@lunora/codegen 1.0.0-alpha.253 → 1.0.0-alpha.255

package/dist/packem_shared/{emitApp-CokyctXT.mjs → emitApp-0rC4g46B.mjs}

@@ -1,407 +1,102 @@
-import{APP_METHOD_CAPABILITIES as k}from"./CAPABILITY_PROBES-BPeV994T.mjs";import{i as S}from"./ir-DBSvhNa-.mjs";import{G as E}from"./shared-DjUziztz.mjs";const D=e=>k.filter(({key:r})=>e.capabilities.has(r)),R={configKey:"vectors",doc:"Wire the Vectorize index map backing `ctx.vectors`.",method:"vectors"},g=e=>[...D(e).map(({appMethod:r})=>r),...e.hasVectors===!0?[R]:[]],m=e=>g(e).length>0,x=e=>e?['import * as lunoraIdentityContract from "../identity.js";']:[],A=(e,r)=>e?['import type { CreateAccessResolverOptions } from "@lunora/cloudflare-access";',`import { createAccessResolver${r?", composeResolvers":""} } from "@lunora/cloudflare-access";`]:[],C=e=>e?['import { createKvIntrospectorFromEnv } from "@lunora/bindings/kv";']:[],O=e=>e?['import { createVectorAdminIntrospector } from "@lunora/bindings/vectors";']:[],T=e=>e?['import type { D1CtxDbOptions, D1DatabaseLike, D1Exec } from "@lunora/d1";','import { applyCdcChanges, createD1CtxDb, emitD1QueryCost, exportGlobalRows, facetGlobalColumn, importGlobalRows, listGlobalTables, readD1CdcChanges, readGlobalTablePage, retryingExec } from "@lunora/d1";']:[],N=e=>e?['import notifyConfig from "../notify.js";']:[],v=e=>(e.emailAgents?.length??0)>0,q=e=>v(e)?['import { dispatchAgentEmail } from "@lunora/agent/inbound";']:[],I=e=>v(e)?['import * as lunoraAgentDefinitions from "../agents.js";']:[],d=e=>e.tables.some(r=>S(r)),L=e=>{const{hasFramework:r,hasGlobal:t,hasHyperdriveGlobal:a,hasQueue:n,useUmbrella:o}=e,i=o?"lunorash/runtime":"@lunora/runtime",l=["ExecutionContextLike","HttpRouterLike","LunoraWorker","Route","ScheduledControllerLike","ShardNamespaceLike","WorkerOptions",...n?["TriggerTrace"]:[],...t?["GlobalIntrospector"]:[],...e.tables.length>0?["ShardingInfo"]:[],...r?["FrameworkHostHandler"]:[]],c=[...t||a?["createCrossShardRelationCapabilities"]:[],...d(e)?["createDynamicShardRegistry","createQueryCoordinator"]:[],"createWorker",...e.jurisdiction?["declareAppJurisdiction"]:[],"resolveLogArchiveFromEnv",...r?["withFrameworkWorker"]:[]].join(", ");return[`import type { ${[...l].toSorted((s,h)=>s.localeCompare(h)).join(", ")} } from "${i}";`,`import { ${c} } from "${i}";`]},j=e=>{const{hasAccess:r,hasAuth:t,hasGlobal:a,hasHyperdriveGlobal:n,hasKvIntrospector:o,hasQueue:i,hasScheduler:l,hasStorage:c,hasWorkflow:s,wantsOpenApi:h,wantsOpenRpc:u}=e;return[...t?['import type { AuthNamespaceLike, LunoraAuth, LunoraAuthOptions } from "@lunora/auth";','import { authDiscoveryPathsFor, createAuth, createAuthAdmin, createAuthAuditReader, createDoAuthWiring, d1Executor, ensureMigrated, handleAuthDiscoveryRequest, handleAuthRequest, lunoraD1Adapter } from "@lunora/auth";']:[],...A(r,t),...T(a),...n?['import type { HyperdriveEngine } from "@lunora/hyperdrive/global";','import { createHyperdriveGlobalCtxDb } from "@lunora/hyperdrive/global";','import type { SqlCtxDbOptions, SqlExec } from "@lunora/sql-store";']:[],...C(o),...O(e.hasVectors===!0),...l?['import type { DurableObjectNamespaceLike } from "@lunora/scheduler";','import { createScheduler } from "@lunora/scheduler";']:[],...c?['import type { R2BucketLike, R2S3Credentials, Storage } from "@lunora/storage";','import { createBucketStorage, createStorage } from "@lunora/storage";']:[],...s?['import { createWorkflowsRestClient } from "@lunora/workflow";']:[],...q(e),...L(e),"",...x(e.identity),...I(e),...a||n?['import schema from "../schema.js";']:[],...N(e.hasNotify),'import { LUNORA_CRONS } from "./crons.js";','import { LUNORA_FUNCTIONS } from "./functions.js";',...i?['import { createQueueCaptureSink, dispatchQueueBatch, shouldCaptureQueue } from "@lunora/queue";','import { LUNORA_QUEUE_REGISTRY } from "./queues.js";']:[],...e.wantsArchitecture?['import { architecture } from "./architecture.js";']:[],...h?['import { openApiSpec } from "./openapi.js";']:[],...u?['import { openRpcSpec } from "./openrpc.js";']:[],'import { createShardDO } from "./shard.js";',...e.hasVectors===!0?['import { LUNORA_VECTOR_INDEXES } from "./vectors.js";']:[]]},G=e=>[...e.hasStorage?["/** `.storage(...)` declaration — one bucket (required) plus optional extra named buckets and signed-URL config. Backs `ctx.storage` AND the studio file browser. */\ninterface StorageDeclaration<Env> {\n    /** The default R2 bucket binding (the bare `ctx.storage`). */\n    bucket: Selector<Env, R2BucketLike>;\n    /** Extra named buckets, reached via `ctx.storage.bucket(\"name\")` and the studio's bucket picker. */\n    buckets?: Record<string, Selector<Env, R2BucketLike>>;\n    /** Public base URL signed/public object URLs resolve against. Omit it and `ctx.storage` in a mutation, action or HTTP handler (and the studio's copy-URL) signs against the origin the request reached the worker on — no per-environment value to ship. Queries get no such fallback (a live query re-runs with no request behind it), so a query that signs URLs needs this set. */\n    publicBaseUrl?: Selector<Env, string>;\n    /** R2 S3-API credentials (`{ accountId, accessKeyId, secretAccessKey, bucket, jurisdiction? }`) enabling `ctx.storage.getPresignedUrl` — native S3 presigned URLs that hit R2 directly, bypassing the worker. Omit to use only the worker-signed `getSignedUrl` path. */\n    s3?: Selector<Env, R2S3Credentials>;\n    /** HMAC secret for signed URLs. */\n    signingSecret?: Selector<Env, string>;\n}"]:[],...e.hasScheduler?["/** `.scheduler(...)` declaration — the `SchedulerDO` namespace. Backs `ctx.scheduler` AND the studio's scheduled-jobs view. The origin its callbacks dispatch back to is not declared here: the DO reads `env.LUNORA_ORIGIN_URL` at fire time, because a caller-supplied dispatch target would be an SSRF vector. */\ninterface SchedulerDeclaration<Env> {\n    /** The `SchedulerDO` namespace binding (typically `env.SCHEDULER`). */\n    namespace: Selector<Env, DurableObjectNamespaceLike & ShardNamespaceLike>;\n}"]:[],...e.hasGlobal?["/** `.global(...)` declaration — the D1 binding backing `.global()` tables. Backs cross-tenant `ctx.db` reads/writes AND the studio's global data browser. */\ninterface GlobalDeclaration<Env> {\n    /** The D1 binding (typically `env.DB`). */\n    d1: Selector<Env, D1DatabaseLike>;\n    /** The worker origin used to fan reverse cross-backend relations across shards. Without it, such a relation throws a clear error. */\n    origin?: Selector<Env, string>;\n}"]:[],...e.hasHyperdriveGlobal?['/** `.hyperdriveGlobal(...)` declaration — backs `.global({ backend: "hyperdrive" })` tables on a Postgres/MySQL database via Hyperdrive. Stays reactive: the writer is injected as `globalDb` and the broadcast hook drives live queries. */\ninterface HyperdriveGlobalDeclaration<Env> {\n    /** The Hyperdrive engine — selects the Postgres or MySQL dialect. */\n    engine: HyperdriveEngine;\n    /** Build the `SqlExec` from `env` — e.g. `buildPgExec(fromPostgresJs(postgres(env.HYPERDRIVE.connectionString)))`. Cache the driver on the DO instance; rebuild lazily after hibernation. */\n    exec: (env: Env) => SqlExec;\n    /** The worker origin used to fan reverse cross-backend relations across shards. Without it, such a relation throws a clear error. */\n    origin?: Selector<Env, string>;\n}']:[],...e.hasAuth?['/** `.auth(...)` declaration — better-auth options plus the storage the adapter reads. Give it `d1` (the default) or `namespace` (a Durable Object that hosts the auth tables), never both. The builder owns the lazy build + `ensureMigrated` dance and wires `authHandler` / `resolveIdentity` / `authAdmin`. */\ninterface AuthDeclaration<Env> {\n    /** The D1 binding the auth SQL adapter is wired over (via `lunoraD1Adapter`). Omit only when using `namespace`. */\n    d1?: Selector<Env, unknown>;\n    /** Shared secret the worker presents on the object\'s internal session route. REQUIRED with `namespace`: the binding is reachable from any worker bound to it, so the secret — not the binding — is the authorization boundary. Without it identity resolution fails closed. */\n    internalSecret?: Selector<Env, string>;\n    /** Name of the Durable Object instance holding the auth tables. Defaults to `"auth"`. Set it to run separate auth objects (per deployment, per tenant) off one namespace. */\n    objectName?: Selector<Env, string>;\n    /** The auth Durable Object namespace — the DO-backed mode. Needed for `@better-auth/scim`, which requires native transactions that D1 has none of. The object owns the auth tables, so `/api/auth/*` and identity resolution both go through it. Typed as `AuthNamespaceLike` because `createDoAuthWiring` resolves through `idFromName` + `get` and has no `getByName` fallback — both members are load-bearing here, and `ShardNamespaceLike` leaves both optional. */\n    namespace?: Selector<Env, AuthNamespaceLike>;\n    /** Build the better-auth options from `env` (secret, plugins, email/password, …). */\n    options: (env: Env) => LunoraAuthOptions;\n}']:[]],B=e=>[...e.hasAccess?["    private accessSelector?: Selector<Env, CreateAccessResolverOptions | undefined>;"]:[],"    private adminToken?: Selector<Env, string>;",...e.hasAuth?["    private authDeclaration?: AuthDeclaration<Env>;"]:[],"    private cdcEnabled = false;","    private reactiveCacheConfig: boolean | { maxBytes?: number; maxEntries?: number } = false;",'    private maxRelationKeysLimit?: ShardConfig["maxRelationKeys"];','    private observabilitySink?: ShardConfig["observability"];','    private relationExistsPushDownMode?: ShardConfig["relationExistsPushDown"];',"    private readonly extendFns: ((env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>)[] = [];",...e.hasGlobal?["    private globalDeclaration?: GlobalDeclaration<Env>;"]:[],...e.hasHyperdriveGlobal?["    private hyperdriveGlobalDeclaration?: HyperdriveGlobalDeclaration<Env>;"]:[],"    private httpRouterApp?: HttpRouterLike;","    private readonly routeMap: Record<string, Route> = {};",...e.hasScheduler?["    private schedulerDeclaration?: SchedulerDeclaration<Env>;"]:[],...m(e)?["    private readonly shardExtras: Partial<ShardConfig> = {};"]:[],...d(e)?["    private shardRegistrySelector?: Selector<Env, ShardNamespaceLike>;"]:[],"    private shardSelector?: Selector<Env, ShardNamespaceLike>;",...e.hasSourcedTables?['    private sourceClientFactory?: NonNullable<ShardConfig["sourceClient"]>;']:[],...e.hasStorage?["    private storageDeclaration?: StorageDeclaration<Env>;"]:[]],P=e=>g(e).map(({configKey:r,doc:t,method:a})=>`    /** ${t} */
-    public ${a}(factory: (env: Env) => ReturnType<NonNullable<ShardConfig["${r}"]>>): this {
-        this.shardExtras.${r} = factory as NonNullable<ShardConfig["${r}"]>;
-
-        return this;
-    }`),W=e=>[...e.hasAccess?["    /** Wire Cloudflare Access (Zero Trust) — feeds the verified Access identity into `ctx.auth` / RLS via `resolveIdentity`. Call it with no argument when the Access policy is attached to the Worker (the identity arrives on the execution context; nothing to configure); pass `teamDomain` + `aud` for a hostname-scoped Access application, whose `Cf-Access-Jwt-Assertion` JWT is verified against your team JWKS. When `.auth(...)` is also configured, Access is composed ahead of it (Access wins when it authenticated the caller; everyone else falls through to the app session). */\n    public access(selector?: Selector<Env, CreateAccessResolverOptions>): this {\n        this.accessSelector = selector ?? (() => undefined);\n\n        return this;\n    }"]:[],`    /** Bearer token gating the \`/_lunora/admin/*\` endpoints the studio calls. */
-    public admin(selector: Selector<Env, string>): this {
-        this.adminToken = selector;
+import{APP_METHOD_CAPABILITIES as k}from"./CAPABILITY_PROBES-DFsutD7g.mjs";import{i as S}from"./ir-DBSvhNa-.mjs";import{G as E}from"./shared-DjUziztz.mjs";const D={configKey:"vectors",doc:"Wire the Vectorize index map backing `ctx.vectors`.",method:"vectors"},g=e=>[...k.filter(({key:r})=>e.capabilities.has(r)).map(({appMethod:r})=>r),...e.hasVectors?[D]:[]],m=e=>g(e).length>0,v=e=>(e.emailAgents?.length??0)>0,d=e=>e.tables.some(r=>S(r)),R=e=>e.hasScheduler?`
+    /** Resolve the \`SchedulerDO\`-backed scheduler for this env; \`undefined\` until the namespace is wired. */
+    private resolveScheduler(env: Env): ReturnType<typeof createScheduler> | undefined {
+        const namespace = this.schedulerDeclaration?.namespace(env);
 
-        return this;
-    }`,"    /**\n     * Opt into change-data-capture: every write records a post-image to `__cdc_log` — on this shard AND, when the app has `.global()` tables, on the global backend. Backs streaming export, replay-PITR, and the `.global()` half of `defineShape` replication (whose poll tick asks the global changelog which tables moved). Off by default: it costs a changelog row per write, which an app using none of the above should not pay.\n     *\n     * REQUIRED for a shard-local `defineShape`: those replicate out of `__cdc_log`, and a `shape_subscribe` is refused with `SHAPE_REQUIRES_CDC` without it.\n     *\n     * It also changes how fresh a `.global()` shape is against writes made OUTSIDE `ctx.db` — an admin import, a PITR replay, an external ETL job, or a predicate over wall clock. With CDC off the poll re-reads every shape every 2s. With it on the poll asks the global changelog which tables moved and skips the rest, so a change the changelog never saw waits for the 30s unconditional resync instead. Writes through `ctx.db` are unaffected: they append, so the poll sees them on the next tick either way.\n     */\n    public cdc(enabled = true): this {\n        this.cdcEnabled = enabled;\n\n        return this;\n    }",`    /**
-     * Enable the per-shard reactive query cache: query results are memoized by \`(functionPath, args, identity)\` and invalidated by the ctx-db write hooks BEFORE the subscription broadcast, so a subscriber re-running its query always observes the post-write state.
+        return namespace ? createScheduler({${e.jurisdiction?` jurisdiction: ${JSON.stringify(e.jurisdiction)},`:""} namespace }) : undefined;
+    }
+`:"",x=e=>e?`
+    /**
+     * One bucket's \`Storage\`, signing under the name it is registered as.
      *
-     * Off by default (every dispatch re-runs its handler). Pass an options object to tune the caps: \`maxEntries\` (default 1000) and \`maxBytes\` (default 4 MiB); either accepts \`Number.POSITIVE_INFINITY\` to disable that cap.
+     * \`bucketName\` is bound into every signed URL's HMAC canonical, so a bucket
+     * that signs as the default's name lets a URL minted for one bucket verify
+     * against another sharing the secret — and multi-bucket verification fails
+     * outright. Hence \`"default"\` for the bare \`ctx.storage\` bucket and the
+     * \`buckets\` key for every other.
+     *
+     * \`origin\` is the request's own origin, the base when no \`publicBaseUrl\` is
+     * declared.
      */
-    public reactiveCache(config: boolean | { maxBytes?: number; maxEntries?: number } = true): this {
-        this.reactiveCacheConfig = config;
-
-        return this;
-    }`,`    /** Ceiling on the join keys ONE relation-crossing \`where\` predicate may pre-resolve via semijoin before failing closed. Omit for the engine default. */
-    public maxRelationKeys(limit: NonNullable<ShardConfig["maxRelationKeys"]>): this {
-        this.maxRelationKeysLimit = limit;
-
-        return this;
-    }`,"    /**\n     * Route the shard's `ctx.log` lines, `ctx.trace` spans and `ctx.metrics` measurements to a telemetry sink.\n     *\n     * The DO half of observability: without it every in-handler signal stays in the shard's local ring buffer (the studio Logs panel) and reaches no collector. The worker half — one `onRpc` event per dispatched RPC — is a `createWorker` option; pass the SAME sink to both via `.extend((env) => ({ observability: sink(env) }))` to correlate them.\n     */\n    public observability(selector: NonNullable<ShardConfig[\"observability\"]>): this {\n        this.observabilitySink = selector;\n\n        return this;\n    }",'    /** Resolution policy for a relation-crossing `where` whose child is co-located in this shard: `"auto"` (cost-based, the engine default), `"always"` (inline correlated EXISTS) or `"never"` (universal semijoin). All three return identical rows. */\n    public relationExistsPushDown(mode: NonNullable<ShardConfig["relationExistsPushDown"]>): this {\n        this.relationExistsPushDownMode = mode;\n\n        return this;\n    }',...e.hasAuth?['    /** Wire better-auth — the builder lazily builds the instance, runs `ensureMigrated`, and dispatches `/api/auth/*` inside the worker (instrumented for the auth-failure SLO). Pass `d1` for the D1-backed default, or `namespace` + `internalSecret` to host the auth tables in a Durable Object (what `@better-auth/scim` needs). */\n    public auth(declaration: AuthDeclaration<Env>): this {\n        // Reject the ambiguous and the empty shapes here rather than at the first\n        // request: with neither storage set, auth would silently never answer, and\n        // with both it is unclear which one owns the tables.\n        if (declaration.d1 && declaration.namespace) {\n            throw new Error(".auth(): pass either `d1` or `namespace`, not both — they are two different homes for the same tables.");\n        }\n\n        if (!declaration.d1 && !declaration.namespace) {\n            throw new Error(".auth(): needs `d1` (D1-backed) or `namespace` (Durable-Object-backed) to know where the auth tables live.");\n        }\n\n        if (declaration.namespace && !declaration.internalSecret) {\n            throw new Error(\n                ".auth(): `namespace` requires `internalSecret` — the auth DO binding is reachable from any worker bound to it, so identity resolution is gated on a shared secret and would otherwise fail closed on every request.",\n            );\n        }\n\n        this.authDeclaration = declaration;\n\n        return this;\n    }']:[],"    /** Escape hatch — merge raw `WorkerOptions` (anything not yet sugared) over the derived options at build time. The second `derived` argument is a snapshot of the options assembled so far (after `.auth(...)` etc.), so you can compose rather than clobber — e.g. wrap `derived.resolveIdentity` instead of replacing it. */\n    public extend(fn: (env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>): this {\n        this.extendFns.push(fn);\n\n        return this;\n    }",...e.hasGlobal?[`    /** Back \`.global()\` (cross-tenant) tables with D1 — wires \`ctx.db\` routing, the studio global browser, and reverse cross-shard relations. */
-    public global(declaration: GlobalDeclaration<Env>): this {
-        this.globalDeclaration = declaration;
+    private makeStorage(env: Env, declaration: StorageDeclaration<Env>, bucket: R2BucketLike, bucketName: string, origin?: string): Storage {
+        return createStorage({
+            bucket,
+            bucketName,
+            publicBaseUrl: declaration.publicBaseUrl?.(env) ?? origin,
+            s3: declaration.s3?.(env),
+            signingSecret: declaration.signingSecret?.(env),
+        });
+    }
 
-        return this;
-    }`]:[],...e.hasHyperdriveGlobal?[`    /** Back \`.global({ backend: "hyperdrive" })\` tables with a Postgres/MySQL database via Hyperdrive — wires reactive \`ctx.db\` routing through the shared store core. */
-    public hyperdriveGlobal(declaration: HyperdriveGlobalDeclaration<Env>): this {
-        this.hyperdriveGlobalDeclaration = declaration;
+    /** Resolve the storage capability (single or multi-bucket) for the DO side. */
+    private resolveStorage(env: Env, origin?: string): Storage | undefined {
+        const declaration = this.storageDeclaration;
 
-        return this;
-    }`]:[],`    /** Cloudflare Email Routing entry — exposes the top-level \`email\` handler. */
-    public onEmail(handler: (env: Env) => (message: unknown, env: unknown, context: ExecutionContextLike) => Promise<void>): this {
-        this.emailHandler = handler;
+        if (!declaration) {
+            return undefined;
+        }
 
-        return this;
-    }`,"    /** Mount a whole HTTP app (`httpRouter()` from `@lunora/server`, or anything with a `fetch`) ahead of Lunora's own routes. Use this for a multi-endpoint hono app with its own CORS + error handling; `.route()` is for one-off endpoints. */\n    public httpRouter(app: HttpRouterLike): this {\n        this.httpRouterApp = app;\n\n        return this;\n    }",`    /** Mount a custom HTTP route (e.g. an asset-serving or test endpoint). Key is \`"METHOD path"\`, \`"path"\`, or a path prefix matched by the runtime. */
-    public route(key: string, handler: Route): this {
-        this.routeMap[key] = handler;
+        const defaultBucket = declaration.bucket(env);
 
-        return this;
-    }`,...e.hasScheduler?[`    /** Wire the \`SchedulerDO\` — backs \`ctx.scheduler\` and the studio's scheduled-jobs view. */
-    public scheduler(declaration: SchedulerDeclaration<Env>): this {
-        this.schedulerDeclaration = declaration;
+        if (!defaultBucket) {
+            return undefined;
+        }
 
-        return this;
-    }`]:[],`    /** The shard Durable Object namespace (typically \`env.SHARD\`) — required: every app routes RPC + WebSocket traffic through it. */
-    public shard(selector: Selector<Env, ShardNamespaceLike>): this {
-        this.shardSelector = selector;
+        const extraEntries = Object.entries(declaration.buckets ?? {})
+            .map(([name, selector]) => [name, selector(env)] as const)
+            .filter((entry): entry is [string, R2BucketLike] => Boolean(entry[1]));
 
-        return this;
-    }`,...d(e)?["    /** The `ShardRegistryDO` namespace (typically `env.SHARD_REGISTRY`). Each shard registers itself for the `.shardBy()` tables it writes, and cross-shard export, CDC sync and migrations fan out to the shards it lists. Without it they refuse a `.shardBy()` table. */\n    public shardRegistry(selector: Selector<Env, ShardNamespaceLike>): this {\n        this.shardRegistrySelector = selector;\n\n        return this;\n    }"]:[],...e.hasSourcedTables?[`    /** Resolve the SQL client a \`.source(...)\` table's ingest poll reads from, given the wrangler Hyperdrive binding it named. Build it with \`@lunora/hyperdrive\`'s \`createHyperdrive\` plus your driver adapter. REQUIRED for a sourced table: without it every poll tick records "no sourceClient resolved for binding" and the table stays empty. */
-    public sourceClient(factory: (env: Env, binding: string) => ReturnType<NonNullable<ShardConfig["sourceClient"]>>): this {
-        this.sourceClientFactory = factory as NonNullable<ShardConfig["sourceClient"]>;
+        if (extraEntries.length === 0) {
+            return this.makeStorage(env, declaration, defaultBucket, "default", origin);
+        }
 
-        return this;
-    }`]:[],...e.hasStorage?[`    /** Wire R2 storage — backs \`ctx.storage\` (incl. multi-bucket) and the studio file browser, from one declaration. */
-    public storage(declaration: StorageDeclaration<Env>): this {
-        this.storageDeclaration = declaration;
+        const map: Record<string, Storage> = { default: this.makeStorage(env, declaration, defaultBucket, "default", origin) };
 
-        return this;
-    }`]:[],...P(e)],_=e=>{const r=a=>e.hasScheduler?`
-                              ...(this.schedulerDeclaration ? { scheduler: this.resolveScheduler(env) as unknown as ${a}["scheduler"] } : {}),`:"",t=["            cdc: this.cdcEnabled,","            reactiveCache: this.reactiveCacheConfig,","            ...(this.maxRelationKeysLimit === undefined ? {} : { maxRelationKeys: this.maxRelationKeysLimit }),","            ...(this.observabilitySink === undefined ? {} : { observability: this.observabilitySink }),","            ...(this.relationExistsPushDownMode === undefined ? {} : { relationExistsPushDown: this.relationExistsPushDownMode }),",...e.hasGlobal?[`            ...(this.globalDeclaration
-                ? {
-                      d1: (rawEnv: Record<string, unknown>, request?: { bookmark?: string; cdc?: boolean; cdcRetentionMs?: number; identity?: Record<string, unknown>; onBookmark?: (bookmark: string | undefined) => void; userId?: string | null }) => {
-                          const env = rawEnv as Env;
-                          const database = this.globalDeclaration?.d1(env);
+        for (const [name, bucket] of extraEntries) {
+            map[name] = this.makeStorage(env, declaration, bucket, name, origin);
+        }
 
-                          if (!database) {
-                              return undefined;
-                          }
+        return createBucketStorage(map, { default: "default" });
+    }
 
-                          const origin = this.globalDeclaration?.origin?.(env);
-                          const crossShard = origin
-                              ? createCrossShardRelationCapabilities({ identity: request?.identity, origin, userId: request?.userId ?? undefined })
-                              : undefined;
+    /** Derive the studio file-browser admin functions from the same buckets \`.storage()\` declared. */
+    private buildStorageAdmin(env: Env): Partial<WorkerOptions> {
+        const declaration = this.storageDeclaration;
 
-                          return createD1CtxDb({
-                              ...(crossShard ? { crossShardCounter: crossShard.crossShardCounter, crossShardReader: crossShard.crossShardReader } : {}),${r("D1CtxDbOptions")}
-                              ...(request?.cdcRetentionMs === undefined ? {} : { cdcRetentionMs: request.cdcRetentionMs }),
-                              auth: { identity: request?.identity ?? null, userId: request?.userId ?? null },
-                              // Forwarded from the shard's own \`cdc\` config, so ONE
-                              // switch governs both changelogs. Built without it, the
-                              // global \`__cdc_log\` is never written and the shape
-                              // poll's changed-tables fast path is unreachable.
-                              cdc: request?.cdc ?? false,
-                              exec: buildExec(database, request?.bookmark, request?.onBookmark),
-                              // The binding outlives this per-request writer, so the
-                              // provisioning sweep runs once per isolate rather than
-                              // once per request. See \`SqlCtxDbOptions.provisionScope\`.
-                              provisionScope: database,
-                              schema: schema as unknown as D1CtxDbOptions["schema"],
-                          });
-                      },
-                  }
-                : {}),`]:[],...e.hasHyperdriveGlobal?[`            ...(this.hyperdriveGlobalDeclaration
-                ? {
-                      hyperdriveGlobal: (rawEnv: Record<string, unknown>, request?: { cdc?: boolean; cdcRetentionMs?: number; identity?: Record<string, unknown>; userId?: string | null }) => {
-                          const env = rawEnv as Env;
-                          const declaration = this.hyperdriveGlobalDeclaration;
-                          const exec = declaration?.exec(env) as SqlExec | undefined;
+        if (!declaration) {
+            return {};
+        }
 
-                          if (!declaration || !exec) {
-                              return undefined;
-                          }
+        const defaultBucket = declaration.bucket(env);
 
-                          const origin = declaration.origin?.(env);
-                          const crossShard = origin
-                              ? createCrossShardRelationCapabilities({ identity: request?.identity, origin, userId: request?.userId ?? undefined })
-                              : undefined;
+        if (!defaultBucket) {
+            return {};
+        }
 
-                          return createHyperdriveGlobalCtxDb({
-                              ...(crossShard ? { crossShardCounter: crossShard.crossShardCounter, crossShardReader: crossShard.crossShardReader } : {}),${r("SqlCtxDbOptions")}
-                              ...(request?.cdcRetentionMs === undefined ? {} : { cdcRetentionMs: request.cdcRetentionMs }),
-                              auth: { identity: request?.identity ?? null, userId: request?.userId ?? null },
-                              // See the D1 twin: one \`cdc\` switch, both changelogs.
-                              cdc: request?.cdc ?? false,
-                              engine: declaration.engine as HyperdriveEngine,
-                              exec,
-                              // The DECLARATION, not \`exec\` — \`exec(env)\` is a user
-                              // callback that builds a fresh client per call, so scoping
-                              // to its result would key the memo on a new object every
-                              // request and never share anything. The declaration is
-                              // built once and names one database.
-                              provisionScope: declaration,
-                              schema: schema as unknown as SqlCtxDbOptions["schema"],
-                          });
-                      },
-                  }
-                : {}),`]:[],...e.hasScheduler?[`            ...(this.schedulerDeclaration
-                ? {
-                      scheduler: (rawEnv: Record<string, unknown>) => this.resolveScheduler(rawEnv as Env),
-                  }
-                : {}),`]:[],...d(e)?["            ...(this.shardRegistrySelector ? { shardRegistry: (rawEnv: Record<string, unknown>) => this.shardRegistrySelector?.(rawEnv as Env) } : {}),"]:[],...e.hasSourcedTables?["            ...(this.sourceClientFactory === undefined ? {} : { sourceClient: this.sourceClientFactory }),"]:[],...e.hasStorage?["            ...(this.storageDeclaration ? { storage: (rawEnv: Record<string, unknown>, origin?: string) => this.resolveStorage(rawEnv as Env, origin) } : {}),"]:[],...m(e)?["            ...this.shardExtras,"]:[]];return t.length>0?`
-${t.join(`
-`)}
-        `:""},$=e=>e.jurisdiction&&e.jurisdictionPinsAuth===!0?`
-                // The schema's jurisdiction pins the auth object like every other DO.
-                jurisdiction: ${JSON.stringify(e.jurisdiction)},`:"",H=e=>typeof e=="string"?`{ mode: { kind: ${JSON.stringify(e)} } }`:`{ mode: { field: ${JSON.stringify(e.field)}, kind: "shardBy" } }`,U=e=>[...e.tables.length>0?[`        const tableSharding = new Map<string, ShardingInfo>([
-${e.tables.map(r=>`            [${JSON.stringify(r.name)}, ${H(r.shardMode)}],`).join(`
-`)}
-        ]);
+        const bindings: Record<string, R2BucketLike> = { default: defaultBucket };
 
-        options.listSchemaTables = () => [...tableSharding.keys()];
-        options.resolveTableSharding = (table) => tableSharding.get(table);`]:[],...d(e)?[`        const shardRegistry = this.shardRegistrySelector?.(env);
+        for (const [name, selector] of Object.entries(declaration.buckets ?? {})) {
+            const bucket = selector(env);
 
-        if (shardRegistry) {
-            options.queryCoordinator = createQueryCoordinator({ registry: createDynamicShardRegistry({ ${e.jurisdiction?`jurisdiction: ${JSON.stringify(e.jurisdiction)}, `:""}namespace: shardRegistry }) });
-        }`]:[]],F=e=>[...U(e),...e.hasScheduler?[`        if (this.schedulerDeclaration) {
-            options.schedulerDO = this.schedulerDeclaration.namespace(env);
-        }`]:[],...e.hasWorkflow?[`        options.workflowsClient = (workflowEnv) => {
-            const source = workflowEnv as Record<string, unknown>;
-            const accountId = source["CLOUDFLARE_ACCOUNT_ID"];
-            const apiToken = source["CLOUDFLARE_API_TOKEN"];
+            if (bucket) {
+                bindings[name] = bucket;
+            }
+        }
 
-            return typeof accountId === "string" && accountId !== "" && typeof apiToken === "string" && apiToken !== ""
-                ? createWorkflowsRestClient({ accountId, apiToken })
-                : undefined;
-        };`]:[],...e.hasGlobal?[`        if (this.globalDeclaration) {
-            const database = this.globalDeclaration.d1(env);
+        // \`Object.hasOwn\`, not a bare lookup: \`bindings\` is a plain object, so a
+        // prototype key (\`?bucket=constructor\`, \`__proto__\`, \`toString\`) resolves
+        // to an inherited Object.prototype member instead of the default bucket.
+        //
+        // \`origin\` is the base when no \`publicBaseUrl\` is declared: the origin the
+        // admin request reached the worker on, which the signed-URL route hands
+        // over and then verifies. Only the secret gates signing.
+        const pick = (name?: string, origin?: string): Storage => {
+            const wanted = name !== undefined && name !== "" ? name : "default";
+            const bucketName = Object.hasOwn(bindings, wanted) ? wanted : "default";
 
-            if (database) {
-                options.globalIntrospector = buildGlobalIntrospector(database);
-                // \`importGlobals\` wires the admin bulk-import endpoint's global
-                // plane: the rows \`resolveTableSharding\` classifies as \`.global()\`
-                // land here, and without it they are reported, not written.
-                options.importGlobals = buildGlobalImporter(database, this.cdcEnabled);
-                // The read/replay half of the same admin plane. Each one is the
-                // only reason its endpoint can see the global storage plane at
-                // all, and every one of them fails SILENTLY when unset — export
-                // and \`lunora backup create\` answer 200 having written only
-                // shard-local rows (an export→import round trip then restores
-                // cleanly minus every global row), CDC sync answers with only
-                // shard changes, and point-in-time apply reports
-                // \`globalApplied: 0\`. Nothing here is project-specific either.
-                options.exportGlobals = buildGlobalExporter(database);
-                options.syncGlobals = buildGlobalCdcSync(database);
-                options.applyGlobals = buildGlobalCdcApplier(database, this.cdcEnabled);
-            }
-        }`]:[],...e.hasStorage?[`        if (this.storageDeclaration) {
-            Object.assign(options, this.buildStorageAdmin(env));
-            options.storage = (rawEnv: unknown, origin?: string) => this.resolveStorage(rawEnv as Env, origin);
-        }`]:[],...e.hasKvIntrospector?["        options.kvIntrospector = createKvIntrospectorFromEnv(env);"]:[],...e.hasVectors===!0?[`        if (this.shardExtras.vectors) {
-            options.vectorIntrospector = createVectorAdminIntrospector({
-                indexes: this.shardExtras.vectors(env as unknown as Record<string, unknown>),
-                registry: LUNORA_VECTOR_INDEXES,
-            });
-        } else {
-            // Emitted only when the schema declares an index, so reaching here
-            // means the app declared one and never bound it. The studio's
-            // Vectors tab is on (its flag is the same index count) and every
-            // request to it would answer VECTORS_NOT_CONFIGURED, while
-            // \`ctx.vectors\` is the throwing stub — so this is already broken,
-            // just later and less legibly. Same shape as \`.auth()\`'s guards.
-            throw new Error(
-                ".vectors(): the schema declares vector index(es) but no binding map was chained. Pass \`.vectors((env) => ({ <indexName>: env.<BINDING> }))\` so \`ctx.vectors\` resolves and the studio's Vectors tab can list them.",
-            );
-        }`]:[],...e.hasNotify?["        options.notifySubscriptionStore = notifyConfig.store ? notifyConfig.store(env as Record<string, unknown>) : undefined;"]:[],"        options.logArchive = resolveLogArchiveFromEnv(env);",...e.hasAuth?[`        // Captured before the branch so the narrowing survives — reading
-        // \`this.authDeclaration.namespace\` again below would be optional all over again.
-        const authDeclaration = this.authDeclaration;
-        const authNamespace = authDeclaration?.namespace;
-        const authD1 = authDeclaration?.d1;
-
-        if (authDeclaration && authNamespace) {
-            // DO-backed mode. The auth tables live inside the object and DO storage is
-            // unreachable from here, so better-auth runs in there and this worker talks
-            // to it. \`createDoAuthWiring\` is a tested function in \`@lunora/auth\` rather
-            // than more emitted code: request-path logic in generated output can only be
-            // typechecked, never unit-tested.
-            const authWiring = createDoAuthWiring({
-                // The OAuth discovery documents (an \`mcp()\` resource's metadata, the
-                // issuer's) are derived here from the declared options, so the worker
-                // forwards only those exact paths and no other probe reaches the object.
-                // Memoised on the declaration: a framework-hosted worker rebuilds these
-                // options per request, and \`options(env)\` rebuilds every plugin.
-                discoveryPaths: authDiscoveryPathsFor(authDeclaration, env),
-                internalSecret: authDeclaration.internalSecret?.(env),${$(e)}
-                namespace: authNamespace(env),
-                objectName: authDeclaration.objectName?.(env),
-            });
-
-            options.authHandler = authWiring.authHandler;
-            options.authDiscoveryHandler = authWiring.discoveryHandler;
-            options.resolveIdentity = authWiring.resolveIdentity;
-            // The audit log lives in the object like every other auth table, so the feed
-            // reads through it rather than querying D1.
-            options.authAuditReader = authWiring.auditReader;
-            // Set only once auth is pinned to a jurisdiction: copies the users left in the
-            // un-pinned object across (\`__lunora_admin__:copyAuthToJurisdiction\`).
-            options.authJurisdictionMove = authWiring.jurisdictionMove;
-            // \`authAdmin\` stays D1-only: its ~30 methods read the auth tables directly
-            // from the worker, which DO storage does not allow. The studio's auth pages
-            // therefore report "not configured" in this mode rather than silently
-            // returning empty data.
-        } else if (authDeclaration && authD1) {
-            options.authHandler = (request) => {
-                const auth = getAuth();
-
-                return auth ? handleAuthRequest(auth, request) : Promise.resolve(undefined);
-            };
-            // The OAuth discovery documents outside \`/api/auth\` (served only with an
-            // \`mcp()\` or \`oauthProvider()\` plugin, and only after the app's own routes).
-            options.authDiscoveryHandler = (request) => {
-                const auth = getAuth();
-
-                return auth ? handleAuthDiscoveryRequest(auth, request) : Promise.resolve(undefined);
-            };
-            options.resolveIdentity = async (request) => {
-                const auth = getAuth();
-
-                if (!auth) {
-                    return null;
-                }
-
-                const session = await auth.api.getSession({ headers: (request as Request).headers });
-
-                if (!session?.user?.id) {
-                    return null;
-                }
-
-                // \`role\` rides along so \`rls(policies, { roles })\` and \`auth.can(...)\`
-                // work on this wiring without a hand-written resolver. better-auth's
-                // \`admin()\` plugin owns that column (comma-joined for multiple roles)
-                // and only an administrator can write it; it is absent when the plugin
-                // is off, which reads as no roles.
-                //
-                // \`expiresAtMs\` is the socket credential expiry the runtime forwards
-                // as \`x-lunora-identity-exp\`. Without it the DO's expiry check never
-                // fires, so a signed-out, banned or lapsed user keeps streaming their
-                // RLS-scoped rows over an already-open WebSocket while every HTTP call
-                // is anonymous. better-auth hands back a \`Date\`; anything else means
-                // the adapter did not hydrate it, and omitting beats guessing.
-                const expiresAt = session.session.expiresAt;
-                // \`email\` and \`name\` are the claims \`ctx.auth.getIdentity()\` is
-                // documented to carry ("email, name, roles, custom claims"). Without
-                // them the documented \`me\` query — \`identity?.email\` — resolves
-                // \`undefined\` on the built-in wiring. Empty strings are dropped so an
-                // absent claim reads as absent rather than as "".
-                const user = session.user as { email?: unknown; name?: unknown; role?: unknown };
-
-                return {
-                    ...(typeof user.email === "string" && user.email.length > 0 ? { email: user.email } : {}),
-                    ...(expiresAt instanceof Date ? { expiresAtMs: expiresAt.getTime() } : {}),
-                    ...(typeof user.name === "string" && user.name.length > 0 ? { name: user.name } : {}),
-                    role: user.role,
-                    userId: session.user.id,
-                };
-            };
-            const authInstance = getAuth();
-
-            options.authAdmin = authInstance ? createAuthAdmin(authInstance) : undefined;
-            options.authAuditReader = createAuthAuditReader(d1Executor(authD1(env) as never));
-        }`]:[],...e.hasAccess?[e.hasAuth?`        if (this.accessSelector) {
-            const accessResolver = createAccessResolver(this.accessSelector(env));
-            const fallback = options.resolveIdentity;
-
-            options.resolveIdentity = fallback ? composeResolvers(accessResolver, fallback) : accessResolver;
-        }`:`        if (this.accessSelector) {
-            options.resolveIdentity = createAccessResolver(this.accessSelector(env));
-        }`]:[],...e.voiceAgents&&e.voiceAgents.length>0?[`        options.voiceAgents = {
-${e.voiceAgents.map(r=>`            ${JSON.stringify(r.exportName)}: (env as Record<string, unknown>)[${JSON.stringify(r.bindingName)}] as ShardNamespaceLike,`).join(`
-`)}
-        };`]:[]],M=e=>["            cronJobs: LUNORA_CRONS,","            functions: LUNORA_FUNCTIONS,",...e.identity?[`            identity: lunoraIdentityContract.${e.identity.exportName},`]:[],...e.jurisdiction?[`            jurisdiction: ${JSON.stringify(e.jurisdiction)},`]:[],...e.wantsArchitecture?["            architecture,"]:[],...e.wantsOpenApi?["            openApiSpec,"]:[],...e.wantsOpenRpc?["            openRpcSpec,"]:[],...e.hasQueue?["            queue: (batch: unknown, queueEnv: unknown, _context: ExecutionContextLike, trigger: TriggerTrace): Promise<void> =>","                dispatchQueueBatch(batch as Parameters<typeof dispatchQueueBatch>[0], LUNORA_QUEUE_REGISTRY, {","                    capture: shouldCaptureQueue(queueEnv as Record<string, unknown>)",`                        ? createQueueCaptureSink(queueEnv as Record<string, unknown>${e.jurisdiction?`, { jurisdiction: ${JSON.stringify(e.jurisdiction)} }`:""})`,"                        : undefined,","                    env: queueEnv as Record<string, unknown>,","                    traceparent: trigger.traceparent,","                }),"]:[],"            ...(this.httpRouterApp ? { httpRouter: this.httpRouterApp } : {}),","            routes: this.routeMap,","            shardDO: this.shardSelector?.(env) ?? (undefined as unknown as ShardNamespaceLike),"],Q=e=>e.hasScheduler?`
-    /** Resolve the \`SchedulerDO\`-backed scheduler for this env; \`undefined\` until the namespace is wired. */
-    private resolveScheduler(env: Env): ReturnType<typeof createScheduler> | undefined {
-        const namespace = this.schedulerDeclaration?.namespace(env);
-
-        return namespace ? createScheduler({${e.jurisdiction?` jurisdiction: ${JSON.stringify(e.jurisdiction)},`:""} namespace }) : undefined;
-    }
-`:"",J=e=>e?`
-    /**
-     * One bucket's \`Storage\`, signing under the name it is registered as.
-     *
-     * \`bucketName\` is bound into every signed URL's HMAC canonical, so a bucket
-     * that signs as the default's name lets a URL minted for one bucket verify
-     * against another sharing the secret — and multi-bucket verification fails
-     * outright. Hence \`"default"\` for the bare \`ctx.storage\` bucket and the
-     * \`buckets\` key for every other.
-     *
-     * \`origin\` is the request's own origin, the base when no \`publicBaseUrl\` is
-     * declared.
-     */
-    private makeStorage(env: Env, declaration: StorageDeclaration<Env>, bucket: R2BucketLike, bucketName: string, origin?: string): Storage {
-        return createStorage({
-            bucket,
-            bucketName,
-            publicBaseUrl: declaration.publicBaseUrl?.(env) ?? origin,
-            s3: declaration.s3?.(env),
-            signingSecret: declaration.signingSecret?.(env),
-        });
-    }
-
-    /** Resolve the storage capability (single or multi-bucket) for the DO side. */
-    private resolveStorage(env: Env, origin?: string): Storage | undefined {
-        const declaration = this.storageDeclaration;
-
-        if (!declaration) {
-            return undefined;
-        }
-
-        const defaultBucket = declaration.bucket(env);
-
-        if (!defaultBucket) {
-            return undefined;
-        }
-
-        const extraEntries = Object.entries(declaration.buckets ?? {})
-            .map(([name, selector]) => [name, selector(env)] as const)
-            .filter((entry): entry is [string, R2BucketLike] => Boolean(entry[1]));
-
-        if (extraEntries.length === 0) {
-            return this.makeStorage(env, declaration, defaultBucket, "default", origin);
-        }
-
-        const map: Record<string, Storage> = { default: this.makeStorage(env, declaration, defaultBucket, "default", origin) };
-
-        for (const [name, bucket] of extraEntries) {
-            map[name] = this.makeStorage(env, declaration, bucket, name, origin);
-        }
-
-        return createBucketStorage(map, { default: "default" });
-    }
-
-    /** Derive the studio file-browser admin functions from the same buckets \`.storage()\` declared. */
-    private buildStorageAdmin(env: Env): Partial<WorkerOptions> {
-        const declaration = this.storageDeclaration;
-
-        if (!declaration) {
-            return {};
-        }
-
-        const defaultBucket = declaration.bucket(env);
-
-        if (!defaultBucket) {
-            return {};
-        }
-
-        const bindings: Record<string, R2BucketLike> = { default: defaultBucket };
-
-        for (const [name, selector] of Object.entries(declaration.buckets ?? {})) {
-            const bucket = selector(env);
-
-            if (bucket) {
-                bindings[name] = bucket;
-            }
-        }
-
-        // \`Object.hasOwn\`, not a bare lookup: \`bindings\` is a plain object, so a
-        // prototype key (\`?bucket=constructor\`, \`__proto__\`, \`toString\`) resolves
-        // to an inherited Object.prototype member instead of the default bucket.
-        //
-        // \`origin\` is the base when no \`publicBaseUrl\` is declared: the origin the
-        // admin request reached the worker on, which the signed-URL route hands
-        // over and then verifies. Only the secret gates signing.
-        const pick = (name?: string, origin?: string): Storage => {
-            const wanted = name !== undefined && name !== "" ? name : "default";
-            const bucketName = Object.hasOwn(bindings, wanted) ? wanted : "default";
-
-            return this.makeStorage(env, declaration, bindings[bucketName] ?? defaultBucket, bucketName, origin);
-        };
-        const hasSigning = Boolean(declaration.signingSecret?.(env));
+            return this.makeStorage(env, declaration, bindings[bucketName] ?? defaultBucket, bucketName, origin);
+        };
+        const hasSigning = Boolean(declaration.signingSecret?.(env));
 
         return {
             storageBuckets: Object.keys(bindings),
@@ -415,7 +110,7 @@ ${e.voiceAgents.map(r=>`            ${JSON.stringify(r.exportName)}: (env as Rec
             storageUpload: (key: string, body: ArrayBuffer, opts?: { bucket?: string; contentType?: string; sha256?: string }) => pick(opts?.bucket).upload(key, body, opts),
         };
     }
-`:"",K=e=>e?`
+`:"",A=e=>e?`
 /**
  * Adapt the raw D1 binding to \`@lunora/d1\`'s \`D1Exec\` (reads via \`all\`, writes via \`run\`, and — when the binding exposes it — several writes in one round trip via \`batch\`).
  *
@@ -637,7 +332,312 @@ const buildGlobalCdcApplier =
 
         return request.changes.length;
     };
-`:"",V=e=>[...e.hasAuth?["AuthDeclaration"]:[],"ComposedApp",...e.hasGlobal?["GlobalDeclaration"]:[],"LunoraConfig",...e.hasScheduler?["SchedulerDeclaration"]:[],"Selector",...e.hasStorage?["StorageDeclaration"]:[]].toSorted((r,t)=>r.localeCompare(t)).join(", "),Z=e=>{const r=(e.hasVectors??!0)&&(e.vectorIndexCount??0)>0,t={...e,hasVectors:r},{hasAuth:a}=t,n=G(t),o=F(t),i=a?`        let auth: LunoraAuth | null = null;
+`:"",C=e=>[...e.hasStorage?["/** `.storage(...)` declaration — one bucket (required) plus optional extra named buckets and signed-URL config. Backs `ctx.storage` AND the studio file browser. */\ninterface StorageDeclaration<Env> {\n    /** The default R2 bucket binding (the bare `ctx.storage`). */\n    bucket: Selector<Env, R2BucketLike>;\n    /** Extra named buckets, reached via `ctx.storage.bucket(\"name\")` and the studio's bucket picker. */\n    buckets?: Record<string, Selector<Env, R2BucketLike>>;\n    /** Public base URL signed/public object URLs resolve against. Omit it and `ctx.storage` in a mutation, action or HTTP handler (and the studio's copy-URL) signs against the origin the request reached the worker on — no per-environment value to ship. Queries get no such fallback (a live query re-runs with no request behind it), so a query that signs URLs needs this set. */\n    publicBaseUrl?: Selector<Env, string>;\n    /** R2 S3-API credentials (`{ accountId, accessKeyId, secretAccessKey, bucket, jurisdiction? }`) enabling `ctx.storage.getPresignedUrl` — native S3 presigned URLs that hit R2 directly, bypassing the worker. Omit to use only the worker-signed `getSignedUrl` path. */\n    s3?: Selector<Env, R2S3Credentials>;\n    /** HMAC secret for signed URLs. */\n    signingSecret?: Selector<Env, string>;\n}"]:[],...e.hasScheduler?["/** `.scheduler(...)` declaration — the `SchedulerDO` namespace. Backs `ctx.scheduler` AND the studio's scheduled-jobs view. The origin its callbacks dispatch back to is not declared here: the DO reads `env.LUNORA_ORIGIN_URL` at fire time, because a caller-supplied dispatch target would be an SSRF vector. */\ninterface SchedulerDeclaration<Env> {\n    /** The `SchedulerDO` namespace binding (typically `env.SCHEDULER`). */\n    namespace: Selector<Env, DurableObjectNamespaceLike & ShardNamespaceLike>;\n}"]:[],...e.hasGlobal?["/** `.global(...)` declaration — the D1 binding backing `.global()` tables. Backs cross-tenant `ctx.db` reads/writes AND the studio's global data browser. */\ninterface GlobalDeclaration<Env> {\n    /** The D1 binding (typically `env.DB`). */\n    d1: Selector<Env, D1DatabaseLike>;\n    /** The worker origin used to fan reverse cross-backend relations across shards. Without it, such a relation throws a clear error. */\n    origin?: Selector<Env, string>;\n}"]:[],...e.hasHyperdriveGlobal?['/** `.hyperdriveGlobal(...)` declaration — backs `.global({ backend: "hyperdrive" })` tables on a Postgres/MySQL database via Hyperdrive. Stays reactive: the writer is injected as `globalDb` and the broadcast hook drives live queries. */\ninterface HyperdriveGlobalDeclaration<Env> {\n    /** The Hyperdrive engine — selects the Postgres or MySQL dialect. */\n    engine: HyperdriveEngine;\n    /** Build the `SqlExec` from `env` — e.g. `buildPgExec(fromPostgresJs(postgres(env.HYPERDRIVE.connectionString)))`. Cache the driver on the DO instance; rebuild lazily after hibernation. */\n    exec: (env: Env) => SqlExec;\n    /** The worker origin used to fan reverse cross-backend relations across shards. Without it, such a relation throws a clear error. */\n    origin?: Selector<Env, string>;\n}']:[],...e.hasAuth?['/** `.auth(...)` declaration — better-auth options plus the storage the adapter reads. Give it `d1` (the default) or `namespace` (a Durable Object that hosts the auth tables), never both. The builder owns the lazy build + `ensureMigrated` dance and wires `authHandler` / `resolveIdentity` / `authAdmin`. */\ninterface AuthDeclaration<Env> {\n    /** The D1 binding the auth SQL adapter is wired over (via `lunoraD1Adapter`). Omit only when using `namespace`. */\n    d1?: Selector<Env, unknown>;\n    /** Shared secret the worker presents on the object\'s internal session route. REQUIRED with `namespace`: the binding is reachable from any worker bound to it, so the secret — not the binding — is the authorization boundary. Without it identity resolution fails closed. */\n    internalSecret?: Selector<Env, string>;\n    /** Name of the Durable Object instance holding the auth tables. Defaults to `"auth"`. Set it to run separate auth objects (per deployment, per tenant) off one namespace. */\n    objectName?: Selector<Env, string>;\n    /** The auth Durable Object namespace — the DO-backed mode. Needed for `@better-auth/scim`, which requires native transactions that D1 has none of. The object owns the auth tables, so `/api/auth/*` and identity resolution both go through it. Typed as `AuthNamespaceLike` because `createDoAuthWiring` resolves through `idFromName` + `get` and has no `getByName` fallback — both members are load-bearing here, and `ShardNamespaceLike` leaves both optional. */\n    namespace?: Selector<Env, AuthNamespaceLike>;\n    /** Build the better-auth options from `env` (secret, plugins, email/password, …). */\n    options: (env: Env) => LunoraAuthOptions;\n}']:[]],O=e=>[...e.hasAccess?["    private accessSelector?: Selector<Env, CreateAccessResolverOptions | undefined>;"]:[],"    private adminToken?: Selector<Env, string>;",...e.hasAuth?["    private authDeclaration?: AuthDeclaration<Env>;"]:[],"    private cdcEnabled = false;","    private reactiveCacheConfig: boolean | { maxBytes?: number; maxEntries?: number } = false;",'    private maxRelationKeysLimit?: ShardConfig["maxRelationKeys"];','    private observabilitySink?: ShardConfig["observability"];','    private relationExistsPushDownMode?: ShardConfig["relationExistsPushDown"];',"    private readonly extendFns: ((env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>)[] = [];",...e.hasGlobal?["    private globalDeclaration?: GlobalDeclaration<Env>;"]:[],...e.hasHyperdriveGlobal?["    private hyperdriveGlobalDeclaration?: HyperdriveGlobalDeclaration<Env>;"]:[],"    private httpRouterApp?: HttpRouterLike;","    private readonly routeMap: Record<string, Route> = {};",...e.hasScheduler?["    private schedulerDeclaration?: SchedulerDeclaration<Env>;"]:[],...m(e)?["    private readonly shardExtras: Partial<ShardConfig> = {};"]:[],...d(e)?["    private shardRegistrySelector?: Selector<Env, ShardNamespaceLike>;"]:[],"    private shardSelector?: Selector<Env, ShardNamespaceLike>;",...e.hasSourcedTables?['    private sourceClientFactory?: NonNullable<ShardConfig["sourceClient"]>;']:[],...e.hasStorage?["    private storageDeclaration?: StorageDeclaration<Env>;"]:[]],T=e=>g(e).map(({configKey:r,doc:t,method:a})=>`    /** ${t} */
+    public ${a}(factory: (env: Env) => ReturnType<NonNullable<ShardConfig["${r}"]>>): this {
+        this.shardExtras.${r} = factory as NonNullable<ShardConfig["${r}"]>;
+
+        return this;
+    }`),N=e=>[...e.hasAccess?["    /** Wire Cloudflare Access (Zero Trust) — feeds the verified Access identity into `ctx.auth` / RLS via `resolveIdentity`. Call it with no argument when the Access policy is attached to the Worker (the identity arrives on the execution context; nothing to configure); pass `teamDomain` + `aud` for a hostname-scoped Access application, whose `Cf-Access-Jwt-Assertion` JWT is verified against your team JWKS. When `.auth(...)` is also configured, Access is composed ahead of it (Access wins when it authenticated the caller; everyone else falls through to the app session). */\n    public access(selector?: Selector<Env, CreateAccessResolverOptions>): this {\n        this.accessSelector = selector ?? (() => undefined);\n\n        return this;\n    }"]:[],`    /** Bearer token gating the \`/_lunora/admin/*\` endpoints the studio calls. */
+    public admin(selector: Selector<Env, string>): this {
+        this.adminToken = selector;
+
+        return this;
+    }`,"    /**\n     * Opt into change-data-capture: every write records a post-image to `__cdc_log` — on this shard AND, when the app has `.global()` tables, on the global backend. Backs streaming export, replay-PITR, and the `.global()` half of `defineShape` replication (whose poll tick asks the global changelog which tables moved). Off by default: it costs a changelog row per write, which an app using none of the above should not pay.\n     *\n     * REQUIRED for a shard-local `defineShape`: those replicate out of `__cdc_log`, and a `shape_subscribe` is refused with `SHAPE_REQUIRES_CDC` without it.\n     *\n     * It also changes how fresh a `.global()` shape is against writes made OUTSIDE `ctx.db` — an admin import, a PITR replay, an external ETL job, or a predicate over wall clock. With CDC off the poll re-reads every shape every 2s. With it on the poll asks the global changelog which tables moved and skips the rest, so a change the changelog never saw waits for the 30s unconditional resync instead. Writes through `ctx.db` are unaffected: they append, so the poll sees them on the next tick either way.\n     */\n    public cdc(enabled = true): this {\n        this.cdcEnabled = enabled;\n\n        return this;\n    }",`    /**
+     * Enable the per-shard reactive query cache: query results are memoized by \`(functionPath, args, identity)\` and invalidated by the ctx-db write hooks BEFORE the subscription broadcast, so a subscriber re-running its query always observes the post-write state.
+     *
+     * Off by default (every dispatch re-runs its handler). Pass an options object to tune the caps: \`maxEntries\` (default 1000) and \`maxBytes\` (default 4 MiB); either accepts \`Number.POSITIVE_INFINITY\` to disable that cap.
+     */
+    public reactiveCache(config: boolean | { maxBytes?: number; maxEntries?: number } = true): this {
+        this.reactiveCacheConfig = config;
+
+        return this;
+    }`,`    /** Ceiling on the join keys ONE relation-crossing \`where\` predicate may pre-resolve via semijoin before failing closed. Omit for the engine default. */
+    public maxRelationKeys(limit: NonNullable<ShardConfig["maxRelationKeys"]>): this {
+        this.maxRelationKeysLimit = limit;
+
+        return this;
+    }`,"    /**\n     * Route the shard's `ctx.log` lines, `ctx.trace` spans and `ctx.metrics` measurements to a telemetry sink.\n     *\n     * The DO half of observability: without it every in-handler signal stays in the shard's local ring buffer (the studio Logs panel) and reaches no collector. The worker half — one `onRpc` event per dispatched RPC — is a `createWorker` option; pass the SAME sink to both via `.extend((env) => ({ observability: sink(env) }))` to correlate them.\n     */\n    public observability(selector: NonNullable<ShardConfig[\"observability\"]>): this {\n        this.observabilitySink = selector;\n\n        return this;\n    }",'    /** Resolution policy for a relation-crossing `where` whose child is co-located in this shard: `"auto"` (cost-based, the engine default), `"always"` (inline correlated EXISTS) or `"never"` (universal semijoin). All three return identical rows. */\n    public relationExistsPushDown(mode: NonNullable<ShardConfig["relationExistsPushDown"]>): this {\n        this.relationExistsPushDownMode = mode;\n\n        return this;\n    }',...e.hasAuth?['    /** Wire better-auth — the builder lazily builds the instance, runs `ensureMigrated`, and dispatches `/api/auth/*` inside the worker (instrumented for the auth-failure SLO). Pass `d1` for the D1-backed default, or `namespace` + `internalSecret` to host the auth tables in a Durable Object (what `@better-auth/scim` needs). */\n    public auth(declaration: AuthDeclaration<Env>): this {\n        // Reject the ambiguous and the empty shapes here rather than at the first\n        // request: with neither storage set, auth would silently never answer, and\n        // with both it is unclear which one owns the tables.\n        if (declaration.d1 && declaration.namespace) {\n            throw new Error(".auth(): pass either `d1` or `namespace`, not both — they are two different homes for the same tables.");\n        }\n\n        if (!declaration.d1 && !declaration.namespace) {\n            throw new Error(".auth(): needs `d1` (D1-backed) or `namespace` (Durable-Object-backed) to know where the auth tables live.");\n        }\n\n        if (declaration.namespace && !declaration.internalSecret) {\n            throw new Error(\n                ".auth(): `namespace` requires `internalSecret` — the auth DO binding is reachable from any worker bound to it, so identity resolution is gated on a shared secret and would otherwise fail closed on every request.",\n            );\n        }\n\n        this.authDeclaration = declaration;\n\n        return this;\n    }']:[],"    /** Escape hatch — merge raw `WorkerOptions` (anything not yet sugared) over the derived options at build time. The second `derived` argument is a snapshot of the options assembled so far (after `.auth(...)` etc.), so you can compose rather than clobber — e.g. wrap `derived.resolveIdentity` instead of replacing it. */\n    public extend(fn: (env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>): this {\n        this.extendFns.push(fn);\n\n        return this;\n    }",...e.hasGlobal?[`    /** Back \`.global()\` (cross-tenant) tables with D1 — wires \`ctx.db\` routing, the studio global browser, and reverse cross-shard relations. */
+    public global(declaration: GlobalDeclaration<Env>): this {
+        this.globalDeclaration = declaration;
+
+        return this;
+    }`]:[],...e.hasHyperdriveGlobal?[`    /** Back \`.global({ backend: "hyperdrive" })\` tables with a Postgres/MySQL database via Hyperdrive — wires reactive \`ctx.db\` routing through the shared store core. */
+    public hyperdriveGlobal(declaration: HyperdriveGlobalDeclaration<Env>): this {
+        this.hyperdriveGlobalDeclaration = declaration;
+
+        return this;
+    }`]:[],`    /** Cloudflare Email Routing entry — exposes the top-level \`email\` handler. */
+    public onEmail(handler: (env: Env) => (message: unknown, env: unknown, context: ExecutionContextLike) => Promise<void>): this {
+        this.emailHandler = handler;
+
+        return this;
+    }`,"    /** Mount a whole HTTP app (`httpRouter()` from `@lunora/server`, or anything with a `fetch`) ahead of Lunora's own routes. Use this for a multi-endpoint hono app with its own CORS + error handling; `.route()` is for one-off endpoints. */\n    public httpRouter(app: HttpRouterLike): this {\n        this.httpRouterApp = app;\n\n        return this;\n    }",`    /** Mount a custom HTTP route (e.g. an asset-serving or test endpoint). Key is \`"METHOD path"\`, \`"path"\`, or a path prefix matched by the runtime. */
+    public route(key: string, handler: Route): this {
+        this.routeMap[key] = handler;
+
+        return this;
+    }`,...e.hasScheduler?[`    /** Wire the \`SchedulerDO\` — backs \`ctx.scheduler\` and the studio's scheduled-jobs view. */
+    public scheduler(declaration: SchedulerDeclaration<Env>): this {
+        this.schedulerDeclaration = declaration;
+
+        return this;
+    }`]:[],`    /** The shard Durable Object namespace (typically \`env.SHARD\`) — required: every app routes RPC + WebSocket traffic through it. */
+    public shard(selector: Selector<Env, ShardNamespaceLike>): this {
+        this.shardSelector = selector;
+
+        return this;
+    }`,...d(e)?["    /** The `ShardRegistryDO` namespace (typically `env.SHARD_REGISTRY`). Each shard registers itself for the `.shardBy()` tables it writes, and cross-shard export, CDC sync and migrations fan out to the shards it lists. Without it they refuse a `.shardBy()` table. */\n    public shardRegistry(selector: Selector<Env, ShardNamespaceLike>): this {\n        this.shardRegistrySelector = selector;\n\n        return this;\n    }"]:[],...e.hasSourcedTables?[`    /** Resolve the SQL client a \`.source(...)\` table's ingest poll reads from, given the wrangler Hyperdrive binding it named. Build it with \`@lunora/hyperdrive\`'s \`createHyperdrive\` plus your driver adapter. REQUIRED for a sourced table: without it every poll tick records "no sourceClient resolved for binding" and the table stays empty. */
+    public sourceClient(factory: (env: Env, binding: string) => ReturnType<NonNullable<ShardConfig["sourceClient"]>>): this {
+        this.sourceClientFactory = factory as NonNullable<ShardConfig["sourceClient"]>;
+
+        return this;
+    }`]:[],...e.hasStorage?[`    /** Wire R2 storage — backs \`ctx.storage\` (incl. multi-bucket) and the studio file browser, from one declaration. */
+    public storage(declaration: StorageDeclaration<Env>): this {
+        this.storageDeclaration = declaration;
+
+        return this;
+    }`]:[],...T(e)],q=e=>{const r=a=>e.hasScheduler?`
+                              ...(this.schedulerDeclaration ? { scheduler: this.resolveScheduler(env) as unknown as ${a}["scheduler"] } : {}),`:"",t=["            cdc: this.cdcEnabled,","            reactiveCache: this.reactiveCacheConfig,","            ...(this.maxRelationKeysLimit === undefined ? {} : { maxRelationKeys: this.maxRelationKeysLimit }),","            ...(this.observabilitySink === undefined ? {} : { observability: this.observabilitySink }),","            ...(this.relationExistsPushDownMode === undefined ? {} : { relationExistsPushDown: this.relationExistsPushDownMode }),",...e.hasGlobal?[`            ...(this.globalDeclaration
+                ? {
+                      d1: (rawEnv: Record<string, unknown>, request?: { bookmark?: string; cdc?: boolean; cdcRetentionMs?: number; identity?: Record<string, unknown>; onBookmark?: (bookmark: string | undefined) => void; userId?: string | null }) => {
+                          const env = rawEnv as Env;
+                          const database = this.globalDeclaration?.d1(env);
+
+                          if (!database) {
+                              return undefined;
+                          }
+
+                          const origin = this.globalDeclaration?.origin?.(env);
+                          const crossShard = origin
+                              ? createCrossShardRelationCapabilities({ identity: request?.identity, origin, userId: request?.userId ?? undefined })
+                              : undefined;
+
+                          return createD1CtxDb({
+                              ...(crossShard ? { crossShardCounter: crossShard.crossShardCounter, crossShardReader: crossShard.crossShardReader } : {}),${r("D1CtxDbOptions")}
+                              ...(request?.cdcRetentionMs === undefined ? {} : { cdcRetentionMs: request.cdcRetentionMs }),
+                              auth: { identity: request?.identity ?? null, userId: request?.userId ?? null },
+                              // Forwarded from the shard's own \`cdc\` config, so ONE
+                              // switch governs both changelogs. Built without it, the
+                              // global \`__cdc_log\` is never written and the shape
+                              // poll's changed-tables fast path is unreachable.
+                              cdc: request?.cdc ?? false,
+                              exec: buildExec(database, request?.bookmark, request?.onBookmark),
+                              // The binding outlives this per-request writer, so the
+                              // provisioning sweep runs once per isolate rather than
+                              // once per request. See \`SqlCtxDbOptions.provisionScope\`.
+                              provisionScope: database,
+                              schema: schema as unknown as D1CtxDbOptions["schema"],
+                          });
+                      },
+                  }
+                : {}),`]:[],...e.hasHyperdriveGlobal?[`            ...(this.hyperdriveGlobalDeclaration
+                ? {
+                      hyperdriveGlobal: (rawEnv: Record<string, unknown>, request?: { cdc?: boolean; cdcRetentionMs?: number; identity?: Record<string, unknown>; userId?: string | null }) => {
+                          const env = rawEnv as Env;
+                          const declaration = this.hyperdriveGlobalDeclaration;
+                          const exec = declaration?.exec(env) as SqlExec | undefined;
+
+                          if (!declaration || !exec) {
+                              return undefined;
+                          }
+
+                          const origin = declaration.origin?.(env);
+                          const crossShard = origin
+                              ? createCrossShardRelationCapabilities({ identity: request?.identity, origin, userId: request?.userId ?? undefined })
+                              : undefined;
+
+                          return createHyperdriveGlobalCtxDb({
+                              ...(crossShard ? { crossShardCounter: crossShard.crossShardCounter, crossShardReader: crossShard.crossShardReader } : {}),${r("SqlCtxDbOptions")}
+                              ...(request?.cdcRetentionMs === undefined ? {} : { cdcRetentionMs: request.cdcRetentionMs }),
+                              auth: { identity: request?.identity ?? null, userId: request?.userId ?? null },
+                              // See the D1 twin: one \`cdc\` switch, both changelogs.
+                              cdc: request?.cdc ?? false,
+                              engine: declaration.engine as HyperdriveEngine,
+                              exec,
+                              // The DECLARATION, not \`exec\` — \`exec(env)\` is a user
+                              // callback that builds a fresh client per call, so scoping
+                              // to its result would key the memo on a new object every
+                              // request and never share anything. The declaration is
+                              // built once and names one database.
+                              provisionScope: declaration,
+                              schema: schema as unknown as SqlCtxDbOptions["schema"],
+                          });
+                      },
+                  }
+                : {}),`]:[],...e.hasScheduler?[`            ...(this.schedulerDeclaration
+                ? {
+                      scheduler: (rawEnv: Record<string, unknown>) => this.resolveScheduler(rawEnv as Env),
+                  }
+                : {}),`]:[],...d(e)?["            ...(this.shardRegistrySelector ? { shardRegistry: (rawEnv: Record<string, unknown>) => this.shardRegistrySelector?.(rawEnv as Env) } : {}),"]:[],...e.hasSourcedTables?["            ...(this.sourceClientFactory === undefined ? {} : { sourceClient: this.sourceClientFactory }),"]:[],...e.hasStorage?["            ...(this.storageDeclaration ? { storage: (rawEnv: Record<string, unknown>, origin?: string) => this.resolveStorage(rawEnv as Env, origin) } : {}),"]:[],...m(e)?["            ...this.shardExtras,"]:[]];return t.length>0?`
+${t.join(`
+`)}
+        `:""},I=e=>e?['import * as lunoraIdentityContract from "../identity.js";']:[],L=(e,r)=>e?['import type { CreateAccessResolverOptions } from "@lunora/cloudflare-access";',`import { createAccessResolver${r?", composeResolvers":""} } from "@lunora/cloudflare-access";`]:[],j=e=>e?['import { createKvIntrospectorFromEnv } from "@lunora/bindings/kv";']:[],G=e=>e?['import { createVectorAdminIntrospector } from "@lunora/bindings/vectors";']:[],B=e=>e?['import type { D1CtxDbOptions, D1DatabaseLike, D1Exec } from "@lunora/d1";','import { applyCdcChanges, createD1CtxDb, emitD1QueryCost, exportGlobalRows, facetGlobalColumn, importGlobalRows, listGlobalTables, readD1CdcChanges, readGlobalTablePage, retryingExec } from "@lunora/d1";']:[],P=e=>e?['import notifyConfig from "../notify.js";']:[],W=e=>v(e)?['import { dispatchAgentEmail } from "@lunora/agent/inbound";']:[],_=e=>v(e)?['import * as lunoraAgentDefinitions from "../agents.js";']:[],$=e=>{const{hasFramework:r,hasGlobal:t,hasHyperdriveGlobal:a,hasQueue:n,useUmbrella:o}=e,i=o?"lunorash/runtime":"@lunora/runtime",l=["ExecutionContextLike","HttpRouterLike","LunoraWorker","Route","ScheduledControllerLike","ShardNamespaceLike","WorkerOptions",...n?["TriggerTrace"]:[],...t?["GlobalIntrospector"]:[],...e.tables.length>0?["ShardingInfo"]:[],...r?["FrameworkHostHandler"]:[]],c=[...t||a?["createCrossShardRelationCapabilities"]:[],...d(e)?["createDynamicShardRegistry","createQueryCoordinator"]:[],"createWorker",...e.jurisdiction?["declareAppJurisdiction"]:[],"resolveLogArchiveFromEnv",...r?["withFrameworkWorker"]:[]].join(", ");return[`import type { ${[...l].toSorted((s,h)=>s.localeCompare(h)).join(", ")} } from "${i}";`,`import { ${c} } from "${i}";`]},H=e=>{const{hasAccess:r,hasAuth:t,hasGlobal:a,hasHyperdriveGlobal:n,hasKvIntrospector:o,hasQueue:i,hasScheduler:l,hasStorage:c,hasWorkflow:s,wantsOpenApi:h,wantsOpenRpc:u}=e;return[...t?['import type { AuthNamespaceLike, LunoraAuth, LunoraAuthOptions } from "@lunora/auth";','import { authDiscoveryPathsFor, createAuth, createAuthAdmin, createAuthAuditReader, createDoAuthWiring, d1Executor, ensureMigrated, handleAuthDiscoveryRequest, handleAuthRequest, lunoraD1Adapter } from "@lunora/auth";']:[],...L(r,t),...B(a),...n?['import type { HyperdriveEngine } from "@lunora/hyperdrive/global";','import { createHyperdriveGlobalCtxDb } from "@lunora/hyperdrive/global";','import type { SqlCtxDbOptions, SqlExec } from "@lunora/sql-store";']:[],...j(o),...G(e.hasVectors),...l?['import type { DurableObjectNamespaceLike } from "@lunora/scheduler";','import { createScheduler } from "@lunora/scheduler";']:[],...c?['import type { R2BucketLike, R2S3Credentials, Storage } from "@lunora/storage";','import { createBucketStorage, createStorage } from "@lunora/storage";']:[],...s?['import { createWorkflowsRestClient } from "@lunora/workflow";']:[],...W(e),...$(e),"",...I(e.identity),..._(e),...a||n?['import schema from "../schema.js";']:[],...P(e.hasNotify),'import { LUNORA_CRONS } from "./crons.js";','import { LUNORA_FUNCTIONS } from "./functions.js";',...i?['import { createQueueCaptureSink, dispatchQueueBatch, shouldCaptureQueue } from "@lunora/queue";','import { LUNORA_QUEUE_REGISTRY } from "./queues.js";']:[],...e.wantsArchitecture?['import { architecture } from "./architecture.js";']:[],...h?['import { openApiSpec } from "./openapi.js";']:[],...u?['import { openRpcSpec } from "./openrpc.js";']:[],'import { createShardDO } from "./shard.js";',...e.hasVectors?['import { LUNORA_VECTOR_INDEXES } from "./vectors.js";']:[]]},U=e=>e.jurisdiction&&e.jurisdictionPinsAuth===!0?`
+                // The schema's jurisdiction pins the auth object like every other DO.
+                jurisdiction: ${JSON.stringify(e.jurisdiction)},`:"",F=e=>typeof e=="string"?`{ mode: { kind: ${JSON.stringify(e)} } }`:`{ mode: { field: ${JSON.stringify(e.field)}, kind: "shardBy" } }`,M=e=>[...e.tables.length>0?[`        const tableSharding = new Map<string, ShardingInfo>([
+${e.tables.map(r=>`            [${JSON.stringify(r.name)}, ${F(r.shardMode)}],`).join(`
+`)}
+        ]);
+
+        options.listSchemaTables = () => [...tableSharding.keys()];
+        options.resolveTableSharding = (table) => tableSharding.get(table);`]:[],...d(e)?[`        const shardRegistry = this.shardRegistrySelector?.(env);
+
+        if (shardRegistry) {
+            options.queryCoordinator = createQueryCoordinator({ registry: createDynamicShardRegistry({ ${e.jurisdiction?`jurisdiction: ${JSON.stringify(e.jurisdiction)}, `:""}namespace: shardRegistry }) });
+        }`]:[]],Q=e=>[...M(e),...e.hasScheduler?[`        if (this.schedulerDeclaration) {
+            options.schedulerDO = this.schedulerDeclaration.namespace(env);
+        }`]:[],...e.hasWorkflow?[`        options.workflowsClient = (workflowEnv) => {
+            const source = workflowEnv as Record<string, unknown>;
+            const accountId = source["CLOUDFLARE_ACCOUNT_ID"];
+            const apiToken = source["CLOUDFLARE_API_TOKEN"];
+
+            return typeof accountId === "string" && accountId !== "" && typeof apiToken === "string" && apiToken !== ""
+                ? createWorkflowsRestClient({ accountId, apiToken })
+                : undefined;
+        };`]:[],...e.hasGlobal?[`        if (this.globalDeclaration) {
+            const database = this.globalDeclaration.d1(env);
+
+            if (database) {
+                options.globalIntrospector = buildGlobalIntrospector(database);
+                // \`importGlobals\` wires the admin bulk-import endpoint's global
+                // plane: the rows \`resolveTableSharding\` classifies as \`.global()\`
+                // land here, and without it they are reported, not written.
+                options.importGlobals = buildGlobalImporter(database, this.cdcEnabled);
+                // The read/replay half of the same admin plane. Each one is the
+                // only reason its endpoint can see the global storage plane at
+                // all, and every one of them fails SILENTLY when unset — export
+                // and \`lunora backup create\` answer 200 having written only
+                // shard-local rows (an export→import round trip then restores
+                // cleanly minus every global row), CDC sync answers with only
+                // shard changes, and point-in-time apply reports
+                // \`globalApplied: 0\`. Nothing here is project-specific either.
+                options.exportGlobals = buildGlobalExporter(database);
+                options.syncGlobals = buildGlobalCdcSync(database);
+                options.applyGlobals = buildGlobalCdcApplier(database, this.cdcEnabled);
+            }
+        }`]:[],...e.hasStorage?[`        if (this.storageDeclaration) {
+            Object.assign(options, this.buildStorageAdmin(env));
+            options.storage = (rawEnv: unknown, origin?: string) => this.resolveStorage(rawEnv as Env, origin);
+        }`]:[],...e.hasKvIntrospector?["        options.kvIntrospector = createKvIntrospectorFromEnv(env);"]:[],...e.hasVectors?[`        if (this.shardExtras.vectors) {
+            options.vectorIntrospector = createVectorAdminIntrospector({
+                indexes: this.shardExtras.vectors(env as unknown as Record<string, unknown>),
+                registry: LUNORA_VECTOR_INDEXES,
+            });
+        } else {
+            // Emitted only when the schema declares an index, so reaching here
+            // means the app declared one and never bound it. The studio's
+            // Vectors tab is on (its flag is the same index count) and every
+            // request to it would answer VECTORS_NOT_CONFIGURED, while
+            // \`ctx.vectors\` is the throwing stub — so this is already broken,
+            // just later and less legibly. Same shape as \`.auth()\`'s guards.
+            throw new Error(
+                ".vectors(): the schema declares vector index(es) but no binding map was chained. Pass \`.vectors((env) => ({ <indexName>: env.<BINDING> }))\` so \`ctx.vectors\` resolves and the studio's Vectors tab can list them.",
+            );
+        }`]:[],...e.hasNotify?["        options.notifySubscriptionStore = notifyConfig.store ? notifyConfig.store(env as Record<string, unknown>) : undefined;"]:[],"        options.logArchive = resolveLogArchiveFromEnv(env);",...e.hasAuth?[`        // Captured before the branch so the narrowing survives — reading
+        // \`this.authDeclaration.namespace\` again below would be optional all over again.
+        const authDeclaration = this.authDeclaration;
+        const authNamespace = authDeclaration?.namespace;
+        const authD1 = authDeclaration?.d1;
+
+        if (authDeclaration && authNamespace) {
+            // DO-backed mode. The auth tables live inside the object and DO storage is
+            // unreachable from here, so better-auth runs in there and this worker talks
+            // to it. \`createDoAuthWiring\` is a tested function in \`@lunora/auth\` rather
+            // than more emitted code: request-path logic in generated output can only be
+            // typechecked, never unit-tested.
+            const authWiring = createDoAuthWiring({
+                // The OAuth discovery documents (an \`mcp()\` resource's metadata, the
+                // issuer's) are derived here from the declared options, so the worker
+                // forwards only those exact paths and no other probe reaches the object.
+                // Memoised on the declaration: a framework-hosted worker rebuilds these
+                // options per request, and \`options(env)\` rebuilds every plugin.
+                discoveryPaths: authDiscoveryPathsFor(authDeclaration, env),
+                internalSecret: authDeclaration.internalSecret?.(env),${U(e)}
+                namespace: authNamespace(env),
+                objectName: authDeclaration.objectName?.(env),
+            });
+
+            options.authHandler = authWiring.authHandler;
+            options.authDiscoveryHandler = authWiring.discoveryHandler;
+            options.resolveIdentity = authWiring.resolveIdentity;
+            // The audit log lives in the object like every other auth table, so the feed
+            // reads through it rather than querying D1.
+            options.authAuditReader = authWiring.auditReader;
+            // Set only once auth is pinned to a jurisdiction: copies the users left in the
+            // un-pinned object across (\`__lunora_admin__:copyAuthToJurisdiction\`).
+            options.authJurisdictionMove = authWiring.jurisdictionMove;
+            // \`authAdmin\` stays D1-only: its ~30 methods read the auth tables directly
+            // from the worker, which DO storage does not allow. The studio's auth pages
+            // therefore report "not configured" in this mode rather than silently
+            // returning empty data.
+        } else if (authDeclaration && authD1) {
+            options.authHandler = (request) => {
+                const auth = getAuth();
+
+                return auth ? handleAuthRequest(auth, request) : Promise.resolve(undefined);
+            };
+            // The OAuth discovery documents outside \`/api/auth\` (served only with an
+            // \`mcp()\` or \`oauthProvider()\` plugin, and only after the app's own routes).
+            options.authDiscoveryHandler = (request) => {
+                const auth = getAuth();
+
+                return auth ? handleAuthDiscoveryRequest(auth, request) : Promise.resolve(undefined);
+            };
+            options.resolveIdentity = async (request) => {
+                const auth = getAuth();
+
+                if (!auth) {
+                    return null;
+                }
+
+                const session = await auth.api.getSession({ headers: (request as Request).headers });
+
+                if (!session?.user?.id) {
+                    return null;
+                }
+
+                // \`role\` rides along so \`rls(policies, { roles })\` and \`auth.can(...)\`
+                // work on this wiring without a hand-written resolver. better-auth's
+                // \`admin()\` plugin owns that column (comma-joined for multiple roles)
+                // and only an administrator can write it; it is absent when the plugin
+                // is off, which reads as no roles.
+                //
+                // \`expiresAtMs\` is the socket credential expiry the runtime forwards
+                // as \`x-lunora-identity-exp\`. Without it the DO's expiry check never
+                // fires, so a signed-out, banned or lapsed user keeps streaming their
+                // RLS-scoped rows over an already-open WebSocket while every HTTP call
+                // is anonymous. better-auth hands back a \`Date\`; anything else means
+                // the adapter did not hydrate it, and omitting beats guessing.
+                const expiresAt = session.session.expiresAt;
+                // \`email\` and \`name\` are the claims \`ctx.auth.getIdentity()\` is
+                // documented to carry ("email, name, roles, custom claims"). Without
+                // them the documented \`me\` query — \`identity?.email\` — resolves
+                // \`undefined\` on the built-in wiring. Empty strings are dropped so an
+                // absent claim reads as absent rather than as "".
+                const user = session.user as { email?: unknown; name?: unknown; role?: unknown };
+
+                return {
+                    ...(typeof user.email === "string" && user.email.length > 0 ? { email: user.email } : {}),
+                    ...(expiresAt instanceof Date ? { expiresAtMs: expiresAt.getTime() } : {}),
+                    ...(typeof user.name === "string" && user.name.length > 0 ? { name: user.name } : {}),
+                    role: user.role,
+                    userId: session.user.id,
+                };
+            };
+            const authInstance = getAuth();
+
+            options.authAdmin = authInstance ? createAuthAdmin(authInstance) : undefined;
+            options.authAuditReader = createAuthAuditReader(d1Executor(authD1(env) as never));
+        }`]:[],...e.hasAccess?[e.hasAuth?`        if (this.accessSelector) {
+            const accessResolver = createAccessResolver(this.accessSelector(env));
+            const fallback = options.resolveIdentity;
+
+            options.resolveIdentity = fallback ? composeResolvers(accessResolver, fallback) : accessResolver;
+        }`:`        if (this.accessSelector) {
+            options.resolveIdentity = createAccessResolver(this.accessSelector(env));
+        }`]:[],...e.voiceAgents&&e.voiceAgents.length>0?[`        options.voiceAgents = {
+${e.voiceAgents.map(r=>`            ${JSON.stringify(r.exportName)}: (env as Record<string, unknown>)[${JSON.stringify(r.bindingName)}] as ShardNamespaceLike,`).join(`
+`)}
+        };`]:[]],J=e=>["            cronJobs: LUNORA_CRONS,","            functions: LUNORA_FUNCTIONS,",...e.identity?[`            identity: lunoraIdentityContract.${e.identity.exportName},`]:[],...e.jurisdiction?[`            jurisdiction: ${JSON.stringify(e.jurisdiction)},`]:[],...e.wantsArchitecture?["            architecture,"]:[],...e.wantsOpenApi?["            openApiSpec,"]:[],...e.wantsOpenRpc?["            openRpcSpec,"]:[],...e.hasQueue?["            queue: (batch: unknown, queueEnv: unknown, _context: ExecutionContextLike, trigger: TriggerTrace): Promise<void> =>","                dispatchQueueBatch(batch as Parameters<typeof dispatchQueueBatch>[0], LUNORA_QUEUE_REGISTRY, {","                    capture: shouldCaptureQueue(queueEnv as Record<string, unknown>)",`                        ? createQueueCaptureSink(queueEnv as Record<string, unknown>${e.jurisdiction?`, { jurisdiction: ${JSON.stringify(e.jurisdiction)} }`:""})`,"                        : undefined,","                    env: queueEnv as Record<string, unknown>,","                    traceparent: trigger.traceparent,","                }),"]:[],"            ...(this.httpRouterApp ? { httpRouter: this.httpRouterApp } : {}),","            routes: this.routeMap,","            shardDO: this.shardSelector?.(env) ?? (undefined as unknown as ShardNamespaceLike),"],K=e=>[...e.hasAuth?["AuthDeclaration"]:[],"ComposedApp",...e.hasGlobal?["GlobalDeclaration"]:[],"LunoraConfig",...e.hasScheduler?["SchedulerDeclaration"]:[],"Selector",...e.hasStorage?["StorageDeclaration"]:[]].toSorted((r,t)=>r.localeCompare(t)).join(", "),X=e=>{const r=(e.hasVectors??!0)&&(e.vectorIndexCount??0)>0,t={...e,hasVectors:r},{hasAuth:a}=t,n=C(t),o=Q(t),i=a?`        let auth: LunoraAuth | null = null;
         let authInit: Promise<void> | null = null;
 `:"",l=a?`
         const initAuth = async (env: Env): Promise<void> => {
@@ -698,7 +698,7 @@ ${p.map(b=>`            { agent: lunoraAgentDefinitions.${b.exportName}, classNa
 `:"",w=`    /** Materialise the standalone Cloudflare worker + \`ShardDO\` class. */
     public build(): ComposedApp {
         return this.assemble();
-    }${t.hasFramework?"\n\n    /** Compose Lunora's realtime plane INTO a meta-framework's Cloudflare handler (SvelteKit/Astro/Nuxt). The framework `host` serves everything except the reserved `/_lunora/*` endpoints; pass the adapter-emitted worker (e.g. SvelteKit's `_worker.js`, Astro's `handle`). */\n    public buildFrameworkWorker(host: FrameworkHostHandler): ComposedApp {\n        return this.assemble(host);\n    }":""}`;return`${E}${j(t).join(`
+    }${t.hasFramework?"\n\n    /** Compose Lunora's realtime plane INTO a meta-framework's Cloudflare handler (SvelteKit/Astro/Nuxt). The framework `host` serves everything except the reserved `/_lunora/*` endpoints; pass the adapter-emitted worker (e.g. SvelteKit's `_worker.js`, Astro's `handle`). */\n    public buildFrameworkWorker(host: FrameworkHostHandler): ComposedApp {\n        return this.assemble(host);\n    }":""}`;return`${E}${H(t).join(`
 `)}
 
 /** Read a value off the per-request \`env\`. Returns \`undefined\` to leave the capability unconfigured (its \`ctx.*\`/admin surface stays a clear-error stub). */
@@ -731,12 +731,12 @@ interface ComposedApp extends LunoraWorker {
  * first request so per-isolate singletons are built once.
  */
 class AppBuilder<Env extends object> {
-${B(t).join(`
+${O(t).join(`
 `)}
 
     private emailHandler?: (env: Env) => (message: unknown, env: unknown, context: ExecutionContextLike) => Promise<void>;
 
-${W(t).join(`
+${N(t).join(`
 
 `)}
 
@@ -744,7 +744,7 @@ ${w}
 
     /** Build the shard DO + compose the worker (standalone or framework-hosted), wrapping the lazy per-isolate singletons + auth init. */
     private assemble(${y}): ComposedApp {
-        const ShardDO = createShardDO({${_(t)}});
+        const ShardDO = createShardDO({${q(t)}});
 
         // Per-isolate singletons: the worker (and auth instance) are expensive to
         // build, so the first request constructs them and every later request on
@@ -798,11 +798,11 @@ ${t.hasFramework?`
 `:""}
         return composed;
     }
-${Q(t)}${J(t.hasStorage)}
+${R(t)}${x(t.hasStorage)}
     /** Fan the recorded declarations into the worker-side \`createWorker\` options. */
     private buildWorkerOptions(env: Env, ${h}): WorkerOptions {
         const options: WorkerOptions = {
-${M(t).join(`
+${J(t).join(`
 `)}
         };
 
@@ -821,7 +821,7 @@ ${o.join(`
         return options;
     }
 }
-${K(t.hasGlobal)}
+${A(t.hasGlobal)}
 /**
  * Shape of the project's root \`lunora.config.*\`.
  *
@@ -856,5 +856,5 @@ interface LunoraConfig<Env extends object = object> {
 const defineApp = <Env extends object>(): AppBuilder<Env> => new AppBuilder<Env>();
 
 export { AppBuilder, defineApp };
-export type { ${V(t)} };
-`};export{Z as emitApp};
+export type { ${K(t)} };
+`};export{X as emitApp};