@lunora/codegen 1.0.0-alpha.235 → 1.0.0-alpha.237

package/dist/packem_shared/emitFunctions-BqAz1ssY.mjs

@@ -0,0 +1,249 @@
+import{LunoraError as B}from"@lunora/errors";import{L as H,G as q,I as J,d as Q,r as G,b as z,c as x}from"./shared-DjUziztz.mjs";import{s as p}from"./paths-C-9fwEgQ.mjs";import{renderAgentFunctionRegistry as V,renderSandboxFunctionRegistry as W,groupByFileSorted as K}from"./emitApi-CJ9ziZnP.mjs";import{r as Y,a as X,b as O,c as Z}from"./qualifiers-BhOL15WZ.mjs";const ee=new Set(["any","bigint","boolean","date","id","null","number","storage","string","timestamp"]),A=n=>n.column!==void 0,te=(n,e)=>{switch(n){case"bigint":return`if (typeof ${e} !== "bigint") return DEFER;
+`;case"boolean":return`if (typeof ${e} !== "boolean") return DEFER;
+`;case"date":case"number":case"timestamp":return`if (typeof ${e} !== "number" || !Number.isFinite(${e})) return DEFER;
+`;case"null":return`if (${e} !== null) return DEFER;
+`;default:return`if (typeof ${e} !== "string") return DEFER;
+`}},ne=(n,e)=>n.stringMaxLength===void 0?"":`if (${e}.length > ${String(n.stringMaxLength)}) return DEFER;
+`,re=(n,e)=>{const r=n.literalValue?.trim();if(!(r===void 0||!H.test(r)))return{out:e,pre:`if (${e} !== ${r}) return DEFER;
+`}},v=(n,e,r)=>{if(!A(n)&&!(n.unmodelledRefinement||n.sourceText!==void 0)){if(ee.has(n.kind))return n.kind==="any"?{out:e,pre:""}:{out:e,pre:te(n.kind,e)+ne(n,e)};switch(n.kind){case"array":return oe(n,e,r);case"literal":return re(n,e);case"object":return ie(n,e,r);default:return}}},oe=(n,e,r)=>{const{inner:c}=n;if(!c)return;const o=r.next(),a=`__arr${String(o)}`,i=`__i${String(o)}`,s=`__e${String(o)}`,l=v(c,s,r);if(!l)return;const u=`if (!Array.isArray(${e})) return DEFER;
+const ${a} = new Array(${e}.length);
+for (let ${i} = 0; ${i} < ${e}.length; ${i}++) {
+const ${s} = ${e}[${i}];
+${l.pre}${a}[${i}] = ${l.out};
+}
+`;return{out:a,pre:u}},ae=(n,e,r,c)=>{const o=JSON.stringify(n);if(e.kind==="optional"){if(e.hasRefinement||e.sourceText!==void 0||A(e))return;const{inner:i}=e;if(!i)return;const s=v(i,r,c);if(!s)return;const l=c.next(),u=`__has${String(l)}`,d=`__val${String(l)}`,f=`let ${u} = false;
+let ${d};
+if (${r} !== undefined) {
+${s.pre}${d} = ${s.out};
+${u} = true;
+}
+`;return{entry:`...(${u} ? { ${o}: ${d} } : {})`,pre:f}}const a=v(e,r,c);if(a)return{entry:`${o}: ${a.out}`,pre:a.pre}},se=new Set(Object.getOwnPropertyNames(Object.prototype)),_=(n,e,r)=>{let c="";const o=[];for(const a of Object.keys(n)){const i=n[a];if(!i)return;const s=JSON.stringify(a);let l=`${e}[${s}]`;if(se.has(a)){const d=`__f${String(r.next())}`;c+=`const ${d} = Object.hasOwn(${e}, ${s}) ? ${e}[${s}] : undefined;
+`,l=d}const u=ae(a,i,l,r);if(!u)return;c+=u.pre,o.push(u.entry)}return{entries:o.join(", "),pre:c}},T=n=>{const e=`Object.getPrototypeOf(${n})`;return`if (${e} !== Object.prototype && ${e} !== null) return DEFER;
+`},ie=(n,e,r)=>{const c=n.shape??{},o=_(c,e,r);if(!o)return;const a=r.next(),i=`__obj${String(a)}`,s=`if (typeof ${e} !== "object" || ${e} === null || Array.isArray(${e})) return DEFER;
+${T(e)}${o.pre}const ${i} = { ${o.entries} };
+`;return{out:i,pre:s}},ce=n=>{let e=0;const c=_(n,"source",{next:()=>(e+=1,e)});if(c)return`(source) => {
+if (typeof source !== "object" || source === null || Array.isArray(source)) return DEFER;
+${T("source")}${c.pre}return { ${c.entries} };
+}`},le=(n,e)=>`lunora_${p(n)}_${String(e)}`,ue=`const callRegistered = async <R>(context: CallerCtx, functionPath: string, args: Record<string, unknown> | undefined): Promise<R> => {
+    const registered = LUNORA_FUNCTIONS[functionPath];
+
+    if (!registered) {
+        throw new LunoraError("FUNCTION_NOT_FOUND", \`function not registered: \${functionPath}\`);
+    }
+
+    // A mutation is routed through the caller's own \`ctx.runMutation\` rather than
+    // invoked directly, so \`createCaller(ctx).ns.someMutation()\` gets exactly what
+    // \`ctx.runMutation(api.ns.someMutation)\` gets: the BEGIN/COMMIT span (or the
+    // enclosing one, when the caller is already inside a transaction), the jobs it
+    // schedules held until that span commits, and the deferred object deletes
+    // flushed only once it has. Called straight, a mutation composed from an action
+    // or a stream had none of the three — its writes autocommitted one row at a
+    // time and its \`ctx.scheduler\` calls dispatched immediately, so a mid-handler
+    // throw left the earlier writes durable and the job already enqueued.
+    //
+    // The fallback covers a context that is not a shard dispatch (\`runMutation\` is
+    // installed by \`buildCtx\` on every kind but a query's TYPE omits it); there is
+    // no transaction to join in that case, so a direct call is all there is.
+    //
+    // A query is routed through \`ctx.runQuery\` for the same reason: that is what
+    // hands it a query view of a mutation's or action's ctx (no request origin,
+    // query-guarded \`run*\`) instead of the caller's own.
+    if (registered.kind === "mutation" || registered.kind === "query") {
+        const run = (context as { runMutation?: unknown; runQuery?: unknown })[registered.kind === "mutation" ? "runMutation" : "runQuery"];
+
+        if (typeof run === "function") {
+            return (await run.call(context, { __lunoraRef: functionPath }, args ?? {})) as R;
+        }
+    }
+
+    return (await registered.handler(context, args ?? {})) as R;
+};`,de=(n,e,r=[],c=[])=>{const o=new Map,a=t=>{o.has(t)||o.set(t,le(t,o.size))};for(const t of n)a(t.filePath);for(const t of e)a(t.filePath);for(const t of r)a(t.filePath);for(const t of c)a(t.filePath);const i=[...o.entries()].map(([t,g])=>{if(!J.test(t))throw new B("INTERNAL",`@lunora/codegen: refusing to emit import for unsafe file path: ${JSON.stringify(t)}`);return`import * as ${g} from "../${t}.js";`}).join(`
+`),s=n.map(t=>`    "${p(t.filePath)}:${t.exportName}": ${o.get(t.filePath)??""}.${t.exportName} as unknown as RegisteredLunoraFunction,`).join(`
+`),l=e.map(t=>`    ${JSON.stringify(t.id)}: ${o.get(t.filePath)??""}.${t.exportName} as unknown as RegisteredDataMigration,`).join(`
+`),u=r.map(t=>`    "${p(t.filePath)}:${t.exportName}": ${o.get(t.filePath)??""}.${t.exportName} as unknown as RegisteredLunoraFunction,`).join(`
+`),d=c.map(t=>`    "${t.exportName}": ${o.get(t.filePath)??""}.${t.exportName} as unknown as RegisteredShape,`).join(`
+`),f=r.map(t=>`${p(t.filePath)}:${t.exportName}`),m=[s,u].filter(t=>t.length>0).join(`
+`),R=n.map(t=>{if(t.lifecycle||Object.keys(t.args).length===0)return;const g=ce(t.args);return g===void 0?void 0:`installCompiledValidatorMap(${o.get(t.filePath)??""}.${t.exportName}.args, ${g});`}).filter(t=>t!==void 0).join(`
+`);return{dispatchBody:m.length>0?`
+${m}
+`:"",importBlock:i.length>0?`${i}
+
+`:"",installBlock:R,migrationBody:l.length>0?`
+${l}
+`:"",mutatorPaths:f,shapeBody:d.length>0?`
+${d}
+`:""}},he=n=>{const e=K(n),r=e.map(([o,a])=>{const i=a.map(s=>{const l=O(G(s.args),s.filePath),u=l==="{}"?"?":"",d=O(Z(s),s.filePath);return s.kind==="stream"?`        ${s.exportName}: (args${u}: ${l}) => Promise<AsyncIterable<${d}>>;`:`        ${s.exportName}: (args${u}: ${l}) => Promise<${d}>;`}).join(`
+`);return`    ${z(p(o))}: {
+${i}
+    };`}).join(`
+`);return{implementation:e.map(([o,a])=>{const i=p(o),s=a.map(l=>`        ${x(l.exportName)}: (args) => callRegistered(context, "${i}:${l.exportName}", args),`).join(`
+`);return`    ${x(i)}: {
+${s}
+    },`}).join(`
+`),types:r}},pe=n=>{const e={connect:[],disconnect:[],init:[],reactor:[],whisper:[]};for(const r of n)r.lifecycle&&e[r.lifecycle].push(`${p(r.filePath)}:${r.exportName}`);return e},be=n=>{const{agents:e=[],functions:r,migrations:c=[],mutators:o=[],shapes:a=[],useUmbrella:i=!1,usesSandbox:s=!1}=n,l=r.length>0,u=Q(i),{dispatchBody:d,importBlock:f,installBlock:m,migrationBody:R,mutatorPaths:t,shapeBody:g}=de(r,c,o,a),b=V(e,r),w=W(s,r),k=[b.lines,w.lines].filter(h=>h.length>0).join(`
+`);let N=d;k.length>0&&(N=d.length>0?`${d.trimEnd()}
+${k}
+`:`
+${k}
+`);const y=pe(r),P=a.length>0?`import type { RegisteredShape } from "${u.server}";
+`:"",L=a.length>0?`
+/**
+ * Replication-shape registry — one entry per \`defineShape\` in \`lunora/shapes.ts\`.
+ * The generated ShardDO's \`resolveShape\` override looks a shape up by name and
+ * evaluates its trusted \`compileWhere(ctx, args)\` to authorize + scope a
+ * \`shape_subscribe\` (reads-as-permissions).
+ */
+export const LUNORA_SHAPES: Record<string, RegisteredShape> = {${g}};
+`:"",j=t.length>0?`
+/**
+ * Custom-mutator function paths — the \`LUNORA_FUNCTIONS\` keys the generated
+ * ShardDO's \`isCustomMutator\` override routes through the client-watermark push
+ * protocol (\`x-lunora-client-id\`/\`x-lunora-client-seq\` ordering).
+ */
+export const LUNORA_MUTATOR_PATHS: ReadonlySet<string> = new Set([${t.map(h=>JSON.stringify(h)).join(", ")}]);
+`:"",E=m.length>0?`import { DEFER_VALIDATION as DEFER, installCompiledValidatorMap } from "${u.values}";
+`:"",C=m.length>0?`
+/**
+ * AOT-compiled argument validators (Worker-safe, no \`eval\`). Each is installed
+ * onto its function's live \`.args\` object and consulted by the interpreted
+ * parser as a zero-allocation fast path; anything it can't model is deferred.
+ */
+${m}
+`:"",$=he(r),F=$.types?`
+${$.types}
+`:"",M=$.implementation?`
+${$.implementation}
+`:"",S=Y($.types),D=S.length>0?`import type { ${S.join(", ")} } from "./dataModel.js";
+`:"",I=l?"context":"_context",U=l?`${ue}
+
+`:"";return X(`${q}${f}${b.importLine}${w.importLine}${E}${P}import { LunoraError } from "${u.server}";
+import type { ActionCtx, MutationCtx, QueryCtx } from "./server.js";
+${D}
+/**
+ * Single registered function, narrowed to the shape \`handleRpc\` needs.
+ * The real argument validators / return types are checked elsewhere — at
+ * the dispatch site we erase to \`unknown\` so a single map can host every
+ * registered function.
+ */
+export interface RegisteredLunoraFunction {
+    kind: "action" | "mutation" | "query" | "stream";
+    args: Record<string, unknown>;
+    /**
+     * Present on a \`"stream"\` declared \`durable\`: its run is persisted and
+     * survives the socket that opened it. Absent on every other kind, and on an
+     * ephemeral stream.
+     */
+    durable?: { ttlMs?: number };
+    /**
+     * For \`"action" | "mutation" | "query"\` the handler is awaited and its result returned.
+     * For \`"stream"\` the handler returns an \`AsyncIterable\` synchronously and takes an
+     * \`AbortSignal\` as a third argument — the runtime drives it frame-by-frame.
+     */
+    handler: ((context: unknown, args: Record<string, unknown>) => Promise<unknown> | unknown) | ((context: unknown, args: Record<string, unknown>, signal?: AbortSignal) => AsyncIterable<unknown>);
+    /**
+     * The lifecycle moment a hook fires on, when this registration came from
+     * \`onConnect\`/\`onDisconnect\`/\`onShardInit\`/\`onQueryChange\`/\`onWhisper\`.
+     * Read at dispatch to decide whether the function runs system-trusted:
+     * \`init\` and \`reactor\` have no caller identity, so RLS has no user to scope
+     * to. \`whisper\` does have one — it runs under the asking socket's identity.
+     */
+    lifecycle?: "connect" | "disconnect" | "init" | "reactor" | "whisper";
+    /**
+     * Hoisted by the builder when the \`.use()\` chain carries a step with a
+     * per-dispatch effect — \`rateLimit(...)\` consuming budget, a single-use
+     * captcha token being burned. Read by \`isCacheableQuery\`: the chain runs
+     * inside the dispatch callback, and a reactive-cache HIT skips that
+     * callback, so such a query must never be memoized.
+     */
+    perDispatch?: boolean;
+    /** \`"internal"\` functions are rejected on the external RPC path; absence === public. */
+    visibility?: "internal" | "public";
+    /**
+     * \`.x402({ price })\` tag on a paid public procedure. The origin worker
+     * paywalls it; the shard refuses to subscribe it (\`isPaidFunction\`).
+     */
+    x402?: { readonly price: number | string };
+}
+${b.prelude}${w.prelude}
+/**
+ * Static dispatch table. The key matches the \`__lunoraRef\` the client
+ * emits (\`api[namespace][fn].__lunoraRef === "namespace:fn"\`).
+ */
+export const LUNORA_FUNCTIONS: Record<string, RegisteredLunoraFunction> = {${N}};
+${C}${L}${j}
+/**
+ * Lifecycle manifest: the function paths the generated ShardDO dispatches when a
+ * client's WebSocket connects (\`connect\`) or disconnects (\`disconnect\`), once
+ * per Durable Object instance before any handler runs (\`init\`), after a
+ * write flush when a watched read's result changed (\`reactor\`), and before a
+ * socket joins or broadcasts to a whisper topic (\`whisper\`). Each path also
+ * resolves through {@link LUNORA_FUNCTIONS}. The socket-scoped moments run under
+ * the socket's verified identity; \`init\` and \`reactor\` have no caller, so they
+ * run anonymous — all via system dispatch.
+ */
+export const LUNORA_LIFECYCLE_HOOKS: {
+    connect: readonly string[];
+    disconnect: readonly string[];
+    init: readonly string[];
+    reactor: readonly string[];
+    whisper: readonly string[];
+} = {
+    connect: [${y.connect.map(h=>JSON.stringify(h)).join(", ")}],
+    disconnect: [${y.disconnect.map(h=>JSON.stringify(h)).join(", ")}],
+    init: [${y.init.map(h=>JSON.stringify(h)).join(", ")}],
+    reactor: [${y.reactor.map(h=>JSON.stringify(h)).join(", ")}],
+    whisper: [${y.whisper.map(h=>JSON.stringify(h)).join(", ")}],
+};
+
+/**
+ * Resolve and invoke a registered function from an external caller. Throws a
+ * LunoraError-shaped object (404) when the path is unknown — the runtime's
+ * structural error mapper turns that into the right HTTP status. Internal
+ * functions are treated as not-found so their existence never leaks to clients.
+ */
+export const dispatchLunoraFunction = async (functionPath: string, context: unknown, args: Record<string, unknown>): Promise<unknown> => {
+    const registered = LUNORA_FUNCTIONS[functionPath];
+
+    if (!registered || registered.visibility === "internal") {
+        throw new LunoraError("FUNCTION_NOT_FOUND", \`function not registered: \${functionPath}\`);
+    }
+
+    return registered.handler(context, args);
+};
+
+/**
+ * A handler context accepted by {@link createCaller}. The runtime context the
+ * shard DO builds is uniform across kinds, so any handler's \`ctx\` works here.
+ */
+export type CallerCtx = ActionCtx | MutationCtx | QueryCtx;
+
+/**
+ * Typed, in-process server-to-server caller. Every registered function — public
+ * *and* internal — is reachable; each call dispatches against the same shard
+ * with the supplied \`context\`, exactly like \`ctx.runQuery\`/\`runMutation\`/
+ * \`runAction\` but without re-stating the function path.
+ */
+export interface Caller {${F}}
+
+${U}/** Build a {@link Caller} bound to \`context\` (typically a handler's \`ctx\`). */
+export const createCaller = (${I}: CallerCtx): Caller => ({${M}});
+
+/**
+ * Single registered data migration, narrowed to the shape the per-shard runner
+ * consumes. \`up\`/\`down\` are erased to a structural transform; the authoring
+ * validation lives in \`defineMigration\`.
+ */
+export interface RegisteredDataMigration {
+    batchSize?: number;
+    down?: (document: Record<string, unknown>) => Record<string, unknown> | undefined;
+    id: string;
+    table: string;
+    up: (document: Record<string, unknown>) => Record<string, unknown> | undefined;
+}
+
+/**
+ * Registry of online data migrations keyed by \`defineMigration\`'s \`id\`. The
+ * shard DO's admin RPC and the CLI resolve migrations to run through this map.
+ */
+export const LUNORA_MIGRATIONS: Record<string, RegisteredDataMigration> = {${R}};
+`,i)};export{be as default};

package/dist/packem_shared/emitServer-BEo_fCY8.mjs

@@ -0,0 +1,365 @@
+import{LunoraError as Ie}from"@lunora/errors";import{S as $e}from"./capabilities-DJJWVEtk.mjs";import{a as c,G as Re,u as Be,d as Oe}from"./shared-DjUziztz.mjs";const De=(l,s=[])=>{const t=new Set;for(const a of l.tables)for(const n of Object.values(a.shape)){const i=Be(n);i.kind==="storage"&&typeof i.bucket=="string"&&i.bucket!==""&&t.add(i.bucket)}for(const a of s)a!==""&&a!=="default"&&t.add(a);return["default",...[...t].toSorted((a,n)=>a.localeCompare(n))]},Fe=({agents:l=[],containers:s=[],env:t,hasAccessFacade:a=!1,hasAi:n=!1,hasAnalytics:i=!1,hasBrowser:E=!1,hasVectors:P=!0,hasFlags:j=!1,hasHyperdrive:q=!1,hasImages:L=!1,hasKv:V=!1,hasNotify:G=!1,hasPayments:O=!1,hasPipelines:_=!1,hasR2sql:H=!1,hasX402:D=!1,identity:d,queues:m=[],schema:M,storageRuleBuckets:z=[],useUmbrella:U=!1,workflows:b=[]}={})=>{const r=Oe(U),K=De(M??{tables:[]},z).map(e=>JSON.stringify(e)).join(" | "),X=n?`import type { LunoraAi } from "@lunora/ai";
+`:"",J=n?`
+    readonly ai: LunoraAi;`:"",Y=O?`import type { LunoraPayment } from "@lunora/payment";
+`:"",Z=O?`
+    readonly payments: LunoraPayment;`:"",ee=D?`import type { X402Pay } from "@lunora/x402/pay";
+`:"",te=D?`
+    readonly x402: X402Pay;`:"",ae=s.length>0?`import type { ContainerAccessor } from "@lunora/container";
+`:"",re=s.length>0?`
+    readonly containers: {${s.map(e=>`
+        readonly ${e.exportName}: ContainerAccessor;`).join("")}
+    };`:"",N=[...n?["    /** Workers AI binding (the conventional `env.AI`), narrowing `ctx.ai`. */\n    readonly AI?: unknown;"]:[],...s.map(e=>(c(e.bindingName,`container binding "${e.bindingName}"`),`    /** Durable Object namespace for the \`${e.exportName}\` container. */
+    readonly ${e.bindingName}?: unknown;`)),...b.map(e=>(c(e.bindingName,`workflow binding "${e.bindingName}"`),`    /** Workflow binding for the \`${e.exportName}\` workflow. */
+    readonly ${e.bindingName}?: unknown;`)),...m.map(e=>(c(e.bindingName,`queue binding "${e.bindingName}"`),`    /** Queue producer binding for the \`${e.exportName}\` queue. */
+    readonly ${e.bindingName}?: unknown;`)),...l.map(e=>(c(e.bindingName,`agent binding "${e.bindingName}"`),`    /** Workflow binding for the \`${e.exportName}\` agent. */
+    readonly ${e.bindingName}?: unknown;`))].join(`
+`),ne=`
+
+/**
+ * This project's Cloudflare bindings, as far as codegen can discover them from
+ * \`lunora/\` source — the container/workflow Durable Object namespaces and the
+ * conventional Workers AI binding. Bindings the config layer reconciles from
+ * user-named wrangler config (R2/KV/D1/\`services\`/queues/…) aren't statically
+ * visible here, so the open index signature keeps them reachable (cast at the
+ * use site). Service bindings (\`env.<SERVICE>.fetch(...)\` / RPC stubs) live
+ * under this signature too — Lunora can't type a third-party worker's RPC
+ * surface, so treat them as \`Fetcher\`/\`Service<unknown>\` and cast.
+ */
+export interface CloudflareBindings {
+    readonly [binding: string]: unknown;${N?`
+${N}`:""}
+}
+
+/** Alias for {@link CloudflareBindings} — the typed shape of \`env\`. */
+export type Env = CloudflareBindings;`,o=(e,we,Q)=>{const y=$e.get(e);if(y!==void 0&&y.tier!==Q)throw new Ie("INTERNAL",`@lunora/codegen: capability "${e}" declares tier "${y.tier}" in SERVER_CTX_FIELDS but is emitted onto the "${Q}" context — update whichever is wrong.`);return we?y?.field??"":""},h=o("kv",V,"every"),f=o("analytics",i,"every"),oe=o("hyperdrive",q,"action"),se=o("browser",E,"action"),ie=o("images",L,"action"),de=o("pipelines",_,"action"),le=o("r2sql",H,"action"),u=P&&(M?.vectorIndexes.length??0)>0,x=u?' | "vectors"':"",A=u?`
+    readonly vectors: VectorSearch<VectorIndexName>;`:"",ce=u?`
+    readonly vectors: VectorSearchReader<VectorIndexName>;`:"",ue=u?`import type { VectorSearch, VectorSearchReader } from "${r.server}";
+import type { VectorIndexName } from "./dataModel.js";
+`:"",g=a?`
+    /** Verified Cloudflare Access identity — a synchronous facade over the resolved claims (email / groups / hasGroup / claims). Anonymous when no Access token is present. */
+    readonly access: import("@lunora/cloudflare-access/context").AccessFacade;`:"",T=j?`
+    /** Feature-flag evaluation (OpenFeature). Reads are memoized per request; evaluations never throw — a provider error resolves to the supplied default. */
+    readonly flags: import("${r.flags}").LunoraFlags;`:"",v=G?`
+    /** Multi-channel notifications (@lunora/notify): send / chat / inApp / webhook plus the push device sub-facade. Sends are external I/O — confine them to action handlers. */
+    readonly notify: import("@lunora/notify").LunoraNotify;
+    /** Device push sub-facade — the same object as ctx.notify.push (register / send / broadcast). Sends belong in action handlers. */
+    readonly push: import("@lunora/notify").LunoraPush;`:"",p=b.length>0,pe=p?`import type { WorkflowHandle } from "@lunora/workflow";
+import type * as lunoraWorkflowDefinitions from "../workflows.js";
+`:"",ye=p?`
+
+/** Params type carried by a \`defineWorkflow\` definition (its phantom \`__params\`). */
+type WorkflowParamsOf<Definition> = Definition extends { __params?: infer Params }
+    ? unknown extends Params
+        ? Record<string, unknown>
+        : NonNullable<Params>
+    : Record<string, unknown>;
+
+/** This project's declared workflows, addressable from \`ctx.workflows\` by their \`lunora/workflows.ts\` export name. */
+export interface LunoraWorkflows {
+${b.map(e=>`    get(name: ${JSON.stringify(e.exportName)}): WorkflowHandle<WorkflowParamsOf<typeof lunoraWorkflowDefinitions.${e.exportName}>>;`).join(`
+`)}
+}`:"",C=p?' | "workflows"':"",F=p?`
+    readonly workflows: LunoraWorkflows;`:"",k=m.length>0,me=k?`import type { QueueProducer } from "@lunora/queue";
+import type * as lunoraQueueDefinitions from "../queues.js";
+`:"",be=k?`
+
+/** Message body type carried by a \`defineQueue\` definition (its phantom \`__lunoraBody\`). */
+type QueueBodyOf<Definition> = Definition extends { __lunoraBody?: infer Body } ? (unknown extends Body ? unknown : NonNullable<Body>) : unknown;
+
+/** This project's declared queues, addressable from \`ctx.queues\` by their \`lunora/queues.ts\` export name. */
+export interface LunoraQueues {
+${m.map(e=>`    readonly ${e.exportName}: QueueProducer<QueueBodyOf<typeof lunoraQueueDefinitions.${e.exportName}>>;`).join(`
+`)}
+}`:"",S=k?`
+    readonly queues: LunoraQueues;`:"",w=l.length>0,he=w?`import type { AgentHandle } from "@lunora/agent";
+`:"",fe=w?`
+
+/** This project's declared agents, addressable from \`ctx.agents\` by their \`lunora/agents.ts\` export name. */
+export interface LunoraAgents {
+${l.map(e=>(c(e.exportName,`agent export "${e.exportName}"`),`    readonly ${e.exportName}: AgentHandle;`)).join(`
+`)}
+}`:"",W=w?`
+    readonly agents: LunoraAgents;`:"",xe=d?`import type { InferIdentity } from "${r.server}";
+import type * as lunoraIdentityContract from "../identity.js";
+`:"",ge=d?`
+
+/** This app's declared identity claim contract (\`defineIdentity\` in \`lunora/identity.ts\`) — the typed shape of \`ctx.auth.getIdentity()\`, the RLS policy \`ctx.auth.identity\`, and the \`authorizeShard\`/\`authorizeFanOut\` identity argument. */
+export type Identity = InferIdentity<typeof lunoraIdentityContract.${d.exportName}>;
+
+/** \`ctx.auth\` narrowed so \`getIdentity()\` resolves the declared {@link Identity} contract instead of the untyped claim bag. */
+type NarrowedAuth = Omit<QueryCtxBase["auth"], "getIdentity"> & { getIdentity: () => Promise<Identity | null> };`:"",I=d?' | "auth"':"",$=d?`
+    readonly auth: NarrowedAuth;`:"",Te=d?", Identity":"",ve=t?`import type * as lunoraEnvContract from "../env.js";
+`:"",ke=t?`
+
+/** This app's declared env contract (\`defineEnv\` in \`lunora/env.ts\`) — the validated, coercion-aware shape of \`ctx.env\`. */
+export type LunoraEnv = ReturnType<typeof lunoraEnvContract.${t.exportName}>;`:"",R=t?' | "env"':"",B=t?"\n    /** Validated, typed environment declared by `defineEnv` in `lunora/env.ts` — parsed & coercion-aware config values (`ctx.env.STRIPE_KEY`); a missing or invalid value throws at read time. */\n    readonly env: LunoraEnv;":"";return`${Re}import { createPolicyDsl, defineMutator as defineMutatorBase, initLunora, v as vBase } from "${r.server}";
+import type {
+    ActionBuilder,
+    ActionCtx as ActionCtxBase,
+    ColumnValidator,
+    DatabaseReader,
+    DatabaseWriter,
+    EmptyArgs,
+    InternalActionBuilder,
+    InternalMutationBuilder,
+    InternalQueryBuilder,
+    MutationBuilder,
+    MutationCtx as MutationCtxBase,
+    MutationStorage,
+    MutatorDefinition,
+    QueryBuilder,
+    QueryCtx as QueryCtxBase,
+    ReadOnlyStorage,
+    RegisteredMutator,
+    Storage as StorageBase,
+    TableReader,
+    Validator,
+} from "${r.server}";
+
+import type {
+    DatabaseReaderFacade as DatabaseReaderFacadeOf,
+    DatabaseWriterFacade as DatabaseWriterFacadeOf,
+    LoadWith as LoadWithOf,
+    TableReaderFacade as TableReaderFacadeOf,
+    TableWriterFacade as TableWriterFacadeOf,
+    WithArg as WithArgOf,
+} from "${r.serverDataModel}";
+
+export type {
+    AggregateOp,
+    GroupByEntry,
+    OrderBy,
+    QueryArgs,
+    QueryPage,
+    RankPage,
+    RankResult,
+    RestrictableQueryOptions,
+    RestrictableQueryOptionsOf,
+    SearchFilterBuilder,
+    SearchReader,
+    TableAggregateOptions,
+    TableAggregateOptionsOf,
+    TableGroupByOptions,
+    TableGroupByOptionsOf,
+    TableRankOptions,
+    TableRankPageOptions,
+    Where,
+    WhereOf,
+    WhereOperators,
+} from "${r.serverDataModel}";
+
+import type { DataModel, Doc, GeoIndexNamesByTable, Id as IdOfTable, IndexNamesByTable, Insert, InsertModel, RankIndexNamesByTable, Relations, SearchIndexNamesByTable, TableName } from "./dataModel.js";
+${ue}${X}${Y}${ee}${ae}${pe}${me}${he}${xe}${ve}
+export type { AppTableName, DataModel, Doc, Id, TableName } from "./dataModel.js";
+
+/**
+ * The query-DSL bindings: \`@lunora/server/data-model\`'s generics parameterized
+ * over this project's \`DataModel\` / \`InsertModel\` / \`Relations\` / index maps.
+ *
+ * They live here rather than in \`dataModel.ts\` because they are the half that
+ * needs the SERVER package. Keeping \`dataModel.ts\` free of it lets a sibling
+ * package — a web app, another Worker — compile \`api.ts\` for its \`Doc\`/\`Id\`
+ * types without installing a server dependency to do it.
+ */
+
+/** The \`with\` argument for table \`T\` — see \`@lunora/server/data-model\`. */
+export type WithArg<T extends keyof DataModel> = WithArgOf<DataModel, Relations, T>;
+
+/** \`Doc<T>\` narrowed to exactly the relations requested in the with-arg \`W\`. */
+export type LoadWith<T extends keyof DataModel, W> = LoadWithOf<DataModel, Relations, T, W>;
+
+/** Read-only typed table accessor exposed on \`QueryCtx.db.<table>\`. */
+export type TableReaderFacade<T extends keyof DataModel> = TableReaderFacadeOf<DataModel, Relations, RankIndexNamesByTable, SearchIndexNamesByTable, T, GeoIndexNamesByTable>;
+
+/** Read-write typed table accessor exposed on \`MutationCtx.db.<table>\` / \`ActionCtx.db.<table>\`. */
+export type TableWriterFacade<T extends keyof DataModel> = TableWriterFacadeOf<DataModel, InsertModel, Relations, RankIndexNamesByTable, SearchIndexNamesByTable, T, GeoIndexNamesByTable>;
+
+/** Per-table read facade — \`ctx.db.<table>\` on a \`QueryCtx\`. */
+export type DatabaseReaderFacade = DatabaseReaderFacadeOf<DataModel, Relations, RankIndexNamesByTable, SearchIndexNamesByTable, GeoIndexNamesByTable>;
+
+/** Per-table read-write facade — \`ctx.db.<table>\` on a \`MutationCtx\` / \`ActionCtx\`. */
+export type DatabaseWriterFacade = DatabaseWriterFacadeOf<DataModel, InsertModel, Relations, RankIndexNamesByTable, SearchIndexNamesByTable, GeoIndexNamesByTable>;
+
+/** Insert builder returned by \`ctx.orm.insert(table)\`. */
+export interface OrmInsertBuilder<T extends keyof DataModel> {
+    values: (values: Insert<T>) => Promise<IdOfTable<T>>;
+}
+
+/** Replace builder returned by \`ctx.orm.replace(table, id)\` — swaps the whole document. */
+export interface OrmReplaceBuilder<T extends keyof DataModel> {
+    with: (values: Insert<T>) => Promise<void>;
+}
+
+/** Update builder returned by \`ctx.orm.update(table, id)\` — patches the named fields. */
+export interface OrmUpdateBuilder<T extends keyof DataModel> {
+    set: (values: Partial<Insert<T>>) => Promise<void>;
+}
+
+/** Read-only ORM surface — \`ctx.orm\` on a \`QueryCtx\`. Mirrors \`ctx.db\` reads under a kitcn-style \`query\` namespace. */
+export interface OrmReader {
+    query: DatabaseReaderFacade;
+}
+
+/** Read-write ORM surface — \`ctx.orm\` on a \`MutationCtx\` / \`ActionCtx\`. Writes are addressed by id, like \`ctx.db\`. */
+export interface OrmWriter extends OrmReader {
+    delete: <T extends keyof DataModel>(table: T, id: IdOfTable<T>) => Promise<void>;
+    insert: <T extends keyof DataModel>(table: T) => OrmInsertBuilder<T>;
+    replace: <T extends keyof DataModel>(table: T, id: IdOfTable<T>) => OrmReplaceBuilder<T>;
+    update: <T extends keyof DataModel>(table: T, id: IdOfTable<T>) => OrmUpdateBuilder<T>;
+}
+
+/** Storage buckets this schema declares (\`v.storage("name")\`), narrowing \`ctx.storage.bucket(name)\`. */
+export type StorageBucketName = ${K};${ne}${ye}${be}${fe}${ge}${ke}
+
+/**
+ * Project-typed contexts. The base contexts from \`@lunora/server\` are
+ * untyped against the schema; here \`db\` is widened to the generated per-table
+ * facade (\`ctx.db.<table>.findMany(...)\`) while keeping the legacy structural
+ * \`db.get\`/\`db.query\` surface for back-compat, and \`storage\` is narrowed so
+ * \`ctx.storage.bucket(name)\` autocompletes the declared buckets.
+ */
+/**
+ * The Convex-style fluent reader \`ctx.db.query(table)\`, bound to this schema:
+ * a table-name literal narrows the row type, so \`.collect()\` / \`.first()\` /
+ * \`.take()\` (and the \`.withIndex()\` / \`.filter()\` / \`.order()\` chain) resolve
+ * as \`Doc<table>\` with no \`as unknown as Doc<...>\` casts. The per-table accessor
+ * \`ctx.db.<table>\` stays available alongside it via the facade.
+ *
+ * Intersected with the wide \`(string) => TableReader\` signature so the bound
+ * \`ctx.db\` is still structurally assignable to schema-agnostic consumers that
+ * call \`db.query(someString)\` (e.g. \`@lunora/ratelimit\`'s \`createDbStore\`).
+ *
+ * The three index-name unions are what make \`.withIndex("by_TYPO")\` a compile
+ * error: each resolves to the table's declared names, or \`never\` when it
+ * declares none of that kind. Without them a renamed or dropped index left
+ * every call site typechecking, and the query either threw at runtime or
+ * degraded silently to a full table scan.
+ */
+type TypedTableQuery = (<T extends TableName>(
+    table: T,
+) => TableReader<Doc<T>, IndexNamesByTable[T], SearchIndexNamesByTable[T], GeoIndexNamesByTable[T]>) &
+    ((table: string) => TableReader);
+
+/**
+ * The point read \`ctx.db.get(id)\`, bound to this schema: an \`Id<"table">\`
+ * carries its table name, so the resolved document is typed \`Doc<table>\` (or
+ * \`null\` when absent) with no \`as Doc<...>\` cast. Mirrors {@link TypedTableQuery}.
+ */
+type TypedTableGet = <T extends TableName>(id: IdOfTable<T>) => Promise<Doc<T> | null>;
+
+/**
+ * Resolves the \`asId\` table argument: a literal in {@link TableName} passes through, a
+ * genuinely-wide \`string\` (a computed name) passes through, and any OTHER literal
+ * collapses to \`never\` so it fails to typecheck.
+ *
+ * The \`string extends T\` arm is what distinguishes "the caller passed a computed
+ * string" from "the caller passed a misspelled literal" — only the wide \`string\` type
+ * is a supertype of \`string\`.
+ */
+type AsIdTable<T extends string> = T extends TableName ? T : string extends T ? T : never;
+
+/**
+ * The id parse boundary \`ctx.db.asId(table, id)\`, bound to this schema: a misspelled
+ * table literal is a compile error rather than a call that hands back a confidently-
+ * branded id for a table that does not exist. Mirrors {@link TypedTableQuery} /
+ * {@link TypedTableGet}.
+ *
+ * Deliberately NOT an intersection with a wide \`(string, string) => string\` overload:
+ * overload resolution would fall through to it for a bad literal, silently restoring
+ * the very typo hole this narrowing exists to close. {@link AsIdTable} instead keeps a
+ * computed table name working — and keeps \`ctx.db\` structurally assignable to
+ * schema-agnostic consumers — without accepting an invalid literal.
+ */
+type TypedAsId = <T extends string>(tableName: AsIdTable<T>, id: string) => IdOfTable<T & TableName>;
+
+export interface QueryCtx extends Omit<QueryCtxBase, "db" | "storage"${x}${I}${R}> {
+    readonly db: Omit<DatabaseReader, "asId" | "query" | "get"> & DatabaseReaderFacade & { asId: TypedAsId; query: TypedTableQuery; get: TypedTableGet };
+    readonly orm: OrmReader;
+    readonly storage: ReadOnlyStorage<StorageBucketName>;${ce}${g}${h}${T}${v}${f}${B}${$}
+}
+
+export interface MutationCtx extends Omit<MutationCtxBase, "db" | "storage"${x}${C}${I}${R}> {
+    readonly db: Omit<DatabaseWriter, "asId" | "query" | "get"> & DatabaseWriterFacade & { asId: TypedAsId; query: TypedTableQuery; get: TypedTableGet };
+    readonly orm: OrmWriter;
+    readonly storage: MutationStorage<StorageBucketName>;${A}${g}${h}${T}${v}${f}${B}${F}${S}${W}${$}
+}
+
+export interface ActionCtx extends Omit<ActionCtxBase, "db" | "storage"${x}${C}${I}${R}> {
+    readonly db: Omit<DatabaseWriter, "asId" | "query" | "get"> & DatabaseWriterFacade & { asId: TypedAsId; query: TypedTableQuery; get: TypedTableGet };
+    readonly orm: OrmWriter;
+    readonly storage: StorageBase<StorageBucketName>;${A}${g}${J}${Z}${te}${re}${h}${T}${v}${oe}${se}${ie}${f}${de}${le}${B}${F}${S}${W}${$}
+}
+
+/**
+ * Procedure builders bound to this project's typed contexts. Chain
+ * \`.input({...})\` to declare args, \`.use(middleware)\` for rate limiting / RLS /
+ * masking (each middleware may refine \`ctx\`), then the terminal
+ * \`.query()\` / \`.mutation()\` / \`.action()\` with a \`({ ctx, args }) => ...\`
+ * handler. \`.output(validator)\` and (queries) \`.stream()\` are also available.
+ */
+const lunoraBuilders = initLunora.dataModel<DataModel>().create();
+
+/** \`query\` builder bound to this project's typed {@link QueryCtx}. */
+export const query = lunoraBuilders.query as unknown as QueryBuilder<QueryCtx, EmptyArgs>;
+
+/** \`mutation\` builder bound to this project's typed {@link MutationCtx}. */
+export const mutation = lunoraBuilders.mutation as unknown as MutationBuilder<MutationCtx, EmptyArgs>;
+
+/** \`action\` builder bound to this project's typed {@link ActionCtx}. */
+export const action = lunoraBuilders.action as unknown as ActionBuilder<ActionCtx, EmptyArgs>;
+
+/** \`internalQuery\` builder bound to this project's typed {@link QueryCtx} — never exposed on \`api\`. */
+export const internalQuery = lunoraBuilders.internalQuery as unknown as InternalQueryBuilder<QueryCtx, EmptyArgs>;
+
+/** \`internalMutation\` builder bound to this project's typed {@link MutationCtx} — never exposed on \`api\`. */
+export const internalMutation = lunoraBuilders.internalMutation as unknown as InternalMutationBuilder<MutationCtx, EmptyArgs>;
+
+/** \`internalAction\` builder bound to this project's typed {@link ActionCtx} — never exposed on \`api\`. */
+export const internalAction = lunoraBuilders.internalAction as unknown as InternalActionBuilder<ActionCtx, EmptyArgs>;
+
+/**
+ * \`defineMutator\` bound to this project's typed {@link MutationCtx} — declare
+ * custom mutators (\`lunora/mutators.ts\`) with it instead of importing from
+ * \`${r.server}\`, and the authoritative \`server\` impl's \`ctx\` carries the
+ * schema-typed \`ctx.db\` (\`ctx.db.query("nodes")\` resolves \`Doc<"nodes">\`,
+ * \`ctx.db.patch(id, …)\` takes an \`Id<"nodes">\`) with no hand-written ctx type and
+ * no \`as unknown as\` cast. Runtime-identical to the package export; only the
+ * context type narrows, so discovery finds a mutator authored either way.
+ * @example
+ * export const setText = defineMutator({
+ *     args: { id: v.id("nodes"), text: v.string() },
+ *     server: async (ctx, args) => { await ctx.db.patch(args.id, { text: args.text }); },
+ * });
+ */
+export const defineMutator = defineMutatorBase as unknown as <Args extends Record<string, Validator> = Record<string, Validator>, ClientTx = unknown, R = unknown>(
+    definition: MutatorDefinition<Args, MutationCtx, ClientTx, R>,
+) => RegisteredMutator<Args, MutationCtx, ClientTx, R>;
+
+/**
+ * \`definePolicy\` bound to THIS schema's {@link DataModel} + {@link Relations}.
+ * Import it from here (\`./_generated/server\`) instead of \`@lunora/server\` to get
+ * a relation-aware RLS authoring surface: \`table\` autocompletes to a real table
+ * name and the \`when\` predicate type-checks against the table's columns **and**
+ * its declared relations — \`{ author: { is: {...} } }\`, \`{ posts: { some: {...} } }\`,
+ * etc. (the \`@lunora/do\` pre-resolver resolves relation predicates on reads).
+ * Runtime-identical to \`@lunora/server\`'s \`definePolicy\`; only the types narrow,
+ * so the \`rls()\` chain discovers a policy authored either way the same.
+ */
+export const definePolicy = createPolicyDsl<DataModel, Relations${Te}>();
+
+/**
+ * The validator builder \`v\`, with \`v.id(...)\` constrained to THIS schema's
+ * table names — so the argument autocompletes and returns a precise
+ * \`Id<"table">\`. Identical to \`@lunora/server\`'s \`v\` at runtime; the only
+ * difference is the tightened \`id\` type.
+ *
+ * Import \`v\` from here (\`./_generated/server\`) in your queries/mutations/actions
+ * to get table-name autocomplete. \`lunora/schema.ts\` can't use it — it is the
+ * file that defines the table names, so they aren't known yet there; pass the
+ * names as string literals and the generated \`Id<"table">\` types still catch a
+ * typo wherever the id is used.
+ */
+export const v = vBase as unknown as Omit<typeof vBase, "id"> & {
+    id: <T extends TableName>(table: T) => ColumnValidator<IdOfTable<T>, IdOfTable<T>>;
+};
+`};export{Fe as default};

package/dist/packem_shared/emitShard-Bu7EKdou.mjs

@@ -0,0 +1 @@
+import"./SCHEMA_SNAPSHOT_VERSION-C0oHwiJZ.mjs";import"./isD1GlobalTable-udvHAAzD.mjs";import"./json-data-Chfs2Cz5.mjs";import{e as a}from"./shard-B3LMNjIg.mjs";import"./shard-runtime-B_ppYvOf.mjs";import"./shared-DjUziztz.mjs";export{a as default};

package/dist/packem_shared/fingerprintSchemaSources-L3nGKDQt.mjs

@@ -0,0 +1 @@
+import{createHash as c}from"node:crypto";import{existsSync as s,readFileSync as i}from"node:fs";import{join as h}from"node:path";import{listLunoraSourceFiles as u}from"./listLunoraSourceFiles-DP-5e-RE.mjs";const S=t=>{if(!s(t))return"unreadable";const e=u(t),o=h(t,"schema.ts");s(o)&&e.push(o);const r=c("sha256");for(const a of e.toSorted((n,p)=>n.localeCompare(p)))try{r.update(a).update("\0").update(i(a))}catch{}return r.digest("hex")};export{S as default};

package/dist/packem_shared/json-data-Chfs2Cz5.mjs

@@ -0,0 +1 @@
+const a=(r,s)=>`JSON.parse(${JSON.stringify(JSON.stringify(r))}) as ${s}`;export{a as r};

package/dist/packem_shared/qualifiers-BhOL15WZ.mjs

@@ -0,0 +1 @@
+import{d as E}from"./declared-output-Iaar469J.mjs";import{v as u}from"./shared-DjUziztz.mjs";const p=/import\("(?<spec>(?:\.\.?\/)*_generated\/[^"]+)"\)/gu,l=/^(?:\.\.?\/)*_generated\//u,i=/\.[A-Za-z]\w*$/u,R=t=>t.replaceAll(p,(e,r)=>{const o=r.replace(l,"./");return`import("${i.test(o)?o:`${o}.js`}")`}),_=/import\("(?<spec>[^"]+)"\)/gu,a="node_modules/",m=/^@types\//u,A=t=>t.replaceAll(_,(e,r)=>{const o=r.lastIndexOf(a);if(o===-1||o>0&&r[o-1]!=="/")return e;const s=r.slice(o+a.length);return s===""||m.test(s)?e:`import("${s}")`}),I=/import\("(?<spec>\.\.?\/[^"]+)"\)/gu,f=/^(?:\.\.?\/)+/u,g=t=>{const e=[];for(const r of t.split("/"))if(!(r===""||r===".")){if(r===".."&&e.length>0&&e.at(-1)!==".."){e.pop();continue}e.push(r)}return e.join("/")},S=(t,e)=>t.replaceAll(I,(r,o)=>{if(l.test(o.replace(f,"")))return r;const s=e.includes("/")?e.slice(0,e.lastIndexOf("/")):"",c=`../${g(`${s}/${o}`)}`;return`import("${i.test(c)?c:`${c}.js`}")`}),v=(t,e)=>R(S(A(t),e)),d=["client","do","errors","flags","observability","platform","ratelimit","runtime","server","values"],L=new RegExp(String.raw`import\("@lunora/(?<pkg>${d.join("|")})(?<subpath>/[^"]*)?"\)`,"gu"),T={flags:new Set(["/web"]),platform:new Set},M=(t,e)=>e?t.replaceAll(L,(r,o,s)=>{const n=T[o];return s&&n&&!n.has(s)?r:`import("lunorash/${o}${s??""}")`}):t,O=t=>["Doc","Id"].filter(e=>new RegExp(String.raw`(?<![.$\w])${e}<`,"u").test(t)),U=t=>E(t)?u(t.output):t.returnType;export{M as a,v as b,U as c,O as r};