction(initializer) || Node.isFunctionExpression(initializer)) ? initializer : void 0;
+};
+const exportedProcedureHandler = (declaration) => {
+  const initializer = declaration.getInitializer();
+  if (!initializer || !Node.isCallExpression(initializer)) {
+    return void 0;
+  }
+  const classified = classifyProcedureCall(initializer);
+  if (!classified || classified.kind !== "query" && classified.kind !== "mutation") {
+    return void 0;
+  }
+  const handler = handlerOf(initializer, classified.receiver);
+  return handler ? { exportName: declaration.getName(), handler, kind: classified.kind } : void 0;
+};
+const r2sqlCalleeOf = (access) => {
+  if (!Node.isPropertyAccessExpression(access) || access.getName() !== "r2sql") {
+    return void 0;
+  }
+  const receiver = access.getExpression();
+  if (!Node.isIdentifier(receiver) || receiver.getText() !== "ctx") {
+    return void 0;
+  }
+  const parent = access.getParent();
+  if (parent && Node.isPropertyAccessExpression(parent) && parent.getExpression() === access) {
+    return `ctx.r2sql.${parent.getName()}`;
+  }
+  return "ctx.r2sql";
+};
+const accessesInHandler = (procedure, file) => {
+  const found = [];
+  for (const access of procedure.handler.getDescendantsOfKind(SyntaxKind.PropertyAccessExpression)) {
+    const callee = r2sqlCalleeOf(access);
+    if (callee !== void 0) {
+      found.push({ callee, exportName: procedure.exportName, file, kind: procedure.kind, line: access.getStartLineNumber() });
+    }
+  }
+  return found;
+};
+const accessesInSourceFile = (sourceFile, relativePath) => {
+  const found = [];
+  for (const statement of sourceFile.getVariableStatements()) {
+    if (!statement.isExported()) {
+      continue;
+    }
+    for (const declaration of statement.getDeclarations()) {
+      const procedure = exportedProcedureHandler(declaration);
+      if (procedure) {
+        found.push(...accessesInHandler(procedure, relativePath));
+      }
+    }
+  }
+  return found;
+};
+const discoverR2sqlCalls = (project, lunoraDirectory) => {
+  const calls = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    calls.push(...accessesInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+  }
+  return calls;
+};
+
+export { discoverR2sqlCalls as default };

package/dist/packem_shared/{emitApp-CzZ6GbrD.mjs → emitApp-Ci_hcJNO.mjs}

@@ -1,4 +1,4 @@
-import { GENERATED_HEADER } from './emitApi-hRVC-kE7.mjs';
+import { GENERATED_HEADER } from './GENERATED_HEADER-DF1hQcix.mjs';
 
 const LONG_TAIL = [
   ["hasAi", "ai", "ai", "Override the Workers AI binding backing `ctx.ai` (defaults to `env.AI`)."],
@@ -13,6 +13,12 @@ const LONG_TAIL = [
   ["hasImages", "images", "images", "Override the Images binding backing `ctx.images` (defaults to `env.IMAGES`)."],
   ["hasKv", "kv", "kv", "Override the Workers KV binding backing `ctx.kv` (defaults to `env.KV`)."],
   ["hasPayments", "payment", "payment", "Wire the payment options backing `ctx.payments`."],
+  [
+    "hasR2sql",
+    "r2sql",
+    "r2sql",
+    "Wire the R2 SQL client backing `ctx.r2sql` — build it with `createR2Sql({ accountId, apiToken, bucket })` (defaults to env `R2_SQL_TOKEN` / `R2_SQL_ACCOUNT_ID` / `R2_SQL_BUCKET`)."
+  ],
   ["hasVectors", "vectors", "vectors", "Wire the Vectorize index map backing `ctx.vectors`."]
 ];
 const hasAnyLongTail = (options) => LONG_TAIL.some(([flag]) => options[flag]);

package/dist/packem_shared/{lintSchema-DicbOHvH.mjs → formatAdvisories-8NIv1k0I.mjs}

@@ -36,7 +36,7 @@ const toAdvisorSchema = (schema) => {
     })
   };
 };
-const lintSchema = (schema, queries = [], inserts, authApiCalls, rlsProcedures, containers, workflows, workflowCalls, maskProcedures, nondeterministicCalls, procedureProtections, argumentValidators, secretLiterals, sqlInterpolations, adminRoutes) => runAdvisor(
+const lintSchema = (schema, queries = [], inserts, authApiCalls, rlsProcedures, containers, workflows, workflowCalls, maskProcedures, nondeterministicCalls, procedureProtections, argumentValidators, secretLiterals, sqlInterpolations, adminRoutes, r2sqlCalls) => runAdvisor(
   {
     adminRoutes,
     argValidators: argumentValidators,
@@ -47,6 +47,7 @@ const lintSchema = (schema, queries = [], inserts, authApiCalls, rlsProcedures,
     nondeterministicCalls,
     procedureProtections,
     queries,
+    r2sqlCalls,
     rlsProcedures,
     schema: toAdvisorSchema(schema),
     secretLiterals,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/codegen",
-  "version": "1.0.0-alpha.2",
+  "version": "1.0.0-alpha.4",
   "description": "Code generator for Lunora: emits _generated/{api,server,dataModel}.ts from your schema",
   "keywords": [
     "cloudflare",
@@ -46,7 +46,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/advisor": "1.0.0-alpha.1",
+    "@lunora/advisor": "1.0.0-alpha.3",
     "@lunora/container": "1.0.0-alpha.1",
     "@lunora/scheduler": "1.0.0-alpha.1",
     "@lunora/values": "1.0.0-alpha.1",