@lunora/codegen 1.0.0-alpha.249 → 1.0.0-alpha.250

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import { AdvisorExportSink, AdvisorGeoIndexUsage, AdvisorNotifyCall, AdvisorNotifyConfig, Finding, LintContext, AdvisorProcedureProtection } from '@lunora/advisor';
 export type { Finding } from '@lunora/advisor';
-import { Project, Node } from 'ts-morph';
+import { SourceFile, Project, Node } from 'ts-morph';
 import { LunoraError } from '@lunora/errors';
 export { MESSAGE_SOLUTIONS as LUNORA_SOLUTION_RULES, type Solution as LunoraSolution, type SolutionRule as LunoraSolutionRule, findSolutionByMessage as findLunoraSolution } from '@lunora/errors';
 import { Schema } from '@lunora/server';
@@ -2409,18 +2409,20 @@ declare const lintSchema: (options: LintSchemaOptions) => Finding[];
  */
 declare const formatAdvisories: (findings: ReadonlyArray<Finding>) => string;
 /**
- * The canonical capability list. **Order is load-bearing** for the `emit-app.ts`
- * long-tail: the fluent methods are emitted in the order the `appMethod`-bearing
- * rows appear here, so this array is ordered to reproduce the original
- * `LONG_TAIL` sequence (ai, analytics, browser, hyperdrive, images, kv, payment,
- * r2sql, vectors). The `serverCtxField` rows are referenced by name in the ctx
- * interface templates, so their order here is not output-affecting.
+ * The canonical capability list. **Order is load-bearing** — every consumer
+ * emits in row order (see the module doc). The `appMethod` rows reproduce the
+ * original `LONG_TAIL` builder sequence (ai, aiSearch, analytics, artifacts, browser, hyperdrive,
+ * images, kv, payment, x402, r2sql, vectors), and the same order places the
+ * `ctx.*` fields and the ShardDO wiring.
  */
 declare const CAPABILITY_ROWS: readonly [{
   readonly contextProperty: "access";
   readonly key: "access";
   readonly moduleSpecifier: "@lunora/cloudflare-access";
   readonly requiredPackage: "@lunora/cloudflare-access";
+  readonly serverCtxField: "\n    /** Verified Cloudflare Access identity — a synchronous facade over the resolved claims (email / groups / hasGroup / claims). Anonymous when no Access token is present. */\n    readonly access: import(\"@lunora/cloudflare-access/context\").AccessFacade;";
+  readonly shardBinding: "bespoke";
+  readonly tier: "every";
 }, {
   readonly appMethod: {
     readonly configKey: "ai";
@@ -2431,6 +2433,29 @@ declare const CAPABILITY_ROWS: readonly [{
   readonly key: "ai";
   readonly moduleSpecifier: "@lunora/ai";
   readonly requiredPackage: "@lunora/ai";
+  readonly shardBinding: "bespoke";
+  readonly tier: "action";
+}, {
+  readonly appMethod: {
+    readonly configKey: "aiSearch";
+    readonly doc: "Override the AI Search namespace binding backing `ctx.aiSearch` (defaults to `env.AI_SEARCH`).";
+    readonly method: "aiSearch";
+  };
+  readonly contextProperty: "aiSearch";
+  readonly key: "aiSearch";
+  readonly moduleSpecifier: "@lunora/bindings/ai-search";
+  readonly requiredPackage: "@lunora/bindings";
+  readonly serverCtxField: "\n    /** Cloudflare AI Search namespace (`ai_search_namespaces`): `.get(name)` an instance, then `search` / `chatCompletions`. Billed, non-deterministic network I/O — available only in actions. */\n    readonly aiSearch: import(\"@lunora/bindings/ai-search\").AiSearch;";
+  readonly shardBinding: {
+    readonly binding: {
+      readonly envName: "AI_SEARCH";
+    };
+    readonly clientType: "AiSearch";
+    readonly missingMessage: "ctx.aiSearch: no AI Search binding found. Add an \\`ai_search_namespaces\\` binding (env.AI_SEARCH) to wrangler.jsonc, or point \\`defineApp().aiSearch((env) => …)\\` at yours.";
+    readonly stubMethods: readonly ["chatCompletions", "create", "delete", "get", "list", "search"];
+    readonly syncStubMethods: readonly ["get"];
+  };
+  readonly tier: "action";
 }, {
   readonly appMethod: {
     readonly configKey: "analytics";
@@ -2441,10 +2466,47 @@ declare const CAPABILITY_ROWS: readonly [{
   readonly key: "analytics";
   readonly moduleSpecifier: "@lunora/bindings/analytics";
   readonly requiredPackage: "@lunora/bindings";
-  readonly serverCtxField: {
-    readonly field: "\n    /** Analytics Engine telemetry sink. Fire-and-forget and sampled; do not read it back in-handler. */\n    readonly analytics: import(\"@lunora/bindings/analytics\").AnalyticsClient;";
-    readonly tier: "every";
+  readonly serverCtxField: "\n    /** Analytics Engine telemetry sink. Fire-and-forget and sampled; do not read it back in-handler. */\n    readonly analytics: import(\"@lunora/bindings/analytics\").AnalyticsClient;";
+  readonly shardBinding: {
+    readonly binding: {
+      readonly bindingType: "AnalyticsEngineDatasetLike";
+      readonly envName: "ANALYTICS";
+      readonly factory: {
+        readonly name: "createAnalytics";
+      };
+    };
+    readonly clientType: "AnalyticsClient";
+    readonly missingMessage: "ctx.analytics: no Analytics Engine binding found. Add an \\`analytics_engine_datasets\\` binding (env.ANALYTICS) to wrangler.jsonc, or pass \\`analytics\\` to createShardDO().";
+    readonly stubMethods: readonly ["track", "writeDataPoint"];
+    readonly syncStubMethods: readonly ["track", "writeDataPoint"];
+  };
+  readonly tier: "every";
+}, {
+  readonly appMethod: {
+    readonly configKey: "artifacts";
+    readonly doc: "Override the Artifacts binding backing `ctx.artifacts` (defaults to `env.ARTIFACTS`).";
+    readonly method: "artifacts";
+  };
+  readonly contextProperty: "artifacts";
+  readonly key: "artifacts";
+  readonly moduleSpecifier: "@lunora/bindings/artifacts";
+  readonly requiredPackage: "@lunora/bindings";
+  readonly serverCtxField: "\n    /** Cloudflare Artifacts repos (create/import/fork, Git tokens, read commits and files). Non-deterministic — available only in actions. Writes go through `git push` with a token, not this client. */\n    readonly artifacts: import(\"@lunora/bindings/artifacts\").ArtifactsClient;";
+  readonly shardBinding: {
+    readonly binding: {
+      readonly bindingType: "ArtifactsBindingLike";
+      readonly envName: "ARTIFACTS";
+      readonly factory: {
+        readonly name: "createArtifacts";
+        readonly option: "binding";
+      };
+    };
+    readonly clientType: "ArtifactsClient";
+    readonly missingMessage: "ctx.artifacts: no Artifacts binding found. Add an \\`artifacts\\` binding ({ binding: \\\"ARTIFACTS\\\", namespace }) to wrangler.jsonc, or point ctx.artifacts at another binding with defineApp().artifacts((env) => env.<BINDING>).";
+    readonly stubMethods: readonly ["authenticatedRemote", "create", "delete", "import", "info", "list", "withRepo"];
+    readonly syncStubMethods: readonly ["authenticatedRemote"];
   };
+  readonly tier: "action";
 }, {
   readonly appMethod: {
     readonly configKey: "browser";
@@ -2455,10 +2517,13 @@ declare const CAPABILITY_ROWS: readonly [{
   readonly key: "browser";
   readonly moduleSpecifier: "@lunora/browser";
   readonly requiredPackage: "@lunora/browser";
-  readonly serverCtxField: {
-    readonly field: "\n    /** Browser Rendering (screenshots/PDF/scrape). Non-deterministic — available only in actions. */\n    readonly browser: import(\"@lunora/browser\").Browser;";
-    readonly tier: "action";
+  readonly serverCtxField: "\n    /** Browser Rendering (screenshots/PDF/scrape). Non-deterministic — available only in actions. */\n    readonly browser: import(\"@lunora/browser\").Browser;";
+  readonly shardBinding: {
+    readonly clientType: "Browser";
+    readonly missingMessage: "ctx.browser: provide a \\`browser\\` config thunk, e.g. \\`browser: (env) => createBrowser({ binding: env.BROWSER, launch })\\` with \\`import { launch } from '@cloudflare/playwright'\\`. Session reuse (connect/sessions) additionally needs those two exports passed the same way.";
+    readonly stubMethods: readonly ["cancelCrawl", "connect", "content", "crawl", "crawlResult", "launch", "pdf", "quickAction", "scrape", "screenshot", "sessions"];
   };
+  readonly tier: "action";
 }, {
   readonly contextProperty: "containers";
   readonly key: "container";
@@ -2477,10 +2542,13 @@ declare const CAPABILITY_ROWS: readonly [{
   readonly key: "hyperdrive";
   readonly moduleSpecifier: "@lunora/hyperdrive";
   readonly requiredPackage: "@lunora/hyperdrive";
-  readonly serverCtxField: {
-    readonly field: "\n    /**\n     * External database access via Hyperdrive. Non-deterministic — available only in actions. Writes here are NOT tracked by Lunora live queries; subscriptions will not re-run on external DB changes.\n     */\n    readonly sql: import(\"@lunora/hyperdrive\").SqlClient;";
-    readonly tier: "action";
+  readonly serverCtxField: "\n    /**\n     * External database access via Hyperdrive. Non-deterministic — available only in actions. Writes here are NOT tracked by Lunora live queries; subscriptions will not re-run on external DB changes.\n     */\n    readonly sql: import(\"@lunora/hyperdrive\").SqlClient;";
+  readonly shardBinding: {
+    readonly clientType: "SqlClient";
+    readonly missingMessage: "ctx.sql: provide a \\`sql\\` config thunk that builds a SqlClient from your driver, e.g. \\`sql: (env) => fromPostgresJs(postgres(env.HYPERDRIVE.connectionString))\\`.";
+    readonly stubMethods: readonly ["query"];
   };
+  readonly tier: "action";
 }, {
   readonly appMethod: {
     readonly configKey: "images";
@@ -2491,10 +2559,21 @@ declare const CAPABILITY_ROWS: readonly [{
   readonly key: "images";
   readonly moduleSpecifier: "@lunora/bindings/images";
   readonly requiredPackage: "@lunora/bindings";
-  readonly serverCtxField: {
-    readonly field: "\n    /** Cloudflare Images transforms (resize/format/optimize). Non-deterministic — available only in actions. */\n    readonly images: import(\"@lunora/bindings/images\").Images;";
-    readonly tier: "action";
+  readonly serverCtxField: "\n    /** Cloudflare Images transforms (resize/format/optimize). Non-deterministic — available only in actions. */\n    readonly images: import(\"@lunora/bindings/images\").Images;";
+  readonly shardBinding: {
+    readonly binding: {
+      readonly bindingType: "ImagesBindingLike";
+      readonly envName: "IMAGES";
+      readonly factory: {
+        readonly name: "createImages";
+        readonly option: "binding";
+      };
+    };
+    readonly clientType: "Images";
+    readonly missingMessage: "ctx.images: no Images binding found. Add an \\`images\\` binding (env.IMAGES) to wrangler.jsonc, or pass \\`images\\` to createShardDO().";
+    readonly stubMethods: readonly ["info", "transform"];
   };
+  readonly tier: "action";
 }, {
   readonly appMethod: {
     readonly configKey: "kv";
@@ -2505,10 +2584,22 @@ declare const CAPABILITY_ROWS: readonly [{
   readonly key: "kv";
   readonly moduleSpecifier: "@lunora/bindings/kv";
   readonly requiredPackage: "@lunora/bindings";
-  readonly serverCtxField: {
-    readonly field: "\n    readonly kv: import(\"@lunora/bindings/kv\").Kv;";
-    readonly tier: "every";
+  readonly serverCtxField: "\n    readonly kv: import(\"@lunora/bindings/kv\").Kv;";
+  readonly shardBinding: {
+    readonly binding: {
+      readonly bindingType: "KVNamespaceLike";
+      readonly envName: "KV";
+      readonly factory: {
+        readonly name: "createKv";
+        readonly option: "namespace";
+      };
+      readonly unvouchableReads: readonly ["get", "getRaw", "getWithMetadata", "list"];
+    };
+    readonly clientType: "Kv";
+    readonly missingMessage: "ctx.kv: no KV binding found. Add a \\`kv_namespaces\\` binding (env.KV) to wrangler.jsonc, or pass \\`kv\\` to createShardDO().";
+    readonly stubMethods: readonly ["delete", "get", "getRaw", "getWithMetadata", "list", "put"];
   };
+  readonly tier: "every";
 }, {
   readonly key: "mail";
   readonly moduleSpecifier: "@lunora/mail";
@@ -2541,10 +2632,21 @@ declare const CAPABILITY_ROWS: readonly [{
   readonly key: "pipelines";
   readonly moduleSpecifier: "@lunora/bindings/pipelines";
   readonly requiredPackage: "@lunora/bindings";
-  readonly serverCtxField: {
-    readonly field: "\n    /** Pipelines ingestion sink (durable, R2-backed). Fire-and-forget and batched; do not read it back in-handler. */\n    readonly pipelines: import(\"@lunora/bindings/pipelines\").PipelineClient;";
-    readonly tier: "action";
+  readonly serverCtxField: "\n    /** Pipelines ingestion sink (durable, R2-backed). Fire-and-forget and batched; do not read it back in-handler. */\n    readonly pipelines: import(\"@lunora/bindings/pipelines\").PipelineClient;";
+  readonly shardBinding: {
+    readonly binding: {
+      readonly bindingType: "PipelineBindingLike";
+      readonly envName: "PIPELINES";
+      readonly factory: {
+        readonly name: "createPipelines";
+        readonly option: "binding";
+      };
+    };
+    readonly clientType: "PipelineClient";
+    readonly missingMessage: "ctx.pipelines: no Pipelines binding found. Add a \\`pipelines\\` binding (env.PIPELINES) to wrangler.jsonc, or pass \\`pipelines\\` to createShardDO().";
+    readonly stubMethods: readonly ["send"];
   };
+  readonly tier: "action";
 }, {
   readonly appMethod: {
     readonly configKey: "r2sql";
@@ -2555,10 +2657,9 @@ declare const CAPABILITY_ROWS: readonly [{
   readonly key: "r2sql";
   readonly moduleSpecifier: "@lunora/bindings/r2sql";
   readonly requiredPackage: "@lunora/bindings";
-  readonly serverCtxField: {
-    readonly field: "\n    /**\n     * R2 SQL over Apache Iceberg tables (window functions, DISTINCT, set operations). Non-deterministic — available only in actions. Reads here are NOT tracked by Lunora live queries.\n     */\n    readonly r2sql: import(\"@lunora/bindings/r2sql\").R2SqlClient;";
-    readonly tier: "action";
-  };
+  readonly serverCtxField: "\n    /**\n     * R2 SQL over Apache Iceberg tables (window functions, DISTINCT, set operations). Non-deterministic — available only in actions. Reads here are NOT tracked by Lunora live queries.\n     */\n    readonly r2sql: import(\"@lunora/bindings/r2sql\").R2SqlClient;";
+  readonly shardBinding: "bespoke";
+  readonly tier: "action";
 }, {
   readonly contextProperty: "scheduler";
   readonly key: "scheduler";
@@ -2583,6 +2684,51 @@ declare const CAPABILITY_ROWS: readonly [{
 }];
 /** The literal union of every capability id — the single source of truth for `FeatureUsage`'s keys (so they cannot drift). */
 type CapabilityKey = (typeof CAPABILITY_ROWS)[number]["key"];
+/**
+ * Code-usage signals for every optional, package-backed feature, in a single
+ * pass over the `lunora/` source set. Each flag is `true` when a source imports
+ * the feature's `@lunora/*` package or reads its generated `ctx.*` helper. This
+ * is the one detection path for all of them — it subsumes the old standalone
+ * `discoverAiUsage` / `discoverPaymentUsage` probes (which were line-for-line
+ * copies of this same import-or-`ctx.X` check).
+ *
+ * The key set is derived from the {@link CAPABILITIES} table (its
+ * {@link CapabilityKey} union), so a capability added there is automatically
+ * probed here — the two can't drift. `ai` and `payments` gate whether codegen
+ * wires the SDK into the generated worker (so a non-AI app never imports
+ * `@lunora/ai`); the rest additionally feed the studio's nav gating via
+ * `buildStudioFeatures`. `mail` is import-only — it has no `ctx.mail`
+ * helper (mail is reached through its own client), so only a `@lunora/mail`
+ * import flips it here; a worker-entry wiring outside `lunora/` is caught
+ * instead by the package-dependency signal in `buildStudioFeatures`.
+ */
+type FeatureUsage = Record<CapabilityKey, boolean>;
+/**
+ * The set of `ctx` helper names the source reaches — a direct `ctx.PROPERTY`
+ * access, or a destructuring of the property off the context (`const { kv } =
+ * ctx`, `async ({ ctx: { kv } }) => …`).
+ *
+ * The context is resolved by BINDING, not by the identifier text `ctx`. A
+ * handler receives it as a property of one destructured argument, so the local
+ * name it lands under is the handler's to pick: `{ ctx }`, `{ ctx: context }`
+ * and `{ ctx: { secrets } }` are the same read. Matching the text `ctx`
+ * recognised only the first — and for `secrets`, which has no import arm and no
+ * {@link CAPABILITIES} row, nothing else covered the other two, so a renamed or
+ * destructured read built green on a host that rates the Secrets Store
+ * unsupported and threw on first use.
+ *
+ * Three descendant walks (bindings, then accesses and `const … = ctx` patterns),
+ * collected once per file: each context-bearing {@link CAPABILITIES} entry then
+ * just tests membership in this set, so detection is O(files × nodes) rather
+ * than O(files × features × nodes).
+ */
+declare const contextPropertiesRead: (sourceFile: SourceFile) => Set<string>;
+/**
+ * Detect code-usage of every package-backed feature across the function files
+ * under `lunora/`, in a single pass. The result feeds both worker gating (`ai` /
+ * `payments`) and — via `buildStudioFeatures` — the studio nav.
+ */
+declare const discoverFeatureUsage: (project: Project, lunoraDirectory: string) => FeatureUsage;
 /** The default codegen target — today's behavior, byte-identical goldens. */
 declare const DEFAULT_TARGET = "cloudflare";
 /**
@@ -3378,6 +3524,13 @@ declare const emitWranglerCronTriggers: (crons: ReadonlyArray<CronJobIR>) => str
 interface EmitServerOptions {
   /** Agents declared via `defineAgent` exports — wires the typed `ctx.agents` producers onto Mutation/Action contexts. */
   agents?: ReadonlyArray<AgentIR>;
+  /**
+   * The package-backed capabilities the app uses (post platform gate). Each
+   * used row of the `CAPABILITIES` table with a `serverCtxField` lands on the
+   * ctx interfaces its `tier` names; `ai` / `payments` / `x402` gate their
+   * bespoke ActionCtx fields off the same set.
+   */
+  capabilities?: ReadonlySet<CapabilityKey>;
   containers?: ReadonlyArray<ContainerIR>;
   /**
    * The single `defineEnv(...)` contract declared in `lunora/env.ts`. When
@@ -3388,37 +3541,12 @@ interface EmitServerOptions {
   env?: EnvIR;
   /** Absolute `_generated/` directory, so an RPC service's entry module is imported by a path relative to it. Required with `services`. */
   generatedDirectory?: string;
-  /**
-   * A `lunora/` source reads `ctx.access` — wires the verified Cloudflare Access
-   * facade (`@lunora/cloudflare-access/context`) onto every ctx. Distinct from
-   * `emitApp`'s `hasAccess` (which gates the worker's `.access()` resolveIdentity
-   * method); this one gates the per-request `ctx.access` read surface.
-   */
-  hasAccessFacade?: boolean;
-  hasAi?: boolean;
-  /** A `lunora/` source uses `@lunora/bindings/analytics` / `ctx.analytics` — wires the write helper onto every ctx. */
-  hasAnalytics?: boolean;
-  /** A `lunora/` source uses `@lunora/browser` / `ctx.browser` — wires `ctx.browser` onto ActionCtx only. */
-  hasBrowser?: boolean;
   /** The project declares `lunora/flags.ts` — wires `ctx.flags` (OpenFeature) onto every ctx. */
   hasFlags?: boolean;
-  /** A `lunora/` source uses `@lunora/hyperdrive` / `ctx.sql` — wires `ctx.sql` onto ActionCtx only. */
-  hasHyperdrive?: boolean;
-  /** A `lunora/` source uses `@lunora/bindings/images` / `ctx.images` — wires `ctx.images` onto ActionCtx only. */
-  hasImages?: boolean;
-  /** A `lunora/` source uses `@lunora/bindings/kv` / `ctx.kv` — wires `ctx.kv` onto every ctx. */
-  hasKv?: boolean;
   /** The project declares `lunora/notify.ts` — wires `ctx.notify` + its `ctx.push` alias (`@lunora/notify`) onto every ctx. */
   hasNotify?: boolean;
-  hasPayments?: boolean;
-  /** A `lunora/` source uses `@lunora/bindings/pipelines` / `ctx.pipelines` — wires `ctx.pipelines` onto ActionCtx only. */
-  hasPipelines?: boolean;
-  /** A `lunora/` source uses `@lunora/bindings/r2sql` / `ctx.r2sql` — wires `ctx.r2sql` onto ActionCtx only. */
-  hasR2sql?: boolean;
   /** The target platform supports a vector store. `false` withholds `ctx.vectors` even when the schema declares an index. */
   hasVectors?: boolean;
-  /** A `lunora/` source uses `@lunora/x402/pay` / `ctx.x402` — wires the agent-wallet pay rail onto ActionCtx only. */
-  hasX402?: boolean;
   /**
    * The single `defineIdentity(...)` claim contract declared in
    * `lunora/identity.ts` (Plan 080). When present, `ctx.auth.getIdentity()`,
@@ -3440,13 +3568,15 @@ interface EmitServerOptions {
   useUmbrella?: boolean;
   workflows?: ReadonlyArray<WorkflowIR>;
 }
-declare const emitServer: ({ agents, containers, env, hasAccessFacade, hasAi, hasAnalytics, hasBrowser, hasVectors, hasFlags, hasHyperdrive, hasImages, hasKv, hasNotify, hasPayments, hasPipelines, hasR2sql, hasX402, identity, queues, schema, generatedDirectory, services, storageRuleBuckets, topics, useUmbrella, workflows }?: EmitServerOptions) => string;
+declare const emitServer: ({ agents, capabilities, containers, env, hasVectors, hasFlags, hasNotify, identity, queues, schema, generatedDirectory, services, storageRuleBuckets, topics, useUmbrella, workflows }?: EmitServerOptions) => string;
 interface EmitShardOptions {
   advisories?: ReadonlyArray<Finding>;
   /** Every declared procedure — the health map's denominator, served via `getAdvisorProcedures`. */
   advisorProcedures?: ReadonlyArray<AdvisorProcedureProtection>;
   /** Agents declared via `defineAgent` exports in `lunora/agents.ts` — wires the typed `ctx.agents` producers. */
   agents?: ReadonlyArray<AgentIR>;
+  /** The package-backed capabilities the app uses (post platform gate) — each row of the `CAPABILITIES` table it names is wired per its `shardBinding` / `tier`. */
+  capabilities?: ReadonlySet<CapabilityKey>;
   containers?: ReadonlyArray<ContainerIR>;
   /** The single `defineEnv(...)` contract declared in `lunora/env.ts` — applies the accessor to the worker `env` to populate `ctx.env`. */
   env?: EnvIR;
@@ -3455,28 +3585,10 @@ interface EmitShardOptions {
     key: string;
     type: "boolean" | "number" | "object" | "string";
   }>;
-  /** A `lunora/` source reads `ctx.access` — wires the verified Cloudflare Access facade onto every ctx. */
-  hasAccessFacade?: boolean;
-  hasAi?: boolean;
-  /** A `lunora/` source reads `ctx.analytics` — wires the Analytics Engine write helper onto every ctx. */
-  hasAnalytics?: boolean;
-  /** A `lunora/` source reads `ctx.browser` — wires `ctx.browser` onto the ActionCtx only. */
-  hasBrowser?: boolean;
   /** The project declares `lunora/flags.ts` — wires `ctx.flags` (OpenFeature) onto every ctx. */
   hasFlags?: boolean;
-  /** A `lunora/` source reads `ctx.sql` (Hyperdrive) — wires `ctx.sql` onto the ActionCtx only. */
-  hasHyperdrive?: boolean;
-  /** A `lunora/` source reads `ctx.images` — wires `ctx.images` onto the ActionCtx only. */
-  hasImages?: boolean;
-  /** A `lunora/` source reads `ctx.kv` — wires `ctx.kv` onto every ctx. */
-  hasKv?: boolean;
   /** The project declares `lunora/notify.ts` — wires `ctx.notify` + its `ctx.push` alias (`@lunora/notify`) onto every ctx. */
   hasNotify?: boolean;
-  hasPayments?: boolean;
-  /** A `lunora/` source reads `ctx.pipelines` — wires `ctx.pipelines` onto the ActionCtx only. */
-  hasPipelines?: boolean;
-  /** A `lunora/` source reads `ctx.r2sql` (R2 SQL) — wires `ctx.r2sql` onto the ActionCtx only. */
-  hasR2sql?: boolean;
   /**
    * The target platform supports a vector store. `false` withholds the whole
    * Vectorize wiring — the `@lunora/bindings/vectors` imports, the
@@ -3485,8 +3597,6 @@ interface EmitShardOptions {
    * `emitApp` withhold from the type surface for the same verdict.
    */
   hasVectors?: boolean;
-  /** A `lunora/` source reads `ctx.x402` — wires the agent-wallet pay rail onto the ActionCtx only. */
-  hasX402?: boolean;
   maskMetadata?: MaskMetadataIR;
   /** Custom mutators declared via `defineMutator` in `lunora/mutators.ts` — wires the `isCustomMutator` push-protocol override. */
   mutators?: ReadonlyArray<MutatorIR>;
@@ -3514,7 +3624,7 @@ interface EmitShardOptions {
   useUmbrella?: boolean;
   workflows?: ReadonlyArray<WorkflowIR>;
 }
-declare const emitShard: ({ advisories, advisorProcedures, agents, containers, env, flagKeys, hasAccessFacade, hasAi, hasAnalytics, hasBrowser, hasFlags, hasHyperdrive, hasImages, hasKv, hasNotify, hasPayments, hasPipelines, hasR2sql, hasVectors, hasX402, maskMetadata, mutators, queues, rlsMetadata, schema, schemaSnapshot, shapes, storageRules, studioFeatures, services, topics, useUmbrella, workflows }: EmitShardOptions) => string;
+declare const emitShard: ({ advisories, advisorProcedures, agents, capabilities, containers, env, flagKeys, hasFlags, hasNotify, hasVectors, maskMetadata, mutators, queues, rlsMetadata, schema, schemaSnapshot, shapes, storageRules, studioFeatures, services, topics, useUmbrella, workflows }: EmitShardOptions) => string;
 /**
  * Emit `_generated/containers.ts` — one container-enabled Durable Object class
  * per `defineContainer` export, each a thin subclass of `LunoraContainer`
@@ -3546,6 +3656,16 @@ declare const emitAgents: (agents: ReadonlyArray<AgentIR>) => string;
 declare const GENERATED_HEADER = "// GENERATED by @lunora/codegen — do not edit.\n// Run `lunora codegen` to regenerate.\n\n";
 /** Which capability methods the generated `defineApp` builder exposes — one flag per package-backed feature the app actually uses. */
 interface EmitAppOptions {
+  /**
+   * The package-backed capabilities the app uses (post platform gate). Every
+   * used row of the `CAPABILITIES` table with an `appMethod` gets its fluent
+   * `defineApp` method (`.ai()`, `.kv()`, `.payment()`, …), which sets the
+   * matching `createShardDO` config key. Usage-driven on purpose: each method's
+   * parameter reads `ShardConfig[configKey]`, and the shard emits that config
+   * field on the same usage signal. `vectors` is the exception — its method
+   * follows {@link EmitAppOptions.hasVectors} + `vectorIndexCount`, not usage.
+   */
+  capabilities: ReadonlySet<CapabilityKey>;
   /**
    * Inbound-email agents (`defineAgent({ onEmail })`) → wire the worker's
    * top-level `email()` handler to `dispatchAgentEmail(...)` (from
@@ -3558,32 +3678,20 @@ interface EmitAppOptions {
   }>;
   /** App depends on `@lunora/cloudflare-access` → emit `.access()` (wire the Cloudflare Access `resolveIdentity`, composed ahead of `@lunora/auth` when both are present). */
   hasAccess: boolean;
-  /** App uses `@lunora/ai` / `ctx.ai` → emit `.ai()` (override the Workers AI binding backing `ctx.ai`). */
-  hasAi: boolean;
-  /** App uses `@lunora/bindings/analytics` / `ctx.analytics` → emit `.analytics()` (override the dataset backing `ctx.analytics`). */
-  hasAnalytics: boolean;
   /** App depends on `@lunora/auth` → emit `.auth()` + the lazy build/migrate dance. */
   hasAuth: boolean;
-  /** App uses `@lunora/browser` / `ctx.browser` → emit `.browser()`. */
-  hasBrowser: boolean;
   /** App depends on a worker-composition framework adapter (`@lunora/astro`/`@lunora/svelte`/`@lunora/vue`), or hand-composes one in `src/worker.ts` → emit `.buildFrameworkWorker(host)`. */
   hasFramework: boolean;
   /** Schema declares **D1-backed** `.global()` tables → emit `.global()` (D1 ctx-db + studio introspector + cross-shard relations). */
   hasGlobal: boolean;
-  /** App uses `@lunora/hyperdrive` / `ctx.sql` → emit `.hyperdrive()`. */
-  hasHyperdrive: boolean;
   /** Schema declares **Hyperdrive-backed** `.global({ backend: "hyperdrive" })` tables → emit `.hyperdriveGlobal()` (reactive Postgres/MySQL ctx-db over Hyperdrive). */
   hasHyperdriveGlobal: boolean;
-  /** App uses `@lunora/bindings/images` / `ctx.images` → emit `.images()`. */
-  hasImages: boolean;
-  /** App uses `@lunora/bindings/kv` / `ctx.kv` → emit `.kv()`. Usage-only, because the method's parameter type reads `ShardConfig["kv"]`, and that config field is emitted on the same usage signal. */
-  hasKv: boolean;
   /**
    * Wire the studio's zero-config KV introspector. Gated on `studioFeatures.kv`
-   * (usage OR a declared `@lunora/bindings` dependency), NOT on {@link EmitAppOptions.hasKv},
+   * (usage OR a declared `@lunora/bindings` dependency), NOT on the `kv` capability,
    * so a visible KV tab always has a working backend — never the reverse.
    *
-   * Kept separate from `hasKv` deliberately: the two were accidentally equal
+   * Kept separate from the `kv` usage flag deliberately: the two were accidentally equal
    * while the dependency arm in `discover/studio-features.ts` matched a subpath
    * and could never fire. Fixing that arm made them diverge, and the shared flag
    * emitted a `.kv()` builder whose `ShardConfig["kv"]` type did not exist.
@@ -3591,12 +3699,8 @@ interface EmitAppOptions {
   hasKvIntrospector: boolean;
   /** App declares `lunora/notify.ts` (`@lunora/notify`) → wire `options.notifySubscriptionStore` so the studio Notifications page can read registered devices. */
   hasNotify: boolean;
-  /** App uses `@lunora/payment` / `ctx.payments` → emit `.payment()`. */
-  hasPayments: boolean;
   /** App declares push queues (`defineQueue`) → wire `LUNORA_QUEUE_REGISTRY` into the worker's `queue()` consumer entry. */
   hasQueue: boolean;
-  /** App uses `@lunora/bindings/r2sql` / `ctx.r2sql` → emit `.r2sql()`. */
-  hasR2sql: boolean;
   /** App imports `@lunora/scheduler` / declares crons → emit `.scheduler()`. */
   hasScheduler: boolean;
   /**
@@ -3624,8 +3728,6 @@ interface EmitAppOptions {
   hasVectors?: boolean;
   /** App declares Cloudflare Workflows (`defineWorkflow`) → wire `options.workflowsClient` so the studio's workflow-instance proxy can reach the CF REST API. */
   hasWorkflow: boolean;
-  /** App uses `@lunora/x402/pay` / `ctx.x402` → emit `.x402()` (wire the agent-wallet pay rail). */
-  hasX402: boolean;
   /** The single `defineIdentity(...)` contract in `lunora/identity.ts` (Plan 080) → import it as a VALUE and wire `options.identity`, so the runtime trust boundary validates every resolved identity before it becomes `ctx.auth`. `undefined` ⇒ no wiring, byte-identical output. */
   identity?: IdentityIR;
   /** Schema declares `.jurisdiction("…")` → pin every DO the worker reaches (shards, fan-out, scheduler, containers, voice sessions, DO-backed auth, `@lunora/mail` shard RPC) to the Cloudflare data-residency jurisdiction. */
@@ -4329,4 +4431,4 @@ declare const secretKindOf: (value: string) => string | undefined;
 /** A redacted preview of a secret value — first 4 chars plus its length, never the full value. */
 declare const redact: (value: string) => string;
 declare const VERSION = "0.0.0";
-export { AGENTS_FILENAME, type AgentIR, type AuthApiCallIR, CONTAINERS_FILENAME, CodegenDiagnosticError, type CodegenOptions, type CodegenResult, type ContainerIR, type ContainerImageIR, type ContainerNamedImageIR, type ContextPropertyCallIR, type CronJobIR, DEFAULT_TARGET, type DefaultScheduledContainerIR, type DriftChange, type DriftRemediation, type DriftScope, type DurableObjectScheduledContainerIR, type EmitAppOptions, FLAGS_FILENAME, type FieldSnapshot, type FlagsIR, type FunctionIR, GENERATED_HEADER, type HttpRouteIR, type IndexIR, type IndexSnapshot, type InsertWriteIR, LUNORA_ERROR_CODES, type LintSchemaOptions, type LoadedProjectConfig, type LunoraProjectConfig, MUTATORS_FILENAME, type MaskProcedureIR, type MigrationIR, type MutatorIR, NOTIFY_FILENAME, OPENRPC_VERSION, type OpenApiEmitInput, type OpenRpcDocument, type OpenRpcEmitInput, type OpenRpcMethod, PROJECT_CONFIG_FILENAMES, type PlatformDiagnostic, type ProjectConfigLiterals, type ProjectIR, QUEUES_FILENAME, type QueryReadIR, type QueueIR, type RelationSnapshot, type RlsMetadataIR, type RlsPolicyIR, type RlsProcedureIR, type RlsRoleIR, type RuntimeVerb, SCHEMA_SNAPSHOT_FILENAME, SCHEMA_SNAPSHOT_VERSION, SDK_LANGUAGES, SDK_TARGETS, SHAPES_FILENAME, type SandboxUsage, type SchemaDrift, type SchemaDriftDecision, type SchemaIR, type SchemaSnapshot, SchemaSnapshotParseError, type SdkFiles, type SdkMethod, type SdkNamespace, type SdkRenderInput, type SdkResult, type SdkTarget, type ServiceBindingIR, type ServiceLiteral, type ShapeIR, type StorageRuleIR, type StorageRulesMetadataIR, type TableIR, type TableSnapshot, type TopicIR, VERSION, type ValidatorIR, type VectorIndexIR, WORKFLOWS_FILENAME, type WorkflowIR, type WranglerVariableIR, buildOpenApiDocument, buildOpenRpcDocument, buildSchemaSnapshot, createCodegenProject, describeErrorLevelFindings, diagnosticAt, diffSchemaSnapshots, discoverAgents, discoverAuthApiCalls, discoverContainers, discoverCrons, discoverFlags, discoverFunctions, discoverHttpRoutes, discoverHyperdriveCalls, discoverInserts, discoverMaskProcedures, discoverMigrations, discoverMutators, discoverNondeterministicCalls, discoverNotifyCalls, discoverNotifyConfig, discoverQueries, discoverQueues, discoverR2sqlCalls, discoverRlsMetadata, discoverRlsProcedures, discoverSandboxUsage, discoverSchema, discoverShapes, discoverStorageRulesMetadata, discoverWorkflows, emitAgents, emitApi, emitApp, emitCollections, emitContainers, emitCrons, emitDataModel, emitDrizzleSchema, emitFunctions, emitOpenApi, emitOpenApiModule, emitOpenRpc, emitOpenRpcModule, emitScheduler, emitServer, emitShard, emitVectors, emitWorkflows, emitWranglerCronTriggers, errorAdvisoryNames, errorPlatformDiagnosticNames, evaluateSchemaDrift, findProjectConfigFile, findTsconfig, fingerprintSchemaSources, formatAdvisories, generateSdk, isD1GlobalTable, isHyperdriveGlobalTable, isTypedSchema, lintSchema, listLunoraSourceFiles, loadProjectConfig, parseSchemaSnapshot, platformMatrixIds, readPackageDependencies, readProjectConfigLiterals, readProjectTarget, readServiceBindings, redact, refreshCodegenProject, resolveCodegenTarget, resolveServiceBindings, runCodegen, schemaFromIr, secretKindOf, serializeSchemaSnapshot, sortedUniqueNames, toAdvisorContext, validatorIrToJsonSchema };
+export { AGENTS_FILENAME, type AgentIR, type AuthApiCallIR, CONTAINERS_FILENAME, CodegenDiagnosticError, type CodegenOptions, type CodegenResult, type ContainerIR, type ContainerImageIR, type ContainerNamedImageIR, type ContextPropertyCallIR, type CronJobIR, DEFAULT_TARGET, type DefaultScheduledContainerIR, type DriftChange, type DriftRemediation, type DriftScope, type DurableObjectScheduledContainerIR, type EmitAppOptions, FLAGS_FILENAME, type FeatureUsage, type FieldSnapshot, type FlagsIR, type FunctionIR, GENERATED_HEADER, type HttpRouteIR, type IndexIR, type IndexSnapshot, type InsertWriteIR, LUNORA_ERROR_CODES, type LintSchemaOptions, type LoadedProjectConfig, type LunoraProjectConfig, MUTATORS_FILENAME, type MaskProcedureIR, type MigrationIR, type MutatorIR, NOTIFY_FILENAME, OPENRPC_VERSION, type OpenApiEmitInput, type OpenRpcDocument, type OpenRpcEmitInput, type OpenRpcMethod, PROJECT_CONFIG_FILENAMES, type PlatformDiagnostic, type ProjectConfigLiterals, type ProjectIR, QUEUES_FILENAME, type QueryReadIR, type QueueIR, type RelationSnapshot, type RlsMetadataIR, type RlsPolicyIR, type RlsProcedureIR, type RlsRoleIR, type RuntimeVerb, SCHEMA_SNAPSHOT_FILENAME, SCHEMA_SNAPSHOT_VERSION, SDK_LANGUAGES, SDK_TARGETS, SHAPES_FILENAME, type SandboxUsage, type SchemaDrift, type SchemaDriftDecision, type SchemaIR, type SchemaSnapshot, SchemaSnapshotParseError, type SdkFiles, type SdkMethod, type SdkNamespace, type SdkRenderInput, type SdkResult, type SdkTarget, type ServiceBindingIR, type ServiceLiteral, type ShapeIR, type StorageRuleIR, type StorageRulesMetadataIR, type TableIR, type TableSnapshot, type TopicIR, VERSION, type ValidatorIR, type VectorIndexIR, WORKFLOWS_FILENAME, type WorkflowIR, type WranglerVariableIR, buildOpenApiDocument, buildOpenRpcDocument, buildSchemaSnapshot, contextPropertiesRead, createCodegenProject, describeErrorLevelFindings, diagnosticAt, diffSchemaSnapshots, discoverAgents, discoverAuthApiCalls, discoverContainers, discoverCrons, discoverFeatureUsage, discoverFlags, discoverFunctions, discoverHttpRoutes, discoverHyperdriveCalls, discoverInserts, discoverMaskProcedures, discoverMigrations, discoverMutators, discoverNondeterministicCalls, discoverNotifyCalls, discoverNotifyConfig, discoverQueries, discoverQueues, discoverR2sqlCalls, discoverRlsMetadata, discoverRlsProcedures, discoverSandboxUsage, discoverSchema, discoverShapes, discoverStorageRulesMetadata, discoverWorkflows, emitAgents, emitApi, emitApp, emitCollections, emitContainers, emitCrons, emitDataModel, emitDrizzleSchema, emitFunctions, emitOpenApi, emitOpenApiModule, emitOpenRpc, emitOpenRpcModule, emitScheduler, emitServer, emitShard, emitVectors, emitWorkflows, emitWranglerCronTriggers, errorAdvisoryNames, errorPlatformDiagnosticNames, evaluateSchemaDrift, findProjectConfigFile, findTsconfig, fingerprintSchemaSources, formatAdvisories, generateSdk, isD1GlobalTable, isHyperdriveGlobalTable, isTypedSchema, lintSchema, listLunoraSourceFiles, loadProjectConfig, parseSchemaSnapshot, platformMatrixIds, readPackageDependencies, readProjectConfigLiterals, readProjectTarget, readServiceBindings, redact, refreshCodegenProject, resolveCodegenTarget, resolveServiceBindings, runCodegen, schemaFromIr, secretKindOf, serializeSchemaSnapshot, sortedUniqueNames, toAdvisorContext, validatorIrToJsonSchema };