@lunora/codegen 1.0.0-alpha.240 → 1.0.0-alpha.242

package/dist/packem_shared/{emitApp-BGhO5bhT.mjs → emitApp--W9G6MZd.mjs}

@@ -1,9 +1,9 @@
-import{A as w}from"./capabilities-DJJWVEtk.mjs";import{G as y}from"./shared-DjUziztz.mjs";const k=e=>`has${e.charAt(0).toUpperCase()}${e.slice(1)}`,b=w.map(({appMethod:e,key:t})=>[k(t),e.method,e.configKey,e.doc]),g=e=>b.some(([t])=>e[t]),S=e=>e?['import * as lunoraIdentityContract from "../identity.js";']:[],E=(e,t)=>e?['import type { CreateAccessResolverOptions } from "@lunora/cloudflare-access";',`import { createAccessResolver${t?", composeResolvers":""} } from "@lunora/cloudflare-access";`]:[],D=e=>e?['import { createKvIntrospectorFromEnv } from "@lunora/bindings/kv";']:[],x=e=>e?['import { createVectorAdminIntrospector } from "@lunora/bindings/vectors";']:[],R=e=>e?['import type { D1CtxDbOptions, D1DatabaseLike, D1Exec } from "@lunora/d1";','import { applyCdcChanges, createD1CtxDb, emitD1QueryCost, exportGlobalRows, facetGlobalColumn, importGlobalRows, listGlobalTables, readD1CdcChanges, readGlobalTablePage, retryingExec } from "@lunora/d1";']:[],A=e=>e?['import notifyConfig from "../notify.js";']:[],m=e=>(e.emailAgents?.length??0)>0,C=e=>m(e)?['import { dispatchAgentEmail } from "@lunora/agent/inbound";']:[],O=e=>m(e)?['import * as lunoraAgentDefinitions from "../agents.js";']:[],T=e=>{const{hasFramework:t,hasGlobal:a,hasHyperdriveGlobal:r,hasQueue:n,useUmbrella:i}=e,o=i?"lunorash/runtime":"@lunora/runtime",l=["ExecutionContextLike","HttpRouterLike","LunoraWorker","Route","ScheduledControllerLike","ShardNamespaceLike","WorkerOptions",...n?["TriggerTrace"]:[],...a?["GlobalIntrospector","AdminTableResolver"]:[],...t?["FrameworkHostHandler"]:[]],s=[...a||r?["createCrossShardRelationCapabilities"]:[],"createWorker",...e.jurisdiction?["declareAppJurisdiction"]:[],"resolveLogArchiveFromEnv",...t?["withFrameworkWorker"]:[]].join(", ");return[`import type { ${[...l].toSorted((c,d)=>c.localeCompare(d)).join(", ")} } from "${o}";`,`import { ${s} } from "${o}";`]},N=e=>{const{hasAccess:t,hasAuth:a,hasGlobal:r,hasHyperdriveGlobal:n,hasKvIntrospector:i,hasQueue:o,hasScheduler:l,hasStorage:s,hasWorkflow:c,wantsOpenApi:d,wantsOpenRpc:h}=e;return[...a?['import type { AuthNamespaceLike, LunoraAuth, LunoraAuthOptions } from "@lunora/auth";','import { createAuth, createAuthAdmin, createAuthAuditReader, createDoAuthWiring, d1Executor, ensureMigrated, handleAuthRequest, lunoraD1Adapter } from "@lunora/auth";']:[],...E(t,a),...R(r),...n?['import type { HyperdriveEngine } from "@lunora/hyperdrive/global";','import { createHyperdriveGlobalCtxDb } from "@lunora/hyperdrive/global";','import type { SqlCtxDbOptions, SqlExec } from "@lunora/sql-store";']:[],...D(i),...x(e.hasVectors===!0),...l?['import type { DurableObjectNamespaceLike } from "@lunora/scheduler";','import { createScheduler } from "@lunora/scheduler";']:[],...s?['import type { R2BucketLike, R2S3Credentials, Storage } from "@lunora/storage";','import { createBucketStorage, createStorage } from "@lunora/storage";']:[],...c?['import { createWorkflowsRestClient } from "@lunora/workflow";']:[],...C(e),...T(e),"",...S(e.identity),...O(e),...r||n?['import schema from "../schema.js";']:[],...A(e.hasNotify),'import { LUNORA_CRONS } from "./crons.js";','import { LUNORA_FUNCTIONS } from "./functions.js";',...o?['import { createQueueCaptureSink, dispatchQueueBatch, shouldCaptureQueue } from "@lunora/queue";','import { LUNORA_QUEUE_REGISTRY } from "./queues.js";']:[],...d?['import { openApiSpec } from "./openapi.js";']:[],...h?['import { openRpcSpec } from "./openrpc.js";']:[],'import { createShardDO } from "./shard.js";',...e.hasVectors===!0?['import { LUNORA_VECTOR_INDEXES } from "./vectors.js";']:[]]},I=e=>[...e.hasStorage?["/** `.storage(...)` declaration — one bucket (required) plus optional extra named buckets and signed-URL config. Backs `ctx.storage` AND the studio file browser. */\ninterface StorageDeclaration<Env> {\n    /** The default R2 bucket binding (the bare `ctx.storage`). */\n    bucket: Selector<Env, R2BucketLike>;\n    /** Extra named buckets, reached via `ctx.storage.bucket(\"name\")` and the studio's bucket picker. */\n    buckets?: Record<string, Selector<Env, R2BucketLike>>;\n    /** Public base URL signed/public object URLs resolve against. Omit it and `ctx.storage` in a mutation, action or HTTP handler (and the studio's copy-URL) signs against the origin the request reached the worker on — no per-environment value to ship. Queries get no such fallback (a live query re-runs with no request behind it), so a query that signs URLs needs this set. */\n    publicBaseUrl?: Selector<Env, string>;\n    /** R2 S3-API credentials (`{ accountId, accessKeyId, secretAccessKey, bucket, jurisdiction? }`) enabling `ctx.storage.getPresignedUrl` — native S3 presigned URLs that hit R2 directly, bypassing the worker. Omit to use only the worker-signed `getSignedUrl` path. */\n    s3?: Selector<Env, R2S3Credentials>;\n    /** HMAC secret for signed URLs. */\n    signingSecret?: Selector<Env, string>;\n}"]:[],...e.hasScheduler?["/** `.scheduler(...)` declaration — the `SchedulerDO` namespace. Backs `ctx.scheduler` AND the studio's scheduled-jobs view. The origin its callbacks dispatch back to is not declared here: the DO reads `env.LUNORA_ORIGIN_URL` at fire time, because a caller-supplied dispatch target would be an SSRF vector. */\ninterface SchedulerDeclaration<Env> {\n    /** The `SchedulerDO` namespace binding (typically `env.SCHEDULER`). */\n    namespace: Selector<Env, DurableObjectNamespaceLike & ShardNamespaceLike>;\n}"]:[],...e.hasGlobal?["/** `.global(...)` declaration — the D1 binding backing `.global()` tables. Backs cross-tenant `ctx.db` reads/writes AND the studio's global data browser. */\ninterface GlobalDeclaration<Env> {\n    /** The D1 binding (typically `env.DB`). */\n    d1: Selector<Env, D1DatabaseLike>;\n    /** The worker origin used to fan reverse cross-backend relations across shards. Without it, such a relation throws a clear error. */\n    origin?: Selector<Env, string>;\n}"]:[],...e.hasHyperdriveGlobal?['/** `.hyperdriveGlobal(...)` declaration — backs `.global({ backend: "hyperdrive" })` tables on a Postgres/MySQL database via Hyperdrive. Stays reactive: the writer is injected as `globalDb` and the broadcast hook drives live queries. */\ninterface HyperdriveGlobalDeclaration<Env> {\n    /** The Hyperdrive engine — selects the Postgres or MySQL dialect. */\n    engine: HyperdriveEngine;\n    /** Build the `SqlExec` from `env` — e.g. `buildPgExec(fromPostgresJs(postgres(env.HYPERDRIVE.connectionString)))`. Cache the driver on the DO instance; rebuild lazily after hibernation. */\n    exec: (env: Env) => SqlExec;\n    /** The worker origin used to fan reverse cross-backend relations across shards. Without it, such a relation throws a clear error. */\n    origin?: Selector<Env, string>;\n}']:[],...e.hasAuth?['/** `.auth(...)` declaration — better-auth options plus the storage the adapter reads. Give it `d1` (the default) or `namespace` (a Durable Object that hosts the auth tables), never both. The builder owns the lazy build + `ensureMigrated` dance and wires `authHandler` / `resolveIdentity` / `authAdmin`. */\ninterface AuthDeclaration<Env> {\n    /** The D1 binding the auth SQL adapter is wired over (via `lunoraD1Adapter`). Omit only when using `namespace`. */\n    d1?: Selector<Env, unknown>;\n    /** Shared secret the worker presents on the object\'s internal session route. REQUIRED with `namespace`: the binding is reachable from any worker bound to it, so the secret — not the binding — is the authorization boundary. Without it identity resolution fails closed. */\n    internalSecret?: Selector<Env, string>;\n    /** Name of the Durable Object instance holding the auth tables. Defaults to `"auth"`. Set it to run separate auth objects (per deployment, per tenant) off one namespace. */\n    objectName?: Selector<Env, string>;\n    /** The auth Durable Object namespace — the DO-backed mode. Needed for `@better-auth/scim`, which requires native transactions that D1 has none of. The object owns the auth tables, so `/api/auth/*` and identity resolution both go through it. Typed as `AuthNamespaceLike` because `createDoAuthWiring` resolves through `idFromName` + `get` and has no `getByName` fallback — both members are load-bearing here, and `ShardNamespaceLike` leaves both optional. */\n    namespace?: Selector<Env, AuthNamespaceLike>;\n    /** Build the better-auth options from `env` (secret, plugins, email/password, …). */\n    options: (env: Env) => LunoraAuthOptions;\n}']:[]],L=e=>[...e.hasAccess?["    private accessSelector?: Selector<Env, CreateAccessResolverOptions | undefined>;"]:[],"    private adminToken?: Selector<Env, string>;",...e.hasAuth?["    private authDeclaration?: AuthDeclaration<Env>;"]:[],"    private cdcEnabled = false;","    private reactiveCacheConfig: boolean | { maxBytes?: number; maxEntries?: number } = false;",'    private maxRelationKeysLimit?: ShardConfig["maxRelationKeys"];','    private observabilitySink?: ShardConfig["observability"];','    private relationExistsPushDownMode?: ShardConfig["relationExistsPushDown"];',"    private readonly extendFns: ((env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>)[] = [];",...e.hasGlobal?["    private globalDeclaration?: GlobalDeclaration<Env>;"]:[],...e.hasHyperdriveGlobal?["    private hyperdriveGlobalDeclaration?: HyperdriveGlobalDeclaration<Env>;"]:[],"    private httpRouterApp?: HttpRouterLike;","    private readonly routeMap: Record<string, Route> = {};",...e.hasScheduler?["    private schedulerDeclaration?: SchedulerDeclaration<Env>;"]:[],...g(e)?["    private readonly shardExtras: Partial<ShardConfig> = {};"]:[],"    private shardSelector?: Selector<Env, ShardNamespaceLike>;",...e.hasSourcedTables?['    private sourceClientFactory?: NonNullable<ShardConfig["sourceClient"]>;']:[],...e.hasStorage?["    private storageDeclaration?: StorageDeclaration<Env>;"]:[]],q=e=>b.filter(([t])=>e[t]).map(([,t,a,r])=>`    /** ${r} */
-    public ${t}(factory: (env: Env) => ReturnType<NonNullable<ShardConfig["${a}"]>>): this {
-        this.shardExtras.${a} = factory as NonNullable<ShardConfig["${a}"]>;
+import{A as w}from"./capabilities-DJJWVEtk.mjs";import{i as k}from"./ir-BgM8A3XV.mjs";import{G as S}from"./shared-DjUziztz.mjs";const E=e=>`has${e.charAt(0).toUpperCase()}${e.slice(1)}`,g=w.map(({appMethod:e,key:t})=>[E(t),e.method,e.configKey,e.doc]),m=e=>g.some(([t])=>e[t]),D=e=>e?['import * as lunoraIdentityContract from "../identity.js";']:[],R=(e,t)=>e?['import type { CreateAccessResolverOptions } from "@lunora/cloudflare-access";',`import { createAccessResolver${t?", composeResolvers":""} } from "@lunora/cloudflare-access";`]:[],x=e=>e?['import { createKvIntrospectorFromEnv } from "@lunora/bindings/kv";']:[],A=e=>e?['import { createVectorAdminIntrospector } from "@lunora/bindings/vectors";']:[],C=e=>e?['import type { D1CtxDbOptions, D1DatabaseLike, D1Exec } from "@lunora/d1";','import { applyCdcChanges, createD1CtxDb, emitD1QueryCost, exportGlobalRows, facetGlobalColumn, importGlobalRows, listGlobalTables, readD1CdcChanges, readGlobalTablePage, retryingExec } from "@lunora/d1";']:[],O=e=>e?['import notifyConfig from "../notify.js";']:[],v=e=>(e.emailAgents?.length??0)>0,T=e=>v(e)?['import { dispatchAgentEmail } from "@lunora/agent/inbound";']:[],N=e=>v(e)?['import * as lunoraAgentDefinitions from "../agents.js";']:[],d=e=>e.tables.some(t=>k(t)),I=e=>{const{hasFramework:t,hasGlobal:r,hasHyperdriveGlobal:a,hasQueue:n,useUmbrella:i}=e,o=i?"lunorash/runtime":"@lunora/runtime",l=["ExecutionContextLike","HttpRouterLike","LunoraWorker","Route","ScheduledControllerLike","ShardNamespaceLike","WorkerOptions",...n?["TriggerTrace"]:[],...r?["GlobalIntrospector"]:[],...e.tables.length>0?["ShardingInfo"]:[],...t?["FrameworkHostHandler"]:[]],s=[...r||a?["createCrossShardRelationCapabilities"]:[],...d(e)?["createDynamicShardRegistry","createQueryCoordinator"]:[],"createWorker",...e.jurisdiction?["declareAppJurisdiction"]:[],"resolveLogArchiveFromEnv",...t?["withFrameworkWorker"]:[]].join(", ");return[`import type { ${[...l].toSorted((c,h)=>c.localeCompare(h)).join(", ")} } from "${o}";`,`import { ${s} } from "${o}";`]},L=e=>{const{hasAccess:t,hasAuth:r,hasGlobal:a,hasHyperdriveGlobal:n,hasKvIntrospector:i,hasQueue:o,hasScheduler:l,hasStorage:s,hasWorkflow:c,wantsOpenApi:h,wantsOpenRpc:u}=e;return[...r?['import type { AuthNamespaceLike, LunoraAuth, LunoraAuthOptions } from "@lunora/auth";','import { createAuth, createAuthAdmin, createAuthAuditReader, createDoAuthWiring, d1Executor, ensureMigrated, handleAuthRequest, lunoraD1Adapter } from "@lunora/auth";']:[],...R(t,r),...C(a),...n?['import type { HyperdriveEngine } from "@lunora/hyperdrive/global";','import { createHyperdriveGlobalCtxDb } from "@lunora/hyperdrive/global";','import type { SqlCtxDbOptions, SqlExec } from "@lunora/sql-store";']:[],...x(i),...A(e.hasVectors===!0),...l?['import type { DurableObjectNamespaceLike } from "@lunora/scheduler";','import { createScheduler } from "@lunora/scheduler";']:[],...s?['import type { R2BucketLike, R2S3Credentials, Storage } from "@lunora/storage";','import { createBucketStorage, createStorage } from "@lunora/storage";']:[],...c?['import { createWorkflowsRestClient } from "@lunora/workflow";']:[],...T(e),...I(e),"",...D(e.identity),...N(e),...a||n?['import schema from "../schema.js";']:[],...O(e.hasNotify),'import { LUNORA_CRONS } from "./crons.js";','import { LUNORA_FUNCTIONS } from "./functions.js";',...o?['import { createQueueCaptureSink, dispatchQueueBatch, shouldCaptureQueue } from "@lunora/queue";','import { LUNORA_QUEUE_REGISTRY } from "./queues.js";']:[],...h?['import { openApiSpec } from "./openapi.js";']:[],...u?['import { openRpcSpec } from "./openrpc.js";']:[],'import { createShardDO } from "./shard.js";',...e.hasVectors===!0?['import { LUNORA_VECTOR_INDEXES } from "./vectors.js";']:[]]},q=e=>[...e.hasStorage?["/** `.storage(...)` declaration — one bucket (required) plus optional extra named buckets and signed-URL config. Backs `ctx.storage` AND the studio file browser. */\ninterface StorageDeclaration<Env> {\n    /** The default R2 bucket binding (the bare `ctx.storage`). */\n    bucket: Selector<Env, R2BucketLike>;\n    /** Extra named buckets, reached via `ctx.storage.bucket(\"name\")` and the studio's bucket picker. */\n    buckets?: Record<string, Selector<Env, R2BucketLike>>;\n    /** Public base URL signed/public object URLs resolve against. Omit it and `ctx.storage` in a mutation, action or HTTP handler (and the studio's copy-URL) signs against the origin the request reached the worker on — no per-environment value to ship. Queries get no such fallback (a live query re-runs with no request behind it), so a query that signs URLs needs this set. */\n    publicBaseUrl?: Selector<Env, string>;\n    /** R2 S3-API credentials (`{ accountId, accessKeyId, secretAccessKey, bucket, jurisdiction? }`) enabling `ctx.storage.getPresignedUrl` — native S3 presigned URLs that hit R2 directly, bypassing the worker. Omit to use only the worker-signed `getSignedUrl` path. */\n    s3?: Selector<Env, R2S3Credentials>;\n    /** HMAC secret for signed URLs. */\n    signingSecret?: Selector<Env, string>;\n}"]:[],...e.hasScheduler?["/** `.scheduler(...)` declaration — the `SchedulerDO` namespace. Backs `ctx.scheduler` AND the studio's scheduled-jobs view. The origin its callbacks dispatch back to is not declared here: the DO reads `env.LUNORA_ORIGIN_URL` at fire time, because a caller-supplied dispatch target would be an SSRF vector. */\ninterface SchedulerDeclaration<Env> {\n    /** The `SchedulerDO` namespace binding (typically `env.SCHEDULER`). */\n    namespace: Selector<Env, DurableObjectNamespaceLike & ShardNamespaceLike>;\n}"]:[],...e.hasGlobal?["/** `.global(...)` declaration — the D1 binding backing `.global()` tables. Backs cross-tenant `ctx.db` reads/writes AND the studio's global data browser. */\ninterface GlobalDeclaration<Env> {\n    /** The D1 binding (typically `env.DB`). */\n    d1: Selector<Env, D1DatabaseLike>;\n    /** The worker origin used to fan reverse cross-backend relations across shards. Without it, such a relation throws a clear error. */\n    origin?: Selector<Env, string>;\n}"]:[],...e.hasHyperdriveGlobal?['/** `.hyperdriveGlobal(...)` declaration — backs `.global({ backend: "hyperdrive" })` tables on a Postgres/MySQL database via Hyperdrive. Stays reactive: the writer is injected as `globalDb` and the broadcast hook drives live queries. */\ninterface HyperdriveGlobalDeclaration<Env> {\n    /** The Hyperdrive engine — selects the Postgres or MySQL dialect. */\n    engine: HyperdriveEngine;\n    /** Build the `SqlExec` from `env` — e.g. `buildPgExec(fromPostgresJs(postgres(env.HYPERDRIVE.connectionString)))`. Cache the driver on the DO instance; rebuild lazily after hibernation. */\n    exec: (env: Env) => SqlExec;\n    /** The worker origin used to fan reverse cross-backend relations across shards. Without it, such a relation throws a clear error. */\n    origin?: Selector<Env, string>;\n}']:[],...e.hasAuth?['/** `.auth(...)` declaration — better-auth options plus the storage the adapter reads. Give it `d1` (the default) or `namespace` (a Durable Object that hosts the auth tables), never both. The builder owns the lazy build + `ensureMigrated` dance and wires `authHandler` / `resolveIdentity` / `authAdmin`. */\ninterface AuthDeclaration<Env> {\n    /** The D1 binding the auth SQL adapter is wired over (via `lunoraD1Adapter`). Omit only when using `namespace`. */\n    d1?: Selector<Env, unknown>;\n    /** Shared secret the worker presents on the object\'s internal session route. REQUIRED with `namespace`: the binding is reachable from any worker bound to it, so the secret — not the binding — is the authorization boundary. Without it identity resolution fails closed. */\n    internalSecret?: Selector<Env, string>;\n    /** Name of the Durable Object instance holding the auth tables. Defaults to `"auth"`. Set it to run separate auth objects (per deployment, per tenant) off one namespace. */\n    objectName?: Selector<Env, string>;\n    /** The auth Durable Object namespace — the DO-backed mode. Needed for `@better-auth/scim`, which requires native transactions that D1 has none of. The object owns the auth tables, so `/api/auth/*` and identity resolution both go through it. Typed as `AuthNamespaceLike` because `createDoAuthWiring` resolves through `idFromName` + `get` and has no `getByName` fallback — both members are load-bearing here, and `ShardNamespaceLike` leaves both optional. */\n    namespace?: Selector<Env, AuthNamespaceLike>;\n    /** Build the better-auth options from `env` (secret, plugins, email/password, …). */\n    options: (env: Env) => LunoraAuthOptions;\n}']:[]],j=e=>[...e.hasAccess?["    private accessSelector?: Selector<Env, CreateAccessResolverOptions | undefined>;"]:[],"    private adminToken?: Selector<Env, string>;",...e.hasAuth?["    private authDeclaration?: AuthDeclaration<Env>;"]:[],"    private cdcEnabled = false;","    private reactiveCacheConfig: boolean | { maxBytes?: number; maxEntries?: number } = false;",'    private maxRelationKeysLimit?: ShardConfig["maxRelationKeys"];','    private observabilitySink?: ShardConfig["observability"];','    private relationExistsPushDownMode?: ShardConfig["relationExistsPushDown"];',"    private readonly extendFns: ((env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>)[] = [];",...e.hasGlobal?["    private globalDeclaration?: GlobalDeclaration<Env>;"]:[],...e.hasHyperdriveGlobal?["    private hyperdriveGlobalDeclaration?: HyperdriveGlobalDeclaration<Env>;"]:[],"    private httpRouterApp?: HttpRouterLike;","    private readonly routeMap: Record<string, Route> = {};",...e.hasScheduler?["    private schedulerDeclaration?: SchedulerDeclaration<Env>;"]:[],...m(e)?["    private readonly shardExtras: Partial<ShardConfig> = {};"]:[],...d(e)?["    private shardRegistrySelector?: Selector<Env, ShardNamespaceLike>;"]:[],"    private shardSelector?: Selector<Env, ShardNamespaceLike>;",...e.hasSourcedTables?['    private sourceClientFactory?: NonNullable<ShardConfig["sourceClient"]>;']:[],...e.hasStorage?["    private storageDeclaration?: StorageDeclaration<Env>;"]:[]],G=e=>g.filter(([t])=>e[t]).map(([,t,r,a])=>`    /** ${a} */
+    public ${t}(factory: (env: Env) => ReturnType<NonNullable<ShardConfig["${r}"]>>): this {
+        this.shardExtras.${r} = factory as NonNullable<ShardConfig["${r}"]>;
 
         return this;
-    }`),j=e=>[...e.hasAccess?["    /** Wire Cloudflare Access (Zero Trust) — feeds the verified Access identity into `ctx.auth` / RLS via `resolveIdentity`. Call it with no argument when the Access policy is attached to the Worker (the identity arrives on the execution context; nothing to configure); pass `teamDomain` + `aud` for a hostname-scoped Access application, whose `Cf-Access-Jwt-Assertion` JWT is verified against your team JWKS. When `.auth(...)` is also configured, Access is composed ahead of it (Access wins when it authenticated the caller; everyone else falls through to the app session). */\n    public access(selector?: Selector<Env, CreateAccessResolverOptions>): this {\n        this.accessSelector = selector ?? (() => undefined);\n\n        return this;\n    }"]:[],`    /** Bearer token gating the \`/_lunora/admin/*\` endpoints the studio calls. */
+    }`),B=e=>[...e.hasAccess?["    /** Wire Cloudflare Access (Zero Trust) — feeds the verified Access identity into `ctx.auth` / RLS via `resolveIdentity`. Call it with no argument when the Access policy is attached to the Worker (the identity arrives on the execution context; nothing to configure); pass `teamDomain` + `aud` for a hostname-scoped Access application, whose `Cf-Access-Jwt-Assertion` JWT is verified against your team JWKS. When `.auth(...)` is also configured, Access is composed ahead of it (Access wins when it authenticated the caller; everyone else falls through to the app session). */\n    public access(selector?: Selector<Env, CreateAccessResolverOptions>): this {\n        this.accessSelector = selector ?? (() => undefined);\n\n        return this;\n    }"]:[],`    /** Bearer token gating the \`/_lunora/admin/*\` endpoints the studio calls. */
     public admin(selector: Selector<Env, string>): this {
         this.adminToken = selector;
 
@@ -52,7 +52,7 @@ import{A as w}from"./capabilities-DJJWVEtk.mjs";import{G as y}from"./shared-DjUz
         this.shardSelector = selector;
 
         return this;
-    }`,...e.hasSourcedTables?[`    /** Resolve the SQL client a \`.source(...)\` table's ingest poll reads from, given the wrangler Hyperdrive binding it named. Build it with \`@lunora/hyperdrive\`'s \`createHyperdrive\` plus your driver adapter. REQUIRED for a sourced table: without it every poll tick records "no sourceClient resolved for binding" and the table stays empty. */
+    }`,...d(e)?["    /** The `ShardRegistryDO` namespace (typically `env.SHARD_REGISTRY`). Each shard registers itself for the `.shardBy()` tables it writes, and cross-shard export, CDC sync and migrations fan out to the shards it lists. Without it they refuse a `.shardBy()` table. */\n    public shardRegistry(selector: Selector<Env, ShardNamespaceLike>): this {\n        this.shardRegistrySelector = selector;\n\n        return this;\n    }"]:[],...e.hasSourcedTables?[`    /** Resolve the SQL client a \`.source(...)\` table's ingest poll reads from, given the wrangler Hyperdrive binding it named. Build it with \`@lunora/hyperdrive\`'s \`createHyperdrive\` plus your driver adapter. REQUIRED for a sourced table: without it every poll tick records "no sourceClient resolved for binding" and the table stays empty. */
     public sourceClient(factory: (env: Env, binding: string) => ReturnType<NonNullable<ShardConfig["sourceClient"]>>): this {
         this.sourceClientFactory = factory as NonNullable<ShardConfig["sourceClient"]>;
 
@@ -62,8 +62,8 @@ import{A as w}from"./capabilities-DJJWVEtk.mjs";import{G as y}from"./shared-DjUz
         this.storageDeclaration = declaration;
 
         return this;
-    }`]:[],...q(e)],G=e=>{const t=r=>e.hasScheduler?`
-                              ...(this.schedulerDeclaration ? { scheduler: this.resolveScheduler(env) as unknown as ${r}["scheduler"] } : {}),`:"",a=["            cdc: this.cdcEnabled,","            reactiveCache: this.reactiveCacheConfig,","            ...(this.maxRelationKeysLimit === undefined ? {} : { maxRelationKeys: this.maxRelationKeysLimit }),","            ...(this.observabilitySink === undefined ? {} : { observability: this.observabilitySink }),","            ...(this.relationExistsPushDownMode === undefined ? {} : { relationExistsPushDown: this.relationExistsPushDownMode }),",...e.hasGlobal?[`            ...(this.globalDeclaration
+    }`]:[],...G(e)],P=e=>{const t=a=>e.hasScheduler?`
+                              ...(this.schedulerDeclaration ? { scheduler: this.resolveScheduler(env) as unknown as ${a}["scheduler"] } : {}),`:"",r=["            cdc: this.cdcEnabled,","            reactiveCache: this.reactiveCacheConfig,","            ...(this.maxRelationKeysLimit === undefined ? {} : { maxRelationKeys: this.maxRelationKeysLimit }),","            ...(this.observabilitySink === undefined ? {} : { observability: this.observabilitySink }),","            ...(this.relationExistsPushDownMode === undefined ? {} : { relationExistsPushDown: this.relationExistsPushDownMode }),",...e.hasGlobal?[`            ...(this.globalDeclaration
                 ? {
                       d1: (rawEnv: Record<string, unknown>, request?: { bookmark?: string; cdc?: boolean; cdcRetentionMs?: number; identity?: Record<string, unknown>; onBookmark?: (bookmark: string | undefined) => void; userId?: string | null }) => {
                           const env = rawEnv as Env;
@@ -134,12 +134,22 @@ import{A as w}from"./capabilities-DJJWVEtk.mjs";import{G as y}from"./shared-DjUz
                 ? {
                       scheduler: (rawEnv: Record<string, unknown>) => this.resolveScheduler(rawEnv as Env),
                   }
-                : {}),`]:[],...e.hasSourcedTables?["            ...(this.sourceClientFactory === undefined ? {} : { sourceClient: this.sourceClientFactory }),"]:[],...e.hasStorage?["            ...(this.storageDeclaration ? { storage: (rawEnv: Record<string, unknown>, origin?: string) => this.resolveStorage(rawEnv as Env, origin) } : {}),"]:[],...g(e)?["            ...this.shardExtras,"]:[]];return a.length>0?`
-${a.join(`
+                : {}),`]:[],...d(e)?["            ...(this.shardRegistrySelector ? { shardRegistry: (rawEnv: Record<string, unknown>) => this.shardRegistrySelector?.(rawEnv as Env) } : {}),"]:[],...e.hasSourcedTables?["            ...(this.sourceClientFactory === undefined ? {} : { sourceClient: this.sourceClientFactory }),"]:[],...e.hasStorage?["            ...(this.storageDeclaration ? { storage: (rawEnv: Record<string, unknown>, origin?: string) => this.resolveStorage(rawEnv as Env, origin) } : {}),"]:[],...m(e)?["            ...this.shardExtras,"]:[]];return r.length>0?`
+${r.join(`
 `)}
-        `:""},B=e=>e.jurisdiction&&e.jurisdictionPinsAuth===!0?`
+        `:""},W=e=>e.jurisdiction&&e.jurisdictionPinsAuth===!0?`
                 // The schema's jurisdiction pins the auth object like every other DO.
-                jurisdiction: ${JSON.stringify(e.jurisdiction)},`:"",P=e=>[...e.tableNames.length>0?[`        options.listSchemaTables = () => [${e.tableNames.map(t=>JSON.stringify(t)).join(", ")}];`]:[],...e.hasScheduler?[`        if (this.schedulerDeclaration) {
+                jurisdiction: ${JSON.stringify(e.jurisdiction)},`:"",_=e=>typeof e=="string"?`{ mode: { kind: ${JSON.stringify(e)} } }`:`{ mode: { field: ${JSON.stringify(e.field)}, kind: "shardBy" } }`,$=e=>[...e.tables.length>0?[`        const tableSharding = new Map<string, ShardingInfo>([
+${e.tables.map(t=>`            [${JSON.stringify(t.name)}, ${_(t.shardMode)}],`).join(`
+`)}
+        ]);
+
+        options.listSchemaTables = () => [...tableSharding.keys()];
+        options.resolveTableSharding = (table) => tableSharding.get(table);`]:[],...d(e)?[`        const shardRegistry = this.shardRegistrySelector?.(env);
+
+        if (shardRegistry) {
+            options.queryCoordinator = createQueryCoordinator({ registry: createDynamicShardRegistry({ ${e.jurisdiction?`jurisdiction: ${JSON.stringify(e.jurisdiction)}, `:""}namespace: shardRegistry }) });
+        }`]:[]],H=e=>[...$(e),...e.hasScheduler?[`        if (this.schedulerDeclaration) {
             options.schedulerDO = this.schedulerDeclaration.namespace(env);
         }`]:[],...e.hasWorkflow?[`        options.workflowsClient = (workflowEnv) => {
             const source = workflowEnv as Record<string, unknown>;
@@ -154,14 +164,9 @@ ${a.join(`
 
             if (database) {
                 options.globalIntrospector = buildGlobalIntrospector(database);
-                // \`resolveTableSharding\`/\`importGlobals\` wire the admin bulk-import
-                // endpoint: without the former, EVERY row (including a \`.global()\`
-                // table's) routes to the default shard, so a global table is never
-                // recognised as global and the latter is never reached — the
-                // endpoint answers 200 with \`inserted: {}\` for a write that never
-                // happened. Both are mechanical over the schema this file already
-                // imports, so there is nothing project-specific to configure.
-                options.resolveTableSharding = buildTableShardingResolver();
+                // \`importGlobals\` wires the admin bulk-import endpoint's global
+                // plane: the rows \`resolveTableSharding\` classifies as \`.global()\`
+                // land here, and without it they are reported, not written.
                 options.importGlobals = buildGlobalImporter(database, this.cdcEnabled);
                 // The read/replay half of the same admin plane. Each one is the
                 // only reason its endpoint can see the global storage plane at
@@ -206,7 +211,7 @@ ${a.join(`
             // than more emitted code: request-path logic in generated output can only be
             // typechecked, never unit-tested.
             const authWiring = createDoAuthWiring({
-                internalSecret: authDeclaration.internalSecret?.(env),${B(e)}
+                internalSecret: authDeclaration.internalSecret?.(env),${W(e)}
                 namespace: authNamespace(env),
                 objectName: authDeclaration.objectName?.(env),
             });
@@ -284,14 +289,14 @@ ${a.join(`
         }`]:[],...e.voiceAgents&&e.voiceAgents.length>0?[`        options.voiceAgents = {
 ${e.voiceAgents.map(t=>`            ${JSON.stringify(t.exportName)}: (env as Record<string, unknown>)[${JSON.stringify(t.bindingName)}] as ShardNamespaceLike,`).join(`
 `)}
-        };`]:[]],W=e=>["            cronJobs: LUNORA_CRONS,","            functions: LUNORA_FUNCTIONS,",...e.identity?[`            identity: lunoraIdentityContract.${e.identity.exportName},`]:[],...e.jurisdiction?[`            jurisdiction: ${JSON.stringify(e.jurisdiction)},`]:[],...e.wantsOpenApi?["            openApiSpec,"]:[],...e.wantsOpenRpc?["            openRpcSpec,"]:[],...e.hasQueue?["            queue: (batch: unknown, queueEnv: unknown, _context: ExecutionContextLike, trigger: TriggerTrace): Promise<void> =>","                dispatchQueueBatch(batch as Parameters<typeof dispatchQueueBatch>[0], LUNORA_QUEUE_REGISTRY, {","                    capture: shouldCaptureQueue(queueEnv as Record<string, unknown>)",`                        ? createQueueCaptureSink(queueEnv as Record<string, unknown>${e.jurisdiction?`, { jurisdiction: ${JSON.stringify(e.jurisdiction)} }`:""})`,"                        : undefined,","                    env: queueEnv as Record<string, unknown>,","                    traceparent: trigger.traceparent,","                }),"]:[],"            ...(this.httpRouterApp ? { httpRouter: this.httpRouterApp } : {}),","            routes: this.routeMap,","            shardDO: this.shardSelector?.(env) ?? (undefined as unknown as ShardNamespaceLike),"],_=e=>e.hasScheduler?`
+        };`]:[]],U=e=>["            cronJobs: LUNORA_CRONS,","            functions: LUNORA_FUNCTIONS,",...e.identity?[`            identity: lunoraIdentityContract.${e.identity.exportName},`]:[],...e.jurisdiction?[`            jurisdiction: ${JSON.stringify(e.jurisdiction)},`]:[],...e.wantsOpenApi?["            openApiSpec,"]:[],...e.wantsOpenRpc?["            openRpcSpec,"]:[],...e.hasQueue?["            queue: (batch: unknown, queueEnv: unknown, _context: ExecutionContextLike, trigger: TriggerTrace): Promise<void> =>","                dispatchQueueBatch(batch as Parameters<typeof dispatchQueueBatch>[0], LUNORA_QUEUE_REGISTRY, {","                    capture: shouldCaptureQueue(queueEnv as Record<string, unknown>)",`                        ? createQueueCaptureSink(queueEnv as Record<string, unknown>${e.jurisdiction?`, { jurisdiction: ${JSON.stringify(e.jurisdiction)} }`:""})`,"                        : undefined,","                    env: queueEnv as Record<string, unknown>,","                    traceparent: trigger.traceparent,","                }),"]:[],"            ...(this.httpRouterApp ? { httpRouter: this.httpRouterApp } : {}),","            routes: this.routeMap,","            shardDO: this.shardSelector?.(env) ?? (undefined as unknown as ShardNamespaceLike),"],F=e=>e.hasScheduler?`
     /** Resolve the \`SchedulerDO\`-backed scheduler for this env; \`undefined\` until the namespace is wired. */
     private resolveScheduler(env: Env): ReturnType<typeof createScheduler> | undefined {
         const namespace = this.schedulerDeclaration?.namespace(env);
 
         return namespace ? createScheduler({${e.jurisdiction?` jurisdiction: ${JSON.stringify(e.jurisdiction)},`:""} namespace }) : undefined;
     }
-`:"",$=e=>e?`
+`:"",M=e=>e?`
     /**
      * One bucket's \`Storage\`, signing under the name it is registered as.
      *
@@ -396,7 +401,7 @@ ${e.voiceAgents.map(t=>`            ${JSON.stringify(t.exportName)}: (env as Rec
             storageUpload: (key: string, body: ArrayBuffer, opts?: { bucket?: string; contentType?: string; sha256?: string }) => pick(opts?.bucket).upload(key, body, opts),
         };
     }
-`:"",H=e=>e?`
+`:"",Q=e=>e?`
 /**
  * Adapt the raw D1 binding to \`@lunora/d1\`'s \`D1Exec\` (reads via \`all\`, writes via \`run\`, and — when the binding exposes it — several writes in one round trip via \`batch\`).
  *
@@ -518,19 +523,6 @@ const buildGlobalIntrospector = (database: D1DatabaseLike): GlobalIntrospector =
     };
 };
 
-/**
- * \`resolveTableSharding\` for the admin bulk-import endpoint: a lookup over each
- * table's declared \`shardMode\` (\`defineTable(...).global()\` / \`.shardBy(field)\`
- * already record exactly this shape on the table) — mechanical, nothing to
- * configure per project. \`undefined\` for a table the schema doesn't declare, so
- * the import endpoint's own unknown-table handling still applies.
- */
-const buildTableShardingResolver = (): AdminTableResolver => (table) => {
-    const declared = (schema as unknown as D1CtxDbOptions["schema"]).tables[table];
-
-    return declared?.shardMode ? { mode: declared.shardMode } : undefined;
-};
-
 /**
  * \`importGlobals\` for the admin bulk-import endpoint: routes \`.global()\` rows
  * through the same D1 writer \`.global()\` reads/writes already use, via
@@ -631,9 +623,9 @@ const buildGlobalCdcApplier =
 
         return request.changes.length;
     };
-`:"",U=e=>[...e.hasAuth?["AuthDeclaration"]:[],"ComposedApp",...e.hasGlobal?["GlobalDeclaration"]:[],"LunoraConfig",...e.hasScheduler?["SchedulerDeclaration"]:[],"Selector",...e.hasStorage?["StorageDeclaration"]:[]].toSorted((t,a)=>t.localeCompare(a)).join(", "),Q=e=>{const t={...e,hasVectors:(e.hasVectors??!0)&&(e.vectorIndexCount??0)>0},{hasAuth:a}=t,r=I(t),n=P(t),i=a?`        let auth: LunoraAuth | null = null;
+`:"",K=e=>[...e.hasAuth?["AuthDeclaration"]:[],"ComposedApp",...e.hasGlobal?["GlobalDeclaration"]:[],"LunoraConfig",...e.hasScheduler?["SchedulerDeclaration"]:[],"Selector",...e.hasStorage?["StorageDeclaration"]:[]].toSorted((t,r)=>t.localeCompare(r)).join(", "),Y=e=>{const t={...e,hasVectors:(e.hasVectors??!0)&&(e.vectorIndexCount??0)>0},{hasAuth:r}=t,a=q(t),n=H(t),i=r?`        let auth: LunoraAuth | null = null;
         let authInit: Promise<void> | null = null;
-`:"",o=a?`
+`:"",o=r?`
         const initAuth = async (env: Env): Promise<void> => {
             if (!this.authDeclaration) {
                 return;
@@ -682,17 +674,17 @@ const buildGlobalCdcApplier =
                 authInit = null;
                 throw error;
             }));
-`:"",l=a?`
-                await ensureAuth(env);`:"",s=a?"() => auth":"() => null",c=a?"getAuth: () => LunoraAuth | null":"_getAuth: () => null",d=t.hasFramework?`        const buildWorker = (env: Env): LunoraWorker =>
-            host ? withFrameworkWorker(host, (hostEnv) => this.buildWorkerOptions(hostEnv as Env, ${s})) : createWorker(this.buildWorkerOptions(env, ${s}));`:`        const buildWorker = (env: Env): LunoraWorker => createWorker(this.buildWorkerOptions(env, ${s}));`,h=t.hasFramework?"host?: FrameworkHostHandler":"",u=t.emailAgents??[],v=u.length>0?`        composed.email = dispatchAgentEmail([
-${u.map(p=>`            { agent: lunoraAgentDefinitions.${p.exportName}, binding: ${JSON.stringify(p.bindingName)} },`).join(`
+`:"",l=r?`
+                await ensureAuth(env);`:"",s=r?"() => auth":"() => null",c=r?"getAuth: () => LunoraAuth | null":"_getAuth: () => null",h=t.hasFramework?`        const buildWorker = (env: Env): LunoraWorker =>
+            host ? withFrameworkWorker(host, (hostEnv) => this.buildWorkerOptions(hostEnv as Env, ${s})) : createWorker(this.buildWorkerOptions(env, ${s}));`:`        const buildWorker = (env: Env): LunoraWorker => createWorker(this.buildWorkerOptions(env, ${s}));`,u=t.hasFramework?"host?: FrameworkHostHandler":"",p=t.emailAgents??[],y=p.length>0?`        composed.email = dispatchAgentEmail([
+${p.map(b=>`            { agent: lunoraAgentDefinitions.${b.exportName}, className: ${JSON.stringify(b.className)} },`).join(`
 `)}
         ]);
 
 `:"",f=`    /** Materialise the standalone Cloudflare worker + \`ShardDO\` class. */
     public build(): ComposedApp {
         return this.assemble();
-    }${t.hasFramework?"\n\n    /** Compose Lunora's realtime plane INTO a meta-framework's Cloudflare handler (SvelteKit/Astro/Nuxt). The framework `host` serves everything except the reserved `/_lunora/*` endpoints; pass the adapter-emitted worker (e.g. SvelteKit's `_worker.js`, Astro's `handle`). */\n    public buildFrameworkWorker(host: FrameworkHostHandler): ComposedApp {\n        return this.assemble(host);\n    }":""}`;return`${y}${N(t).join(`
+    }${t.hasFramework?"\n\n    /** Compose Lunora's realtime plane INTO a meta-framework's Cloudflare handler (SvelteKit/Astro/Nuxt). The framework `host` serves everything except the reserved `/_lunora/*` endpoints; pass the adapter-emitted worker (e.g. SvelteKit's `_worker.js`, Astro's `handle`). */\n    public buildFrameworkWorker(host: FrameworkHostHandler): ComposedApp {\n        return this.assemble(host);\n    }":""}`;return`${S}${L(t).join(`
 `)}
 
 /** Read a value off the per-request \`env\`. Returns \`undefined\` to leave the capability unconfigured (its \`ctx.*\`/admin surface stays a clear-error stub). */
@@ -706,9 +698,9 @@ ${t.jurisdiction?`
 // \`@lunora/mail\` reads it to pin its shard RPC like every other DO path.
 declareAppJurisdiction(${JSON.stringify(t.jurisdiction)});
 `:""}
-${r.join(`
+${a.join(`
 
-`)}${r.length>0?`
+`)}${a.length>0?`
 
 `:""}/** The composed app: a Cloudflare module worker (\`fetch\` / \`scheduled\` / optional \`email\`) plus the \`ShardDO\` class binding. */
 interface ComposedApp extends LunoraWorker {
@@ -725,27 +717,27 @@ interface ComposedApp extends LunoraWorker {
  * first request so per-isolate singletons are built once.
  */
 class AppBuilder<Env extends object> {
-${L(t).join(`
+${j(t).join(`
 `)}
 
     private emailHandler?: (env: Env) => (message: unknown, env: unknown, context: ExecutionContextLike) => Promise<void>;
 
-${j(t).join(`
+${B(t).join(`
 
 `)}
 
 ${f}
 
     /** Build the shard DO + compose the worker (standalone or framework-hosted), wrapping the lazy per-isolate singletons + auth init. */
-    private assemble(${h}): ComposedApp {
-        const ShardDO = createShardDO({${G(t)}});
+    private assemble(${u}): ComposedApp {
+        const ShardDO = createShardDO({${P(t)}});
 
         // Per-isolate singletons: the worker (and auth instance) are expensive to
         // build, so the first request constructs them and every later request on
         // the same isolate reuses them.
         let worker: LunoraWorker | null = null;
 ${i}${o}
-${d}
+${h}
 
         const composed: ComposedApp = {
             ShardDO,
@@ -772,7 +764,7 @@ ${d}
             },`:""}
         };
 
-${v}        if (this.emailHandler) {
+${y}        if (this.emailHandler) {
             const handler = this.emailHandler;
 
             composed.email = (message, rawEnv, context) => handler(rawEnv as Env)(message, rawEnv, context);
@@ -792,11 +784,11 @@ ${t.hasFramework?`
 `:""}
         return composed;
     }
-${_(t)}${$(t.hasStorage)}
+${F(t)}${M(t.hasStorage)}
     /** Fan the recorded declarations into the worker-side \`createWorker\` options. */
     private buildWorkerOptions(env: Env, ${c}): WorkerOptions {
         const options: WorkerOptions = {
-${W(t).join(`
+${U(t).join(`
 `)}
         };
 
@@ -815,7 +807,7 @@ ${n.join(`
         return options;
     }
 }
-${H(t.hasGlobal)}
+${Q(t.hasGlobal)}
 /**
  * Shape of the project's root \`lunora.config.*\`.
  *
@@ -848,5 +840,5 @@ interface LunoraConfig<Env extends object = object> {
 const defineApp = <Env extends object>(): AppBuilder<Env> => new AppBuilder<Env>();
 
 export { AppBuilder, defineApp };
-export type { ${U(t)} };
-`};export{Q as emitApp};
+export type { ${K(t)} };
+`};export{Y as emitApp};

package/dist/packem_shared/{emitCrons-mkwWkn0R.mjs → emitCrons-Bop1FTEz.mjs}

@@ -1,4 +1,4 @@
-import{G as c}from"./shared-DjUziztz.mjs";const g=o=>o?`${c}/**
+import{i as f}from"./ir-BgM8A3XV.mjs";import{G as c,d as m}from"./shared-DjUziztz.mjs";const u=n=>n?`${c}/**
  * The \`SchedulerDO\` Durable Object class, re-exported so a worker entry can
  * forward it — wrangler binds only what the entry exports:
  *
@@ -8,19 +8,33 @@ import{G as c}from"./shared-DjUziztz.mjs";const g=o=>o?`${c}/**
  * forwards this module for you whenever it exists.
  */
 export { SchedulerDO } from "@lunora/scheduler";
-`:"",h=o=>{const t=new Map;for(const n of o){const a=t.get(n.cron);a?a.push(n):t.set(n.cron,[n])}const i=[...t.keys()].map(n=>`    ${JSON.stringify(n)},`).join(`
-`),e=i.length>0?`
-${i}
-`:"",r=[...t.entries()].map(([n,a])=>{const l=a.map(s=>{const f=s.workflow?`workflow: ${JSON.stringify(s.workflow.binding)}`:`functionPath: ${JSON.stringify(s.functionPath)}`;return`        { name: ${JSON.stringify(s.name)}, ${f}, args: ${JSON.stringify(s.args)} },`}).join(`
-`);return`    ${JSON.stringify(n)}: [
+`:"",y=(n,r)=>n.some(o=>f(o))?`${c}/**
+ * The \`ShardRegistryDO\` Durable Object class — the live set of shard keys per
+ * \`.shardBy()\` table, which cross-shard export, CDC sync and migrations fan out
+ * to. Re-exported so a worker entry can forward it (wrangler binds only what the
+ * entry exports), next to \`.shardRegistry((env) => env.SHARD_REGISTRY)\`:
+ *
+ * \`export { ShardRegistryDO } from "./lunora/_generated/shardRegistry.js";\`
+ *
+ * Name the class in a hand-written entry: binding inference provisions
+ * \`SHARD_REGISTRY\` off the entry's named exports, and cannot see through an
+ * \`export *\`. A Vite-first (class-A) app needs neither line — its generated
+ * worker entry does both whenever this module exists.
+ */
+export { ShardRegistryDO } from "${m(r).do}";
+`:"",w=n=>{const r=new Map;for(const s of n){const a=r.get(s.cron);a?a.push(s):r.set(s.cron,[s])}const o=[...r.keys()].map(s=>`    ${JSON.stringify(s)},`).join(`
+`),e=o.length>0?`
+${o}
+`:"",t=[...r.entries()].map(([s,a])=>{const l=a.map(i=>{const h=i.workflow?`workflow: ${JSON.stringify(i.workflow.className)}`:`functionPath: ${JSON.stringify(i.functionPath)}`;return`        { name: ${JSON.stringify(i.name)}, ${h}, args: ${JSON.stringify(i.args)} },`}).join(`
+`);return`    ${JSON.stringify(s)}: [
 ${l}
     ],`}).join(`
-`),d=r.length>0?`
-${r}
+`),d=t.length>0?`
+${t}
 `:"";return`${c}/**
  * One scheduled cron invocation. Exactly one target is set: \`functionPath\` is
  * the \`namespace:fn\` dispatch ref (matches \`__lunoraRef\`), invoked on the
- * shard; \`workflow\` is a \`WORKFLOW_*\` binding name whose durable workflow is
+ * shard; \`workflow\` is a workflow class name (its \`ctx.exports\` key) whose durable workflow is
  * started fresh per fire. \`args\` are forwarded verbatim (a workflow's become
  * its \`params\`).
  */
@@ -42,9 +56,9 @@ export const LUNORA_CRON_TRIGGERS: ReadonlyArray<string> = [${e}];
  * looks up \`event.cron\` here and dispatches every job in the list.
  */
 export const LUNORA_CRONS: Record<string, ReadonlyArray<LunoraCronJob>> = {${d}};
-`},u=o=>{const t=[...o].toSorted((e,r)=>e.name.localeCompare(r.name)).map(e=>{const r=[`name: ${JSON.stringify(e.name)}`,`table: ${JSON.stringify(e.table)}`];return e.field!==void 0&&r.push(`field: ${JSON.stringify(e.field)}`),e.dimensions!==void 0&&r.push(`dimensions: ${JSON.stringify(e.dimensions)}`),e.metric!==void 0&&r.push(`metric: ${JSON.stringify(e.metric)}`),e.metadata!==void 0&&r.push(`metadata: ${JSON.stringify(e.metadata)}`),`    { ${r.join(", ")} },`}).join(`
-`),i=t.length>0?`
-${t}
+`},S=n=>{const r=[...n].toSorted((e,t)=>e.name.localeCompare(t.name)).map(e=>{const t=[`name: ${JSON.stringify(e.name)}`,`table: ${JSON.stringify(e.table)}`];return e.field!==void 0&&t.push(`field: ${JSON.stringify(e.field)}`),e.dimensions!==void 0&&t.push(`dimensions: ${JSON.stringify(e.dimensions)}`),e.metric!==void 0&&t.push(`metric: ${JSON.stringify(e.metric)}`),e.metadata!==void 0&&t.push(`metadata: ${JSON.stringify(e.metadata)}`),`    { ${t.join(", ")} },`}).join(`
+`),o=r.length>0?`
+${r}
 `:"";return`${c}/**
  * One vector index declared in \`schema.ts\` — an inline \`.vectorize()\` column
  * or a standalone \`defineVectorIndex()\`. \`field\` is the source column (absent
@@ -65,5 +79,5 @@ export interface LunoraVectorIndex {
  * Vectorize cannot enumerate indexes at runtime, so the worker passes this to
  * \`createWorker({ vectorIntrospector })\` to back the studio's vector browser.
  */
-export const LUNORA_VECTOR_INDEXES: ReadonlyArray<LunoraVectorIndex> = [${i}];
-`},p=o=>[...new Set(o.map(t=>t.cron))];export{h as emitCrons,g as emitScheduler,u as emitVectors,p as emitWranglerCronTriggers};
+export const LUNORA_VECTOR_INDEXES: ReadonlyArray<LunoraVectorIndex> = [${o}];
+`},R=n=>[...new Set(n.map(r=>r.cron))];export{w as emitCrons,u as emitScheduler,y as emitShardRegistry,S as emitVectors,R as emitWranglerCronTriggers};

package/dist/packem_shared/{emitFunctions-BqAz1ssY.mjs → emitFunctions-BgNeOZt_.mjs}

@@ -1,4 +1,4 @@
-import{LunoraError as B}from"@lunora/errors";import{L as H,G as q,I as J,d as Q,r as G,b as z,c as x}from"./shared-DjUziztz.mjs";import{s as p}from"./paths-C-9fwEgQ.mjs";import{renderAgentFunctionRegistry as V,renderSandboxFunctionRegistry as W,groupByFileSorted as K}from"./emitApi-CJ9ziZnP.mjs";import{r as Y,a as X,b as O,c as Z}from"./qualifiers-BhOL15WZ.mjs";const ee=new Set(["any","bigint","boolean","date","id","null","number","storage","string","timestamp"]),A=n=>n.column!==void 0,te=(n,e)=>{switch(n){case"bigint":return`if (typeof ${e} !== "bigint") return DEFER;
+import{LunoraError as B}from"@lunora/errors";import{L as H,G as q,I as J,d as Q,r as G,b as z,c as x}from"./shared-DjUziztz.mjs";import{s as p}from"./paths-C-9fwEgQ.mjs";import{renderAgentFunctionRegistry as V,renderSandboxFunctionRegistry as W,groupByFileSorted as K}from"./emitApi-DdW9RyGG.mjs";import{r as Y,a as X,b as O,c as Z}from"./qualifiers-BhOL15WZ.mjs";const ee=new Set(["any","bigint","boolean","date","id","null","number","storage","string","timestamp"]),A=n=>n.column!==void 0,te=(n,e)=>{switch(n){case"bigint":return`if (typeof ${e} !== "bigint") return DEFER;
 `;case"boolean":return`if (typeof ${e} !== "boolean") return DEFER;
 `;case"date":case"number":case"timestamp":return`if (typeof ${e} !== "number" || !Number.isFinite(${e})) return DEFER;
 `;case"null":return`if (${e} !== null) return DEFER;

package/dist/packem_shared/{emitServer-BEo_fCY8.mjs → emitServer-B8t7Hzb1.mjs}

@@ -1,19 +1,17 @@
-import{LunoraError as Ie}from"@lunora/errors";import{S as $e}from"./capabilities-DJJWVEtk.mjs";import{a as c,G as Re,u as Be,d as Oe}from"./shared-DjUziztz.mjs";const De=(l,s=[])=>{const t=new Set;for(const a of l.tables)for(const n of Object.values(a.shape)){const i=Be(n);i.kind==="storage"&&typeof i.bucket=="string"&&i.bucket!==""&&t.add(i.bucket)}for(const a of s)a!==""&&a!=="default"&&t.add(a);return["default",...[...t].toSorted((a,n)=>a.localeCompare(n))]},Fe=({agents:l=[],containers:s=[],env:t,hasAccessFacade:a=!1,hasAi:n=!1,hasAnalytics:i=!1,hasBrowser:E=!1,hasVectors:P=!0,hasFlags:j=!1,hasHyperdrive:q=!1,hasImages:L=!1,hasKv:V=!1,hasNotify:G=!1,hasPayments:O=!1,hasPipelines:_=!1,hasR2sql:H=!1,hasX402:D=!1,identity:d,queues:m=[],schema:M,storageRuleBuckets:z=[],useUmbrella:U=!1,workflows:b=[]}={})=>{const r=Oe(U),K=De(M??{tables:[]},z).map(e=>JSON.stringify(e)).join(" | "),X=n?`import type { LunoraAi } from "@lunora/ai";
-`:"",J=n?`
-    readonly ai: LunoraAi;`:"",Y=O?`import type { LunoraPayment } from "@lunora/payment";
-`:"",Z=O?`
-    readonly payments: LunoraPayment;`:"",ee=D?`import type { X402Pay } from "@lunora/x402/pay";
-`:"",te=D?`
+import{LunoraError as Ie}from"@lunora/errors";import{S as $e}from"./capabilities-DJJWVEtk.mjs";import{a as R,G as Re,u as Be,d as Oe}from"./shared-DjUziztz.mjs";const De=(l,s=[])=>{const t=new Set;for(const a of l.tables)for(const o of Object.values(a.shape)){const i=Be(o);i.kind==="storage"&&typeof i.bucket=="string"&&i.bucket!==""&&t.add(i.bucket)}for(const a of s)a!==""&&a!=="default"&&t.add(a);return["default",...[...t].toSorted((a,o)=>a.localeCompare(o))]},Fe=({agents:l=[],containers:s=[],env:t,hasAccessFacade:a=!1,hasAi:o=!1,hasAnalytics:i=!1,hasBrowser:E=!1,hasVectors:P=!0,hasFlags:j=!1,hasHyperdrive:q=!1,hasImages:L=!1,hasKv:V=!1,hasNotify:G=!1,hasPayments:B=!1,hasPipelines:_=!1,hasR2sql:H=!1,hasX402:O=!1,identity:d,queues:y=[],schema:D,storageRuleBuckets:z=[],useUmbrella:U=!1,workflows:M=[]}={})=>{const r=Oe(U),K=De(D??{tables:[]},z).map(e=>JSON.stringify(e)).join(" | "),X=o?`import type { LunoraAi } from "@lunora/ai";
+`:"",J=o?`
+    readonly ai: LunoraAi;`:"",Y=B?`import type { LunoraPayment } from "@lunora/payment";
+`:"",Z=B?`
+    readonly payments: LunoraPayment;`:"",ee=O?`import type { X402Pay } from "@lunora/x402/pay";
+`:"",te=O?`
     readonly x402: X402Pay;`:"",ae=s.length>0?`import type { ContainerAccessor } from "@lunora/container";
 `:"",re=s.length>0?`
     readonly containers: {${s.map(e=>`
         readonly ${e.exportName}: ContainerAccessor;`).join("")}
-    };`:"",N=[...n?["    /** Workers AI binding (the conventional `env.AI`), narrowing `ctx.ai`. */\n    readonly AI?: unknown;"]:[],...s.map(e=>(c(e.bindingName,`container binding "${e.bindingName}"`),`    /** Durable Object namespace for the \`${e.exportName}\` container. */
-    readonly ${e.bindingName}?: unknown;`)),...b.map(e=>(c(e.bindingName,`workflow binding "${e.bindingName}"`),`    /** Workflow binding for the \`${e.exportName}\` workflow. */
-    readonly ${e.bindingName}?: unknown;`)),...m.map(e=>(c(e.bindingName,`queue binding "${e.bindingName}"`),`    /** Queue producer binding for the \`${e.exportName}\` queue. */
-    readonly ${e.bindingName}?: unknown;`)),...l.map(e=>(c(e.bindingName,`agent binding "${e.bindingName}"`),`    /** Workflow binding for the \`${e.exportName}\` agent. */
+    };`:"",A=[...o?["    /** Workers AI binding (the conventional `env.AI`), narrowing `ctx.ai`. */\n    readonly AI?: unknown;"]:[],...s.map(e=>(R(e.bindingName,`container binding "${e.bindingName}"`),`    /** Durable Object namespace for the \`${e.exportName}\` container. */
+    readonly ${e.bindingName}?: unknown;`)),...y.map(e=>(R(e.bindingName,`queue binding "${e.bindingName}"`),`    /** Queue producer binding for the \`${e.exportName}\` queue. */
     readonly ${e.bindingName}?: unknown;`))].join(`
-`),ne=`
+`),oe=`
 
 /**
  * This project's Cloudflare bindings, as far as codegen can discover them from
@@ -26,26 +24,26 @@ import{LunoraError as Ie}from"@lunora/errors";import{S as $e}from"./capabilities
  * surface, so treat them as \`Fetcher\`/\`Service<unknown>\` and cast.
  */
 export interface CloudflareBindings {
-    readonly [binding: string]: unknown;${N?`
-${N}`:""}
+    readonly [binding: string]: unknown;${A?`
+${A}`:""}
 }
 
 /** Alias for {@link CloudflareBindings} — the typed shape of \`env\`. */
-export type Env = CloudflareBindings;`,o=(e,we,Q)=>{const y=$e.get(e);if(y!==void 0&&y.tier!==Q)throw new Ie("INTERNAL",`@lunora/codegen: capability "${e}" declares tier "${y.tier}" in SERVER_CTX_FIELDS but is emitted onto the "${Q}" context — update whichever is wrong.`);return we?y?.field??"":""},h=o("kv",V,"every"),f=o("analytics",i,"every"),oe=o("hyperdrive",q,"action"),se=o("browser",E,"action"),ie=o("images",L,"action"),de=o("pipelines",_,"action"),le=o("r2sql",H,"action"),u=P&&(M?.vectorIndexes.length??0)>0,x=u?' | "vectors"':"",A=u?`
-    readonly vectors: VectorSearch<VectorIndexName>;`:"",ce=u?`
-    readonly vectors: VectorSearchReader<VectorIndexName>;`:"",ue=u?`import type { VectorSearch, VectorSearchReader } from "${r.server}";
+export type Env = CloudflareBindings;`,n=(e,we,Q)=>{const p=$e.get(e);if(p!==void 0&&p.tier!==Q)throw new Ie("INTERNAL",`@lunora/codegen: capability "${e}" declares tier "${p.tier}" in SERVER_CTX_FIELDS but is emitted onto the "${Q}" context — update whichever is wrong.`);return we?p?.field??"":""},m=n("kv",V,"every"),b=n("analytics",i,"every"),ne=n("hyperdrive",q,"action"),se=n("browser",E,"action"),ie=n("images",L,"action"),de=n("pipelines",_,"action"),le=n("r2sql",H,"action"),c=P&&(D?.vectorIndexes.length??0)>0,h=c?' | "vectors"':"",C=c?`
+    readonly vectors: VectorSearch<VectorIndexName>;`:"",ce=c?`
+    readonly vectors: VectorSearchReader<VectorIndexName>;`:"",ue=c?`import type { VectorSearch, VectorSearchReader } from "${r.server}";
 import type { VectorIndexName } from "./dataModel.js";
-`:"",g=a?`
+`:"",f=a?`
     /** Verified Cloudflare Access identity — a synchronous facade over the resolved claims (email / groups / hasGroup / claims). Anonymous when no Access token is present. */
-    readonly access: import("@lunora/cloudflare-access/context").AccessFacade;`:"",T=j?`
+    readonly access: import("@lunora/cloudflare-access/context").AccessFacade;`:"",x=j?`
     /** Feature-flag evaluation (OpenFeature). Reads are memoized per request; evaluations never throw — a provider error resolves to the supplied default. */
-    readonly flags: import("${r.flags}").LunoraFlags;`:"",v=G?`
+    readonly flags: import("${r.flags}").LunoraFlags;`:"",g=G?`
     /** Multi-channel notifications (@lunora/notify): send / chat / inApp / webhook plus the push device sub-facade. Sends are external I/O — confine them to action handlers. */
     readonly notify: import("@lunora/notify").LunoraNotify;
     /** Device push sub-facade — the same object as ctx.notify.push (register / send / broadcast). Sends belong in action handlers. */
-    readonly push: import("@lunora/notify").LunoraPush;`:"",p=b.length>0,pe=p?`import type { WorkflowHandle } from "@lunora/workflow";
+    readonly push: import("@lunora/notify").LunoraPush;`:"",u=M.length>0,pe=u?`import type { WorkflowHandle } from "@lunora/workflow";
 import type * as lunoraWorkflowDefinitions from "../workflows.js";
-`:"",ye=p?`
+`:"",ye=u?`
 
 /** Params type carried by a \`defineWorkflow\` definition (its phantom \`__params\`). */
 type WorkflowParamsOf<Definition> = Definition extends { __params?: infer Params }
@@ -56,29 +54,29 @@ type WorkflowParamsOf<Definition> = Definition extends { __params?: infer Params
 
 /** This project's declared workflows, addressable from \`ctx.workflows\` by their \`lunora/workflows.ts\` export name. */
 export interface LunoraWorkflows {
-${b.map(e=>`    get(name: ${JSON.stringify(e.exportName)}): WorkflowHandle<WorkflowParamsOf<typeof lunoraWorkflowDefinitions.${e.exportName}>>;`).join(`
+${M.map(e=>`    get(name: ${JSON.stringify(e.exportName)}): WorkflowHandle<WorkflowParamsOf<typeof lunoraWorkflowDefinitions.${e.exportName}>>;`).join(`
 `)}
-}`:"",C=p?' | "workflows"':"",F=p?`
-    readonly workflows: LunoraWorkflows;`:"",k=m.length>0,me=k?`import type { QueueProducer } from "@lunora/queue";
+}`:"",N=u?' | "workflows"':"",F=u?`
+    readonly workflows: LunoraWorkflows;`:"",T=y.length>0,me=T?`import type { QueueProducer } from "@lunora/queue";
 import type * as lunoraQueueDefinitions from "../queues.js";
-`:"",be=k?`
+`:"",be=T?`
 
 /** Message body type carried by a \`defineQueue\` definition (its phantom \`__lunoraBody\`). */
 type QueueBodyOf<Definition> = Definition extends { __lunoraBody?: infer Body } ? (unknown extends Body ? unknown : NonNullable<Body>) : unknown;
 
 /** This project's declared queues, addressable from \`ctx.queues\` by their \`lunora/queues.ts\` export name. */
 export interface LunoraQueues {
-${m.map(e=>`    readonly ${e.exportName}: QueueProducer<QueueBodyOf<typeof lunoraQueueDefinitions.${e.exportName}>>;`).join(`
+${y.map(e=>`    readonly ${e.exportName}: QueueProducer<QueueBodyOf<typeof lunoraQueueDefinitions.${e.exportName}>>;`).join(`
 `)}
-}`:"",S=k?`
-    readonly queues: LunoraQueues;`:"",w=l.length>0,he=w?`import type { AgentHandle } from "@lunora/agent";
-`:"",fe=w?`
+}`:"",S=T?`
+    readonly queues: LunoraQueues;`:"",v=l.length>0,he=v?`import type { AgentHandle } from "@lunora/agent";
+`:"",fe=v?`
 
 /** This project's declared agents, addressable from \`ctx.agents\` by their \`lunora/agents.ts\` export name. */
 export interface LunoraAgents {
-${l.map(e=>(c(e.exportName,`agent export "${e.exportName}"`),`    readonly ${e.exportName}: AgentHandle;`)).join(`
+${l.map(e=>(R(e.exportName,`agent export "${e.exportName}"`),`    readonly ${e.exportName}: AgentHandle;`)).join(`
 `)}
-}`:"",W=w?`
+}`:"",W=v?`
     readonly agents: LunoraAgents;`:"",xe=d?`import type { InferIdentity } from "${r.server}";
 import type * as lunoraIdentityContract from "../identity.js";
 `:"",ge=d?`
@@ -87,12 +85,12 @@ import type * as lunoraIdentityContract from "../identity.js";
 export type Identity = InferIdentity<typeof lunoraIdentityContract.${d.exportName}>;
 
 /** \`ctx.auth\` narrowed so \`getIdentity()\` resolves the declared {@link Identity} contract instead of the untyped claim bag. */
-type NarrowedAuth = Omit<QueryCtxBase["auth"], "getIdentity"> & { getIdentity: () => Promise<Identity | null> };`:"",I=d?' | "auth"':"",$=d?`
+type NarrowedAuth = Omit<QueryCtxBase["auth"], "getIdentity"> & { getIdentity: () => Promise<Identity | null> };`:"",k=d?' | "auth"':"",w=d?`
     readonly auth: NarrowedAuth;`:"",Te=d?", Identity":"",ve=t?`import type * as lunoraEnvContract from "../env.js";
 `:"",ke=t?`
 
 /** This app's declared env contract (\`defineEnv\` in \`lunora/env.ts\`) — the validated, coercion-aware shape of \`ctx.env\`. */
-export type LunoraEnv = ReturnType<typeof lunoraEnvContract.${t.exportName}>;`:"",R=t?' | "env"':"",B=t?"\n    /** Validated, typed environment declared by `defineEnv` in `lunora/env.ts` — parsed & coercion-aware config values (`ctx.env.STRIPE_KEY`); a missing or invalid value throws at read time. */\n    readonly env: LunoraEnv;":"";return`${Re}import { createPolicyDsl, defineMutator as defineMutatorBase, initLunora, v as vBase } from "${r.server}";
+export type LunoraEnv = ReturnType<typeof lunoraEnvContract.${t.exportName}>;`:"",I=t?' | "env"':"",$=t?"\n    /** Validated, typed environment declared by `defineEnv` in `lunora/env.ts` — parsed & coercion-aware config values (`ctx.env.STRIPE_KEY`); a missing or invalid value throws at read time. */\n    readonly env: LunoraEnv;":"";return`${Re}import { createPolicyDsl, defineMutator as defineMutatorBase, initLunora, v as vBase } from "${r.server}";
 import type {
     ActionBuilder,
     ActionCtx as ActionCtxBase,
@@ -209,7 +207,7 @@ export interface OrmWriter extends OrmReader {
 }
 
 /** Storage buckets this schema declares (\`v.storage("name")\`), narrowing \`ctx.storage.bucket(name)\`. */
-export type StorageBucketName = ${K};${ne}${ye}${be}${fe}${ge}${ke}
+export type StorageBucketName = ${K};${oe}${ye}${be}${fe}${ge}${ke}
 
 /**
  * Project-typed contexts. The base contexts from \`@lunora/server\` are
@@ -272,22 +270,22 @@ type AsIdTable<T extends string> = T extends TableName ? T : string extends T ?
  */
 type TypedAsId = <T extends string>(tableName: AsIdTable<T>, id: string) => IdOfTable<T & TableName>;
 
-export interface QueryCtx extends Omit<QueryCtxBase, "db" | "storage"${x}${I}${R}> {
+export interface QueryCtx extends Omit<QueryCtxBase, "db" | "storage"${h}${k}${I}> {
     readonly db: Omit<DatabaseReader, "asId" | "query" | "get"> & DatabaseReaderFacade & { asId: TypedAsId; query: TypedTableQuery; get: TypedTableGet };
     readonly orm: OrmReader;
-    readonly storage: ReadOnlyStorage<StorageBucketName>;${ce}${g}${h}${T}${v}${f}${B}${$}
+    readonly storage: ReadOnlyStorage<StorageBucketName>;${ce}${f}${m}${x}${g}${b}${$}${w}
 }
 
-export interface MutationCtx extends Omit<MutationCtxBase, "db" | "storage"${x}${C}${I}${R}> {
+export interface MutationCtx extends Omit<MutationCtxBase, "db" | "storage"${h}${N}${k}${I}> {
     readonly db: Omit<DatabaseWriter, "asId" | "query" | "get"> & DatabaseWriterFacade & { asId: TypedAsId; query: TypedTableQuery; get: TypedTableGet };
     readonly orm: OrmWriter;
-    readonly storage: MutationStorage<StorageBucketName>;${A}${g}${h}${T}${v}${f}${B}${F}${S}${W}${$}
+    readonly storage: MutationStorage<StorageBucketName>;${C}${f}${m}${x}${g}${b}${$}${F}${S}${W}${w}
 }
 
-export interface ActionCtx extends Omit<ActionCtxBase, "db" | "storage"${x}${C}${I}${R}> {
+export interface ActionCtx extends Omit<ActionCtxBase, "db" | "storage"${h}${N}${k}${I}> {
     readonly db: Omit<DatabaseWriter, "asId" | "query" | "get"> & DatabaseWriterFacade & { asId: TypedAsId; query: TypedTableQuery; get: TypedTableGet };
     readonly orm: OrmWriter;
-    readonly storage: StorageBase<StorageBucketName>;${A}${g}${J}${Z}${te}${re}${h}${T}${v}${oe}${se}${ie}${f}${de}${le}${B}${F}${S}${W}${$}
+    readonly storage: StorageBase<StorageBucketName>;${C}${f}${J}${Z}${te}${re}${m}${x}${g}${ne}${se}${ie}${b}${de}${le}${$}${F}${S}${W}${w}
 }
 
 /**

package/dist/packem_shared/emitShard-RnNua5aR.mjs

@@ -0,0 +1 @@
+import"./SCHEMA_SNAPSHOT_VERSION-C0oHwiJZ.mjs";import"./isD1GlobalTable-udvHAAzD.mjs";import"./ir-BgM8A3XV.mjs";import"./json-data-Chfs2Cz5.mjs";import{e as f}from"./shard-CCNl561P.mjs";import"./shard-runtime-B7xvdFPc.mjs";import"./shared-DjUziztz.mjs";export{f as default};

package/dist/packem_shared/ir-BgM8A3XV.mjs

@@ -0,0 +1 @@
+const o=d=>typeof d.shardMode=="object"&&d.shardMode.kind==="shardBy";export{o as i};