@lunora/codegen 1.0.0-alpha.23 → 1.0.0-alpha.230

package/dist/packem_shared/emit-D_prE7y6.mjs

@@ -0,0 +1,2691 @@
+import{agentComponent as ft}from"@lunora/agent/component";import{LunoraError as Z}from"@lunora/errors";import{serializeSchemaSnapshot as An,hashSchemaSnapshot as On}from"./SCHEMA_SNAPSHOT_VERSION-C0oHwiJZ.mjs";import{d as In}from"./declared-output-Iaar469J.mjs";import{isHyperdriveGlobalTable as Cn,isD1GlobalTable as Dn}from"./isD1GlobalTable-udvHAAzD.mjs";import{s as A}from"./paths-C-9fwEgQ.mjs";import{acceptsAbsentIr as Ln}from"./LUNORA_ERROR_CODES-C2s0xWQD.mjs";const bt=[{contextProperty:"access",key:"access",moduleSpecifier:"@lunora/cloudflare-access",requiredPackage:"@lunora/cloudflare-access"},{appMethod:{configKey:"ai",doc:"Override the Workers AI binding backing `ctx.ai` (defaults to `env.AI`).",method:"ai"},contextProperty:"ai",key:"ai",moduleSpecifier:"@lunora/ai",requiredPackage:"@lunora/ai"},{appMethod:{configKey:"analytics",doc:"Override the Analytics Engine dataset backing `ctx.analytics` (defaults to `env.ANALYTICS`).",method:"analytics"},contextProperty:"analytics",key:"analytics",moduleSpecifier:"@lunora/bindings/analytics",requiredPackage:"@lunora/bindings",serverCtxField:{field:`
+    /** Analytics Engine telemetry sink. Fire-and-forget and sampled; do not read it back in-handler. */
+    readonly analytics: import("@lunora/bindings/analytics").AnalyticsClient;`,tier:"every"}},{appMethod:{configKey:"browser",doc:"Build the `ctx.browser` helper, e.g. `(env) => createBrowser({ binding: env.BROWSER, launch })`. REQUIRED: unlike the binding-backed capabilities, `ctx.browser` is not auto-constructed — without this thunk every method throws, because the generated worker deliberately stays free of the optional `@cloudflare/playwright` peer.",method:"browser"},contextProperty:"browser",key:"browser",moduleSpecifier:"@lunora/browser",requiredPackage:"@lunora/browser",serverCtxField:{field:`
+    /** Browser Rendering (screenshots/PDF/scrape). Non-deterministic — available only in actions. */
+    readonly browser: import("@lunora/browser").Browser;`,tier:"action"}},{contextProperty:"containers",key:"container",moduleSpecifier:"@lunora/container"},{contextProperty:"flags",key:"flags",moduleSpecifier:"@lunora/flags"},{appMethod:{configKey:"sql",doc:"Wire the Hyperdrive SQL client backing `ctx.sql` — build it with `createHyperdrive` + `fromPostgresJs`/`fromNodePg`/`fromMysql2`.",method:"hyperdrive"},contextProperty:"sql",key:"hyperdrive",moduleSpecifier:"@lunora/hyperdrive",requiredPackage:"@lunora/hyperdrive",serverCtxField:{field:`
+    /**
+     * External database access via Hyperdrive. Non-deterministic — available only in actions. Writes here are NOT tracked by Lunora live queries; subscriptions will not re-run on external DB changes.
+     */
+    readonly sql: import("@lunora/hyperdrive").SqlClient;`,tier:"action"}},{appMethod:{configKey:"images",doc:"Override the Images binding backing `ctx.images` (defaults to `env.IMAGES`).",method:"images"},contextProperty:"images",key:"images",moduleSpecifier:"@lunora/bindings/images",requiredPackage:"@lunora/bindings",serverCtxField:{field:`
+    /** Cloudflare Images transforms (resize/format/optimize). Non-deterministic — available only in actions. */
+    readonly images: import("@lunora/bindings/images").Images;`,tier:"action"}},{appMethod:{configKey:"kv",doc:"Override the Workers KV binding backing `ctx.kv` (defaults to `env.KV`).",method:"kv"},contextProperty:"kv",key:"kv",moduleSpecifier:"@lunora/bindings/kv",requiredPackage:"@lunora/bindings",serverCtxField:{field:`
+    readonly kv: import("@lunora/bindings/kv").Kv;`,tier:"every"}},{key:"mail",moduleSpecifier:"@lunora/mail"},{contextProperty:"notify",key:"notify",moduleSpecifier:"@lunora/notify"},{appMethod:{configKey:"payment",doc:"Wire the payment options backing `ctx.payments`.",method:"payment"},contextProperty:"payments",key:"payments",moduleSpecifier:"@lunora/payment",requiredPackage:"@lunora/payment"},{appMethod:{configKey:"x402",doc:"Wire the x402 agent-wallet pay rail backing `ctx.x402` — a payment-enabled `fetch` that answers `402` challenges under a mandatory spend policy (ActionCtx-only; spends real funds).",method:"x402"},contextProperty:"x402",key:"x402",moduleSpecifier:"@lunora/x402/pay",requiredPackage:"@lunora/x402"},{contextProperty:"pipelines",key:"pipelines",moduleSpecifier:"@lunora/bindings/pipelines",requiredPackage:"@lunora/bindings",serverCtxField:{field:`
+    /** Pipelines ingestion sink (durable, R2-backed). Fire-and-forget and batched; do not read it back in-handler. */
+    readonly pipelines: import("@lunora/bindings/pipelines").PipelineClient;`,tier:"action"}},{appMethod:{configKey:"r2sql",doc:"Wire the R2 SQL client backing `ctx.r2sql` — build it with `createR2Sql({ accountId, apiToken, bucket })` (defaults to env `R2_SQL_TOKEN` / `R2_SQL_ACCOUNT_ID` / `R2_SQL_BUCKET`).",method:"r2sql"},contextProperty:"r2sql",key:"r2sql",moduleSpecifier:"@lunora/bindings/r2sql",requiredPackage:"@lunora/bindings",serverCtxField:{field:`
+    /**
+     * R2 SQL over Apache Iceberg tables (window functions, DISTINCT, set operations). Non-deterministic — available only in actions. Reads here are NOT tracked by Lunora live queries.
+     */
+    readonly r2sql: import("@lunora/bindings/r2sql").R2SqlClient;`,tier:"action"}},{contextProperty:"scheduler",key:"scheduler",moduleSpecifier:"@lunora/scheduler"},{contextProperty:"storage",key:"storage",moduleSpecifier:"@lunora/storage"},{appMethod:{configKey:"vectors",doc:"Wire the Vectorize index map backing `ctx.vectors`.",method:"vectors"},contextProperty:"vectors",key:"vectors",moduleSpecifier:"@lunora/bindings/vectors"},{contextProperty:"workflows",key:"workflows",moduleSpecifier:"@lunora/workflow"}],En=bt,_n=new Map(En.flatMap(e=>e.serverCtxField?[[e.key,e.serverCtxField]]:[])),ga=bt.flatMap(e=>"appMethod"in e?[{appMethod:e.appMethod,key:e.key}]:[]),yt=/^(?:"(?:[^"\\]|\\(?:["\\/bfnrt]|u[0-9A-Fa-f]{4}))*"|'[^'\\]*'|-?\d+(?:\.\d+)?|true|false|null)$/u,Pn=new Set(["any","bigint","boolean","date","id","null","number","storage","string","timestamp"]),wt=e=>e.column!==void 0,Mn=(e,t)=>{switch(e){case"bigint":return`if (typeof ${t} !== "bigint") return DEFER;
+`;case"boolean":return`if (typeof ${t} !== "boolean") return DEFER;
+`;case"date":case"number":case"timestamp":return`if (typeof ${t} !== "number" || !Number.isFinite(${t})) return DEFER;
+`;case"null":return`if (${t} !== null) return DEFER;
+`;default:return`if (typeof ${t} !== "string") return DEFER;
+`}},Fn=(e,t)=>e.stringMaxLength===void 0?"":`if (${t}.length > ${String(e.stringMaxLength)}) return DEFER;
+`,Bn=(e,t)=>{const n=e.literalValue?.trim();if(!(n===void 0||!yt.test(n)))return{out:t,pre:`if (${t} !== ${n}) return DEFER;
+`}},ze=(e,t,n)=>{if(!wt(e)&&!(e.unmodelledRefinement||e.sourceText!==void 0)){if(Pn.has(e.kind))return e.kind==="any"?{out:t,pre:""}:{out:t,pre:Mn(e.kind,t)+Fn(e,t)};switch(e.kind){case"array":return qn(e,t,n);case"literal":return Bn(e,t);case"object":return Un(e,t,n);default:return}}},qn=(e,t,n)=>{const{inner:r}=e;if(!r)return;const a=n.next(),o=`__arr${String(a)}`,i=`__i${String(a)}`,s=`__e${String(a)}`,c=ze(r,s,n);if(!c)return;const d=`if (!Array.isArray(${t})) return DEFER;
+const ${o} = new Array(${t}.length);
+for (let ${i} = 0; ${i} < ${t}.length; ${i}++) {
+const ${s} = ${t}[${i}];
+${c.pre}${o}[${i}] = ${c.out};
+}
+`;return{out:o,pre:d}},jn=(e,t,n,r)=>{const a=JSON.stringify(e);if(t.kind==="optional"){if(t.hasRefinement||t.sourceText!==void 0||wt(t))return;const{inner:i}=t;if(!i)return;const s=ze(i,n,r);if(!s)return;const c=r.next(),d=`__has${String(c)}`,h=`__val${String(c)}`,g=`let ${d} = false;
+let ${h};
+if (${n} !== undefined) {
+${s.pre}${h} = ${s.out};
+${d} = true;
+}
+`;return{entry:`...(${d} ? { ${a}: ${h} } : {})`,pre:g}}const o=ze(t,n,r);if(o)return{entry:`${a}: ${o.out}`,pre:o.pre}},Wn=new Set(Object.getOwnPropertyNames(Object.prototype)),kt=(e,t,n)=>{let r="";const a=[];for(const o of Object.keys(e)){const i=e[o];if(!i)return;const s=JSON.stringify(o);let c=`${t}[${s}]`;if(Wn.has(o)){const h=`__f${String(n.next())}`;r+=`const ${h} = Object.hasOwn(${t}, ${s}) ? ${t}[${s}] : undefined;
+`,c=h}const d=jn(o,i,c,n);if(!d)return;r+=d.pre,a.push(d.entry)}return{entries:a.join(", "),pre:r}},xt=e=>{const t=`Object.getPrototypeOf(${e})`;return`if (${t} !== Object.prototype && ${t} !== null) return DEFER;
+`},Un=(e,t,n)=>{const r=e.shape??{},a=kt(r,t,n);if(!a)return;const o=n.next(),i=`__obj${String(o)}`,s=`if (typeof ${t} !== "object" || ${t} === null || Array.isArray(${t})) return DEFER;
+${xt(t)}${a.pre}const ${i} = { ${a.entries} };
+`;return{out:i,pre:s}},Kn=e=>{let t=0;const r=kt(e,"source",{next:()=>(t+=1,t)});if(r)return`(source) => {
+if (typeof source !== "object" || source === null || Array.isArray(source)) return DEFER;
+${xt("source")}${r.pre}return { ${r.entries} };
+}`},I=(e,t)=>`JSON.parse(${JSON.stringify(JSON.stringify(e))}) as ${t}`,S=`// GENERATED by @lunora/codegen — do not edit.
+// Run \`lunora codegen\` to regenerate.
+
+`,se=(e=!1)=>e?{client:"lunorash/client",do:"lunorash/do",flags:"lunorash/flags",server:"lunorash/server",serverDataModel:"lunorash/server/data-model",serverDrizzle:"lunorash/server/drizzle",serverTypes:"lunorash/server/types",values:"lunorash/values"}:{client:"@lunora/client",do:"@lunora/do",flags:"@lunora/flags",server:"@lunora/server",serverDataModel:"@lunora/server/data-model",serverDrizzle:"@lunora/server/drizzle",serverTypes:"@lunora/server/types",values:"@lunora/values"},vt=/^[A-Za-z_$][\w$]*$/u,Qn=/^[\w./-]+$/u,f=(e,t)=>{if(!vt.test(e))throw new Z("INTERNAL",`@lunora/codegen: ${t} is not a valid JS identifier: ${JSON.stringify(e)}`)},Ge=e=>e.charAt(0).toUpperCase()+e.slice(1),W=e=>vt.test(e)?e:JSON.stringify(e),X=e=>e==="__proto__"?`[${JSON.stringify(e)}]`:W(e),Vn={any:"unknown",bigint:"bigint",boolean:"boolean",bytes:"ArrayBuffer",date:"number",geoPoint:"{ lat: number; lng: number }",null:"null",number:"number",storage:"string",string:"string",timestamp:"number"},Hn=e=>{if(e===void 0)return"unknown";if(!yt.test(e))throw new Z("INTERNAL",`@lunora/codegen: v.literal() argument is not a parseable string/number/boolean/null literal: ${JSON.stringify(e)}`);return e},N=e=>e.column?.notNull===!1?`${ht(e)} | null`:ht(e),ht=e=>{const t=Vn[e.kind];if(t!==void 0)return t;switch(e.kind){case"array":return`Array<${e.inner?N(e.inner):"unknown"}>`;case"from":return e.tsType??"unknown";case"id":{const n=e.tableName??"_unknown_";return f(n,"v.id() table name"),`Id<"${n}">`}case"literal":return Hn(e.literalValue);case"object":return e.shape?`{ ${Object.entries(e.shape).map(([r,a])=>St(r,a)).join("; ")} }`:"Record<string, unknown>";case"optional":return`${e.inner?N(e.inner):"unknown"} | undefined`;case"record":{const n=e.keyType?N(e.keyType):"string",r=e.valueType?N(e.valueType):"unknown";return`Record<${n}, ${r}>`}case"union":return e.members&&e.members.length>0?e.members.map(n=>N(n)).join(" | "):"never";default:return"unknown"}},St=(e,t)=>{const n=W(e);if(t.kind==="optional"){const r=t.inner?N(t.inner):"unknown";return`${n}?: ${r}`}return Ln(t)?`${n}?: ${N(t)}`:`${n}: ${N(t)}`},ve=e=>{const t=Object.entries(e);return t.length===0?"{}":`{ ${t.map(([n,r])=>St(n,r)).join("; ")} }`},Rt=e=>e.kind==="optional"||!!e.column?.hasDefault,ie=e=>e.kind==="optional"&&e.inner?e.inner:e,Gn=e=>{f(e.name,"table name");const t=Object.entries(e.shape).map(([r,a])=>{const o=ie(a),i=N(o),s=W(r);return Rt(a)?`    ${s}?: ${i};`:`    ${s}: ${i};`}).join(`
+`),n=t?`
+${t}
+`:"";return`export interface Insert_${e.name} {
+    _id?: Id<"${e.name}">;
+    _creationTime?: number;${n}}`},Je="schema",fa=e=>{for(const u of e.tables)f(u.name,"table name");const t=e.tables.map(u=>`"${u.name}"`).join(" | ")||"never",n=e.tables.filter(u=>u.extensionKey===void 0).map(u=>`"${u.name}"`).join(" | ")||"never",r=e.tables.map(u=>{const l=Object.entries(u.shape).map(([x,v])=>{const $=W(x);if(v.kind==="optional"){const T=v.inner?N(v.inner):"unknown";return`    ${$}?: ${T};`}return`    ${$}: ${N(v)};`}).join(`
+`),b=l?`
+${l}
+`:"",R=u.commitOrdered===!0?`
+    _commitSeq: number;`:"";return`export interface Doc_${u.name} {
+    _id: Id<"${u.name}">;
+    _creationTime: number;${R}${b}}`}).join(`
+
+`),a=e.tables.map(u=>`    ${u.name}: Doc_${u.name};`).join(`
+`),o=e.tables.map(u=>{const l=u.indexes.map(b=>JSON.stringify(b.name)).join(" | ");return`    ${u.name}: ${l||"never"};`}).join(`
+`),i=e.tables.map(u=>{const l=u.searchIndexes.map(b=>JSON.stringify(b.name)).join(" | ");return`    ${u.name}: ${l||"never"};`}).join(`
+`),s=e.tables.map(u=>{const l=u.rankIndexes.map(b=>JSON.stringify(b.name)).join(" | ");return`    ${u.name}: ${l||"never"};`}).join(`
+`),c=e.tables.map(u=>{const l=u.shardMode==="global"?"":(u.geoIndexes??[]).map(b=>JSON.stringify(b.name)).join(" | ");return`    ${u.name}: ${l||"never"};`}).join(`
+`),d=e.vectorIndexes.map(u=>JSON.stringify(u.name)).join(" | ")||"never",h=e.tables.map(u=>Gn(u)).join(`
+
+`),g=e.tables.map(u=>`    ${u.name}: Insert_${u.name};`).join(`
+`),y=e.tables.map(u=>{const l=u.relations.map(b=>(f(b.table,"relation target table"),`        ${W(b.name)}: ${b.kind==="one"?"OneRelation":"ManyRelation"}<"${b.table}">;`)).join(`
+`);return l?`    ${u.name}: {
+${l}
+    };`:`    ${u.name}: {};`}).join(`
+`);return E(`${S}export type TableName = ${t};
+
+/**
+ * The tables **this app declared** — every {@link TableName} except those an add-on
+ * contributed through \`defineSchema(...).extend(...)\`.
+ *
+ * An add-on's tables are real tables and stay in \`TableName\` (they are queryable,
+ * they appear in \`DataModel\`), but an app enumerating "my tables" should not have to
+ * know they exist: an account-deletion sweep, an export, a migration allowlist, or a
+ * helper generic over a table union is about the app's own data, and every add-on
+ * added or removed would otherwise silently change the correct answer.
+ *
+ * \`\`\`ts
+ * // Doesn't need to mention \`ratelimit_buckets\`, and won't drift when an add-on lands.
+ * const EXPORTED: readonly AppTableName[] = ["nodes", "tagColors"];
+ * \`\`\`
+ */
+export type AppTableName = ${n};
+
+export type Id<TName extends string> = string & { readonly __table: TName };
+
+${r}
+
+export interface DataModel {
+${a}
+}
+
+export type Doc<T extends keyof DataModel> = DataModel[T];
+
+/**
+ * Per-table index name union. \`never\` for tables without secondary indexes.
+ * Used by \`TableReader.withIndex()\` to constrain callers to declared names.
+ */
+export interface IndexNamesByTable {
+${o}
+}
+
+export type IndexName<T extends keyof DataModel> = IndexNamesByTable[T];
+
+/** Per-table search-index name union. \`never\` for tables without searchIndex. */
+export interface SearchIndexNamesByTable {
+${i}
+}
+
+export type SearchIndexName<T extends keyof DataModel> = SearchIndexNamesByTable[T];
+
+/** Per-table rank-index name union. \`never\` for tables without a rankIndex. */
+export interface RankIndexNamesByTable {
+${s}
+}
+
+export type RankIndexName<T extends keyof DataModel> = RankIndexNamesByTable[T];
+
+/** Per-table geo-index name union. \`never\` for tables without a geoIndex. */
+export interface GeoIndexNamesByTable {
+${c}
+}
+
+export type GeoIndexName<T extends keyof DataModel> = GeoIndexNamesByTable[T];
+
+/** Union of declared vector index names. \`never\` when none are declared. */
+export type VectorIndexName = ${d};
+
+${h}
+
+/** Per-table insert shape, accepted by \`ctx.db.<table>.insert(...)\`. */
+export interface InsertModel {
+${g}
+}
+
+export type Insert<T extends keyof DataModel> = InsertModel[T];
+
+/**
+ * Phantom relation descriptors. They carry the relation kind and target table
+ * as type parameters only — there is no runtime value — so the \`with\` argument
+ * and its return type can be inferred from {@link Relations}.
+ */
+export interface OneRelation<Target extends keyof DataModel> {
+    readonly __relationKind: "one";
+    readonly __target: Target;
+}
+
+export interface ManyRelation<Target extends keyof DataModel> {
+    readonly __relationKind: "many";
+    readonly __target: Target;
+}
+
+/** Per-table relation map keyed by accessor name. \`{}\` for tables with none. */
+export interface Relations {
+${y}
+}
+
+`,Je)},zn=/import\("(?<spec>(?:\.\.?\/)*_generated\/[^"]+)"\)/gu,$t=/^(?:\.\.?\/)*_generated\//u,Tt=/\.[A-Za-z]\w*$/u,Jn=e=>e.replaceAll(zn,(t,n)=>{const r=n.replace($t,"./");return`import("${Tt.test(r)?r:`${r}.js`}")`}),Yn=/import\("(?<spec>[^"]+)"\)/gu,pt="node_modules/",Xn=/^@types\//u,Zn=e=>e.replaceAll(Yn,(t,n)=>{const r=n.lastIndexOf(pt);if(r===-1||r>0&&n[r-1]!=="/")return t;const a=n.slice(r+pt.length);return a===""||Xn.test(a)?t:`import("${a}")`}),er=/import\("(?<spec>\.\.?\/[^"]+)"\)/gu,tr=/^(?:\.\.?\/)+/u,nr=e=>{const t=[];for(const n of e.split("/"))if(!(n===""||n===".")){if(n===".."&&t.length>0&&t.at(-1)!==".."){t.pop();continue}t.push(n)}return t.join("/")},rr=(e,t)=>e.replaceAll(er,(n,r)=>{if($t.test(r.replace(tr,"")))return n;const a=t.includes("/")?t.slice(0,t.lastIndexOf("/")):"",i=`../${nr(`${a}/${r}`)}`;return`import("${Tt.test(i)?i:`${i}.js`}")`}),E=(e,t)=>Jn(rr(Zn(e),t)),ar=["client","do","errors","flags","observability","platform","ratelimit","runtime","server","values"],or=new RegExp(String.raw`import\("@lunora/(?<pkg>${ar.join("|")})(?<subpath>/[^"]*)?"\)`,"gu"),sr={flags:new Set(["/web"]),platform:new Set},Nt=(e,t)=>t?e.replaceAll(or,(n,r,a)=>{const o=sr[r];return a&&o&&!o.has(a)?n:`import("lunorash/${r}${a??""}")`}):e,Ye=e=>["Doc","Id"].filter(t=>new RegExp(String.raw`(?<![.$\w])${t}<`,"u").test(e)),At=e=>In(e)?N(e.output):e.returnType,Xe=e=>{const t=new Map;for(const n of e){const r=t.get(n.filePath)??[];r.push(n),t.set(n.filePath,r)}return[...t.entries()].toSorted(([n],[r])=>n.localeCompare(r))},mt=e=>{const t=([n,r])=>{const a=r.toSorted((o,i)=>o.exportName.localeCompare(i.exportName)).map(o=>{const i=E(ve(o.args),o.filePath),s=E(At(o),o.filePath);return`        ${o.exportName}: FunctionReference<"${o.kind}", ${i}, ${s}>;`}).join(`
+`);return`    ${W(A(n))}: {
+${a}
+    };`};return Xe(e).map(n=>t(n)).join(`
+`)},ir=(e,t)=>{if(e.length===0&&t.length===0)return{block:"",importLine:""};const n=[];let r="";if(e.length>0&&(r+="\n/** Params type carried by a `defineWorkflow` definition (its phantom `__params`). */\ntype WorkflowParamsOf<Definition> = Definition extends { __params?: infer Params } ? (unknown extends Params ? Record<string, unknown> : Params) : Record<string, unknown>;\n"),r+=`
+/** A typed reference to a durable workflow, addressable for \`cronJobs()\` targets. Mirrors \`@lunora/scheduler\`'s \`WorkflowReference\` structurally. */
+export interface WorkflowReference<Params = Record<string, unknown>> {
+    readonly isLunoraWorkflow: true;
+    readonly __params?: Params;
+    readonly binding: string;
+    readonly name: string;
+}
+`,e.length>0){const a=[...e].toSorted((s,c)=>s.exportName.localeCompare(c.exportName)),o=a.map(s=>`    ${s.exportName}: WorkflowReference<WorkflowParamsOf<typeof lunoraWorkflowDefinitions.${s.exportName}>>;`).join(`
+`),i=a.map(s=>`    ${X(s.exportName)}: { isLunoraWorkflow: true, binding: ${JSON.stringify(s.bindingName)}, name: ${JSON.stringify(s.exportName)} },`).join(`
+`);r+=`
+/** This project's durable workflows, addressable as typed references (e.g. \`crons.daily("digest", …, workflows.digestPipeline, params)\`). */
+export interface WorkflowsRef {
+${o}
+}
+
+export const workflows: WorkflowsRef = {
+${i}
+};
+`,n.push(`import type * as lunoraWorkflowDefinitions from "../workflows.js";
+`)}if(t.length>0){const a=[...t].toSorted((s,c)=>s.exportName.localeCompare(c.exportName)),o=a.map(s=>`    ${s.exportName}: WorkflowReference<AgentRunInput>;`).join(`
+`),i=a.map(s=>`    ${X(s.exportName)}: { isLunoraWorkflow: true, binding: ${JSON.stringify(s.bindingName)}, name: ${JSON.stringify(s.name)} },`).join(`
+`);r+=`
+/** This project's durable agents, addressable as typed references for \`cronJobs()\` — each fire starts a fresh agent run (e.g. \`crons.daily("sweep", …, agents.support, { input, threadKey })\`). */
+export interface AgentsRef {
+${o}
+}
+
+export const agents: AgentsRef = {
+${i}
+};
+`,n.push(`import type { AgentRunInput } from "@lunora/agent";
+`)}return{block:r,importLine:n.join("")}},lr=()=>Object.keys(ft().functions).toSorted((e,t)=>e.localeCompare(t)),Ot=e=>new Set(e.filter(t=>A(t.filePath)==="agents").map(t=>t.exportName)),cr=()=>new Set(Object.entries(ft().functions).filter(([,e])=>e.visibility==="internal").map(([e])=>e)),dr=(e,t)=>{const n={importLine:"",lines:"",prelude:""};if(e.length===0)return n;const r=Ot(t),a=cr(),o=t.find(s=>A(s.filePath)==="agents"&&a.has(s.exportName));if(o)throw new Z("INTERNAL",`@lunora/codegen: "agents:${o.exportName}" is reserved for the durable agent loop's internal dispatch — rename the "${o.exportName}" export in ${o.filePath}`);const i=lr().filter(s=>!r.has(s));return i.length===0?n:{importLine:`import { agentComponent } from "@lunora/agent/component";
+`,lines:i.map(s=>`    "agents:${s}": lunoraAgentRuntimeFunctions.${s} as unknown as RegisteredLunoraFunction,`).join(`
+`),prelude:`
+/**
+ * The \`@lunora/agent\` runtime component — auto-registered because \`lunora/agents.ts\`
+ * declares agents. The durable loop dispatches the internal mutations; clients
+ * subscribe to the public queries (\`agents:agentMessages\` is the live thread view).
+ */
+const lunoraAgentRuntimeFunctions = agentComponent().functions;
+`}},ur=(e,t)=>{if(!e)return{importLine:"",lines:"",prelude:""};const n=t.find(r=>A(r.filePath)==="sandbox"&&r.exportName==="invoke");if(n)throw new Z("INTERNAL",`@lunora/codegen: "sandbox:invoke" is reserved for the batteries-included sandbox tool dispatcher (browserTool/containerTool) — rename the "invoke" export in ${n.filePath}`);return{importLine:`import { sandboxComponent } from "@lunora/agent/component";
+`,lines:'    "sandbox:invoke": lunoraSandbox.invoke as unknown as RegisteredLunoraFunction,',prelude:"\n/**\n * The `@lunora/agent` sandbox dispatcher — auto-registered because `lunora/`\n * imports a sandbox tool (`browserTool`/`containerTool`). The batteries-included\n * tools dispatch to this internal action, which runs on an action ctx carrying\n * `ctx.browser` + `ctx.containers` (the durable tool step itself has neither).\n */\nconst lunoraSandbox = sandboxComponent();\n"}},hr=(e,t)=>{if(e.length===0)return[];const n=Ot(t),r=[{args:{key:{kind:"string"},limit:{inner:{kind:"number"},kind:"optional"}},exportName:"agentMessages",filePath:"agents",kind:"query",returnType:"Record<string, unknown>[]"},{args:{decision:{kind:"union",members:[{kind:"literal",literalValue:'"approve"'},{kind:"literal",literalValue:'"reject"'}]},instanceId:{kind:"string"},note:{inner:{kind:"string"},kind:"optional"},threadKey:{kind:"string"},toolCallId:{kind:"string"}},exportName:"agentResolveApproval",filePath:"agents",kind:"mutation",returnType:"{ resolved: boolean }"},{args:{agent:{kind:"string"},input:{kind:"string"},threadKey:{kind:"string"},title:{inner:{kind:"string"},kind:"optional"}},exportName:"agentRun",filePath:"agents",kind:"mutation",returnType:"{ id: string; threadKey: string }"},{args:{key:{kind:"string"}},exportName:"agentState",filePath:"agents",kind:"query",returnType:"Record<string, unknown> | undefined"},{args:{key:{kind:"string"}},exportName:"agentThread",filePath:"agents",kind:"query",returnType:"Record<string, unknown> | undefined"}];for(const a of e)a.voice&&r.push({args:{threadKey:{kind:"string"}},exportName:`${a.exportName}Voice`,filePath:"agents",kind:"stream",returnType:"Record<string, unknown>"});return r.filter(a=>!n.has(a.exportName))},pr=(e,t)=>{if(e.length===0)return[];const n=new Set(t.filter(r=>A(r.filePath)==="mutators").map(r=>r.exportName));return e.filter(r=>!n.has(r.exportName)).map(r=>({args:r.args,exportName:r.exportName,filePath:r.filePath,kind:"mutation",returnType:r.returnType}))},mr=e=>{const t=e.filter(i=>i.stream);if(t.length===0)return{block:"",body:""};const n=Xe(t),r=n.map(([i,s])=>{const c=s.map(d=>{const h=E(d.chunkType??"unknown",d.filePath),g=E(ve(d.searchParams),d.filePath),y=E(ve(d.params),d.filePath);return`        ${W(d.exportName)}: HttpStreamRef<${h}, ${g}, ${y}>;`}).join(`
+`);return`    ${W(A(i))}: {
+${c}
+    };`}).join(`
+`),a=n.map(([i,s])=>{const c=s.map(d=>`        ${X(d.exportName)}: { method: ${JSON.stringify(d.method)}, path: ${JSON.stringify(d.path)} },`).join(`
+`);return`    ${X(A(i))}: {
+${c}
+    },`}).join(`
+`);return{block:`
+/** This project's HTTP-SSE stream routes (\`httpRoute.<verb>(path).stream()\`), addressable as typed references for \`client.httpStream\` / \`useHttpStream\`. */
+export interface HttpStreamsRef {
+${r}
+}
+
+export const httpStreams: HttpStreamsRef = {
+${a}
+};
+`,body:r}},ba=e=>{const{agents:t=[],functions:n,httpRoutes:r=[],mutators:a=[],useUmbrella:o=!1,workflows:i=[]}=e,s=se(o),c=[...n.filter(O=>O.visibility!=="internal"),...hr(t,n),...pr(a,n)],d=n.filter(O=>O.visibility==="internal"),h=mt(c),g=mt(d),y=mr(r),u=`${h}
+${g}
+${y.body}`,l=Ye(u),b=l.length>0?`
+import type { ${l.join(", ")} } from "./dataModel.js";
+`:"",R=h?`
+${h}
+`:"",x=g?`
+${g}
+`:"",v=ir(i,t),$=`export interface ApiTypes {${R}}
+
+export const api = anyApi as unknown as ApiTypes;
+
+/** Internal functions — callable only server-side via \`ctx.run*\`, never from a client. */
+export interface InternalApiTypes {${x}}
+
+export const internal = anyApi as unknown as InternalApiTypes;
+${v.block}${y.block}`,T=[...$.includes("FunctionReference<")?["FunctionReference"]:[],...y.block===""?[]:["HttpStreamRef"]],H=T.length>0?`import type { ${T.join(", ")} } from "${s.client}";
+`:"";return Nt(`${S}import { anyApi } from "${s.client}";
+${H}${v.importLine}${b}
+${$}`,o)},ya=e=>e?`${S}import { createSeedClient as createSeedClientBase } from "@lunora/seed";
+import type { SeedClient, SeedClientOptions } from "@lunora/seed";
+
+import schema from "../schema.js";
+import type { InsertModel } from "./dataModel.js";
+
+/**
+ * Schema-aware seed client with this project's \`InsertModel\` and runtime schema
+ * pre-bound. Each table is a method; call it with a count, a range, explicit
+ * partial rows, or per-field overrides. Foreign keys connect to rows seeded
+ * earlier in the run, and FK-parent tables are seeded automatically.
+ * @example
+ * const seed = createSeedClient({ seed: 1 });
+ * const { users } = await seed.users(5);
+ * const { posts } = await seed.posts((x) => x([10, 20]));
+ */
+export const createSeedClient = (options?: SeedClientOptions): SeedClient<InsertModel> => createSeedClientBase<InsertModel>(schema, options);
+`:"",wa=(e,t,n=!1)=>{if(e.length===0||!t)return"";const r=se(n),a=c=>c.table===void 0?"Row":`Doc<${JSON.stringify(c.table)}> & Row`,o=e.map(c=>{f(c.exportName,"shape export name");const d=a(c),h=E(ve(c.args),c.filePath),g=Object.keys(c.args).length>0,y=g?`        args: ${h};`:`        args?: ${h};`,u=g?`(args: ${h}) => void`:`(args?: ${h}) => void`,l=`${c.exportName}CollectionOptions`;return`/** Options for the \`${c.exportName}\` shape binding. */
+export interface ${Ge(l)} {
+${y}
+    /**
+     * Share the optimistic-overlay gate with other collections + mutators on this
+     * shard. Defaults to the shared per-shard registry, which is almost always what
+     * you want — pass one only to isolate this collection's gate.
+     */
+    checkpoints?: CheckpointRegistry;
+    /** The Lunora client to subscribe through. */
+    client: LunoraClient;
+    /** Row key extractor — defaults to \`row._id\`. Override when the app keys rows by a natural column. */
+    getKey?: (row: ${d}) => string;
+    /** \`"eager"\` starts syncing at creation; \`"lazy"\` (default) on the first subscriber. */
+    load?: "eager" | "lazy";
+    /** Notified when the underlying subscription errors; the collection always leaves \`loading\`. */
+    onError?: (error: SubscriptionError) => void;
+    /** Routes the subscription to a shard's DO. **Required for a \`.shardBy()\` table** — without it the watermark lands in the default bucket. */
+    shardKey?: string;
+}
+
+/**
+ * Collection options for the \`${c.exportName}\` replication shape: \`config\` for
+ * \`createCollection\`, plus the \`checkpoints\` registry to hand \`bindMutators\` and
+ * \`scope\` to re-point the subscription.
+ */
+export const ${c.exportName}CollectionOptions = (options: ${Ge(l)}): LunoraCollectionOptions<${d}> =>
+    lunoraCollectionOptions<${d}>({
+        client: options.client,
+        ...(options.checkpoints === undefined ? {} : { checkpoints: options.checkpoints }),
+        ...(options.getKey === undefined ? {} : { getKey: options.getKey }),
+        ...(options.load === undefined ? {} : { load: options.load }),
+        ...(options.onError === undefined ? {} : { onError: options.onError }),
+        ...(options.shardKey === undefined ? {} : { shardKey: options.shardKey }),
+        shape: { args: options.args, name: ${JSON.stringify(c.exportName)}, ...(options.shardKey === undefined ? {} : { shardKey: options.shardKey }) },
+    });
+
+/** Live collection for the \`${c.exportName}\` shape, with its sync controls. */
+export const ${c.exportName}Collection = (
+    options: ${Ge(l)},
+): { checkpoints: CheckpointRegistry; collection: Collection<${d}, string>; scope: ${u} } => {
+    const { checkpoints, config, scope } = ${c.exportName}CollectionOptions(options);
+
+    return { checkpoints, collection: createCollection(config), scope };
+};`}).join(`
+
+`),i=Ye(o),s=i.length>0?`import type { ${i.join(", ")} } from "./dataModel.js";
+`:"";return`${S}import type { LunoraClient, SubscriptionError } from "${r.client}";
+import { lunoraCollectionOptions } from "@lunora/db/collections";
+import type { CheckpointRegistry, LunoraCollectionOptions, Row } from "@lunora/db";
+import type { Collection } from "@tanstack/db";
+import { createCollection } from "@tanstack/db";
+${s}
+${o}
+`},gr=(e,t)=>`lunora_${A(e)}_${String(t)}`,fr=`const callRegistered = async <R>(context: CallerCtx, functionPath: string, args: Record<string, unknown> | undefined): Promise<R> => {
+    const registered = LUNORA_FUNCTIONS[functionPath];
+
+    if (!registered) {
+        throw new LunoraError("FUNCTION_NOT_FOUND", \`function not registered: \${functionPath}\`);
+    }
+
+    // A mutation is routed through the caller's own \`ctx.runMutation\` rather than
+    // invoked directly, so \`createCaller(ctx).ns.someMutation()\` gets exactly what
+    // \`ctx.runMutation(api.ns.someMutation)\` gets: the BEGIN/COMMIT span (or the
+    // enclosing one, when the caller is already inside a transaction), the jobs it
+    // schedules held until that span commits, and the deferred object deletes
+    // flushed only once it has. Called straight, a mutation composed from an action
+    // or a stream had none of the three — its writes autocommitted one row at a
+    // time and its \`ctx.scheduler\` calls dispatched immediately, so a mid-handler
+    // throw left the earlier writes durable and the job already enqueued.
+    //
+    // The fallback covers a context that is not a shard dispatch (\`runMutation\` is
+    // installed by \`buildCtx\` on every kind but a query's TYPE omits it); there is
+    // no transaction to join in that case, so a direct call is all there is.
+    if (registered.kind === "mutation") {
+        const { runMutation } = context as { runMutation?: (reference: { __lunoraRef: string }, args: Record<string, unknown>) => Promise<unknown> };
+
+        if (typeof runMutation === "function") {
+            return (await runMutation.call(context, { __lunoraRef: functionPath }, args ?? {})) as R;
+        }
+    }
+
+    return (await registered.handler(context, args ?? {})) as R;
+};`,br=(e,t,n=[],r=[])=>{const a=new Map,o=l=>{a.has(l)||a.set(l,gr(l,a.size))};for(const l of e)o(l.filePath);for(const l of t)o(l.filePath);for(const l of n)o(l.filePath);for(const l of r)o(l.filePath);const i=[...a.entries()].map(([l,b])=>{if(!Qn.test(l))throw new Z("INTERNAL",`@lunora/codegen: refusing to emit import for unsafe file path: ${JSON.stringify(l)}`);return`import * as ${b} from "../${l}.js";`}).join(`
+`),s=e.map(l=>`    "${A(l.filePath)}:${l.exportName}": ${a.get(l.filePath)??""}.${l.exportName} as unknown as RegisteredLunoraFunction,`).join(`
+`),c=t.map(l=>`    ${JSON.stringify(l.id)}: ${a.get(l.filePath)??""}.${l.exportName} as unknown as RegisteredDataMigration,`).join(`
+`),d=n.map(l=>`    "${A(l.filePath)}:${l.exportName}": ${a.get(l.filePath)??""}.${l.exportName} as unknown as RegisteredLunoraFunction,`).join(`
+`),h=r.map(l=>`    "${l.exportName}": ${a.get(l.filePath)??""}.${l.exportName} as unknown as RegisteredShape,`).join(`
+`),g=n.map(l=>`${A(l.filePath)}:${l.exportName}`),y=[s,d].filter(l=>l.length>0).join(`
+`),u=e.map(l=>{if(l.lifecycle||Object.keys(l.args).length===0)return;const b=Kn(l.args);return b===void 0?void 0:`installCompiledValidatorMap(${a.get(l.filePath)??""}.${l.exportName}.args, ${b});`}).filter(l=>l!==void 0).join(`
+`);return{dispatchBody:y.length>0?`
+${y}
+`:"",importBlock:i.length>0?`${i}
+
+`:"",installBlock:u,migrationBody:c.length>0?`
+${c}
+`:"",mutatorPaths:g,shapeBody:h.length>0?`
+${h}
+`:""}},yr=e=>{const t=Xe(e),n=t.map(([a,o])=>{const i=o.map(s=>{const c=E(ve(s.args),s.filePath),d=c==="{}"?"?":"",h=E(At(s),s.filePath);return s.kind==="stream"?`        ${s.exportName}: (args${d}: ${c}) => Promise<AsyncIterable<${h}>>;`:`        ${s.exportName}: (args${d}: ${c}) => Promise<${h}>;`}).join(`
+`);return`    ${W(A(a))}: {
+${i}
+    };`}).join(`
+`);return{implementation:t.map(([a,o])=>{const i=A(a),s=o.map(c=>`        ${X(c.exportName)}: (args) => callRegistered(context, "${i}:${c.exportName}", args),`).join(`
+`);return`    ${X(i)}: {
+${s}
+    },`}).join(`
+`),types:n}},wr=(e,t=[])=>{const n=new Set;for(const r of e.tables)for(const a of Object.values(r.shape)){const o=ie(a);o.kind==="storage"&&typeof o.bucket=="string"&&o.bucket!==""&&n.add(o.bucket)}for(const r of t)r!==""&&r!=="default"&&n.add(r);return["default",...[...n].toSorted((r,a)=>r.localeCompare(a))]},ka=({agents:e=[],containers:t=[],env:n,hasAccessFacade:r=!1,hasAi:a=!1,hasAnalytics:o=!1,hasBrowser:i=!1,hasVectors:s=!0,hasFlags:c=!1,hasHyperdrive:d=!1,hasImages:h=!1,hasKv:g=!1,hasNotify:y=!1,hasPayments:u=!1,hasPipelines:l=!1,hasR2sql:b=!1,hasX402:R=!1,identity:x,queues:v=[],schema:$,storageRuleBuckets:T=[],useUmbrella:H=!1,workflows:O=[]}={})=>{const D=se(H),k=wr($??{tables:[]},T).map(p=>JSON.stringify(p)).join(" | "),F=a?`import type { LunoraAi } from "@lunora/ai";
+`:"",B=a?`
+    readonly ai: LunoraAi;`:"",le=u?`import type { LunoraPayment } from "@lunora/payment";
+`:"",ce=u?`
+    readonly payments: LunoraPayment;`:"",ee=R?`import type { X402Pay } from "@lunora/x402/pay";
+`:"",G=R?`
+    readonly x402: X402Pay;`:"",L=t.length>0?`import type { ContainerAccessor } from "@lunora/container";
+`:"",te=t.length>0?`
+    readonly containers: {${t.map(p=>`
+        readonly ${p.exportName}: ContainerAccessor;`).join("")}
+    };`:"",w=[...a?["    /** Workers AI binding (the conventional `env.AI`), narrowing `ctx.ai`. */\n    readonly AI?: unknown;"]:[],...t.map(p=>(f(p.bindingName,`container binding "${p.bindingName}"`),`    /** Durable Object namespace for the \`${p.exportName}\` container. */
+    readonly ${p.bindingName}?: unknown;`)),...O.map(p=>(f(p.bindingName,`workflow binding "${p.bindingName}"`),`    /** Workflow binding for the \`${p.exportName}\` workflow. */
+    readonly ${p.bindingName}?: unknown;`)),...v.map(p=>(f(p.bindingName,`queue binding "${p.bindingName}"`),`    /** Queue producer binding for the \`${p.exportName}\` queue. */
+    readonly ${p.bindingName}?: unknown;`)),...e.map(p=>(f(p.bindingName,`agent binding "${p.bindingName}"`),`    /** Workflow binding for the \`${p.exportName}\` agent. */
+    readonly ${p.bindingName}?: unknown;`))].join(`
+`),Oe=`
+
+/**
+ * This project's Cloudflare bindings, as far as codegen can discover them from
+ * \`lunora/\` source — the container/workflow Durable Object namespaces and the
+ * conventional Workers AI binding. Bindings the config layer reconciles from
+ * user-named wrangler config (R2/KV/D1/\`services\`/queues/…) aren't statically
+ * visible here, so the open index signature keeps them reachable (cast at the
+ * use site). Service bindings (\`env.<SERVICE>.fetch(...)\` / RPC stubs) live
+ * under this signature too — Lunora can't type a third-party worker's RPC
+ * surface, so treat them as \`Fetcher\`/\`Service<unknown>\` and cast.
+ */
+export interface CloudflareBindings {
+    readonly [binding: string]: unknown;${w?`
+${w}`:""}
+}
+
+/** Alias for {@link CloudflareBindings} — the typed shape of \`env\`. */
+export type Env = CloudflareBindings;`,q=(p,Ue,Ne)=>{const ae=_n.get(p);if(ae!==void 0&&ae.tier!==Ne)throw new Z("INTERNAL",`@lunora/codegen: capability "${p}" declares tier "${ae.tier}" in SERVER_CTX_FIELDS but is emitted onto the "${Ne}" context — update whichever is wrong.`);return Ue?ae?.field??"":""},de=q("kv",g,"every"),ue=q("analytics",o,"every"),Ie=q("hyperdrive",d,"action"),Ce=q("browser",i,"action"),De=q("images",h,"action"),he=q("pipelines",l,"action"),z=q("r2sql",b,"action"),P=s&&($?.vectorIndexes.length??0)>0,J=P?' | "vectors"':"",ne=P?`
+    readonly vectors: VectorSearch<VectorIndexName>;`:"",pe=P?`
+    readonly vectors: VectorSearchReader<VectorIndexName>;`:"",Y=P?`import type { VectorSearch, VectorSearchReader } from "${D.server}";
+import type { VectorIndexName } from "./dataModel.js";
+`:"",U=r?`
+    /** Verified Cloudflare Access identity — a synchronous facade over the resolved claims (email / groups / hasGroup / claims). Anonymous when no Access token is present. */
+    readonly access: import("@lunora/cloudflare-access/context").AccessFacade;`:"",K=c?`
+    /** Feature-flag evaluation (OpenFeature). Reads are memoized per request; evaluations never throw — a provider error resolves to the supplied default. */
+    readonly flags: import("${D.flags}").LunoraFlags;`:"",Q=y?`
+    /** Multi-channel notifications (@lunora/notify): send / chat / inApp / webhook plus the push device sub-facade. Sends are external I/O — confine them to action handlers. */
+    readonly notify: import("@lunora/notify").LunoraNotify;
+    /** Device push sub-facade — the same object as ctx.notify.push (register / send / broadcast). Sends belong in action handlers. */
+    readonly push: import("@lunora/notify").LunoraPush;`:"",j=O.length>0,re=j?`import type { WorkflowHandle } from "@lunora/workflow";
+import type * as lunoraWorkflowDefinitions from "../workflows.js";
+`:"",Le=j?`
+
+/** Params type carried by a \`defineWorkflow\` definition (its phantom \`__params\`). */
+type WorkflowParamsOf<Definition> = Definition extends { __params?: infer Params }
+    ? unknown extends Params
+        ? Record<string, unknown>
+        : NonNullable<Params>
+    : Record<string, unknown>;
+
+/** This project's declared workflows, addressable from \`ctx.workflows\` by their \`lunora/workflows.ts\` export name. */
+export interface LunoraWorkflows {
+${O.map(p=>`    get(name: ${JSON.stringify(p.exportName)}): WorkflowHandle<WorkflowParamsOf<typeof lunoraWorkflowDefinitions.${p.exportName}>>;`).join(`
+`)}
+}`:"",Se=j?' | "workflows"':"",Re=j?`
+    readonly workflows: LunoraWorkflows;`:"",me=v.length>0,Ee=me?`import type { QueueProducer } from "@lunora/queue";
+import type * as lunoraQueueDefinitions from "../queues.js";
+`:"",_e=me?`
+
+/** Message body type carried by a \`defineQueue\` definition (its phantom \`__lunoraBody\`). */
+type QueueBodyOf<Definition> = Definition extends { __lunoraBody?: infer Body } ? (unknown extends Body ? unknown : NonNullable<Body>) : unknown;
+
+/** This project's declared queues, addressable from \`ctx.queues\` by their \`lunora/queues.ts\` export name. */
+export interface LunoraQueues {
+${v.map(p=>`    readonly ${p.exportName}: QueueProducer<QueueBodyOf<typeof lunoraQueueDefinitions.${p.exportName}>>;`).join(`
+`)}
+}`:"",$e=me?`
+    readonly queues: LunoraQueues;`:"",ge=e.length>0,Pe=ge?`import type { AgentHandle } from "@lunora/agent";
+`:"",Me=ge?`
+
+/** This project's declared agents, addressable from \`ctx.agents\` by their \`lunora/agents.ts\` export name. */
+export interface LunoraAgents {
+${e.map(p=>(f(p.exportName,`agent export "${p.exportName}"`),`    readonly ${p.exportName}: AgentHandle;`)).join(`
+`)}
+}`:"",Te=ge?`
+    readonly agents: LunoraAgents;`:"",Fe=x?`import type { InferIdentity } from "${D.server}";
+import type * as lunoraIdentityContract from "../identity.js";
+`:"",Be=x?`
+
+/** This app's declared identity claim contract (\`defineIdentity\` in \`lunora/identity.ts\`) — the typed shape of \`ctx.auth.getIdentity()\`, the RLS policy \`ctx.auth.identity\`, and the \`authorizeShard\`/\`authorizeFanOut\` identity argument. */
+export type Identity = InferIdentity<typeof lunoraIdentityContract.${x.exportName}>;
+
+/** \`ctx.auth\` narrowed so \`getIdentity()\` resolves the declared {@link Identity} contract instead of the untyped claim bag. */
+type NarrowedAuth = Omit<QueryCtxBase["auth"], "getIdentity"> & { getIdentity: () => Promise<Identity | null> };`:"",fe=x?' | "auth"':"",be=x?`
+    readonly auth: NarrowedAuth;`:"",qe=x?", Identity":"",je=n?`import type * as lunoraEnvContract from "../env.js";
+`:"",We=n?`
+
+/** This app's declared env contract (\`defineEnv\` in \`lunora/env.ts\`) — the validated, coercion-aware shape of \`ctx.env\`. */
+export type LunoraEnv = ReturnType<typeof lunoraEnvContract.${n.exportName}>;`:"",ye=n?' | "env"':"",we=n?"\n    /** Validated, typed environment declared by `defineEnv` in `lunora/env.ts` — parsed & coercion-aware config values (`ctx.env.STRIPE_KEY`); a missing or invalid value throws at read time. */\n    readonly env: LunoraEnv;":"";return`${S}import { createPolicyDsl, defineMutator as defineMutatorBase, initLunora, v as vBase } from "${D.server}";
+import type {
+    ActionBuilder,
+    ActionCtx as ActionCtxBase,
+    ColumnValidator,
+    DatabaseReader,
+    DatabaseWriter,
+    EmptyArgs,
+    InternalActionBuilder,
+    InternalMutationBuilder,
+    InternalQueryBuilder,
+    MutationBuilder,
+    MutationCtx as MutationCtxBase,
+    MutationStorage,
+    MutatorDefinition,
+    QueryBuilder,
+    QueryCtx as QueryCtxBase,
+    ReadOnlyStorage,
+    RegisteredMutator,
+    Storage as StorageBase,
+    TableReader,
+    Validator,
+} from "${D.server}";
+
+import type {
+    DatabaseReaderFacade as DatabaseReaderFacadeOf,
+    DatabaseWriterFacade as DatabaseWriterFacadeOf,
+    LoadWith as LoadWithOf,
+    TableReaderFacade as TableReaderFacadeOf,
+    TableWriterFacade as TableWriterFacadeOf,
+    WithArg as WithArgOf,
+} from "${D.serverDataModel}";
+
+export type {
+    AggregateOp,
+    GroupByEntry,
+    OrderBy,
+    QueryArgs,
+    QueryPage,
+    RankPage,
+    RankResult,
+    RestrictableQueryOptions,
+    RestrictableQueryOptionsOf,
+    SearchFilterBuilder,
+    SearchReader,
+    TableAggregateOptions,
+    TableAggregateOptionsOf,
+    TableGroupByOptions,
+    TableGroupByOptionsOf,
+    TableRankOptions,
+    TableRankPageOptions,
+    Where,
+    WhereOf,
+    WhereOperators,
+} from "${D.serverDataModel}";
+
+import type { DataModel, Doc, GeoIndexNamesByTable, Id as IdOfTable, IndexNamesByTable, Insert, InsertModel, RankIndexNamesByTable, Relations, SearchIndexNamesByTable, TableName } from "./dataModel.js";
+${Y}${F}${le}${ee}${L}${re}${Ee}${Pe}${Fe}${je}
+export type { AppTableName, DataModel, Doc, Id, TableName } from "./dataModel.js";
+
+/**
+ * The query-DSL bindings: \`@lunora/server/data-model\`'s generics parameterized
+ * over this project's \`DataModel\` / \`InsertModel\` / \`Relations\` / index maps.
+ *
+ * They live here rather than in \`dataModel.ts\` because they are the half that
+ * needs the SERVER package. Keeping \`dataModel.ts\` free of it lets a sibling
+ * package — a web app, another Worker — compile \`api.ts\` for its \`Doc\`/\`Id\`
+ * types without installing a server dependency to do it.
+ */
+
+/** The \`with\` argument for table \`T\` — see \`@lunora/server/data-model\`. */
+export type WithArg<T extends keyof DataModel> = WithArgOf<DataModel, Relations, T>;
+
+/** \`Doc<T>\` narrowed to exactly the relations requested in the with-arg \`W\`. */
+export type LoadWith<T extends keyof DataModel, W> = LoadWithOf<DataModel, Relations, T, W>;
+
+/** Read-only typed table accessor exposed on \`QueryCtx.db.<table>\`. */
+export type TableReaderFacade<T extends keyof DataModel> = TableReaderFacadeOf<DataModel, Relations, RankIndexNamesByTable, SearchIndexNamesByTable, T, GeoIndexNamesByTable>;
+
+/** Read-write typed table accessor exposed on \`MutationCtx.db.<table>\` / \`ActionCtx.db.<table>\`. */
+export type TableWriterFacade<T extends keyof DataModel> = TableWriterFacadeOf<DataModel, InsertModel, Relations, RankIndexNamesByTable, SearchIndexNamesByTable, T, GeoIndexNamesByTable>;
+
+/** Per-table read facade — \`ctx.db.<table>\` on a \`QueryCtx\`. */
+export type DatabaseReaderFacade = DatabaseReaderFacadeOf<DataModel, Relations, RankIndexNamesByTable, SearchIndexNamesByTable, GeoIndexNamesByTable>;
+
+/** Per-table read-write facade — \`ctx.db.<table>\` on a \`MutationCtx\` / \`ActionCtx\`. */
+export type DatabaseWriterFacade = DatabaseWriterFacadeOf<DataModel, InsertModel, Relations, RankIndexNamesByTable, SearchIndexNamesByTable, GeoIndexNamesByTable>;
+
+/** Insert builder returned by \`ctx.orm.insert(table)\`. */
+export interface OrmInsertBuilder<T extends keyof DataModel> {
+    values: (values: Insert<T>) => Promise<IdOfTable<T>>;
+}
+
+/** Replace builder returned by \`ctx.orm.replace(table, id)\` — swaps the whole document. */
+export interface OrmReplaceBuilder<T extends keyof DataModel> {
+    with: (values: Insert<T>) => Promise<void>;
+}
+
+/** Update builder returned by \`ctx.orm.update(table, id)\` — patches the named fields. */
+export interface OrmUpdateBuilder<T extends keyof DataModel> {
+    set: (values: Partial<Insert<T>>) => Promise<void>;
+}
+
+/** Read-only ORM surface — \`ctx.orm\` on a \`QueryCtx\`. Mirrors \`ctx.db\` reads under a kitcn-style \`query\` namespace. */
+export interface OrmReader {
+    query: DatabaseReaderFacade;
+}
+
+/** Read-write ORM surface — \`ctx.orm\` on a \`MutationCtx\` / \`ActionCtx\`. Writes are addressed by id, like \`ctx.db\`. */
+export interface OrmWriter extends OrmReader {
+    delete: <T extends keyof DataModel>(table: T, id: IdOfTable<T>) => Promise<void>;
+    insert: <T extends keyof DataModel>(table: T) => OrmInsertBuilder<T>;
+    replace: <T extends keyof DataModel>(table: T, id: IdOfTable<T>) => OrmReplaceBuilder<T>;
+    update: <T extends keyof DataModel>(table: T, id: IdOfTable<T>) => OrmUpdateBuilder<T>;
+}
+
+/** Storage buckets this schema declares (\`v.storage("name")\`), narrowing \`ctx.storage.bucket(name)\`. */
+export type StorageBucketName = ${k};${Oe}${Le}${_e}${Me}${Be}${We}
+
+/**
+ * Project-typed contexts. The base contexts from \`@lunora/server\` are
+ * untyped against the schema; here \`db\` is widened to the generated per-table
+ * facade (\`ctx.db.<table>.findMany(...)\`) while keeping the legacy structural
+ * \`db.get\`/\`db.query\` surface for back-compat, and \`storage\` is narrowed so
+ * \`ctx.storage.bucket(name)\` autocompletes the declared buckets.
+ */
+/**
+ * The Convex-style fluent reader \`ctx.db.query(table)\`, bound to this schema:
+ * a table-name literal narrows the row type, so \`.collect()\` / \`.first()\` /
+ * \`.take()\` (and the \`.withIndex()\` / \`.filter()\` / \`.order()\` chain) resolve
+ * as \`Doc<table>\` with no \`as unknown as Doc<...>\` casts. The per-table accessor
+ * \`ctx.db.<table>\` stays available alongside it via the facade.
+ *
+ * Intersected with the wide \`(string) => TableReader\` signature so the bound
+ * \`ctx.db\` is still structurally assignable to schema-agnostic consumers that
+ * call \`db.query(someString)\` (e.g. \`@lunora/ratelimit\`'s \`createDbStore\`).
+ *
+ * The three index-name unions are what make \`.withIndex("by_TYPO")\` a compile
+ * error: each resolves to the table's declared names, or \`never\` when it
+ * declares none of that kind. Without them a renamed or dropped index left
+ * every call site typechecking, and the query either threw at runtime or
+ * degraded silently to a full table scan.
+ */
+type TypedTableQuery = (<T extends TableName>(
+    table: T,
+) => TableReader<Doc<T>, IndexNamesByTable[T], SearchIndexNamesByTable[T], GeoIndexNamesByTable[T]>) &
+    ((table: string) => TableReader);
+
+/**
+ * The point read \`ctx.db.get(id)\`, bound to this schema: an \`Id<"table">\`
+ * carries its table name, so the resolved document is typed \`Doc<table>\` (or
+ * \`null\` when absent) with no \`as Doc<...>\` cast. Mirrors {@link TypedTableQuery}.
+ */
+type TypedTableGet = <T extends TableName>(id: IdOfTable<T>) => Promise<Doc<T> | null>;
+
+/**
+ * Resolves the \`asId\` table argument: a literal in {@link TableName} passes through, a
+ * genuinely-wide \`string\` (a computed name) passes through, and any OTHER literal
+ * collapses to \`never\` so it fails to typecheck.
+ *
+ * The \`string extends T\` arm is what distinguishes "the caller passed a computed
+ * string" from "the caller passed a misspelled literal" — only the wide \`string\` type
+ * is a supertype of \`string\`.
+ */
+type AsIdTable<T extends string> = T extends TableName ? T : string extends T ? T : never;
+
+/**
+ * The id parse boundary \`ctx.db.asId(table, id)\`, bound to this schema: a misspelled
+ * table literal is a compile error rather than a call that hands back a confidently-
+ * branded id for a table that does not exist. Mirrors {@link TypedTableQuery} /
+ * {@link TypedTableGet}.
+ *
+ * Deliberately NOT an intersection with a wide \`(string, string) => string\` overload:
+ * overload resolution would fall through to it for a bad literal, silently restoring
+ * the very typo hole this narrowing exists to close. {@link AsIdTable} instead keeps a
+ * computed table name working — and keeps \`ctx.db\` structurally assignable to
+ * schema-agnostic consumers — without accepting an invalid literal.
+ */
+type TypedAsId = <T extends string>(tableName: AsIdTable<T>, id: string) => IdOfTable<T & TableName>;
+
+export interface QueryCtx extends Omit<QueryCtxBase, "db" | "storage"${J}${fe}${ye}> {
+    readonly db: Omit<DatabaseReader, "asId" | "query" | "get"> & DatabaseReaderFacade & { asId: TypedAsId; query: TypedTableQuery; get: TypedTableGet };
+    readonly orm: OrmReader;
+    readonly storage: ReadOnlyStorage<StorageBucketName>;${pe}${U}${de}${K}${Q}${ue}${we}${be}
+}
+
+export interface MutationCtx extends Omit<MutationCtxBase, "db" | "storage"${J}${Se}${fe}${ye}> {
+    readonly db: Omit<DatabaseWriter, "asId" | "query" | "get"> & DatabaseWriterFacade & { asId: TypedAsId; query: TypedTableQuery; get: TypedTableGet };
+    readonly orm: OrmWriter;
+    readonly storage: MutationStorage<StorageBucketName>;${ne}${U}${de}${K}${Q}${ue}${we}${Re}${$e}${Te}${be}
+}
+
+export interface ActionCtx extends Omit<ActionCtxBase, "db" | "storage"${J}${Se}${fe}${ye}> {
+    readonly db: Omit<DatabaseWriter, "asId" | "query" | "get"> & DatabaseWriterFacade & { asId: TypedAsId; query: TypedTableQuery; get: TypedTableGet };
+    readonly orm: OrmWriter;
+    readonly storage: StorageBase<StorageBucketName>;${ne}${U}${B}${ce}${G}${te}${de}${K}${Q}${Ie}${Ce}${De}${ue}${he}${z}${we}${Re}${$e}${Te}${be}
+}
+
+/**
+ * Procedure builders bound to this project's typed contexts. Chain
+ * \`.input({...})\` to declare args, \`.use(middleware)\` for rate limiting / RLS /
+ * masking (each middleware may refine \`ctx\`), then the terminal
+ * \`.query()\` / \`.mutation()\` / \`.action()\` with a \`({ ctx, args }) => ...\`
+ * handler. \`.output(validator)\` and (queries) \`.stream()\` are also available.
+ */
+const lunoraBuilders = initLunora.dataModel<DataModel>().create();
+
+/** \`query\` builder bound to this project's typed {@link QueryCtx}. */
+export const query = lunoraBuilders.query as unknown as QueryBuilder<QueryCtx, EmptyArgs>;
+
+/** \`mutation\` builder bound to this project's typed {@link MutationCtx}. */
+export const mutation = lunoraBuilders.mutation as unknown as MutationBuilder<MutationCtx, EmptyArgs>;
+
+/** \`action\` builder bound to this project's typed {@link ActionCtx}. */
+export const action = lunoraBuilders.action as unknown as ActionBuilder<ActionCtx, EmptyArgs>;
+
+/** \`internalQuery\` builder bound to this project's typed {@link QueryCtx} — never exposed on \`api\`. */
+export const internalQuery = lunoraBuilders.internalQuery as unknown as InternalQueryBuilder<QueryCtx, EmptyArgs>;
+
+/** \`internalMutation\` builder bound to this project's typed {@link MutationCtx} — never exposed on \`api\`. */
+export const internalMutation = lunoraBuilders.internalMutation as unknown as InternalMutationBuilder<MutationCtx, EmptyArgs>;
+
+/** \`internalAction\` builder bound to this project's typed {@link ActionCtx} — never exposed on \`api\`. */
+export const internalAction = lunoraBuilders.internalAction as unknown as InternalActionBuilder<ActionCtx, EmptyArgs>;
+
+/**
+ * \`defineMutator\` bound to this project's typed {@link MutationCtx} — declare
+ * custom mutators (\`lunora/mutators.ts\`) with it instead of importing from
+ * \`${D.server}\`, and the authoritative \`server\` impl's \`ctx\` carries the
+ * schema-typed \`ctx.db\` (\`ctx.db.query("nodes")\` resolves \`Doc<"nodes">\`,
+ * \`ctx.db.patch(id, …)\` takes an \`Id<"nodes">\`) with no hand-written ctx type and
+ * no \`as unknown as\` cast. Runtime-identical to the package export; only the
+ * context type narrows, so discovery finds a mutator authored either way.
+ * @example
+ * export const setText = defineMutator({
+ *     args: { id: v.id("nodes"), text: v.string() },
+ *     server: async (ctx, args) => { await ctx.db.patch(args.id, { text: args.text }); },
+ * });
+ */
+export const defineMutator = defineMutatorBase as unknown as <Args extends Record<string, Validator> = Record<string, Validator>, ClientTx = unknown, R = unknown>(
+    definition: MutatorDefinition<Args, MutationCtx, ClientTx, R>,
+) => RegisteredMutator<Args, MutationCtx, ClientTx, R>;
+
+/**
+ * \`definePolicy\` bound to THIS schema's {@link DataModel} + {@link Relations}.
+ * Import it from here (\`./_generated/server\`) instead of \`@lunora/server\` to get
+ * a relation-aware RLS authoring surface: \`table\` autocompletes to a real table
+ * name and the \`when\` predicate type-checks against the table's columns **and**
+ * its declared relations — \`{ author: { is: {...} } }\`, \`{ posts: { some: {...} } }\`,
+ * etc. (the \`@lunora/do\` pre-resolver resolves relation predicates on reads).
+ * Runtime-identical to \`@lunora/server\`'s \`definePolicy\`; only the types narrow,
+ * so the \`rls()\` chain discovers a policy authored either way the same.
+ */
+export const definePolicy = createPolicyDsl<DataModel, Relations${qe}>();
+
+/**
+ * The validator builder \`v\`, with \`v.id(...)\` constrained to THIS schema's
+ * table names — so the argument autocompletes and returns a precise
+ * \`Id<"table">\`. Identical to \`@lunora/server\`'s \`v\` at runtime; the only
+ * difference is the tightened \`id\` type.
+ *
+ * Import \`v\` from here (\`./_generated/server\`) in your queries/mutations/actions
+ * to get table-name autocomplete. \`lunora/schema.ts\` can't use it — it is the
+ * file that defines the table names, so they aren't known yet there; pass the
+ * names as string literals and the generated \`Id<"table">\` types still catch a
+ * typo wherever the id is used.
+ */
+export const v = vBase as unknown as Omit<typeof vBase, "id"> & {
+    id: <T extends TableName>(table: T) => ColumnValidator<IdOfTable<T>, IdOfTable<T>>;
+};
+`},kr=e=>{const t={connect:[],disconnect:[],init:[],reactor:[],whisper:[]};for(const n of e)n.lifecycle&&t[n.lifecycle].push(`${A(n.filePath)}:${n.exportName}`);return t},xa=e=>{const{agents:t=[],functions:n,migrations:r=[],mutators:a=[],shapes:o=[],useUmbrella:i=!1,usesSandbox:s=!1}=e,c=n.length>0,d=se(i),{dispatchBody:h,importBlock:g,installBlock:y,migrationBody:u,mutatorPaths:l,shapeBody:b}=br(n,r,a,o),R=dr(t,n),x=ur(s,n),v=[R.lines,x.lines].filter(w=>w.length>0).join(`
+`);let $=h;v.length>0&&($=h.length>0?`${h.trimEnd()}
+${v}
+`:`
+${v}
+`);const T=kr(n),H=o.length>0?`import type { RegisteredShape } from "${d.server}";
+`:"",O=o.length>0?`
+/**
+ * Replication-shape registry — one entry per \`defineShape\` in \`lunora/shapes.ts\`.
+ * The generated ShardDO's \`resolveShape\` override looks a shape up by name and
+ * evaluates its trusted \`compileWhere(ctx, args)\` to authorize + scope a
+ * \`shape_subscribe\` (reads-as-permissions).
+ */
+export const LUNORA_SHAPES: Record<string, RegisteredShape> = {${b}};
+`:"",D=l.length>0?`
+/**
+ * Custom-mutator function paths — the \`LUNORA_FUNCTIONS\` keys the generated
+ * ShardDO's \`isCustomMutator\` override routes through the client-watermark push
+ * protocol (\`x-lunora-client-id\`/\`x-lunora-client-seq\` ordering).
+ */
+export const LUNORA_MUTATOR_PATHS: ReadonlySet<string> = new Set([${l.map(w=>JSON.stringify(w)).join(", ")}]);
+`:"",k=y.length>0?`import { DEFER_VALIDATION as DEFER, installCompiledValidatorMap } from "${d.values}";
+`:"",F=y.length>0?`
+/**
+ * AOT-compiled argument validators (Worker-safe, no \`eval\`). Each is installed
+ * onto its function's live \`.args\` object and consulted by the interpreted
+ * parser as a zero-allocation fast path; anything it can't model is deferred.
+ */
+${y}
+`:"",B=yr(n),le=B.types?`
+${B.types}
+`:"",ce=B.implementation?`
+${B.implementation}
+`:"",ee=Ye(B.types),G=ee.length>0?`import type { ${ee.join(", ")} } from "./dataModel.js";
+`:"",L=c?"context":"_context",te=c?`${fr}
+
+`:"";return Nt(`${S}${g}${R.importLine}${x.importLine}${k}${H}import { LunoraError } from "${d.server}";
+import type { ActionCtx, MutationCtx, QueryCtx } from "./server.js";
+${G}
+/**
+ * Single registered function, narrowed to the shape \`handleRpc\` needs.
+ * The real argument validators / return types are checked elsewhere — at
+ * the dispatch site we erase to \`unknown\` so a single map can host every
+ * registered function.
+ */
+export interface RegisteredLunoraFunction {
+    kind: "action" | "mutation" | "query" | "stream";
+    args: Record<string, unknown>;
+    /**
+     * Present on a \`"stream"\` declared \`durable\`: its run is persisted and
+     * survives the socket that opened it. Absent on every other kind, and on an
+     * ephemeral stream.
+     */
+    durable?: { ttlMs?: number };
+    /**
+     * For \`"action" | "mutation" | "query"\` the handler is awaited and its result returned.
+     * For \`"stream"\` the handler returns an \`AsyncIterable\` synchronously and takes an
+     * \`AbortSignal\` as a third argument — the runtime drives it frame-by-frame.
+     */
+    handler: ((context: unknown, args: Record<string, unknown>) => Promise<unknown> | unknown) | ((context: unknown, args: Record<string, unknown>, signal?: AbortSignal) => AsyncIterable<unknown>);
+    /**
+     * The lifecycle moment a hook fires on, when this registration came from
+     * \`onConnect\`/\`onDisconnect\`/\`onShardInit\`/\`onQueryChange\`/\`onWhisper\`.
+     * Read at dispatch to decide whether the function runs system-trusted:
+     * \`init\` and \`reactor\` have no caller identity, so RLS has no user to scope
+     * to. \`whisper\` does have one — it runs under the asking socket's identity.
+     */
+    lifecycle?: "connect" | "disconnect" | "init" | "reactor" | "whisper";
+    /**
+     * Hoisted by the builder when the \`.use()\` chain carries a step with a
+     * per-dispatch effect — \`rateLimit(...)\` consuming budget, a single-use
+     * captcha token being burned. Read by \`isCacheableQuery\`: the chain runs
+     * inside the dispatch callback, and a reactive-cache HIT skips that
+     * callback, so such a query must never be memoized.
+     */
+    perDispatch?: boolean;
+    /** \`"internal"\` functions are rejected on the external RPC path; absence === public. */
+    visibility?: "internal" | "public";
+    /**
+     * \`.x402({ price })\` tag on a paid public procedure. The origin worker
+     * paywalls it; the shard refuses to subscribe it (\`isPaidFunction\`).
+     */
+    x402?: { readonly price: number | string };
+}
+${R.prelude}${x.prelude}
+/**
+ * Static dispatch table. The key matches the \`__lunoraRef\` the client
+ * emits (\`api[namespace][fn].__lunoraRef === "namespace:fn"\`).
+ */
+export const LUNORA_FUNCTIONS: Record<string, RegisteredLunoraFunction> = {${$}};
+${F}${O}${D}
+/**
+ * Lifecycle manifest: the function paths the generated ShardDO dispatches when a
+ * client's WebSocket connects (\`connect\`) or disconnects (\`disconnect\`), once
+ * per Durable Object instance before any handler runs (\`init\`), after a
+ * write flush when a watched read's result changed (\`reactor\`), and before a
+ * socket joins or broadcasts to a whisper topic (\`whisper\`). Each path also
+ * resolves through {@link LUNORA_FUNCTIONS}. The socket-scoped moments run under
+ * the socket's verified identity; \`init\` and \`reactor\` have no caller, so they
+ * run anonymous — all via system dispatch.
+ */
+export const LUNORA_LIFECYCLE_HOOKS: {
+    connect: readonly string[];
+    disconnect: readonly string[];
+    init: readonly string[];
+    reactor: readonly string[];
+    whisper: readonly string[];
+} = {
+    connect: [${T.connect.map(w=>JSON.stringify(w)).join(", ")}],
+    disconnect: [${T.disconnect.map(w=>JSON.stringify(w)).join(", ")}],
+    init: [${T.init.map(w=>JSON.stringify(w)).join(", ")}],
+    reactor: [${T.reactor.map(w=>JSON.stringify(w)).join(", ")}],
+    whisper: [${T.whisper.map(w=>JSON.stringify(w)).join(", ")}],
+};
+
+/**
+ * Resolve and invoke a registered function from an external caller. Throws a
+ * LunoraError-shaped object (404) when the path is unknown — the runtime's
+ * structural error mapper turns that into the right HTTP status. Internal
+ * functions are treated as not-found so their existence never leaks to clients.
+ */
+export const dispatchLunoraFunction = async (functionPath: string, context: unknown, args: Record<string, unknown>): Promise<unknown> => {
+    const registered = LUNORA_FUNCTIONS[functionPath];
+
+    if (!registered || registered.visibility === "internal") {
+        throw new LunoraError("FUNCTION_NOT_FOUND", \`function not registered: \${functionPath}\`);
+    }
+
+    return registered.handler(context, args);
+};
+
+/**
+ * A handler context accepted by {@link createCaller}. The runtime context the
+ * shard DO builds is uniform across kinds, so any handler's \`ctx\` works here.
+ */
+export type CallerCtx = ActionCtx | MutationCtx | QueryCtx;
+
+/**
+ * Typed, in-process server-to-server caller. Every registered function — public
+ * *and* internal — is reachable; each call dispatches against the same shard
+ * with the supplied \`context\`, exactly like \`ctx.runQuery\`/\`runMutation\`/
+ * \`runAction\` but without re-stating the function path.
+ */
+export interface Caller {${le}}
+
+${te}/** Build a {@link Caller} bound to \`context\` (typically a handler's \`ctx\`). */
+export const createCaller = (${L}: CallerCtx): Caller => ({${ce}});
+
+/**
+ * Single registered data migration, narrowed to the shape the per-shard runner
+ * consumes. \`up\`/\`down\` are erased to a structural transform; the authoring
+ * validation lives in \`defineMigration\`.
+ */
+export interface RegisteredDataMigration {
+    batchSize?: number;
+    down?: (document: Record<string, unknown>) => Record<string, unknown> | undefined;
+    id: string;
+    table: string;
+    up: (document: Record<string, unknown>) => Record<string, unknown> | undefined;
+}
+
+/**
+ * Registry of online data migrations keyed by \`defineMigration\`'s \`id\`. The
+ * shard DO's admin RPC and the CLI resolve migrations to run through this map.
+ */
+export const LUNORA_MIGRATIONS: Record<string, RegisteredDataMigration> = {${u}};
+`,i)},xr=e=>{const t={};for(const n of e.tables){const r={};for(const[a,o]of Object.entries(n.shape)){const i=ie(o);i.kind==="id"&&i.tableName!==void 0&&(r[a]=i.tableName)}Object.keys(r).length>0&&(t[n.name]=r)}return t},vr=e=>{const t={};for(const n of e.tables){const r=[];for(const[a,o]of Object.entries(n.shape))ie(o).kind==="storage"&&r.push(a);r.length>0&&(t[n.name]=r)}return t},Sr=e=>{const t={};for(const n of e.tables){const r=[...n.indexes.map(a=>({fields:[...a.fields],name:a.name,type:"index",...a.unique===!0?{unique:!0}:{}})),...n.searchIndexes.map(a=>({fields:[a.field,...a.filterFields??[]],name:a.name,type:"search"})),...(n.geoIndexes??[]).map(a=>({fields:[a.field],name:a.name,type:"geo"})),...n.rankIndexes.map(a=>({fields:a.sortBy.map(o=>o.field),name:a.name,type:"rank"})),...n.vectorIndexes.map(a=>({fields:a.field===void 0?[]:[a.field],name:a.name,type:"vector"}))];r.length>0&&(t[n.name]=r)}return t},Rr=e=>{const t=[];for(const n of e.tables)!n.ttl||n.shardMode==="global"||t.push({...n.ttl.after===void 0?{}:{after:n.ttl.after},field:n.ttl.field,...n.softDelete?{softDeleteField:n.softDelete.field}:{},table:n.name});return t},$r=e=>{if(e.kind!=="union"||e.members===void 0||e.members.length===0)return;const t=[];for(const n of e.members){if(n.kind!=="literal"||n.literalValue===void 0)return;try{const r=JSON.parse(n.literalValue);if(typeof r!="string")return;t.push(r)}catch{return}}return t},Tr=(e,t,n)=>{const r=ie(t),a={name:e,optional:Rt(t),type:r.kind};if(r.kind==="id"&&r.tableName!==void 0){a.ref=r.tableName;const i=n.get(e);i!==void 0&&(a.onDelete=i)}r.kind==="storage"&&(a.isStorage=!0,r.bucket!==void 0&&(a.bucket=r.bucket));const o=$r(r);return o!==void 0&&(a.enumValues=o),r.column?.notNull===!1&&(a.nullable=!0),a},Nr=e=>{const t={};for(const n of e.tables){const r=[{name:"_id",optional:!1,pk:!0,type:"id"},{name:"_creationTime",optional:!1,type:"number"},...n.commitOrdered===!0?[{name:"_commitSeq",optional:!1,type:"number"}]:[]],a=new Map(n.relations.filter(o=>o.kind==="one").map(o=>[o.field,o.onDelete]));for(const[o,i]of Object.entries(n.shape))r.push(Tr(o,i,a));t[n.name]=r}return t},Ar=e=>e?{importFragment:"serveRelationFanout, ",override:`
+        protected override async runRelationFanoutRead(functionPath: string, args: Record<string, unknown>): Promise<unknown> {
+            this.ensureMigrated();
+
+            const { db } = this.buildCtx({ functionPath }) as { db: DatabaseWriterLike };
+
+            return serveRelationFanout(schema as unknown as SchemaLike, db, functionPath, args);
+        }
+`}:{importFragment:"",override:""},Or=e=>{if(!e)return{build:"",configField:"",contextField:"",stub:""};const t='throw new Error("ctx.ai: no AI binding found. Add an \\`ai\\` binding (env.AI) to wrangler.jsonc, or pass \\`ai\\` to createShardDO().");';return{build:`
+            const aiBinding = config.ai?.(env) ?? (env as Record<string, unknown>).AI;
+            // Correlate AI-Gateway-routed calls with the Lunora trace: thread the
+            // function path + trace id into createAi, which folds them into the
+            // gateway's native \`metadata\` only when a gateway is configured (absent
+            // otherwise). Mirror the tracer's anchor guard — a deferred subscription
+            // re-run must not borrow a concurrent dispatch's trace, so read
+            // \`getCurrentTrace()\` only on the synchronous (non-threaded-identity) path.
+            const aiTrace = options.identity ? undefined : this.getCurrentTrace();
+            const ai: LunoraAi = aiBinding
+                ? createAi({ binding: aiBinding as AiBindingLike, env: env as Record<string, unknown>, metadata: { functionPath: options.functionPath, traceId: aiTrace?.traceId } })
+                : aiStub;
+`,configField:`
+    ai?: (env: Record<string, unknown>) => AiBindingLike;`,contextField:`
+                ai,`,stub:`
+const aiStub: LunoraAi = {
+    embeddingModel: () => {
+        ${t}
+    },
+    model: () => {
+        ${t}
+    },
+    run: async () => {
+        ${t}
+    },
+    // workersai is a callable-with-properties; a bare throwing arrow isn't
+    // structurally assignable, so cast it. Never invoked (the stub throws first).
+    workersai: (() => {
+        ${t}
+    }) as unknown as LunoraAi["workersai"],
+};
+`}},C=(e,t,n,{cast:r="",sync:a=[]}={})=>{const o=n.map(i=>`    ${i}: ${a.includes(i)?"":"async "}() => {
+        ${t}
+    },`).join(`
+`);return`
+const ${e} = {
+${o}
+}${r};
+`},_={build:"",configField:"",contextField:"",importLines:[],stub:""},Ir=e=>e?{build:`
+            const kvBinding = config.kv?.(env) ?? (env as Record<string, unknown>).KV;
+            // KV is not this shard's SQLite, so nothing appends a \`__cdc_log\` entry
+            // when a value changes — a subscription that read one can never be proven
+            // current on reconnect and must re-snapshot. Reads only; \`put\`/\`delete\`
+            // are writes and stay unstamped.
+            const kv: Kv = markUnvouchableReads(kvBinding ? createKv({ namespace: kvBinding as KVNamespaceLike }) : kvStub, options.onRead, [
+                "get",
+                "getRaw",
+                "getWithMetadata",
+                "list",
+            ]);
+`,configField:`
+    kv?: (env: Record<string, unknown>) => KVNamespaceLike;`,contextField:`
+                kv,`,importLines:['import type { Kv, KVNamespaceLike } from "@lunora/bindings/kv";','import { createKv } from "@lunora/bindings/kv";'],stub:C("kvStub: Kv",'throw new Error("ctx.kv: no KV binding found. Add a \\`kv_namespaces\\` binding (env.KV) to wrangler.jsonc, or pass \\`kv\\` to createShardDO().");',["delete","get","getRaw","getWithMetadata","list","put"])}:_,Cr=(e,t)=>e?{build:`
+            const flags: import("${t}").LunoraFlags = createFlags(flagsConfig, env, {
+                provider: () => config.flags?.(env),
+                targetingKey: () => flagsConfig.identify?.({ identity: identity ?? null, userId: userId ?? null }),
+            });
+`,configField:`
+    flags?: (env: Record<string, unknown>) => import("${t}").Provider;`,contextField:`
+                flags,`,importLines:[`import { createFlags } from "${t}";`,'import flagsConfig from "../flags.js";'],stub:""}:_,Dr=e=>e?{build:`
+            const { notify, push } = createNotify(notifyConfig, env, { log, metrics });
+`,configField:"",contextField:`
+                notify,
+                push,`,importLines:['import { createNotify } from "@lunora/notify";','import notifyConfig from "../notify.js";'],stub:""}:_,Lr=e=>e?{build:`
+            const envConfig = lunoraEnvContract.${e.exportName}(env);
+`,configField:"",contextField:`
+                env: envConfig,`,importLines:['import * as lunoraEnvContract from "../env.js";'],stub:""}:_,Er=e=>e?{build:`
+            const access = accessFacade(identity, userId);
+`,configField:"",contextField:`
+                access,`,importLines:['import { accessFacade } from "@lunora/cloudflare-access/context";'],stub:""}:_,_r=(e,t,n)=>{if(!t)return{constant:"",evaluateOverride:"",subscriptionOverride:""};const r=s=>`
+            const env = (this.env ?? {}) as Record<string, unknown>;
+            const flags: import("${n}").LunoraFlags = createFlags(flagsConfig, env, {
+                provider: () => config.flags?.(env),
+                targetingKey: ${s},
+            });`,a=`
+/** Statically-discovered feature flags (\`ctx.flags.<type>("key")\` reads) served via \`__lunora_admin__:listFlags\` + the reactive \`__lunora_flags__:\` channel. */
+const LUNORA_FLAG_KEYS = ${I(e,'ReadonlyArray<{ key: string; type: "boolean" | "number" | "object" | "string" }>')};
+`,o=`
+        protected override async evaluateFlags(context?: Record<string, unknown>): Promise<FlagsResult> {${r("undefined")}
+            const evalContext = context as import("${n}").EvaluationContext | undefined;
+            const evaluations: FlagsResult["flags"] = [];
+
+            for (const entry of LUNORA_FLAG_KEYS) {
+                // eslint-disable-next-line no-await-in-loop -- flags evaluate sequentially; each shares the single memoized provider client
+                const details =
+                    entry.type === "boolean"
+                        ? await flags.details.boolean(entry.key, false, evalContext)
+                        : entry.type === "number"
+                          ? await flags.details.number(entry.key, 0, evalContext)
+                          : entry.type === "string"
+                            ? await flags.details.string(entry.key, "", evalContext)
+                            : await flags.details.object(entry.key, {}, evalContext);
+
+                evaluations.push({ errorCode: details.errorCode, key: entry.key, reason: details.reason, type: entry.type, value: details.value, variant: details.variant });
+            }
+
+            return { configured: true, flags: evaluations };
+        }
+`,i=`
+        protected override runFlagSubscriptionRead(_functionPath: string, args: Record<string, unknown>, identity?: SubscriptionIdentity): Promise<unknown> {${r("() => flagsConfig.identify?.({ identity: identity?.identity ?? null, userId: identity?.userId ?? null })")}
+            const key = typeof args.key === "string" ? args.key : "";
+
+            // SECURITY: the reactive channel is public (any socket, no auth). Serve
+            // ONLY statically-discovered flag keys — an arbitrary client-supplied key
+            // would let a subscriber probe the value of internal/unreleased flags the
+            // app never exposes. Unknown key ⇒ the "nothing to deliver" sentinel.
+            // eslint-disable-next-line unicorn/no-null -- the base hook's "nothing to deliver" sentinel
+            if (key.length === 0 || !LUNORA_FLAG_KEYS.some((entry) => entry.key === key)) {
+                return Promise.resolve(null);
+            }
+
+            // SECURITY: evaluate under the socket's server-verified identity ONLY
+            // (the targetingKey resolved above). Client-supplied targeting context is
+            // NOT honored on this public channel — otherwise a subscriber could spoof
+            // targeting attributes (e.g. plan/role) to unlock a flag gated on them.
+            const context = undefined;
+
+            if (args.type === "number") {
+                return flags.number(key, typeof args.default === "number" ? args.default : 0, context);
+            }
+
+            if (args.type === "string") {
+                return flags.string(key, typeof args.default === "string" ? args.default : "", context);
+            }
+
+            if (args.type === "object") {
+                return flags.object(key, (args.default ?? {}) as import("${n}").JsonValue, context);
+            }
+
+            return flags.boolean(key, typeof args.default === "boolean" ? args.default : false, context);
+        }
+`;return{constant:a,evaluateOverride:o,subscriptionOverride:i}},Pr=e=>e?{build:`
+            const analyticsBinding = config.analytics?.(env) ?? (env as Record<string, unknown>).ANALYTICS;
+            const analytics: AnalyticsClient = analyticsBinding ? createAnalytics(analyticsBinding as AnalyticsEngineDatasetLike) : analyticsStub;
+`,configField:`
+    analytics?: (env: Record<string, unknown>) => AnalyticsEngineDatasetLike;`,contextField:`
+                analytics,`,importLines:['import type { AnalyticsClient, AnalyticsEngineDatasetLike } from "@lunora/bindings/analytics";','import { createAnalytics } from "@lunora/bindings/analytics";'],stub:C("analyticsStub: AnalyticsClient",'throw new Error("ctx.analytics: no Analytics Engine binding found. Add an \\`analytics_engine_datasets\\` binding (env.ANALYTICS) to wrangler.jsonc, or pass \\`analytics\\` to createShardDO().");',["track","writeDataPoint"],{sync:["track","writeDataPoint"]})}:_,Mr=e=>e?{build:`
+            const imagesBinding = config.images?.(env) ?? (env as Record<string, unknown>).IMAGES;
+            const images: Images = imagesBinding ? createImages({ binding: imagesBinding as ImagesBindingLike }) : imagesStub;
+`,configField:`
+    images?: (env: Record<string, unknown>) => ImagesBindingLike;`,contextField:`
+                images,`,importLines:['import type { Images, ImagesBindingLike } from "@lunora/bindings/images";','import { createImages } from "@lunora/bindings/images";'],stub:C("imagesStub: Images",'throw new Error("ctx.images: no Images binding found. Add an \\`images\\` binding (env.IMAGES) to wrangler.jsonc, or pass \\`images\\` to createShardDO().");',["info","transform"])}:_,Fr=e=>e?{build:`
+            const sql: SqlClient = config.sql ? config.sql(env) : sqlStub;
+`,configField:`
+    sql?: (env: Record<string, unknown>) => SqlClient;`,contextField:`
+                sql,`,importLines:['import type { SqlClient } from "@lunora/hyperdrive";'],stub:C("sqlStub: SqlClient",'throw new Error("ctx.sql: provide a \\`sql\\` config thunk that builds a SqlClient from your driver, e.g. \\`sql: (env) => fromPostgresJs(postgres(env.HYPERDRIVE.connectionString))\\`.");',["query"])}:_,Br=e=>e?{build:`
+            const browser: Browser = config.browser ? config.browser(env) : browserStub;
+`,configField:`
+    browser?: (env: Record<string, unknown>) => Browser;`,contextField:`
+                browser,`,importLines:['import type { Browser } from "@lunora/browser";'],stub:C("browserStub: Browser","throw new Error(\"ctx.browser: provide a \\`browser\\` config thunk, e.g. \\`browser: (env) => createBrowser({ binding: env.BROWSER, launch })\\` with \\`import { launch } from '@cloudflare/playwright'\\`. Session reuse (connect/sessions) additionally needs those two exports passed the same way.\");",["connect","content","launch","pdf","scrape","screenshot","sessions"])}:_,qr=e=>e?{build:`
+            const r2sqlEnv = env as Record<string, unknown>;
+            const r2sqlAccountId = (r2sqlEnv.R2_SQL_ACCOUNT_ID ?? r2sqlEnv.CLOUDFLARE_ACCOUNT_ID) as string | undefined;
+            const r2sqlToken = r2sqlEnv.R2_SQL_TOKEN as string | undefined;
+            const r2sqlBucket = r2sqlEnv.R2_SQL_BUCKET as string | undefined;
+            const r2sql: R2SqlClient = config.r2sql
+                ? config.r2sql(env)
+                : r2sqlAccountId && r2sqlToken && r2sqlBucket
+                  ? createR2Sql({ accountId: r2sqlAccountId, apiToken: r2sqlToken, bucket: r2sqlBucket })
+                  : r2sqlStub;
+`,configField:`
+    r2sql?: (env: Record<string, unknown>) => R2SqlClient;`,contextField:"",importLines:['import type { R2SqlClient } from "@lunora/bindings/r2sql";','import { createR2Sql } from "@lunora/bindings/r2sql";'],stub:C("r2sqlStub: R2SqlClient",'throw new Error("ctx.r2sql: no R2 SQL credentials found. Set \\`R2_SQL_TOKEN\\`, \\`R2_SQL_ACCOUNT_ID\\` (or \\`CLOUDFLARE_ACCOUNT_ID\\`), and \\`R2_SQL_BUCKET\\` in your env/.dev.vars, or pass an \\`r2sql\\` config thunk to createShardDO().");',["describe","explain","from","query","showDatabases","showTables"],{sync:["from"]})}:_,jr=e=>e?{build:`
+            const pipelinesBinding = config.pipelines?.(env) ?? (env as Record<string, unknown>).PIPELINES;
+            const pipelines: PipelineClient = pipelinesBinding ? createPipelines({ binding: pipelinesBinding as PipelineBindingLike }) : pipelinesStub;
+`,configField:`
+    pipelines?: (env: Record<string, unknown>) => PipelineBindingLike;`,contextField:"",importLines:['import type { PipelineBindingLike, PipelineClient } from "@lunora/bindings/pipelines";','import { createPipelines } from "@lunora/bindings/pipelines";'],stub:C("pipelinesStub: PipelineClient",'throw new Error("ctx.pipelines: no Pipelines binding found. Add a \\`pipelines\\` binding (env.PIPELINES) to wrangler.jsonc, or pass \\`pipelines\\` to createShardDO().");',["send"])}:_,va=(e,t)=>{if(e.length===0)return"";const n=t?`, ${JSON.stringify(t)}`:"",r=e.map(o=>(f(o.exportName,`container export "${o.exportName}"`),f(o.className,`container class "${o.className}"`),`/** Container DO for the \`${o.exportName}\` definition (binding \`${o.bindingName}\`). */
+export class ${o.className} extends LunoraContainer {
+    public constructor(ctx: ConstructorParameters<typeof LunoraContainer>[0], env: Record<string, unknown>) {
+        super(ctx, env, ${o.exportName}, "${o.exportName}"${n});
+    }
+}
+`)).join(`
+`),a=e.map(o=>o.exportName).join(", ");return`${S}/**
+ * Container-enabled Durable Object classes for the containers declared in
+ * \`lunora/containers.ts\`. Re-export them from your worker entry — wrangler
+ * requires each \`containers[].class_name\` to be exported by the worker:
+ *
+ * \`export * from "./lunora/_generated/containers.js";\`
+ *
+ * \`ContainerProxy\` is re-exported alongside them: the egress-interception path
+ * (\`allowedHosts\`/\`deniedHosts\`/\`interceptHttps\` and the runtime
+ * \`handle.egress\` controls) routes container outbound traffic through this
+ * WorkerEntrypoint, so it too must be exported by the deployed worker.
+ */
+import { LunoraContainer } from "@lunora/container/do";
+
+import { ${a} } from "../containers.js";
+
+export { ContainerProxy } from "@lunora/container/do";
+
+${r}`},Wr=(e,t)=>{if(e.length===0)return{build:"",contextField:"",importLines:[],specs:""};for(const r of e)f(r.exportName,`container export "${r.exportName}"`),f(r.bindingName,`container binding "${r.bindingName}"`);const n=e.map(r=>{const a=r.maxInstances===void 0?"":`, maxInstances: ${String(r.maxInstances)}`;return`    { binding: "${r.bindingName}", exportName: "${r.exportName}"${a} },`}).join(`
+`);return{build:`
+            const containers = createContainerContext(env, LUNORA_CONTAINERS, ${t?JSON.stringify(t):"undefined"}, this.getCurrentTraceparent(), this.getCurrentSampleErrors());
+`,contextField:`
+                containers,`,importLines:['import type { ContainerBindingSpec } from "@lunora/container";','import { createContainerContext } from "@lunora/container";'],specs:`
+/** Wiring specs for \`ctx.containers\` (codegen-derived from \`lunora/containers.ts\`). */
+const LUNORA_CONTAINERS: ReadonlyArray<ContainerBindingSpec> = [
+${n}
+];
+`}},Sa=e=>{if(e.length===0)return"";const t=e.map(r=>(f(r.exportName,`workflow export "${r.exportName}"`),f(r.className,`workflow class "${r.className}"`),`/** WorkflowEntrypoint for the \`${r.exportName}\` definition (binding \`${r.bindingName}\`). */
+export class ${r.className} extends LunoraWorkflow<WorkflowParamsOf<typeof ${r.exportName}>, WorkflowOutputOf<typeof ${r.exportName}>> {
+    public constructor(ctx: ConstructorParameters<typeof LunoraWorkflow>[0], env: Record<string, unknown>) {
+        super(ctx, env, ${r.exportName}, "${r.exportName}");
+    }
+}
+`)).join(`
+`),n=e.map(r=>r.exportName).join(", ");return`${S}/**
+ * WorkflowEntrypoint classes for the workflows declared in
+ * \`lunora/workflows.ts\`. Re-export them from your worker entry — wrangler
+ * requires each \`workflows[].class_name\` to be exported by the worker:
+ *
+ * \`export * from "./lunora/_generated/workflows.js";\`
+ */
+import LunoraWorkflow from "@lunora/workflow/do";
+
+import { ${n} } from "../workflows.js";
+
+/** Params type carried by a \`defineWorkflow\` definition (its phantom \`__params\`), so each entrypoint keeps the authored \`ctx.params\` type. */
+type WorkflowParamsOf<Definition> = Definition extends { __params?: infer Params }
+    ? unknown extends Params
+        ? Record<string, unknown>
+        : NonNullable<Params>
+    : Record<string, unknown>;
+
+/** Output type carried by a \`defineWorkflow\` definition (its phantom \`__output\`), so each entrypoint keeps the authored return type. */
+type WorkflowOutputOf<Definition> = Definition extends { __output?: infer Output } ? Output : unknown;
+
+${t}`},Ra=e=>{if(e.length===0)return"";const n=e.filter(s=>s.voice).length>0,r=e.map(s=>{f(s.exportName,`agent export "${s.exportName}"`),f(s.className,`agent class "${s.className}"`);const c=`/** WorkflowEntrypoint for the \`${s.exportName}\` agent (binding \`${s.bindingName}\`). */
+export class ${s.className} extends LunoraWorkflow<AgentRunInput, AgentRunResult> {
+    public constructor(ctx: ConstructorParameters<typeof LunoraWorkflow>[0], env: Record<string, unknown>) {
+        super(ctx, env, compileAgentWorkflow(${s.exportName}, "${s.exportName}"), "${s.exportName}");
+    }
+}
+`;if(!s.voice)return c;const d=s.voiceClassName??"",h=s.voiceBindingName??"";f(d,`agent voice class "${d}"`);const g=`
+/** Voice-session Durable Object for the \`${s.exportName}\` agent (binding \`${h}\`). */
+export class ${d} extends VoiceSessionDO {
+    public constructor(ctx: ConstructorParameters<typeof VoiceSessionDO>[0], env: Record<string, unknown>) {
+        super(ctx, env, ${s.exportName}, "${s.exportName}");
+    }
+}
+`;return`${c}${g}`}).join(`
+`),a=e.map(s=>s.exportName).join(", ");return`${S}/**
+ * WorkflowEntrypoint classes for the agents declared in \`lunora/agents.ts\`.
+ * Each \`defineAgent\` compiles a replay-safe tool-loop onto a Cloudflare
+ * Workflow. Re-export them from your worker entry — wrangler requires each
+ * \`workflows[].class_name\` to be exported by the worker:
+ *
+ * \`export * from "./lunora/_generated/agents.js";\`${n?"\n *\n * Voice-enabled agents ALSO get a `VoiceSessionDO` subclass here — a real\n * Durable Object (unlike the Workflow), so wrangler needs both its\n * `durable_objects` binding and its `class_name` export (the same re-export\n * line covers it).":""}
+ */
+import LunoraWorkflow from "@lunora/workflow/do";
+${n?'import { compileAgentWorkflow, VoiceSessionDO } from "@lunora/agent";':'import { compileAgentWorkflow } from "@lunora/agent";'}
+import type { AgentRunInput, AgentRunResult } from "@lunora/agent";
+
+import { ${a} } from "../agents.js";
+
+${r}`},$a=e=>{const t=e.filter(a=>a.mode==="push");if(t.length===0)return"";for(const a of t)f(a.exportName,`queue export "${a.exportName}"`);const n=t.map(a=>a.exportName).join(", "),r=t.map(a=>`    ${JSON.stringify(a.name)}: { binding: ${JSON.stringify(a.bindingName)}, definition: ${a.exportName}, exportName: ${JSON.stringify(a.exportName)} },`).join(`
+`);return`${S}/**
+ * Push-consumer registry for the queues declared in \`lunora/queues.ts\`. The
+ * composed worker's \`queue(batch, env, ctx)\` entry routes each delivered batch
+ * by \`batch.queue\` to the matching \`defineQueue\` handler. Wired automatically
+ * by \`defineApp\` — you don't import this directly.
+ */
+import type { QueueRegistry } from "@lunora/queue";
+
+import { ${n} } from "../queues.js";
+
+/** Stable wrangler queue name → { binding, definition, exportName } for batch routing. */
+export const LUNORA_QUEUE_REGISTRY: QueueRegistry = {
+${r}
+};
+`},Ur=e=>{if(e.length===0)return{build:"",contextField:"",importLines:[],specs:""};for(const n of e)f(n.exportName,`workflow export "${n.exportName}"`),f(n.bindingName,`workflow binding "${n.bindingName}"`);const t=e.map(n=>`    { binding: "${n.bindingName}", exportName: "${n.exportName}" },`).join(`
+`);return{build:`
+            const workflows = createWorkflowContext(env, LUNORA_WORKFLOWS);
+`,contextField:`
+                workflows,`,importLines:['import type { WorkflowBindingSpec } from "@lunora/workflow";','import { createWorkflowContext } from "@lunora/workflow";'],specs:`
+/** Wiring specs for \`ctx.workflows\` (codegen-derived from \`lunora/workflows.ts\`). */
+const LUNORA_WORKFLOWS: ReadonlyArray<WorkflowBindingSpec> = [
+${t}
+];
+`}},Kr=e=>{if(e.length===0)return{build:"",contextField:"",importLines:[],specs:""};for(const n of e)f(n.exportName,`queue export "${n.exportName}"`),f(n.bindingName,`queue binding "${n.bindingName}"`);const t=e.map(n=>`    { binding: "${n.bindingName}", exportName: "${n.exportName}", name: ${JSON.stringify(n.name)} },`).join(`
+`);return{build:`
+            const queues = createQueueContext(env, LUNORA_QUEUES);
+`,contextField:`
+                queues,`,importLines:['import type { QueueBindingSpec } from "@lunora/queue";','import { createQueueContext } from "@lunora/queue";'],specs:`
+/** Wiring specs for \`ctx.queues\` (codegen-derived from \`lunora/queues.ts\`). */
+const LUNORA_QUEUES: ReadonlyArray<QueueBindingSpec> = [
+${t}
+];
+`}},Qr=e=>{if(e.length===0)return{build:"",contextField:"",importLines:[],specs:""};for(const n of e)f(n.exportName,`agent export "${n.exportName}"`),f(n.bindingName,`agent binding "${n.bindingName}"`);const t=e.map(n=>`    { binding: "${n.bindingName}", exportName: "${n.exportName}"${n.publicRun===!0?", publicRun: true":""} },`).join(`
+`);return{build:`
+            const agents = createAgentContext(env, LUNORA_AGENTS);
+`,contextField:`
+                agents,`,importLines:['import { createAgentContext } from "@lunora/agent";','import type { AgentBindingSpec } from "@lunora/agent";'],specs:`
+/** Wiring specs for \`ctx.agents\` (codegen-derived from \`lunora/agents.ts\`). */
+const LUNORA_AGENTS: ReadonlyArray<AgentBindingSpec> = [
+${t}
+];
+`}},It=(e,t,n,r,a)=>({constant:`
+${a}
+const ${e} = ${I(r,t)};
+`,override:`
+        protected override ${n}(): ${t} {
+            return ${e};
+        }
+`}),Vr=e=>{if(e.length===0)return{constant:"",override:""};const t={workflows:e.map(n=>({binding:n.bindingName,className:n.className,exportName:n.exportName,name:n.name}))};return It("LUNORA_WORKFLOWS_INFO","WorkflowsResult","workflowsMetadata",t,"/** Read-only declared-workflow metadata (discovered from `lunora/workflows.ts`) served via `__lunora_admin__:listWorkflows` for the studio's workflows view. */")},Hr=e=>{if(e.length===0)return{constant:"",override:""};const t={queues:e.map(n=>({binding:n.bindingName,...n.tuning.deadLetterQueue===void 0?{}:{deadLetterQueue:n.tuning.deadLetterQueue},exportName:n.exportName,mode:n.mode,name:n.name}))};return It("LUNORA_QUEUES_INFO","QueuesResult","queuesMetadata",t,"/** Read-only declared-queue metadata (discovered from `lunora/queues.ts`) served via `__lunora_admin__:listQueues` for the studio's queues view. */")},Gr=e=>e?{imports:['import type { LunoraDatabaseLike as LunoraPaymentDbLike, LunoraPayment, PaymentsFromContextOptions } from "@lunora/payment";','import { paymentsFromContext } from "@lunora/payment";'],build:`
+            const payments: LunoraPayment = config.payment
+                ? paymentsFromContext({ auth: { userId: userId ?? null }, db: db as unknown as LunoraPaymentDbLike }, config.payment(env))
+                : paymentStub;
+`,configField:`
+    payment?: (env: Record<string, unknown>) => PaymentsFromContextOptions;`,contextField:`
+                payments,`,stub:C("paymentStub: LunoraPayment",'throw new Error("ctx.payments: no payment configured. Pass \\`payment\\` to createShardDO().");',["attach","cancelSubscription","check","createCheckout","createPortalSession","handleWebhook","listBalances","listSubscriptions","track"],{cast:" as unknown as LunoraPayment",sync:["attach","cancelSubscription","check","createCheckout","createPortalSession","handleWebhook","listBalances","listSubscriptions","track"]})}:{build:"",configField:"",contextField:"",imports:[],stub:""},zr=e=>e?{imports:['import type { X402Pay, X402PayConfig } from "@lunora/x402/pay";','import { lazyX402Pay } from "@lunora/x402/pay";'],build:`
+            const x402: X402Pay = config.x402
+                ? lazyX402Pay(config.x402(env), { getSecret: (name: string) => secrets.get(name) })
+                : x402Stub;
+`,configField:`
+    x402?: (env: Record<string, unknown>) => X402PayConfig;`,stub:C("x402Stub: X402Pay",'throw new Error("ctx.x402: no pay rail configured. Pass \\`x402\\` to createShardDO().");',["fetch"],{cast:" as unknown as X402Pay",sync:["fetch"]})}:{build:"",configField:"",imports:[],stub:""},Jr=(e,t,n,r,a)=>["AdvisorProcedure","AdvisoryFinding","DatabaseWriterLike","DataMigrationLike","DispatchBookmark","ExportRow",...r?["FlagsResult"]:[],"ImportShardResult","KeyRange","MaskPoliciesResult","MigrationRunResult","QueryReadScope",...n?["QueuesResult"]:[],"RelatedPage","RunShardApplyCdcArgs","RunShardExportArgs","RunShardFindRelatedArgs","RunShardImportArgs","RunShardMigrationArgs","RlsPoliciesResult","RunShardRankBeforeArgs","RunShardRankPageArgs","RunShardWriteArgs","RunShardWriteResult","SchedulerLike",...a?["SearchBackfillProgress"]:[],"TransactionHeadroomTracker","SchemaLike","ShardDOState","ShardRankPageResult","SqlExec","StorageRulesResult","StudioFeaturesResult","SubscriptionIdentity","SystemReaderStorageLike","TelemetrySink",...e?["VectorBackfillProgress"]:[],...t?["WorkflowsResult"]:[],...e?["WriteHook"]:[]],Ta=({advisories:e=[],advisorProcedures:t=[],agents:n=[],containers:r=[],env:a,flagKeys:o=[],hasAccessFacade:i=!1,hasAi:s=!1,hasAnalytics:c=!1,hasBrowser:d=!1,hasFlags:h=!1,hasHyperdrive:g=!1,hasImages:y=!1,hasKv:u=!1,hasNotify:l=!1,hasPayments:b=!1,hasPipelines:R=!1,hasR2sql:x=!1,hasVectors:v=!0,hasX402:$=!1,maskMetadata:T,mutators:H=[],queues:O=[],rlsMetadata:D,schema:k,schemaSnapshot:F,shapes:B=[],storageRules:le,studioFeatures:ce,useUmbrella:ee=!1,workflows:G=[]})=>{const L=se(ee),te=H.length>0,w=B.length>0,Oe=F===void 0?"":An(F),q=F===void 0?"":`
+/** Structural schema snapshot + its content hash, recorded in the shard's \`__lunora_schema_history\` ledger on cold start so the studio can show a schema-version timeline and diff any two versions. */
+const LUNORA_SCHEMA_SNAPSHOT: { hash: string; json: string } = { hash: ${JSON.stringify(On(F))}, json: ${JSON.stringify(Oe)} };
+`,de=F===void 0?"":", schemaSnapshot: LUNORA_SCHEMA_SNAPSHOT",{build:ue,configField:Ie,contextField:Ce,stub:De}=Or(s),he=Er(i),z=Ir(u),P=Cr(h,L.flags),J=_r(o,h,L.flags),ne=Dr(l),pe=Lr(a),Y=Pr(c),U=Mr(y),K=Fr(g),Q=Br(d),j=qr(x),re=jr(R),{build:Le,contextField:Se,importLines:Re,specs:me}=Kr(O),{build:Ee,contextField:_e,importLines:$e,specs:ge}=Wr(r,k.jurisdiction),{build:Pe,contextField:Me,importLines:Te,specs:Fe}=Ur(G),{build:Be,contextField:fe,importLines:be,specs:qe}=Qr(n),{build:je,configField:We,contextField:ye,imports:we,stub:et}=Gr(b),{build:p,configField:Ue,imports:Ne,stub:ae}=zr($),Dt=e,Lt=t,tt=D??{policies:[],roles:[]},Et=T??{columns:[]},_t=le??{rules:[]},Pt=ce??{analytics:!1,auth:!1,containers:!1,flags:!1,kv:!1,mail:!1,notifications:!1,payments:!1,queues:!1,scheduler:!1,storage:!1,vectors:!1,workflows:!1},{constant:Mt,override:Ft}=Vr(G),{constant:Bt,override:qt}=Hr(O),M=v&&k.vectorIndexes.length>0,nt=new Set(k.tables.filter(m=>typeof m.shardMode=="object"&&m.shardMode.kind==="shardBy").map(m=>m.name)),Ae=M&&k.vectorIndexes.some(m=>nt.has(m.table)),ke=k.tables.some(m=>m.shardMode==="global"),Ke=k.tables.some(m=>Cn(m)),rt=k.tables.some(m=>Dn(m)),oe=k.tables.some(m=>m.externalSource!==void 0),at=k.tables.some(m=>m.memory===!0),Qe=k.tables.some(m=>m.shardMode!=="global"&&m.searchIndexes.length>0);if(rt&&Ke)throw new Z("INTERNAL",'lunora codegen: mixing `.global()` (D1) and `.global({ backend: "hyperdrive" })` tables in one app is not supported yet — use a single global backend.');const Ve=k.tables.length>0,jt=xr(k),Wt=Sr(k),Ut=Nr(k),Kt=vr(k),ot=Rr(k),st=Jr(M,G.length>0,O.length>0,h,Qe);w&&st.push("WhereInput");const it=Ar(ke),Qt=w?`
+        protected override resolveShape(name: string, args: Record<string, unknown>, identity?: SubscriptionIdentity): { columns?: readonly string[]; effectiveWhere?: WhereInput; global?: boolean; table: string } | undefined {
+            const shape = LUNORA_SHAPES[name];
+
+            if (!shape) {
+                return undefined;
+            }
+
+            this.ensureMigrated();
+
+            // Trusted ctx from the socket's OWN verified identity — the client
+            // supplies only the shape name + args; \`compileWhere\` validates the
+            // args then runs the shape's \`where(ctx, args)\` under that identity,
+            // so which rows replicate is a server decision (reads-as-permissions).
+            const ctx = this.buildCtx({ functionPath: \`__shape__:\${name}\`, identity });
+            // \`ownerField\` resolves an \`owner: true\` shape: only here is the table's
+            // \`.ownedBy(field)\` column in scope, so the DO hands it to the shape
+            // rather than every shape restating the ownership check in its \`where\`.
+            const shapeWhere = shape.compileWhere(ctx, args, {
+                ownerField: (schema as unknown as { tables: Record<string, { ownerField?: string }> }).tables[shape.table]?.ownerField,
+            }) as unknown as WhereInput;
+
+            // AND-compose with the read policies this SHAPE declares
+            // (\`defineShape({ use: [guard] })\`, pre-indexed into
+            // \`shape.rlsRegistry\`). A shape runs no procedure, so the
+            // \`.use(rls(...))\` middleware never fires; without this merge its
+            // reads would bypass the read policies it opted into.
+            // \`composeShapeReadWhere\` evaluates them under this same trusted ctx
+            // and fails closed under a \`.rls("required")\` schema for a
+            // non-\`.public()\` table the shape declared no read policy for.
+            //
+            // The registry is the shape's OWN — never one folded from every
+            // registered function. A project-wide union let one admin-only
+            // procedure's allow-all read policy unrestrict every shape on the
+            // table; see the SCOPE note in \`shape-read-base.ts\`.
+            //
+            // It is NOT identical to the request-time path, and must not be
+            // described as such: roles come from the identity's \`roles\` claim
+            // only, because no middleware runs here to contribute
+            // \`ctx.auth.roles\`. Derive roles at the identity if a policy gates
+            // on them — see \`shape-read-base.ts\`.
+            const effectiveWhere = composeShapeReadWhere(shape.rlsRegistry, {
+                ctx,
+                identity: identity?.identity ?? null,
+                rlsRequired: (schema as unknown as { rlsMode?: string }).rlsMode === "required",
+                shapeWhere,
+                table: shape.table,
+                tablePublic: (schema as unknown as { tables: Record<string, { isPublic?: boolean }> }).tables[shape.table]?.isPublic === true,
+                userId: identity?.userId ?? null,
+            });
+
+            // A live shape pokes only from its OWN shard's op-log, so a \`where()\`
+            // that joins to a \`.shardBy()\` table (rows in another DO) is rejected
+            // here — the first point the compiled predicate + shard modes are both
+            // known. Remedy: denormalize, or move the joined table to \`.global()\`.
+            assertShapeShardable(effectiveWhere, schema as unknown as SchemaLike, shape.table);
+
+            // A \`.global()\` table lives in D1 (no per-DO op-log): flag it so the
+            // base serves it through the latency-tiered poll path (\`readGlobalShapeRows\`)
+            // instead of the CDC poke path.
+            const isGlobal = (schema as unknown as SchemaLike).tables[shape.table]?.shardMode?.kind === "global";
+
+            return { columns: shape.columns, effectiveWhere, global: isGlobal, table: shape.table };
+        }
+`:"",lt=w?[...new Set(tt.policies.filter(m=>m.on==="read"&&m.table!=="").map(m=>m.table))].toSorted((m,Nn)=>m.localeCompare(Nn)):[],ct=lt.length>0?`
+/** Refuses to boot a shape that would replicate around the read policies its table is governed by (\`defineShape({ use })\` is how a shape opts in; \`use: []\` acknowledges an ungoverned one). */
+assertShapesDeclareReadPolicies(LUNORA_SHAPES, ${JSON.stringify(lt)}, (schema as unknown as { rlsMode?: string }).rlsMode === "required");
+`:"",Vt=te?`
+        protected override isCustomMutator(functionPath: string): boolean {
+            return LUNORA_MUTATOR_PATHS.has(functionPath);
+        }
+`:"",Ht=w?"assertShapeShardable, ":"",Gt=ct===""?"":"assertShapesDeclareReadPolicies, ",xe=[`import type { ${st.join(", ")} } from "${L.do}";`,`import { applyCdcChanges, ${Qe?"backfillSearchIndexes, ":""}${M?"backfillVectorIndexes, ":""}buildReprojectionMigration, ${at?"clearMemoryTables, ":""}${Ht}createReadFootprint, createShardCtxDb, exportShardRows, importShardRows, ${oe?"isSourceDue, pullExternalSourceIncrementalTick, pullExternalSourceTick, ":""}markUnvouchableReads, ${Ae?"ROOT_SHARD_NAME, ":""}runDataMigration, runShardMigrations, ${it.importFragment}ShardDO as ShardDOBase } from "${L.do}";`,...oe?[`import type { ExternalSourceLike, SourceClientLike, TraceRefLike } from "${L.do}";`]:[],w?`import { asBucketStorage, ${Gt}beginDeferredDeletes, beginDeferredSchedules, composeShapeReadWhere, createSecrets, flushDeferredDeletes, LunoraError, withDeferredDeletes, withDeferredSchedules } from "${L.server}";`:`import { asBucketStorage, beginDeferredDeletes, beginDeferredSchedules, createSecrets, flushDeferredDeletes, LunoraError, withDeferredDeletes, withDeferredSchedules } from "${L.server}";`];Ve&&xe.push(`import { bindOrm, bindTableFacade } from "${L.server}";`),M&&xe.push('import type { SchemaLike as VectorSchemaLike, VectorBackfillSync, VectorizeIndexLike, VectorSearchLike } from "@lunora/bindings/vectors";','import { createContextVectors, createVectorBackfillSync, createVectors, createVectorSyncHook, vectorBackfillTargets } from "@lunora/bindings/vectors";'),s&&xe.push('import type { AiBindingLike, LunoraAi } from "@lunora/ai";','import { createAi } from "@lunora/ai";'),xe.push(...he.importLines,...z.importLines,...P.importLines,...ne.importLines,...pe.importLines,...Y.importLines,...U.importLines,...K.importLines,...Q.importLines,...j.importLines,...re.importLines,...$e,...Te,...Re,...be,...we,...Ne,"",'import schema from "../schema.js";',`import { ${["LUNORA_FUNCTIONS","LUNORA_LIFECYCLE_HOOKS","LUNORA_MIGRATIONS",...te?["LUNORA_MUTATOR_PATHS"]:[],...w?["LUNORA_SHAPES"]:[]].join(", ")} } from "./functions.js";`);const zt=M?`
+    vectors?: (env: Record<string, unknown>) => Record<string, VectorizeIndexLike>;`:"",Jt=rt?`
+    d1?: (env: Record<string, unknown>, request?: { bookmark?: string; cdc?: boolean; cdcRetentionMs?: number; identity?: Record<string, unknown>; onBookmark?: (bookmark: string | undefined) => void; userId?: string }) => DatabaseWriterLike | undefined;`:"",Yt=Ke?`
+    hyperdriveGlobal?: (env: Record<string, unknown>, request?: { cdc?: boolean; cdcRetentionMs?: number; identity?: Record<string, unknown>; userId?: string }) => DatabaseWriterLike | undefined;`:"",Xt=oe?`
+    sourceClient?: (env: Record<string, unknown>, binding: string) => { query: <Row = Record<string, unknown>>(text: string, params?: readonly unknown[]) => Promise<Row[]> } | undefined;`:"",Zt='throw new Error("ctx.db.<globalTable>: no global backend configured. Pass `d1` or `hyperdriveGlobal` to createShardDO().");',en='throw new Error("ctx.vectors: no vectors configured. Pass `vectors` to createShardDO().");',tn='throw new Error("ctx.scheduler: no scheduler configured. Pass `scheduler` to createShardDO().");',nn='throw new Error("ctx.storage: no storage configured. Pass `storage` to createShardDO().");',rn=ke?C("globalDbStub: DatabaseWriterLike",Zt,["aggregate","count","delete","findFirst","findFirstOrThrow","findMany","get","groupBy","insert","normalizeId","patch","query","rank","rankPage","replace"],{sync:["normalizeId","query"]}):"",an=M?C("vectorsStub: VectorSearchLike",en,["deleteByIds","getByIds","query","upsert","upsertNow"]):"",on=Ae?`            const vectorShardKey = this.currentShardKey();
+`:"",dt=Ae?"namespace: vectorShardKey === ROOT_SHARD_NAME ? undefined : vectorShardKey, ":"",sn=`, { ${["deferAfterCommit: (work) => this.deferAfterCommit(work)",...Ae?["namespace: vectorShardKey === ROOT_SHARD_NAME ? undefined : vectorShardKey",`shardedIndexNames: [${k.vectorIndexes.filter(m=>nt.has(m.table)).map(m=>JSON.stringify(m.name)).join(", ")}]`]:[]].join(", ")} }`,ln=M?`
+            const vectorSync = this.vectorSync(env);
+            // Vectorize lives outside this shard's SQLite, so a query whose result
+            // depends on a similarity search cannot be proven current on reconnect —
+            // an unrelated upsert (or a re-index) moves the matches without touching
+            // \`__cdc_log\`. Only \`ctx.vectors\` is wrapped: the write-through
+            // vector-sync hook keeps calling the bare facade.
+            const bareVectors = vectorSync?.vectors ?? vectorsStub;
+            const vectors = markUnvouchableReads(bareVectors, options.onRead, ["getByIds", "query"]);
+            const onWrite = vectorSync?.onWrite;
+`:"",cn=M?`
+        private vectorSync(env: Record<string, unknown>): { backfill: VectorBackfillSync; onWrite: WriteHook; vectors: VectorSearchLike } | undefined {
+            if (!config.vectors) {
+                return undefined;
+            }
+
+            const lunora = createVectors({ indexes: config.vectors(env) });
+${on}            const vectors = createContextVectors(lunora${sn});
+
+            return {
+                backfill: createVectorBackfillSync({ ${dt}schema: schema as unknown as VectorSchemaLike, upsertMany: lunora.upsertMany, vectors }),
+                onWrite: createVectorSyncHook({ ${dt}schema: schema as unknown as VectorSchemaLike, vectors }),
+                vectors,
+            };
+        }
+
+        // \`__lunora_admin__:backfillVectors\`: the rows that predate a vector index,
+        // a page at a time, each page ordered on the after-commit chain so it
+        // never lands over a newer write's vector.
+        protected override async runShardVectorBackfill(options: { maxPages?: number; restart?: boolean }): Promise<VectorBackfillProgress> {
+            this.ensureMigrated();
+
+            const vectorSync = this.vectorSync((this.env ?? {}) as Record<string, unknown>);
+
+            if (!vectorSync) {
+                throw new LunoraError("NOT_IMPLEMENTED", "vector backfill is unavailable: no vectors configured. Pass \`vectors\` to createShardDO().");
+            }
+
+            return backfillVectorIndexes(this.sql as SqlExec, vectorBackfillTargets(schema as unknown as VectorSchemaLike), vectorSync.backfill, {
+                ...options,
+                ordered: async (read, work) => this.runOrderedAfterWrites(read, work),
+            });
+        }
+`:"",dn=`{
+                ...this.ctxDbTuning(),
+                auth: { identity: identity ?? null, userId: userId ?? null },
+                broadcast: (delta) => {
+                    this.recordChangedTable(delta.table, delta.indexKeys);
+                },
+                // Read at call time, not captured: the baseline belongs to the
+                // dispatch in flight, and a queued mutation admitted after a
+                // sibling's prologue must be judged against ITS caller's cursor.
+                baselineSeq: () => this.getCurrentBaselineSeq(),
+                cdc: config.cdc ?? false,
+                // A dispatch with NO caller identity runs system-trusted: RLS scopes
+                // rows to a user, and these have no user to scope to. This is the tier
+                // migrations, imports and the external-source poll loop already run in
+                // (see \`adminWriterPrelude\`). Only \`onShardInit\` and \`onQueryChange\`
+                // reach it; \`onConnect\`/\`onDisconnect\` carry a verified identity and
+                // stay guarded like any request.
+                enforceRls: options.trusted !== true,
+                headroom: options.headroom ?? this.transactionHeadroom(),
+                // A live predicate, not a flag: the transaction opens AFTER this ctx
+                // is built (a mutation dispatch wraps the handler), so only a call-time
+                // read reports the truth. \`_commitSeq\` reuses one sequence across
+                // writes only while they commit together — an action is not wrapped, so
+                // each of its writes allocates its own.
+                inTransaction: () => this.isInTransaction(),
+                onIndexUse: this.getCtxDbIndexUseHook(),
+                onStalePatchDropped: (event) => {
+                    this.recordStalePatchDropped(event);
+                },
+                // Bound to THIS dispatch's reactive-cache read scope (\`handleRpc\`
+                // threads it in), so two concurrent queries never stamp each
+                // other's dep sets. \`executeSubscription\` overrides both with its
+                // own \`ReadFootprint\` pair instead, and a dispatch with neither
+                // gets an unbound hook that stamps no deps.
+                onRead: options.onRead ?? this.getCtxDbReadHook(options.scope),
+                // Left \`undefined\` when there is no scope so \`createShardCtxDb\`
+                // keeps its own "degrade a provable slice to a whole-table dep"
+                // fallback rather than reporting into a no-op.
+                onReadRange: options.onReadRange ?? (options.scope === undefined ? undefined : this.getCtxDbReadRangeHook(options.scope)),${M?`
+                // Vectorize is outside this shard's SQLite and cannot roll back, so
+                // the sync is held until the mutation's transaction has COMMITTED
+                // (\`deferAfterCommit\`) instead of running inline. Inline, a write
+                // that later aborted left a vector pointing at a row that does not
+                // exist — which a search then surfaces — and a rolled-back delete
+                // left the row with its vector already purged. Outside a
+                // transaction (an action) nothing is open and it runs at once.
+                onWrite: onWrite === undefined ? undefined : (event) => this.deferAfterCommit(() => onWrite(event)),`:""}
+                scheduler,
+                schema: schema as unknown as SchemaLike,
+                sql: this.sql as SqlExec,
+                storage,${ke?`
+                globalDb,`:""}
+            }`,un=`        /**
+         * The bare writer every admin/maintenance entry point writes through.
+         *
+         * Admin and maintenance writes go through the SAME reactive-cache hooks as a
+         * user mutation. Without this, a studio row edit, a TTL sweep, an admin
+         * import, a CDC apply or a data-migration backfill writes without
+         * invalidating, and the next query answers from the pre-write snapshot.
+         *
+         * \`headroom\` meters the transaction. An admin \`/rpc\` caller passes nothing
+         * and falls back to \`this.transactionHeadroom()\`, which for an admin RPC is
+         * \`undefined\` — \`handleAdminRpc\` answers before \`beginDispatch\`, so no
+         * per-dispatch meter is in flight and a bulk loop is bounded by its per-call
+         * row cap alone. The TTL sweep (an alarm work item, no dispatch) passes its
+         * own by-value tracker explicitly instead.
+         */
+        private adminWriter(headroom?: TransactionHeadroomTracker): DatabaseWriterLike {
+            const env = (this.env ?? {}) as Record<string, unknown>;
+            const scheduler = (config.scheduler?.(env) ?? schedulerStub) as SchedulerLike;
+
+            return createShardCtxDb({
+                ...this.ctxDbTuning(),
+                broadcast: (delta) => {
+                    this.recordChangedTable(delta.table, delta.indexKeys);
+                },
+                cdc: config.cdc ?? false,
+                headroom,
+                // Live predicate, same as the user-facing ctx — see \`databaseOptions\`.
+                inTransaction: () => this.isInTransaction(),
+                scheduler,
+                schema: schema as unknown as SchemaLike,
+                sql: this.sql as SqlExec,
+            });
+        }`,V=(m="")=>`            const writer = this.adminWriter(${m});`,hn=M?`
+                vectors,`:"",pn=Ve?`
+                orm: bindOrm(facade),`:"",He=Ke?"config.hyperdriveGlobal":"config.d1",mn=ke?`            const globalRequest = { ...this.globalCdcOptions(config.cdc ?? false), bookmark: this.getInboundBookmark(), identity, onBookmark: (bookmarkValue: string | undefined) => { if (options.bookmarks !== undefined) { options.bookmarks.value = bookmarkValue; } }, userId };
+            const globalDb: DatabaseWriterLike = ${He}?.(env, globalRequest) ?? globalDbStub;
+`:"",gn=w&&ke?`
+        protected override async readGlobalShapeRows(resolved: { columns?: readonly string[]; effectiveWhere?: WhereInput; global?: boolean; table: string }, identity?: SubscriptionIdentity): Promise<Array<{ doc: Record<string, unknown>; id: string }>> {
+            const env = this.env as Record<string, unknown>;
+            // A shape read performs no writes, so the widened request only needs
+            // the inbound bookmark (pin the membership drain to the caller's own
+            // prior writes) — no \`onBookmark\` here.
+            //
+            // The two identity members are named rather than spread, matching the
+            // dispatch-path request built in \`buildCtx\`. A spread would also hand
+            // the global writer \`ip\`, and \`globalShapeReadKey\` — the per-flush
+            // cache in front of this read — keys on identity + userId only. Equal
+            // keys must mean equal rows, so a field the writer can scope by has to
+            // be either in the key or out of the request; it is out.
+            const globalRequest = { ...this.globalCdcOptions(config.cdc ?? false), bookmark: this.getInboundBookmark(), identity: identity?.identity, userId: identity?.userId };
+            const globalDb: DatabaseWriterLike = ${He}?.(env, globalRequest) ?? globalDbStub;
+            const rows: Array<{ doc: Record<string, unknown>; id: string }> = [];
+
+            let cursor: null | string = null;
+
+            // Drain every page of the global membership so the seed/diff sees the
+            // full rowset (D1 \`findMany\` is paginated). Stop one row past the cap:
+            // a broad \`.global()\` shape would otherwise materialize an unbounded
+            // array before the caller's \`withinGlobalShapeBound\` check rejects it,
+            // so bail early and let the caller fail it closed.
+            do {
+                // eslint-disable-next-line no-await-in-loop -- sequential page drain to assemble the full membership
+                const page = await globalDb.findMany(resolved.table, { cursor, where: resolved.effectiveWhere });
+
+                for (const doc of page.page) {
+                    rows.push({ doc, id: String((doc as { _id?: unknown })._id) });
+
+                    if (rows.length > ShardDOBase.GLOBAL_SHAPE_MAX_ROWS) {
+                        return rows;
+                    }
+                }
+
+                cursor = page.isDone ? null : page.continueCursor;
+            } while (cursor !== null);
+
+            return rows;
+        }
+
+        protected override async readGlobalChangedTables(sinceSeq: number, cursorOnly?: boolean): Promise<{ cursor: number; floor?: number; tables: string[] } | undefined> {
+            const env = this.env as Record<string, unknown>;
+            // Metadata-only: this asks the global changelog which TABLES moved,
+            // never what changed in them, so it costs one small read per poll tick
+            // for the whole shard — and a tick whose answer omits a shape's table
+            // skips that shape's membership drain entirely.
+            // Named local, not an inline object literal — same reason as the
+            // dispatch path and \`readGlobalShapeRows\`: \`bookmark\` is not declared
+            // on the narrower Hyperdrive thunk's \`request\` type, and an inline
+            // literal trips an excess-property error (TS2353) that makes the
+            // emitted \`shard.ts\` uncompilable for every Hyperdrive-global app with
+            // a \`defineShape\`. The Hyperdrive factory simply never reads it.
+            const globalRequest = { ...this.globalCdcOptions(config.cdc ?? false), bookmark: this.getInboundBookmark() };
+            const globalDb: DatabaseWriterLike = ${He}?.(env, globalRequest) ?? globalDbStub;
+
+            return globalDb.cdcChangedTables?.(sinceSeq, { cursorOnly });
+        }
+`:"",fn=oe?`
+const sourceClientCache = new WeakMap<object, Map<string, SourceClientLike>>();
+const sourcePollAtCache = new WeakMap<object, Map<string, number>>();
+`:"",bn=`
+        protected override async runShardInit(): Promise<void> {
+            this.ensureMigrated();
+${at?`            clearMemoryTables(this.sql as SqlExec, schema as unknown as SchemaLike);
+`:""}
+            await this.dispatchShardInit();
+        }
+`,yn=oe?`
+        protected override async pollExternalSources(trace?: TraceRefLike): Promise<number | undefined> {
+            const env = (this.env ?? {}) as Record<string, unknown>;
+            const sourced = Object.entries((schema as unknown as SchemaLike).tables)
+                .map(([table, definition]) => [table, (definition as { externalSource?: ExternalSourceLike }).externalSource] as const)
+                .filter((entry): entry is [string, ExternalSourceLike] => entry[1] !== undefined);
+
+            if (sourced.length === 0) {
+                return undefined;
+            }
+
+            const shardKey = this.currentShardKey();
+            const scheduler = (config.scheduler?.(env) ?? schedulerStub) as SchedulerLike;
+
+            let clients = sourceClientCache.get(this);
+
+            if (clients === undefined) {
+                clients = new Map();
+                sourceClientCache.set(this, clients);
+            }
+
+            let polledAt = sourcePollAtCache.get(this);
+
+            if (polledAt === undefined) {
+                polledAt = new Map();
+                sourcePollAtCache.set(this, polledAt);
+            }
+
+            const now = Date.now();
+            // \`nextDueAt\` tracks the EARLIEST next-due timestamp across every
+            // non-manual source; the shared alarm re-arms there instead of the
+            // fixed 2 s global-shape floor, so a large \`refresh.everyMs\` actually
+            // sleeps until it's due. Stays \`undefined\` when every source is
+            // \`refresh: "manual"\`, so the shared alarm goes idle for this tier.
+            let nextDueAt: number | undefined;
+
+            for (const [table, source] of sourced) {
+                if (source.refresh === "manual") {
+                    continue;
+                }
+
+                if (isSourceDue(source.refresh, polledAt.get(table), now)) {
+                    try {
+                        let client = clients.get(source.binding);
+
+                        if (client === undefined) {
+                            client = config.sourceClient?.(env, source.binding);
+
+                            if (client !== undefined) {
+                                clients.set(source.binding, client);
+                            }
+                        }
+
+                        if (client === undefined) {
+                            // No SqlClient resolved for this binding (host never wired
+                            // \`config.sourceClient\`, or wired it wrong). Surface it in the
+                            // Logs panel and stamp \`polledAt\` so a persistent misconfig backs
+                            // off to \`refresh.everyMs\` instead of retrying every alarm tick.
+                            this.recordExternalSourceError(table, new Error(\`external-source: no sourceClient resolved for binding "\${source.binding}"\`), trace);
+                        } else {
+                            // A FRESH tracker per TABLE, not one shared across the whole
+                            // loop: one table's runaway pull must not spend a budget a
+                            // sibling table needs, and a limit hit here must not block
+                            // that sibling from getting its own full budget this tick.
+                            const writer = createShardCtxDb({
+                                // Admin and maintenance writes go through the SAME reactive-cache hooks as
+                                // a user mutation. Without this, a studio row edit, a TTL sweep, an admin
+                                // import, a CDC apply or a data-migration backfill writes without
+                                // invalidating, and the next query answers from the pre-write snapshot.
+                                ...this.ctxDbTuning(),
+                                broadcast: (delta) => {
+                                    this.recordChangedTable(delta.table, delta.indexKeys);
+                                },
+                                cdc: config.cdc ?? false,
+                                headroom: this.alarmHeadroom(),
+                                scheduler,
+                                schema: schema as unknown as SchemaLike,
+                                sql: this.sql as SqlExec,
+                            });
+
+                            if (source.mode === "incremental") {
+                                // Incremental (plan 136): pull only rows past the durable
+                                // watermark (or a full-pull seed/reconcile), upsert-only.
+                                // eslint-disable-next-line no-await-in-loop -- one sourced table at a time; sequential keeps the writer transaction simple
+                                await pullExternalSourceIncrementalTick(this.sql as SqlExec, writer, client, table, source, shardKey, now);
+                            } else {
+                                // eslint-disable-next-line no-await-in-loop -- one sourced table at a time; slices are independent but small and sequential keeps the writer transaction simple
+                                await pullExternalSourceTick(this.sql as SqlExec, writer, client, table, source, shardKey);
+                            }
+                        }
+
+                        // Timestamp AFTER the poll finishes, not the batch-start \`now\` — a
+                        // poll that outruns \`everyMs\` must not make \`nextDueAt\` (below)
+                        // stale-immediate and re-arm the alarm in a hammering loop.
+                        polledAt.set(table, Date.now());
+                    } catch (error) {
+                        if (error instanceof LunoraError && error.code === "TRANSACTION_LIMIT_EXCEEDED") {
+                            // Batch full, not a genuine failure. Incremental mode only
+                            // persists its watermark AFTER a full apply (see
+                            // \`pullExternalSourceIncrementalTick\`), so this throw left it
+                            // untouched — the next tick safely re-pulls/re-applies the
+                            // SAME slice (idempotent upsert). Full-pull mode (and an
+                            // incremental source's own occasional full-pull/reconcile
+                            // sweep) has no resumable cursor at all — deliberately not
+                            // inventing one here; a retry just redoes the whole pull,
+                            // safe if wasteful. Either way: warn instead of
+                            // \`recordExternalSourceError\`, and leave \`polledAt\`
+                            // UNCHANGED (skip the stamp below via \`continue\`) so this
+                            // table stays "due" and \`nextPollAlarmTarget\`'s existing
+                            // due-now floor re-arms the shared alarm promptly — not a
+                            // fresh \`setAlarm(now)\`.
+                            this.recordExternalSourceWarning(
+                                table,
+                                \`external-source poll for "\${table}" hit the transaction limit mid-batch; resuming next tick: \${error.message}\`,
+                                trace,
+                            );
+
+                            nextDueAt = nextDueAt === undefined ? now : Math.min(nextDueAt, now);
+
+                            continue;
+                        }
+
+                        this.recordExternalSourceError(table, error, trace);
+                        // Stamp on failure too, so a persistently failing source throttles
+                        // to \`refresh.everyMs\` rather than being hammered every tick.
+                        polledAt.set(table, Date.now());
+                    }
+                }
+
+                // This source's own next-due time, read AFTER the poll-or-skip above
+                // so a just-polled source reports \`now + everyMs\` (its FRESH due
+                // time), not the stale pre-poll one. An omitted \`refresh\` (poll
+                // every tick) is due again immediately.
+                const sourceNextDueAt = source.refresh === undefined ? now : (polledAt.get(table) ?? now) + source.refresh.everyMs;
+
+                nextDueAt = nextDueAt === undefined ? sourceNextDueAt : Math.min(nextDueAt, sourceNextDueAt);
+            }
+
+            return nextDueAt;
+        }
+`:"",wn=ot.length>0,kn=`
+        public constructor(state: ShardDOState, env: unknown) {
+            super(state, env, {
+                // Every writer this file builds spreads the ctxDbTuning() slice —
+                // the user-facing ctx and all three admin/maintenance writers — so
+                // the base class can drop its coarse invalidation backstop. Only the
+                // emitter can know that; a hand-written subclass leaves this unset
+                // and keeps the backstop.
+                ctxDbCacheWired: true,
+                ...(config.maxRelationKeys === undefined ? {} : { maxRelationKeys: config.maxRelationKeys }),
+                ...(config.reactiveCache ? { reactiveCache: config.reactiveCache === true ? {} : config.reactiveCache } : {}),
+                ...(config.relationExistsPushDown === undefined ? {} : { relationExistsPushDown: config.relationExistsPushDown }),
+            });
+${oe?`
+            const autoSourced = Object.values((schema as unknown as SchemaLike).tables).some((definition) => {
+                const source = (definition as { externalSource?: ExternalSourceLike }).externalSource;
+
+                return source !== undefined && source.refresh !== "manual";
+            });
+
+            if (autoSourced) {
+                void this.scheduleSourcePoll();
+            }
+`:""}${wn?`
+            if (LUNORA_TTL_SWEEPS.length > 0) {
+                void this.scheduleTtlSweep();
+            }
+`:""}        }
+
+        protected override isCacheableQuery(functionPath: string): boolean {
+            // NOT \`kind === "query"\` alone. A cache hit answers without running
+            // \`handleRpc\`, so the \`internal\` refusal at the top of it is skipped —
+            // and an \`internalQuery\` primed by a trusted system dispatch was then
+            // served to an anonymous client that the refusal would have 404'd.
+            //
+            // \`perDispatch\` is the same argument one layer out: the procedure's
+            // own \`.use()\` chain runs INSIDE \`handleRpc\`, so a hit skips it too.
+            // A \`.use(rateLimit(...))\` query was therefore charged once and then
+            // served from the memo to every later request — each of which still
+            // reached this Durable Object and still cost it a dispatch, so only
+            // the accounting was skipped. Metering and memoizing are mutually
+            // exclusive; the author asking for the first is choosing against the
+            // second.
+            const registered = LUNORA_FUNCTIONS[functionPath];
+
+            return registered?.kind === "query" && registered.visibility !== "internal" && registered.perDispatch !== true;
+        }
+
+        protected override isPaidFunction(functionPath: string): boolean {
+            return LUNORA_FUNCTIONS[functionPath]?.x402 !== undefined;
+        }
+`,xn=Ve?`
+            const facade = db as unknown as Record<string, ReturnType<typeof bindTableFacade>>;
+${k.tables.map(m=>`            facade[${JSON.stringify(m.name)}] = bindTableFacade(db, ${JSON.stringify(m.name)});`).join(`
+`)}
+`:"",vn=`${he.build}${z.build}${P.build}${Y.build}${pe.build}
+            const secrets = createSecrets(env);
+`,Sn=`${he.contextField}${z.contextField}${P.contextField}${ne.contextField}${Y.contextField}${pe.contextField}
+                secrets,`,Rn=ne.build,ut=y||g||d||x||R||$,$n=ut?`
+            // ActionCtx-only helpers (external, non-deterministic I/O): constructed
+            // and attached only for an \`action\` so query/mutation ctx never carry them.
+            if (isAction) {
+${U.build}${K.build}${Q.build}${j.build}${re.build}${p}${[...y?["                ctx.images = images;"]:[],...g?["                ctx.sql = sql;"]:[],...d?["                ctx.browser = browser;"]:[],...x?["                ctx.r2sql = r2sql;"]:[],...R?["                ctx.pipelines = pipelines;"]:[],...$?["                ctx.x402 = x402;"]:[]].join(`
+`)}
+            }
+`:"",Tn=ut?`            const isAction = LUNORA_FUNCTIONS[options.functionPath ?? ""]?.kind === "action";
+`:"";return`${S}${xe.join(`
+`)}
+
+type FunctionKind = "action" | "mutation" | "query";
+
+interface FunctionReference {
+    __lunoraRef: string;
+}
+
+/** Foreign-key columns per table (\`v.id("target")\` fields) for the data browser. */
+const LUNORA_TABLE_REFS = ${I(jt,"Record<string, Record<string, string>>")};
+
+/** Declared indexes per table (secondary, search, geo, rank, vector) for the schema viewer. */
+const LUNORA_TABLE_INDEXES = ${I(Wt,'Record<string, Array<{ fields: string[]; name: string; type: "geo" | "index" | "rank" | "search" | "vector"; unique?: boolean }>>')};
+
+/** Columns per table (typed, with PK/FK markers) for the studio's schema diagram, served via \`__lunora_admin__:describeTable\`. */
+const LUNORA_TABLE_COLUMNS = ${I(Ut,`Record<
+    string,
+    Array<{
+        bucket?: string;
+        enumValues?: string[];
+        isStorage?: boolean;
+        name: string;
+        nullable?: boolean;
+        onDelete?: "cascade" | "restrict" | "set null";
+        optional: boolean;
+        pk?: boolean;
+        ref?: string;
+        type: string;
+    }>
+>`)};
+
+/** Storage-key columns per table (\`v.storage(...)\` fields) for the file browser's records↔files join. */
+const LUNORA_STORAGE_COLUMNS = ${I(Kt,"Record<string, string[]>")};
+
+/** Declarative TTL policies (\`.ttl(field, { after? })\`) the DO alarm sweep auto-expires rows for. */
+const LUNORA_TTL_SWEEPS = ${I(ot,"Array<{ after?: number; field: string; softDeleteField?: string; table: string }>")};
+
+/** Static schema advisories (computed by @lunora/advisor at codegen time) served via \`__lunora_admin__:getAdvisories\`. */
+const LUNORA_ADVISORIES = ${I(Dt,"AdvisoryFinding[]")};
+
+/** Every declared procedure (discovered by @lunora/codegen) served via \`__lunora_admin__:getAdvisorProcedures\` — the health map's denominator. */
+const LUNORA_ADVISOR_PROCEDURES = ${I(Lt,"AdvisorProcedure[]")};
+
+/** Read-only RLS metadata (policies + roles discovered from \`.use(rls(...))\` chains) served via \`__lunora_admin__:rlsPolicies\` for the studio's RLS inspector. */
+const LUNORA_RLS_METADATA = ${I(tt,"RlsPoliciesResult")};
+${ct}
+/** Read-only masking metadata (table + column + strategy discovered from \`.use(mask(...))\` chains) served via \`__lunora_admin__:maskPolicies\` for the studio's data-browser mask preview. */
+const LUNORA_MASK_METADATA = ${I(Et,"MaskPoliciesResult")};
+
+/** Read-only storage access-rule metadata (discovered from \`.use(storageRules(...))\` chains) served via \`__lunora_admin__:storageRules\` for the studio's access-rules view. */
+const LUNORA_STORAGE_RULES = ${I(_t,"StorageRulesResult")};
+
+/** Which optional package-backed features this app wires up (discovered from imports / \`ctx.*\` reads / schema signals) served via \`__lunora_admin__:studioFeatures\` so the studio hides nav pages whose package isn't enabled. */
+const LUNORA_STUDIO_FEATURES = ${I(Pt,"StudioFeaturesResult")};
+${q}${J.constant}${Mt}${Bt}${ge}${Fe}${me}${qe}
+export interface ShardDOConfig {
+    /** Opt into change-data-capture: records a post-image to \`__cdc_log\` on every write (backs streaming export + replay-PITR). */
+    cdc?: boolean;
+    /** Ceiling on the join keys one relation-crossing \`where\` predicate may pre-resolve via semijoin before failing closed. Omit for the engine default. */
+    maxRelationKeys?: number;
+    /** Enable the per-shard reactive query cache: \`true\` for the defaults, or an options object to tune the caps. Query results are memoized by \`(functionPath, args, identity)\` and invalidated by the ctx-db write hooks before the subscription broadcast, so subscribers never observe a pre-write value. Omitted (or \`false\`) keeps every dispatch re-running its handler. */
+    reactiveCache?: boolean | { maxBytes?: number; maxEntries?: number };
+    /** Resolution policy for a relation-crossing \`where\` whose child is co-located in this shard: \`"auto"\` (cost-based, the engine default), \`"always"\` (inline correlated EXISTS) or \`"never"\` (universal semijoin). All three return identical rows. */
+    relationExistsPushDown?: "always" | "auto" | "never";
+    /** Optional telemetry sink. When supplied, each \`ctx.log.*\` call is forwarded to \`sink.onLog\`. Pass the SAME sink you give \`createWorker({ observability })\` (which drives \`onRpc\`) to route both RPC and log events. */
+    observability?: (env: Record<string, unknown>) => TelemetrySink | undefined;
+    /** \`unknown\` because \`@lunora/scheduler\`'s \`Scheduler\` is not assignable to \`SchedulerLike\`; the shard casts it. */
+    scheduler?: (env: Record<string, unknown>) => unknown;
+    /** \`origin\` is the origin the current \`/rpc\` request reached the worker on — the fallback base for signed object URLs when no \`publicBaseUrl\` is configured. \`undefined\` off the synchronous dispatch path. */
+    storage?: (env: Record<string, unknown>, origin?: string) => unknown;${zt}${Ie}${z.configField}${P.configField}${Y.configField}${U.configField}${K.configField}${Q.configField}${j.configField}${re.configField}${We}${Ue}${Jt}${Yt}${Xt}
+}
+${C("schedulerStub",tn,["cancel","runAfter","runAt"])}${C("storageStub",nn,["delete","download","getMetadata","getSignedUrl","getUrl","head","list","upload"],{sync:["getUrl"]})}${rn}${fn}${an}${De}${z.stub}${P.stub}${Y.stub}${U.stub}${K.stub}${Q.stub}${j.stub}${re.stub}${et}${ae}
+// Bound in-process \`ctx.run*\` composition depth so a self- or cyclically-
+// referencing call fails loudly with a clear error instead of overflowing the
+// stack. Tracked across the awaited handler chain (one DO invocation is
+// single-threaded), so the counter reflects true nesting depth.
+const MAX_RUN_DEPTH = 32;
+let runDepth = 0;
+
+const dispatchRun = async (
+    expected: FunctionKind,
+    functionPath: string,
+    args: Record<string, unknown>,
+    ctx: unknown,
+    // The kind of the context making the call, and — for a mutation target — the
+    // transaction wrapper to run it under. Both are supplied by \`buildCtx\`, which
+    // is the only place that knows which dispatch this \`ctx\` belongs to. Widened
+    // past \`FunctionKind\` because the registry also carries \`"stream"\`, and
+    // \`undefined\` for a ctx built outside a registered function (admin, migration).
+    callerKind?: "stream" | FunctionKind,
+    runTransactional?: (work: () => Promise<unknown>) => Promise<unknown>,
+): Promise<unknown> => {
+    // A query is read-only. The ctx object installs \`run*\` on every kind (one
+    // shape, built once), so the TYPE is all that stops a query from writing —
+    // and a cast walks straight past it, inside a subscription re-run that can
+    // execute many times per write. Checked on the CALLER, before the registry
+    // lookup, so \`ctx.runMutation\` from a query fails identically whatever it
+    // aimed at.
+    if (callerKind === "query" && expected !== "query") {
+        throw new LunoraError(
+            "RUN_KIND_FORBIDDEN",
+            \`ctx.run\${expected[0]!.toUpperCase()}\${expected.slice(1)}: a query may only compose other queries (tried to run "\${functionPath}")\`,
+        );
+    }
+
+    const registered = LUNORA_FUNCTIONS[functionPath];
+
+    if (!registered) {
+        throw new Error(\`unknown function: \${functionPath}\`);
+    }
+
+    if (registered.kind !== expected) {
+        throw new Error(\`ctx.run\${expected[0]!.toUpperCase()}\${expected.slice(1)}: "\${functionPath}" is registered as a \${registered.kind}, not a \${expected}\`);
+    }
+
+    if (runDepth >= MAX_RUN_DEPTH) {
+        throw new LunoraError("RUN_DEPTH_EXCEEDED", \`ctx.run*: composition depth limit (\${MAX_RUN_DEPTH}) exceeded — likely a cyclic runQuery/runMutation\`);
+    }
+
+    runDepth += 1;
+
+    try {
+        // A mutation composed from an action (or an http action) is the shape the
+        // docs prescribe for atomicity — "do the transactional reads and writes in
+        // a mutation and call it from the action". It only holds if the composed
+        // dispatch gets the same BEGIN/COMMIT span and single-writer gate the
+        // top-level mutation path gets; without it every write autocommits and a
+        // mid-handler throw leaves the earlier ones durable. A \`runMutation\` from
+        // inside a mutation rides the enclosing span instead of opening a second
+        // one (see \`runMutationTransaction\`).
+        if (runTransactional) {
+            return await runTransactional(async () => registered.handler(ctx, args));
+        }
+
+        return await registered.handler(ctx, args);
+    } finally {
+        runDepth -= 1;
+    }
+};
+
+/**
+ * Build the project's shard Durable Object. Export the result as \`ShardDO\`
+ * from the worker entry so wrangler binds it by name.
+ */
+export const createShardDO = (config: ShardDOConfig = {}): new (state: ShardDOState, env: unknown) => ShardDOBase =>
+    class extends ShardDOBase {${kn}
+        private migrated = false;
+
+        public override async handleRpc(functionPath: string, args: Record<string, unknown>, headroom?: TransactionHeadroomTracker, scope?: QueryReadScope, bookmarks?: DispatchBookmark): Promise<unknown> {
+            const registered = LUNORA_FUNCTIONS[functionPath];
+
+            // Internal functions are reachable server-side only: via \`ctx.run*\`
+            // composition, or a trusted system dispatch (scheduler/cron, marked by
+            // \`isSystemDispatch()\`). A client RPC never carries that flag, so its
+            // internals stay not-found and never leak across the external boundary.
+            if (!registered || (registered.visibility === "internal" && !this.isSystemDispatch())) {
+                throw new LunoraError("FUNCTION_NOT_FOUND", \`function not registered: \${functionPath}\`);
+            }
+
+            this.ensureMigrated();
+
+            // \`headroom\`, when the caller supplied one, is threaded straight
+            // through to \`buildCtx\` — bypassing its \`this.transactionHeadroom()\`
+            // fallback (the racy shared-field read) entirely for THIS dispatch.
+            // The main \`/rpc\` path always supplies one; \`dispatchLifecycle\` /
+            // \`handleRunAs\` don't mint their own and omit it, so they keep the
+            // prior fallback behavior unchanged.
+            //
+            // \`scope\` is the reactive cache's per-dispatch read capture, threaded
+            // the same way and for the same reason: the ctx-db read hooks resolve
+            // their tracker at READ time, so binding them to the scope THIS
+            // dispatch was handed is what keeps a concurrent query's reads out of
+            // our dep set — and ours out of theirs. A dispatch with no scope (a
+            // mutation, an action, a cache-less shard) builds unbound hooks that
+            // stamp no deps.
+            const ctx = this.buildCtx({ bookmarks, functionPath, headroom, scope, trusted: registered.lifecycle === "init" });
+
+            // A mutation's writes must commit all-or-nothing, so its dispatch runs
+            // under \`runMutationTransaction\` — the ONE place that opens the span,
+            // settles the deferred schedules and flushes the deferred deletes. The
+            // same helper backs \`ctx.runMutation\` and \`runReactor\`, because a
+            // mutation reached by composition is promised exactly these guarantees
+            // and used to get none of them.
+            //
+            // The replay bookkeeping (idempotency dedup row + custom-mutator
+            // watermark advance) commits INSIDE the span via
+            // \`commitMutationBookkeeping\`, so the writes, the dedup row, and the
+            // watermark are atomic — a crash can't leave the writes durable without
+            // the replay guard. It is deliberately NOT in the shared helper: it is
+            // per-REQUEST bookkeeping, and a composed sub-mutation has no request of
+            // its own to record.
+            if (registered.kind === "mutation") {
+                return await this.runMutationTransaction(ctx, async () => {
+                    const value = await registered.handler(ctx, args);
+
+                    this.commitMutationBookkeeping(value);
+
+                    return value;
+                });
+            }
+
+            const result = await registered.handler(ctx, args);
+
+            // An action is not itself transactional, but \`ctx.runMutation\` runs its
+            // submutations on THIS ctx, so anything they queued after their own
+            // transaction settled lands here. A dispatch with nothing queued no-ops.
+            await this.deferPastResponse(flushDeferredDeletes(ctx));
+
+            return result;
+        }
+
+        /**
+         * Run one mutation handler with the atomicity every caller of a mutation is
+         * promised: a BEGIN/COMMIT span (with the single-writer gate
+         * \`ShardRunner.runInTransaction\` composes in front of it), scheduled jobs
+         * held until that span commits, and the deferred object deletes flushed
+         * only once it has.
+         *
+         * Shared by the three entry points that dispatch a mutation handler — the
+         * top-level RPC, \`ctx.runMutation\` from an action or http action, and a
+         * reactor — because the guarantee is a property of the mutation, not of how
+         * it was reached. The docs tell users to put the transactional part in a
+         * mutation and call it from the action precisely so that composition is
+         * atomic.
+         *
+         * A \`ctx.runMutation\` issued from inside a mutation is NESTED: SQLite-in-DO
+         * has no savepoints and \`runInTransaction\` rejects a second open, so it
+         * rides the enclosing span, which also owns its commit and therefore its
+         * scheduler flush.
+         *
+         * Both deferral windows are opened here and settled against the SAME
+         * outcome. The delete window is what keeps a composed mutation's queued
+         * object deletes off the caller's flush when it rolls back: \`ctx\` is
+         * shared, so without a window the keys are indistinguishable from the
+         * action's own and the action's flush destroys objects whose rows the
+         * rollback put back.
+         */
+        private async runMutationTransaction<T>(ctx: unknown, work: () => Promise<T>): Promise<T> {
+            const settleSchedules = beginDeferredSchedules(ctx as { scheduler?: unknown });
+            // Synchronous and non-throwing (it only moves queue entries), so it can
+            // settle first on every path and cannot mask the outcome.
+            const settleDeletes = beginDeferredDeletes(ctx);
+
+            if (this.isInTransaction()) {
+                try {
+                    const nested = await work();
+
+                    settleDeletes(true);
+                    await settleSchedules(true);
+
+                    return nested;
+                } catch (error) {
+                    settleDeletes(false);
+                    await settleSchedules(false);
+
+                    throw error;
+                }
+            }
+
+            let result: T;
+
+            try {
+                result = await this.runInTransaction(work);
+            } catch (error) {
+                // The span rolled back, so the rows are gone and the jobs that were
+                // to run "after I commit" must go with them. Dropping them is the
+                // whole point of buffering: a persisted job for a write that never
+                // landed fires against state that does not exist.
+                //
+                // The queued object deletes go the same way, and for a sharper
+                // reason: the rows they were to clean up after are still there, and
+                // an R2 delete cannot be undone.
+                settleDeletes(false);
+                await settleSchedules(false);
+
+                throw error;
+            }
+
+            // Committed, so this span's queued keys join whatever the flush below
+            // (or an enclosing span's) will drain.
+            settleDeletes(true);
+
+            // Committed. Schedules first and AWAITED: \`runAfter(0, ...)\` is
+            // documented as the deterministic equivalent of an \`afterCommit\` hook,
+            // so the job must be enqueued after the commit, and a failure to enqueue
+            // it must be visible rather than swallowed.
+            //
+            // In a \`finally\`, because both halves of this are post-commit cleanup
+            // and neither is allowed to cancel the other. \`settleSchedules\` drains
+            // its whole queue and then rethrows what failed, so a SchedulerDO that
+            // refused one job used to take the object cleanup down with it — the
+            // rows were durably gone and their objects leaked with nothing logged.
+            try {
+                await settleSchedules(true);
+            } finally {
+                // Then the objects whose rows are now durably gone. Deliberately AFTER
+                // the span, never inside it: an R2 delete cannot roll back, so a delete
+                // issued from within a transaction that later aborts destroys data the
+                // surviving row still points at.
+                //
+                // \`flushDeferredDeletes\` never rejects — the mutation has already
+                // succeeded, so a failed cleanup must not turn into a failed response.
+                // A leaked object is reported through \`ctx.log\` instead, with its key.
+                await this.deferPastResponse(flushDeferredDeletes(ctx));
+            }
+
+            return result;
+        }
+
+        // Only a \`mutation\` may enter the base class's single-writer gate for
+        // mutation-replay dedup — it is \`blockConcurrencyWhile\`, so gating an
+        // action would stall every other dispatch on the shard for the length of
+        // its outbound I/O, on nothing but a caller-supplied header. Unregistered
+        // paths answer \`false\`; \`handleRpc\` above rejects them anyway.
+        protected override isMutationFunction(functionPath: string): boolean {
+            return LUNORA_FUNCTIONS[functionPath]?.kind === "mutation";
+        }
+
+        // The scheduler the deferred-schedule outbox retries through. Only the
+        // CONFIGURED one: falling back to \`schedulerStub\` would have an app with no
+        // scheduler retry every entry against a thrower until the attempt ceiling
+        // parked it, and there is nothing to park — an app with no scheduler has no
+        // \`ctx.scheduler\` call that reached the buffer in the first place.
+        protected override scheduleOutboxScheduler(): SchedulerLike | undefined {
+            return config.scheduler?.((this.env ?? {}) as Record<string, unknown>) as SchedulerLike | undefined;
+        }
+${it.override}
+        protected override async executeSubscription(functionPath: string, args: Record<string, unknown>, identity?: SubscriptionIdentity): Promise<{ ranges?: Map<string, KeyRange[]>; result: unknown; tables: Set<string> } | null> {
+            const registered = LUNORA_FUNCTIONS[functionPath];
+
+            if (!registered || registered.kind !== "query" || registered.visibility === "internal") {
+                return null;
+            }
+
+            this.ensureMigrated();
+
+            const footprint = createReadFootprint();
+            // Identity is threaded EXPLICITLY from the (deferred/interleaved)
+            // subscription caller — never read from the shared per-request field
+            // here — so a concurrent RPC can't leak its identity into this re-run.
+            const ctx = this.buildCtx({ functionPath, headroom: this.subscriptionHeadroom(), identity, onRead: footprint.onRead, onReadRange: footprint.onReadRange });
+            const result = await registered.handler(ctx, args);
+
+            // Ranges come from THIS run's reads, never a shared field on the DO:
+            // a deferred re-run interleaves with unrelated dispatches.
+            return { ranges: footprint.ranges(), result, tables: footprint.tables };
+        }
+
+        protected override executeStream(functionPath: string, args: Record<string, unknown>, identity?: SubscriptionIdentity): null | { durable?: { ttlMs?: number }; iterator: (signal: AbortSignal) => AsyncIterable<unknown> } {
+            const registered = LUNORA_FUNCTIONS[functionPath];
+
+            if (!registered || registered.kind !== "stream" || registered.visibility === "internal") {
+                return null;
+            }
+
+            this.ensureMigrated();
+
+            return {
+                ...(registered.durable ? { durable: registered.durable as { ttlMs?: number } } : {}),
+                // Identity threaded EXPLICITLY from the socket, exactly as
+                // \`executeSubscription\` above: the iterator is pulled after this
+                // frame returned, interleaved with unrelated dispatches, so
+                // \`buildCtx\`'s per-request fallback would run an \`rls()\` /
+                // \`ctx.auth\` stream as nobody — or as a concurrent RPC's caller.
+                iterator: (signal) => (registered.handler as (context: unknown, args: Record<string, unknown>, signal: AbortSignal) => AsyncIterable<unknown>)(this.buildCtx({ functionPath, identity }), args, signal),
+            };
+        }
+${Vt}${Qt}${gn}${yn}
+        protected override lifecycleHookPaths(event: "connect" | "disconnect" | "init" | "reactor" | "whisper"): readonly string[] {
+            return LUNORA_LIFECYCLE_HOOKS[event];
+        }
+${bn}
+        // One \`onQueryChange\` dispatch. Mirrors \`executeSubscription\` — the
+        // socket-terminated half of the same reactivity — and differs only in who
+        // consumes the result: the base's \`dispatchReactors\` stores the digest as
+        // the new baseline and the footprint as the "should I even re-run this"
+        // gate, instead of pushing a frame down a socket.
+        //
+        // Dispatched through \`runMutationTransaction\` because a reactor handler is
+        // a mutation: its writes must commit all-or-nothing, the jobs it schedules
+        // must wait for that commit, and the objects its row deletes orphaned must
+        // be flushed once it lands. Safe to open a span here: the refresh drain
+        // runs OUTSIDE any dispatch transaction (it is post-flush background work),
+        // so this never nests.
+        //
+        // NO identity is threaded, and the ctx is built \`trusted\`. A reactor fires
+        // because data moved, not because anyone asked, so there is no user for RLS
+        // to scope to — it runs in the same system tier as migrations and the
+        // external-source poll loop. Inheriting the shared per-request identity
+        // would instead run an app's reactor as whichever user happened to write
+        // last, which is worse than running it as nobody.
+        protected override async runReactor(functionPath: string, previousDigest?: string): Promise<{ digest: string; ran: boolean; tables: readonly string[] } | undefined> {
+            const registered = LUNORA_FUNCTIONS[functionPath];
+
+            if (!registered || registered.kind !== "mutation") {
+                return undefined;
+            }
+
+            this.ensureMigrated();
+
+            const footprint = createReadFootprint();
+            const ctx = this.buildCtx({ functionPath, headroom: this.subscriptionHeadroom(), onRead: footprint.onRead, onReadRange: footprint.onReadRange, trusted: true });
+            const outcome = (await this.runMutationTransaction(ctx, async () =>
+                registered.handler(ctx, { previousDigest } as unknown as Record<string, unknown>),
+            )) as {
+                digest: string;
+                ran: boolean;
+            };
+
+            return { digest: outcome.digest, ran: outcome.ran, tables: [...footprint.tables] };
+        }
+
+
+        protected override tableRefs(table: string): Record<string, string> | undefined {
+            return LUNORA_TABLE_REFS[table];
+        }
+
+        protected override tableIndexes(table: string): Array<{ fields: string[]; name: string; type: "geo" | "index" | "rank" | "search" | "vector"; unique?: boolean }> {
+            return LUNORA_TABLE_INDEXES[table] ?? [];
+        }
+
+        protected override ttlSweeps(): ReadonlyArray<{ after?: number; field: string; softDeleteField?: string; table: string }> {
+            return LUNORA_TTL_SWEEPS;
+        }
+
+        protected override tableColumns(table: string): Array<{
+            bucket?: string;
+            enumValues?: string[];
+            isStorage?: boolean;
+            name: string;
+            nullable?: boolean;
+            onDelete?: "cascade" | "restrict" | "set null";
+            optional: boolean;
+            pk?: boolean;
+            ref?: string;
+            type: string;
+        }> {
+            return LUNORA_TABLE_COLUMNS[table] ?? [];
+        }
+
+        protected override storageColumns(): Record<string, string[]> {
+            return LUNORA_STORAGE_COLUMNS;
+        }
+
+        protected override rlsMetadata(): RlsPoliciesResult {
+            return LUNORA_RLS_METADATA;
+        }
+
+        protected override maskMetadata(): MaskPoliciesResult {
+            return LUNORA_MASK_METADATA;
+        }
+
+        protected override storageRulesMetadata(): StorageRulesResult {
+            return LUNORA_STORAGE_RULES;
+        }
+
+        protected override studioFeatures(): StudioFeaturesResult {
+            return LUNORA_STUDIO_FEATURES;
+        }
+${J.evaluateOverride}${J.subscriptionOverride}${Ft}${qt}
+        protected override advisories(): AdvisoryFinding[] {
+            return LUNORA_ADVISORIES;
+        }
+
+        protected override advisorProcedures(): AdvisorProcedure[] {
+            return LUNORA_ADVISOR_PROCEDURES;
+        }
+
+${un}
+
+        protected override async runShardDataMigration(args: RunShardMigrationArgs): Promise<MigrationRunResult> {
+            this.ensureMigrated();
+
+            // Falls back to the framework's reserved re-projection backfill
+            // (\`__lunora_reproject__<table>\`), which rewrites rows whose
+            // v.bigint()/v.bytes() columns are still stored in the pre-projection
+            // tagged form. Built here rather than at module scope because it
+            // needs this shard's \`sql\` handle to tell a legacy row from a
+            // current one.
+            const migration = LUNORA_MIGRATIONS[args.id] ?? buildReprojectionMigration(args.id, schema as unknown as SchemaLike, this.sql as SqlExec);
+
+            if (!migration) {
+                throw new LunoraError("MIGRATION_NOT_FOUND", \`data migration "\${args.id}" is not registered\`, { status: 404 });
+            }
+
+${V()}
+
+            return runDataMigration({
+                batchSize: args.batchSize,
+                direction: args.direction,
+                dryRun: args.dryRun,
+                maxBatches: args.maxBatches,
+                migration: migration as unknown as DataMigrationLike,
+                // Flush after each batch so live migrationStatus subscribers see
+                // progress mid-run (the base method records the reserved state
+                // table the raw-SQL progress write is invisible to the tracker).
+                onBatch: () => this.flushMigrationProgress(),
+                sql: this.sql as SqlExec,
+                writer,
+            });
+        }
+
+        protected override async runShardWrite(args: RunShardWriteArgs, headroom?: TransactionHeadroomTracker): Promise<RunShardWriteResult> {
+            const definition = (schema as unknown as SchemaLike).tables[args.table];
+
+            if (!definition) {
+                throw new LunoraError("UNKNOWN_TABLE", \`unknown table: \${args.table}\`, { status: 404 });
+            }
+
+            // \`.global()\` tables live in D1, not this DO's SQLite — editing them
+            // here would corrupt nothing but would fail confusingly, so reject up
+            // front with a clear code the studio can surface.
+            if (definition.shardMode?.kind === "global") {
+                throw new LunoraError("GLOBAL_TABLE_NOT_EDITABLE", \`table "\${args.table}" is global; edit it through D1, not the shard\`, { status: 400 });
+            }
+
+            this.ensureMigrated();
+
+${V("headroom ?? this.transactionHeadroom()")}
+
+            if (args.op === "insert") {
+                const id = await writer.insert(args.table, args.doc ?? {});
+
+                return { id, op: "insert" };
+            }
+
+            // Every by-id op PINS \`args.table\`. Unpinned, \`locateRowById\` probes
+            // every non-global table for the id, so a request naming table A with an
+            // id belonging to table B locates and mutates B's row — the by-id IDOR
+            // the per-table \`ctx.db.<table>\` facade pins against. Pinning also stops
+            // an absent row falling through to the \`.global()\` D1 twin, though that
+            // branch is already unreachable here: \`adminWriter\` is built without a
+            // \`globalDb\`, so a miss throws \`NOT_FOUND\` either way.
+            // \`hard\` is set only by the BULK delete arm, which needs the row gone
+            // from the physical table for its next batch's scan to make progress.
+            // A single-row \`writeRow\` delete never carries it, so it keeps the
+            // table's declared \`.softDelete()\` behaviour.
+            if (args.op === "delete") {
+                await writer.delete(args.id ?? "", args.table, { hard: args.hard === true });
+
+                return { id: args.id ?? null, op: "delete" };
+            }
+
+            if (args.op === "replace") {
+                await writer.replace(args.id ?? "", args.doc ?? {}, args.table);
+
+                return { id: args.id ?? null, op: "replace" };
+            }
+
+            await writer.patch(args.id ?? "", args.doc ?? {}, args.table);
+
+            return { id: args.id ?? null, op: "patch" };
+        }
+
+        // The base \`ShardDO\` cannot build a schema-aware writer, so its
+        // \`runShardExport\`/\`runShardImport\` return \`[]\` and \`{inserted:{}}\`.
+        // Those are success-shaped: an empty export is what a correct export of
+        // an empty shard looks like, so a backup of a populated sharded schema
+        // reported success and wrote nothing, and an import reported success and
+        // dropped every row. Overriding both here is what makes the two admin
+        // RPCs real for a \`.shardBy()\` table.
+        //
+        // NOTE: the admin export RPC is not paginated — \`parseExportShardArgs\`
+        // takes \`tables\`/\`batchSize\` but no cursor, and the coordinator issues
+        // one call per shard — so the rows are collected into a single response.
+        // \`batchSize\` bounds the SQLite scan page, not the reply. A shard holding
+        // more rows than fit in the DO's memory budget will therefore fail the
+        // export rather than stream it. That is a loud failure where the bug this
+        // replaces was a silent empty one, but a cursor on the RPC is what makes
+        // this a complete backup path for large shards.
+        protected override async runShardExport(args: RunShardExportArgs): Promise<ExportRow[]> {
+            this.ensureMigrated();
+
+${V()}
+
+            const rows: ExportRow[] = [];
+
+            // \`exportShardRows\` walks in keyset batches so a large table does not
+            // materialize at once inside the generator; the admin RPC's response
+            // is a single array, so it is collected here rather than streamed.
+            for await (const row of exportShardRows(writer, schema as unknown as SchemaLike, { batchSize: args.batchSize, tables: args.tables })) {
+                rows.push(row);
+            }
+
+            return rows;
+        }
+
+        protected override async runShardImport(args: RunShardImportArgs): Promise<ImportShardResult> {
+            this.ensureMigrated();
+
+${V()}
+
+            // \`importShardRows\` inserts with \`allowExplicitId\`, so a source
+            // database's \`_id\`s carry across verbatim and every foreign key
+            // referencing them stays valid without a second remapping pass.
+            return importShardRows(writer, schema as unknown as SchemaLike, { rows: args.rows, startLine: args.startLine });
+        }
+
+        protected override async runShardRankBefore(args: RunShardRankBeforeArgs): Promise<{ before: number; total: number }> {
+            this.ensureMigrated();
+
+${V()}
+
+            // \`rankBefore\` is optional on \`DatabaseWriterLike\` (the D1 twin omits it),
+            // but the shard writer from \`createShardCtxDb\` always defines it.
+            if (!writer.rankBefore) {
+                throw new LunoraError("NOT_IMPLEMENTED", "rankBefore is unavailable on the shard writer", { status: 500 });
+            }
+
+            return writer.rankBefore(args.table, args.index, {
+                partitionKey: args.partitionKey,
+                rowId: args.rowId,
+                sortValues: args.sortValues,
+            });
+        }
+
+        protected override async runShardFindRelated(args: RunShardFindRelatedArgs): Promise<RelatedPage> {
+            this.ensureMigrated();
+
+${V()}
+
+            // \`related\` is optional on \`DatabaseWriterLike\` (the D1 twin omits it),
+            // but the shard writer from \`createShardCtxDb\` always defines it — it
+            // derives the edge set from this app's schema.
+            if (!writer.related) {
+                throw new LunoraError("NOT_IMPLEMENTED", "findRelated is unavailable on the shard writer", { status: 500 });
+            }
+
+            return writer.related(
+                { id: args.id, table: args.table },
+                { cursor: args.cursor, depth: args.depth, direction: args.direction, edges: args.edges, limit: args.limit },
+            );
+        }
+
+        protected override async runShardRankPage(args: RunShardRankPageArgs): Promise<ShardRankPageResult> {
+            this.ensureMigrated();
+
+${V()}
+
+            // \`rankPageRows\` is optional on \`DatabaseWriterLike\` (the D1 twin omits it),
+            // but the shard writer from \`createShardCtxDb\` always defines it. The sort
+            // directions live in the schema's rankIndex, so the shard reads them itself;
+            // \`args.directions\` is only the coordinator's comparator hint and isn't forwarded.
+            if (!writer.rankPageRows) {
+                throw new LunoraError("NOT_IMPLEMENTED", "rankPage is unavailable on the shard writer", { status: 500 });
+            }
+
+            return writer.rankPageRows(args.table, args.index, {
+                after: args.after,
+                cursor: args.cursor,
+                partitionKey: args.partitionKey,
+                take: args.take,
+            });
+        }
+
+        protected override async runShardApplyCdc(args: RunShardApplyCdcArgs): Promise<{ applied: number }> {
+            this.ensureMigrated();
+
+${V()}
+
+            await applyCdcChanges(writer, args.changes);
+
+            return { applied: args.changes.length };
+        }
+
+        protected override ensureMigrated(): void {
+            if (this.migrated) {
+                return;
+            }
+
+            runShardMigrations(this.sql as SqlExec, schema as unknown as SchemaLike, { cdc: config.cdc ?? false${de} });
+            this.migrated = true;
+        }
+${Qe?`
+        protected override runShardSearchBackfill(options: { maxPages?: number }): SearchBackfillProgress {
+            // Migrations create the fts5 companions; without them every backfill
+            // statement would raise "no such table" on a shard that has never
+            // served a request.
+            this.ensureMigrated();
+
+            return backfillSearchIndexes(this.sql as SqlExec, schema as unknown as SchemaLike, options);
+        }
+`:""}${cn}
+        private buildCtx(options: { bookmarks?: DispatchBookmark; functionPath?: string; headroom?: TransactionHeadroomTracker; identity?: SubscriptionIdentity; onRead?: (table: string, idOrScan?: string) => void; onReadRange?: (range: KeyRange) => void; scope?: QueryReadScope; trusted?: boolean } = {}): unknown {
+            const env = (this.env ?? {}) as Record<string, unknown>;
+            // The caller context this ctx runs under, resolved ONCE on one
+            // discriminant. When the caller threads an explicit identity
+            // (subscription seed / refresh / stream pull / shape resolve — all
+            // deferred or interleaved), it is used by value and the shared
+            // per-request fields are never read, because a concurrent RPC owns
+            // them: a refresh in particular runs inside the writing dispatch's
+            // \`flushChangedTables\`, BEFORE its \`endDispatch\`, so \`getCurrentIp()\`
+            // there is the MUTATING caller's address. Otherwise (the synchronous
+            // RPC dispatch path) it falls back to those fields as before.
+            //
+            // One expression, not one per field: three parallel ternaries on the
+            // same discriminant is how \`ip\` came to be the only one still reading
+            // the shared field.
+            const caller: SubscriptionIdentity = options.identity ?? {
+                identity: this.getCurrentIdentity(),
+                ip: this.getCurrentIp(),
+                userId: this.getCurrentUserId(),
+            };
+            const { identity, ip, userId } = caller;
+${ln}${ue}${vn}${Ee}${Pe}${Le}${Be}
+            // Which dispatch this ctx belongs to. Drives the two deferral facades
+            // below and the \`ctx.run*\` caller guard; a ctx built for an
+            // admin/lifecycle path has no registered function, and so no kind.
+            const contextKind = LUNORA_FUNCTIONS[options.functionPath ?? ""]?.kind;
+            // \`list\`/\`get\` are the two methods \`ctx.db.system.query("_scheduled_functions")\`
+            // reaches through, and pending jobs live in the SchedulerDO — nothing the
+            // CDC changelog records — so reading them must forfeit a delta resume.
+            // The scheduler's own \`runAfter\`/\`runAt\`/\`cancel\` are writes and stay unstamped.
+            const schedulerBase = markUnvouchableReads((config.scheduler?.(env) ?? schedulerStub) as SchedulerLike, options.onRead, ["get", "list"]);
+            // \`ctx.scheduler.runAfter(0, ...)\` is documented as the deterministic
+            // equivalent of an \`afterCommit\` hook, and the SchedulerDO persists the
+            // job the moment it is called — so inside a mutation the call is BUFFERED
+            // and replayed after the transaction commits (a rollback drops it).
+            // Wrapped on the same dispatches as the deferred-delete queue and for the
+            // same reason: \`ctx.runMutation\` hands the CALLER's ctx to the callee, so
+            // a mutation reached from an action schedules through the action's ctx.
+            // An action's own schedules stay immediate — the window is only open
+            // while a transaction is (see \`runMutationTransaction\`).
+            //
+            // Every kind but \`query\` is wrapped, because \`runMutationTransaction\`
+            // is installed on \`ctx.runMutation\` for every kind but \`query\`: a
+            // STREAM ctx, and an admin/lifecycle ctx with no registered kind at all,
+            // both get the BEGIN/COMMIT span for a mutation they compose, and used
+            // to get it with the deferral missing — so that mutation's job reached
+            // the SchedulerDO while its transaction was still open, and survived the
+            // rollback. A query cannot host a mutation handler (\`dispatchRun\`
+            // refuses it) and its ctx is built on the hot subscription path, so it
+            // stays unwrapped.
+            //
+            // Wrapped OUTSIDE the read-stamping facade so \`get\`/\`list\` stay stamped.
+            //
+            // \`this.scheduleOutbox()\` is what keeps the buffer honest. Everything
+            // between the COMMIT and the scheduler's acknowledgement is outside the
+            // transaction, so a failure there leaves writes that are durable and a
+            // job that exists nowhere — and the mutation's replay-dedup row committed
+            // inside the span, so the client's retry is answered from cache and told
+            // it succeeded. The outbox takes custody of each buffered call inside the
+            // transaction and releases it once the scheduler has the job; what
+            // survives is retried by \`pollScheduleOutbox\` on the shared poll alarm.
+            const scheduler = contextKind === "query" ? schedulerBase : withDeferredSchedules(schedulerBase, this.scheduleOutbox());
+            // Build the storage adapter once and share it between \`ctx.storage\`
+            // and \`ctx.db.system._storage\` so both read the same R2 binding. The
+            // \`storageStub\` fallback satisfies SystemReaderStorageLike structurally
+            // (its \`list\`/\`getMetadata\` throw the "no storage configured" error).
+            //
+            // Wrapped BEFORE the split so both consumers share one stamping facade.
+            // Only the methods that actually reach R2 are stamped: \`getUrl\` and
+            // \`getSignedUrl\` build a URL from the configured base (and an HMAC) and
+            // read nothing, and they are what handlers overwhelmingly call — stamping
+            // them would forfeit resumes for a dependency that cannot move the result.
+            // \`bucket\` IS stamped: it hands back a sub-facade this wrapper does not
+            // reach, so the selection is the last point at which the read can be seen.
+            //
+            // The request origin is the storage base fallback for mutations and
+            // actions on the synchronous dispatch only. A deferred caller
+            // (\`options.identity\` set) runs outside the dispatch that owns the
+            // field, the same hazard \`getCurrentIp\` has. A query never gets it: a
+            // live query re-runs with no request behind it, and the reactive
+            // cache does not key on the host, so a query that signs URLs needs a
+            // declared \`publicBaseUrl\` either way.
+            const requestOrigin = contextKind !== "query" && options.identity === undefined ? this.getCurrentOrigin() : undefined;
+            const storage = markUnvouchableReads(asBucketStorage(config.storage?.(env, requestOrigin) ?? storageStub) as SystemReaderStorageLike, options.onRead, [
+                "bucket",
+                "download",
+                "getMetadata",
+                "list",
+            ]);
+            // \`ctx.storage.deleteAfterCommit(key)\`, on every dispatch that can host
+            // a MUTATION handler — which is not only a mutation dispatch:
+            // \`ctx.runMutation\` hands the CALLER's ctx to the callee, so a mutation
+            // reached from an action runs on the action's ctx. Wrapping mutations
+            // alone made that composition throw a bare TypeError on a method the
+            // handler's own type promises. Queries stay unwrapped: they cannot host
+            // one, and their ctx is built on the hot subscription path.
+            //
+            // Every dispatch wrapped here also flushes (see \`handleRpc\` and
+            // \`runReactor\`) — a queue nothing drains leaks silently, which is worse
+            // than not having the method at all.
+            //
+            // Wrapped OUTSIDE the read-stamping facade so \`bucket(name)\` still
+            // resolves through it and stays stamped, and applied only to
+            // \`ctx.storage\` so \`ctx.db.system._storage\` (which shares the adapter
+            // above) is untouched.
+            const contextStorage = contextKind === "mutation" || contextKind === "action" ? withDeferredDeletes(storage) : storage;
+            // \`ctx.log\`: the DO base builds the attributed logger (structured
+            // fields + \`.with(...)\` child + trace correlation) and routes each call
+            // to the optional \`observability\` sink. It also buffers the line (studio
+            // Logs panel) and emits a structured console event the dev-server formats.
+            //
+            // Resolved BEFORE \`ctx.db\` below, because the database is wrapped in
+            // auto-instrumentation that needs the sink, the trace anchor, and the
+            // dispatch's wide-event handle.
+            const observability = config.observability?.(env);
+            const logFunctionPath = options.functionPath ?? "";
+            const log = this.makeLogger(logFunctionPath, observability);
+            const traceAnchor = this.resolveDispatchAnchor(Boolean(options.identity));
+
+            // \`ctx.span\`: the handle onto the DISPATCH's own span — the wide-event
+            // surface. Attributes attached here accumulate for the whole request
+            // and are folded into the one span it already emits, instead of
+            // becoming N separate log lines. Shares \`traceAnchor\` with \`ctx.trace\`
+            // so both write to the same trace.
+            const span = this.makeDispatchSpan(traceAnchor, observability);
+
+${mn}            // \`ctx.db\`, wrapped in automatic instrumentation: by default this
+            // adds aggregate counters (call count, total time, per-operation
+            // breakdown) to the wide event rather than a span per call, so a
+            // handler making hundreds of queries stays readable. See
+            // \`instrumentDatabase\` for the \`"spans"\` / \`"off"\` levels.
+            const db: DatabaseWriterLike = this.instrumentDb(createShardCtxDb(${dn}), logFunctionPath, traceAnchor, observability);
+${xn}${je}
+
+            // \`ctx.trace\` / \`ctx.metrics\`: spans and measurements to the same sink.
+            // The trace anchor is threaded explicitly for the same reason \`identity\`
+            // is — a deferred caller (a subscription re-run) must not inherit the
+            // writing mutation's trace from the shared per-request field.
+            const trace = this.makeTracer(logFunctionPath, observability, traceAnchor);
+            const metrics = this.makeMetrics(logFunctionPath, observability);
+${Rn}
+            // \`ctx.now\`: the wall-clock instant (epoch ms) this function began,
+            // captured ONCE so the whole handler body sees a single stable value.
+            // A \`query\` handler is re-run by every live subscription that reads it,
+            // so \`Date.now()\` there flickers between re-evaluations. A \`mutation\`
+            // handler does not replay under ordinary dispatch (an OCC conflict throws
+            // to the caller rather than retrying internally), but one called from a
+            // workflow step or queue consumer runs again when that step replays. Both
+            // read time through \`ctx.now\` — the \`nondeterministic_query_mutation\`
+            // advisor flags \`Date.now()\`. Actions may still use ambient \`Date.now()\`.
+            const now = Date.now();
+
+            const ctx: Record<string, unknown> = {
+                auth: {
+                    getIdentity: async () => identity ?? null,
+                    userId: userId ?? null,
+                },
+                db,
+                // Instrumented \`fetch\`: a CLIENT span per outbound call plus W3C
+                // \`traceparent\` propagation, so time spent in a downstream service
+                // is visible and its spans join this trace. Degrades to the bare
+                // global when no sink is configured.
+                fetch: this.makeFetch(logFunctionPath, traceAnchor, observability),
+                // A GETTER, not a plain field, so the reactive cache can tell a
+                // handler that reads the caller's address from the majority that
+                // never do. \`ctx.ip\` is per-request state the memo must be keyed
+                // by — otherwise two anonymous callers share one entry and the
+                // second is served the first's address — but keying every entry
+                // by address would shard the cache per client for every query.
+                // Reading it here marks the dispatch's scope; \`runCachedQuery\`
+                // folds the address into the key for this function from then on.
+                get ip() {
+                    options.scope?.markIpRead();
+
+                    return ip;
+                },
+                log,
+                metrics,
+                now,${pn}
+                scheduler,
+                span,
+                storage: contextStorage,
+                trace,${hn}${Ce}${Sn}${ye}${_e}${Me}${Se}${fe}
+            };
+${Tn}${$n}
+            ctx.runAction = (reference: FunctionReference, fnArgs: Record<string, unknown>) => dispatchRun("action", reference.__lunoraRef, fnArgs, ctx, contextKind);
+            // The composed mutation runs under the SAME wrapper the top-level RPC
+            // uses, so "do the transactional work in a mutation and call it from the
+            // action" — the recipe the docs give for atomicity — actually is atomic.
+            ctx.runMutation = (reference: FunctionReference, fnArgs: Record<string, unknown>) =>
+                dispatchRun("mutation", reference.__lunoraRef, fnArgs, ctx, contextKind, async (work) => this.runMutationTransaction(ctx, work));
+            // \`ctx.runQuery(ref, args, { untracked: true })\` runs the sub-query on
+            // its OWN context, built without the subscription's read-footprint
+            // hooks — so its reads never enter this subscription's footprint and a
+            // write to the tables it touched does not re-run us. Everything else is
+            // inherited: \`functionPath\` (log/metric attribution), \`headroom\` (the
+            // sub-query must not escape this dispatch's resource ceiling),
+            // \`scope\` (the reactive-cache capture — an untracked sub-query's reads
+            // must still be deps of the entry the OUTER query is memoized as, or
+            // the memo goes stale), and — load-bearing — the resolved \`caller\` BY VALUE
+            // (identity, userId AND ip). Omitting it would let \`buildCtx\` fall back
+            // to the shared per-request fields, which a concurrent RPC may have
+            // re-set, and an RLS-scoped sub-query would then read as the wrong user
+            // from the wrong address. A tracked call keeps sharing \`ctx\` exactly as
+            // before.
+            ctx.runQuery = (reference: FunctionReference, fnArgs: Record<string, unknown>, runOptions?: { untracked?: boolean }) =>
+                dispatchRun(
+                    "query",
+                    reference.__lunoraRef,
+                    fnArgs,
+                    runOptions?.untracked === true
+                        ? this.buildCtx({ bookmarks: options.bookmarks, functionPath: options.functionPath, headroom: options.headroom, identity: caller, scope: options.scope })
+                        : ctx,
+                    contextKind,
+                );
+
+            return ctx;
+        }
+    };
+`},Ze=e=>{switch(e.kind){case"array":case"object":case"record":case"union":return{builder:"text",mode:"json",notNull:!0,typeAnnotation:N(e)};case"bigint":return{builder:"blob",mode:"bigint",notNull:!0};case"boolean":return{builder:"integer",mode:"boolean",notNull:!0};case"bytes":return{builder:"blob",mode:"buffer",notNull:!0};case"date":case"timestamp":return{builder:"integer",notNull:!0};case"from":return{builder:"text",notNull:!0,typeAnnotation:N(e)};case"id":return{builder:"text",notNull:!0};case"literal":{const t=e.literalValue??"";return t.startsWith('"')||t.startsWith("'")?{builder:"text",notNull:!0}:t==="true"||t==="false"?{builder:"integer",mode:"boolean",notNull:!0}:t==="null"?{builder:"text",notNull:!0}:{builder:"real",notNull:!0}}case"null":return{builder:"text",notNull:!0};case"number":return{builder:"real",notNull:!0};case"optional":return{...e.inner?Ze(e.inner):{builder:"text",notNull:!1},notNull:!1};case"storage":case"string":return{builder:"text",notNull:!0};default:return{builder:"text",notNull:!0}}},Ct=(e,t)=>{const n=ie(e);return n.kind==="id"&&n.tableName!==void 0&&t.has(n.tableName)?n.tableName:void 0},Yr=(e,t,n)=>{f(e,"drizzle column name");const r=Ze(t),a=r.mode?`, { mode: "${r.mode}" }`:"";let o=`${r.builder}("${e}"${a})`;r.typeAnnotation&&(o+=`.$type<${r.typeAnnotation}>()`);const i=Ct(t,n);return i!==void 0&&(o+=`.references((): AnySQLiteColumn => ${i}._id)`),r.notNull&&t.column?.notNull!==!1&&(o+=".notNull()"),o},Xr=e=>{const t=e.unique?"uniqueIndex":"index",n=e.fields.map(r=>(f(r,"drizzle index field"),`t.${r}`)).join(", ");return`    ${X(e.name)}: ${t}(${JSON.stringify(e.name)}).on(${n}),`},Zr=(e,t)=>{f(e.name,"table name");const n=['    _id: text("_id").primaryKey(),','    _creationTime: integer("_creationTime").notNull(),',...Object.entries(e.shape).map(([a,o])=>`    ${a}: ${Yr(a,o,t)},`)].join(`
+`),r=e.indexes.length>0?`, (t) => ({
+${e.indexes.map(a=>Xr(a)).join(`
+`)}
+})`:"";return`export const ${e.name} = sqliteTable("${e.name}", {
+${n}
+}${r});`},ea=e=>e.typeAnnotation?.includes('Id<"')??!1,ta=(e,t)=>{const n=new Set(["integer","sqliteTable","text"]),r=new Set;let a=!1,o=!1;for(const i of e){for(const s of Object.values(i.shape)){const c=Ze(s);n.add(c.builder),o=o||ea(c),a=a||Ct(s,t)!==void 0}for(const s of i.indexes)r.add(s.unique?"uniqueIndex":"index")}return{columns:[...n].toSorted((i,s)=>i.localeCompare(s)),indexes:[...r].toSorted((i,s)=>i.localeCompare(s)),needsAnyColumn:a,needsId:o}},gt=(e,t=!1)=>{if(e.length===0)return`${S}export {};
+`;const n=se(t),r=new Set(e.map(g=>g.name)),{columns:a,indexes:o,needsAnyColumn:i,needsId:s}=ta(e,r),c=[...o,...a].toSorted((g,y)=>g.localeCompare(y)),d=e.map(g=>Zr(g,r)).join(`
+
+`),h=[i?`import type { AnySQLiteColumn } from "${n.serverDrizzle}";
+`:"",s?`import type { Id } from "./dataModel.js";
+`:""].join("");return`${S}import { ${c.join(", ")} } from "${n.serverDrizzle}";
+${h}
+${d}
+`},Na=(e,t=!1)=>{const n=e.tables.filter(a=>a.shardMode==="global"),r=e.tables.filter(a=>a.shardMode!=="global");return{global:E(gt(n,t),Je),shard:E(gt(r,t),Je)}},Aa=e=>e?`${S}/**
+ * The \`SchedulerDO\` Durable Object class, re-exported so a worker entry can
+ * forward it — wrangler binds only what the entry exports:
+ *
+ * \`export * from "./lunora/_generated/scheduler.js";\`
+ *
+ * A Vite-first (class-A) app needs no such line: the generated worker entry
+ * forwards this module for you whenever it exists.
+ */
+export { SchedulerDO } from "@lunora/scheduler";
+`:"",Oa=e=>{const t=new Map;for(const i of e){const s=t.get(i.cron);s?s.push(i):t.set(i.cron,[i])}const n=[...t.keys()].map(i=>`    ${JSON.stringify(i)},`).join(`
+`),r=n.length>0?`
+${n}
+`:"",a=[...t.entries()].map(([i,s])=>{const c=s.map(d=>{const h=d.workflow?`workflow: ${JSON.stringify(d.workflow.binding)}`:`functionPath: ${JSON.stringify(d.functionPath)}`;return`        { name: ${JSON.stringify(d.name)}, ${h}, args: ${JSON.stringify(d.args)} },`}).join(`
+`);return`    ${JSON.stringify(i)}: [
+${c}
+    ],`}).join(`
+`),o=a.length>0?`
+${a}
+`:"";return`${S}/**
+ * One scheduled cron invocation. Exactly one target is set: \`functionPath\` is
+ * the \`namespace:fn\` dispatch ref (matches \`__lunoraRef\`), invoked on the
+ * shard; \`workflow\` is a \`WORKFLOW_*\` binding name whose durable workflow is
+ * started fresh per fire. \`args\` are forwarded verbatim (a workflow's become
+ * its \`params\`).
+ */
+export interface LunoraCronJob {
+    args: Record<string, unknown>;
+    functionPath?: string;
+    name: string;
+    workflow?: string;
+}
+
+/**
+ * Deduplicated cron schedules — mirror of wrangler's \`triggers.crons\`. The
+ * Lunora vite plugin keeps \`wrangler.jsonc\` in sync with this array.
+ */
+export const LUNORA_CRON_TRIGGERS: ReadonlyArray<string> = [${r}];
+
+/**
+ * Dispatcher map keyed by cron expression. The Worker's \`scheduled()\` handler
+ * looks up \`event.cron\` here and dispatches every job in the list.
+ */
+export const LUNORA_CRONS: Record<string, ReadonlyArray<LunoraCronJob>> = {${o}};
+`},Ia=e=>{const t=[...e].toSorted((r,a)=>r.name.localeCompare(a.name)).map(r=>{const a=[`name: ${JSON.stringify(r.name)}`,`table: ${JSON.stringify(r.table)}`];return r.field!==void 0&&a.push(`field: ${JSON.stringify(r.field)}`),r.dimensions!==void 0&&a.push(`dimensions: ${JSON.stringify(r.dimensions)}`),r.metric!==void 0&&a.push(`metric: ${JSON.stringify(r.metric)}`),r.metadata!==void 0&&a.push(`metadata: ${JSON.stringify(r.metadata)}`),`    { ${a.join(", ")} },`}).join(`
+`),n=t.length>0?`
+${t}
+`:"";return`${S}/**
+ * One vector index declared in \`schema.ts\` — an inline \`.vectorize()\` column
+ * or a standalone \`defineVectorIndex()\`. \`field\` is the source column (absent
+ * for a \`select\`-derived Shape B index); \`metadata\` lists the row fields
+ * mirrored into Vectorize for filtering.
+ */
+export interface LunoraVectorIndex {
+    dimensions?: number;
+    field?: string;
+    metadata?: ReadonlyArray<string>;
+    metric?: "cosine" | "dot-product" | "euclidean";
+    name: string;
+    table: string;
+}
+
+/**
+ * Static registry of every vector index in the schema, sorted by name.
+ * Vectorize cannot enumerate indexes at runtime, so the worker passes this to
+ * \`createWorker({ vectorIntrospector })\` to back the studio's vector browser.
+ */
+export const LUNORA_VECTOR_INDEXES: ReadonlyArray<LunoraVectorIndex> = [${n}];
+`},Ca=e=>[...new Set(e.map(t=>t.cron))];export{ga as A,En as C,S as G,ar as U,ba as a,wa as b,va as c,Oa as d,Ra as e,fa as f,Na as g,xa as h,Aa as i,ka as j,Ta as k,Ia as l,Sa as m,Ca as n,vr as o,$a as p,ya as q,I as r};