@lunora/codegen 1.0.0-alpha.3 → 1.0.0-alpha.30

package/dist/packem_shared/{discoverSchema-BBulgGbH.mjs → discoverSchema-CeXJWVKV.mjs}

@@ -1,6 +1,213 @@
-import { SyntaxKind, Node } from 'ts-morph';
-import { diagnosticAt } from './CodegenDiagnosticError-54jWDxA9.mjs';
-import { a as parseObjectShape } from './parse-validator-tuQtHrsr.mjs';
+import { LunoraError } from '@lunora/errors';
+import { Node, SyntaxKind } from 'ts-morph';
+import { diagnosticAt } from './CodegenDiagnosticError-DyQ5FwkM.mjs';
+import { a as parseObjectShape } from './parse-validator-D6zI2i85.mjs';
+import { createRequire } from 'node:module';
+import { join } from 'node:path';
+
+const renderLiteralValue = (value) => {
+  switch (typeof value) {
+    case "bigint": {
+      return value.toString();
+    }
+    case "boolean":
+    case "number": {
+      return String(value);
+    }
+    case "string": {
+      return JSON.stringify(value);
+    }
+    default: {
+      return value === null ? "null" : void 0;
+    }
+  }
+};
+const columnMetaToIR = (column) => {
+  const hasDefault = column?.["defaultValue"] !== void 0 || column?.["defaultFn"] !== void 0 || column?.["serverDefault"] !== void 0;
+  return {
+    ...hasDefault ? { hasDefault: true } : {},
+    ...column?.["onUpdateFn"] === void 0 ? {} : { hasOnUpdate: true },
+    notNull: column?.["notNull"] ?? true,
+    ...column?.["unique"] === true ? { unique: true } : {}
+  };
+};
+const runtimeValidatorToIR = (validator) => {
+  const meta = validator?._meta ?? {};
+  const kind = validator?.kind ?? "unknown";
+  const ir = { column: columnMetaToIR(meta["column"]), kind };
+  switch (kind) {
+    case "array":
+    case "optional": {
+      ir.inner = runtimeValidatorToIR(meta["inner"]);
+      break;
+    }
+    case "id": {
+      ir.tableName = meta["tableName"];
+      break;
+    }
+    case "literal": {
+      ir.literalValue = renderLiteralValue(meta["value"]);
+      break;
+    }
+    case "object": {
+      const shape = meta["shape"] ?? {};
+      ir.shape = Object.fromEntries(Object.entries(shape).map(([name, child]) => [name, runtimeValidatorToIR(child)]));
+      break;
+    }
+    case "record": {
+      ir.valueType = runtimeValidatorToIR(meta["valueValidator"]);
+      if (meta["keyValidator"] !== void 0) {
+        ir.keyType = runtimeValidatorToIR(meta["keyValidator"]);
+      }
+      break;
+    }
+    case "storage": {
+      if (typeof meta["bucket"] === "string") {
+        ir.bucket = meta["bucket"];
+      }
+      break;
+    }
+    case "union": {
+      const members = meta["members"] ?? [];
+      ir.members = members.map((member) => runtimeValidatorToIR(member));
+      break;
+    }
+  }
+  return ir;
+};
+const shardModeToIR = (shardMode) => {
+  if (shardMode?.kind === "global") {
+    return "global";
+  }
+  if (shardMode?.kind === "shardBy" && typeof shardMode.field === "string") {
+    return { field: shardMode.field, kind: "shardBy" };
+  }
+  return "root";
+};
+const warnDroppedTableFeatures = (builder, bareName) => {
+  const dropped = [];
+  if (builder.relationMap && Object.keys(builder.relationMap).length > 0) {
+    dropped.push("relations");
+  }
+  if (builder.rankIndexes && builder.rankIndexes.length > 0) {
+    dropped.push("rank indexes");
+  }
+  if (builder.vectorIndexes && builder.vectorIndexes.length > 0) {
+    dropped.push("vector indexes");
+  }
+  if (dropped.length > 0) {
+    console.warn(
+      `@lunora/codegen: package schema-extension table "${bareName}" declares ${dropped.join(" + ")}, which are not yet introspected from a node_modules extension — they will be absent from the generated types.`
+    );
+  }
+};
+const runtimeTableToIR = (builder, bareName) => {
+  const shape = builder.shape ?? {};
+  const indexes = (builder.indexes ?? []).map((index) => {
+    return { fields: index.fields, name: index.name, ...index.unique ? { unique: true } : {} };
+  });
+  warnDroppedTableFeatures(builder, bareName);
+  return {
+    ...builder.isExternallyManaged ? { externallyManaged: true } : {},
+    indexes,
+    name: bareName,
+    rankIndexes: [],
+    relations: [],
+    searchIndexes: (builder.searchIndexes ?? []).map((index) => {
+      return {
+        field: index.field,
+        ...index.filterFields ? { filterFields: index.filterFields } : {},
+        name: index.name
+      };
+    }),
+    shape: Object.fromEntries(Object.entries(shape).map(([name, validator]) => [name, runtimeValidatorToIR(validator)])),
+    shardMode: shardModeToIR(builder.shardMode),
+    // Inline vector/rank indexes and relations are not yet introspected from a
+    // package extension; their presence is surfaced via `warnDroppedTableFeatures`.
+    vectorIndexes: []
+  };
+};
+const resolvedExtensionToIR = (value) => {
+  const { key, tables } = value;
+  if (typeof key !== "string" || typeof tables !== "object" || tables === null) {
+    return void 0;
+  }
+  const bareTables = Object.entries(tables).map(([bareName, builder]) => runtimeTableToIR(builder, bareName));
+  const vectorIndexes = value["vectorIndexes"] ?? {};
+  const bareVectorIndexes = Object.entries(vectorIndexes ?? {}).map(([name, index]) => {
+    return {
+      ...index.dimensions === void 0 ? {} : { dimensions: index.dimensions },
+      ...index.field === void 0 ? {} : { field: index.field },
+      ...index.metadata === void 0 ? {} : { metadata: index.metadata },
+      ...index.metric === void 0 ? {} : { metric: index.metric },
+      name,
+      table: index.table ?? ""
+    };
+  });
+  return { bareTables, bareVectorIndexes, key };
+};
+const receiverIdentifierText = (argument) => {
+  if (Node.isIdentifier(argument)) {
+    return argument.getText();
+  }
+  if (Node.isPropertyAccessExpression(argument)) {
+    const receiver = argument.getExpression();
+    return Node.isIdentifier(receiver) ? receiver.getText() : void 0;
+  }
+  return void 0;
+};
+const accessPathOf = (argument) => {
+  const receiverName = receiverIdentifierText(argument);
+  if (receiverName === void 0) {
+    return void 0;
+  }
+  const property = Node.isPropertyAccessExpression(argument) ? argument.getName() : void 0;
+  const propertyPath = property === void 0 ? [] : [property];
+  for (const declaration of argument.getSourceFile().getImportDeclarations()) {
+    const moduleSpecifier = declaration.getModuleSpecifierValue();
+    for (const named of declaration.getNamedImports()) {
+      const localName = named.getAliasNode()?.getText() ?? named.getName();
+      if (localName === receiverName) {
+        return { importedName: named.getName(), moduleSpecifier, propertyPath };
+      }
+    }
+    if (declaration.getDefaultImport()?.getText() === receiverName) {
+      return { importedName: "default", moduleSpecifier, propertyPath };
+    }
+    if (declaration.getNamespaceImport()?.getText() === receiverName && property !== void 0) {
+      return { importedName: property, moduleSpecifier, propertyPath: [] };
+    }
+  }
+  return void 0;
+};
+const readExtensionValue = (module_, access) => {
+  let current = module_[access.importedName];
+  for (const segment of access.propertyPath) {
+    if (typeof current !== "object" || current === null) {
+      return void 0;
+    }
+    current = current[segment];
+  }
+  return current;
+};
+const resolvePackageExtension = (argument, projectRoot) => {
+  const access = accessPathOf(argument);
+  if (!access) {
+    return void 0;
+  }
+  try {
+    const projectRequire = createRequire(join(projectRoot, "noop.cjs"));
+    const resolved = projectRequire.resolve(access.moduleSpecifier);
+    const loadedModule = projectRequire(resolved);
+    const value = readExtensionValue(loadedModule, access);
+    if (typeof value !== "object" || value === null) {
+      return void 0;
+    }
+    return resolvedExtensionToIR(value);
+  } catch {
+    return void 0;
+  }
+};
 
 const VECTOR_METRICS = /* @__PURE__ */ new Set(["cosine", "dot-product", "euclidean"]);
 const ON_DELETE_ACTIONS = /* @__PURE__ */ new Set(["cascade", "restrict", "set null"]);
@@ -179,6 +386,54 @@ const parseGlobalBackend = (args) => {
   }
   return "d1";
 };
+const softDeleteFieldOf = (optionsArgument) => {
+  if (optionsArgument && Node.isObjectLiteralExpression(optionsArgument)) {
+    const fieldProperty = optionsArgument.getProperty("field");
+    if (fieldProperty && Node.isPropertyAssignment(fieldProperty)) {
+      const initializer = fieldProperty.getInitializer();
+      if (initializer && Node.isStringLiteral(initializer)) {
+        return initializer.getLiteralText();
+      }
+    }
+  }
+  return "deletedAt";
+};
+const stringPropertyOf = (object, property) => {
+  const node = object.getProperty(property);
+  if (node && Node.isPropertyAssignment(node)) {
+    const initializer = node.getInitializer();
+    if (initializer && Node.isStringLiteral(initializer)) {
+      return initializer.getLiteralText();
+    }
+  }
+  return void 0;
+};
+const stringArrayPropertyOf = (object, property) => {
+  const node = object.getProperty(property);
+  if (node && Node.isPropertyAssignment(node)) {
+    const initializer = node.getInitializer();
+    if (initializer && Node.isArrayLiteralExpression(initializer)) {
+      const items = initializer.getElements().filter((element) => Node.isStringLiteral(element)).map((element) => element.getLiteralText());
+      return items.length > 0 ? items : void 0;
+    }
+  }
+  return void 0;
+};
+const parseSourceCall = (args) => {
+  const first = args[0];
+  if (!first || !Node.isObjectLiteralExpression(first)) {
+    return { binding: "", hasTenantBy: false, unanalyzable: true };
+  }
+  return {
+    binding: stringPropertyOf(first, "binding") ?? "",
+    columns: stringArrayPropertyOf(first, "columns"),
+    hasReconcile: first.getProperty("reconcileEveryMs") !== void 0,
+    hasTenantBy: first.getProperty("tenantBy") !== void 0,
+    idColumn: stringPropertyOf(first, "idColumn"),
+    mode: stringPropertyOf(first, "mode"),
+    query: stringPropertyOf(first, "query")
+  };
+};
 const applyTableMethod = (accumulator, method, args, name) => {
   switch (method) {
     case "externallyManaged": {
@@ -194,6 +449,10 @@ const applyTableMethod = (accumulator, method, args, name) => {
       accumulator.indexes.push(parseIndexCall(args));
       break;
     }
+    case "public": {
+      accumulator.isPublic = true;
+      break;
+    }
     case "rankIndex": {
       accumulator.rankIndexes.push(parseRankIndexCall(args));
       break;
@@ -214,6 +473,15 @@ const applyTableMethod = (accumulator, method, args, name) => {
       accumulator.shardMode = { field: field && Node.isStringLiteral(field) ? field.getLiteralText() : "_unknown_", kind: "shardBy" };
       break;
     }
+    case "softDelete": {
+      accumulator.softDelete = { field: softDeleteFieldOf(args[0]) };
+      break;
+    }
+    case "source": {
+      accumulator.externalSource = parseSourceCall(args);
+      accumulator.externallyManaged = true;
+      break;
+    }
     case "vectorize": {
       const vectorIndex = parseVectorizeCall(args, name);
       if (vectorIndex) {
@@ -227,6 +495,7 @@ const parseTableBuilder = (expression, name) => {
   const accumulator = {
     externallyManaged: false,
     indexes: [],
+    isPublic: false,
     rankIndexes: [],
     relations: [],
     searchIndexes: [],
@@ -251,16 +520,22 @@ const parseTableBuilder = (expression, name) => {
       break;
     }
   }
+  if (accumulator.softDelete && !(accumulator.softDelete.field in shape)) {
+    shape = { ...shape, [accumulator.softDelete.field]: { inner: { kind: "number" }, kind: "optional" } };
+  }
   return {
     externallyManaged: accumulator.externallyManaged,
+    externalSource: accumulator.externalSource,
     globalBackend: accumulator.shardMode === "global" ? accumulator.globalBackend ?? "d1" : void 0,
     indexes: accumulator.indexes,
+    isPublic: accumulator.isPublic,
     name,
     rankIndexes: accumulator.rankIndexes,
     relations: accumulator.relations,
     searchIndexes: accumulator.searchIndexes,
     shape,
     shardMode: accumulator.shardMode,
+    softDelete: accumulator.softDelete,
     vectorIndexes: accumulator.vectorIndexes
   };
 };
@@ -354,7 +629,27 @@ const extensionTargetIdentifier = (argument) => {
     return argument;
   }
   if (Node.isPropertyAccessExpression(argument)) {
-    return argument.getNameNode();
+    const receiver = argument.getExpression();
+    return Node.isIdentifier(receiver) ? receiver : void 0;
+  }
+  return void 0;
+};
+const pluginConfigObject = (expression) => {
+  if (Node.isObjectLiteralExpression(expression)) {
+    return expression;
+  }
+  if (Node.isCallExpression(expression)) {
+    const callee = expression.getExpression();
+    let name;
+    if (Node.isIdentifier(callee)) {
+      name = callee.getText();
+    } else if (Node.isPropertyAccessExpression(callee)) {
+      name = callee.getName();
+    }
+    if (name === "definePlugin") {
+      const configArgument = expression.getArguments()[1];
+      return configArgument && Node.isObjectLiteralExpression(configArgument) ? configArgument : void 0;
+    }
   }
   return void 0;
 };
@@ -363,8 +658,9 @@ const nextExpressionFromDeclaration = (declaration, argument) => {
   if (!initializer) {
     return void 0;
   }
-  if (Node.isPropertyAccessExpression(argument) && Node.isObjectLiteralExpression(initializer)) {
-    return objectPropertyInitializer(initializer, argument.getName());
+  if (Node.isPropertyAccessExpression(argument)) {
+    const configObject = pluginConfigObject(initializer);
+    return configObject ? objectPropertyInitializer(configObject, argument.getName()) : void 0;
   }
   return initializer;
 };
@@ -434,24 +730,30 @@ const parseExtensionVectorIndexes = (options) => {
   }
   return parseStandaloneVectorIndexes(object);
 };
-const mergeExtension = (key, options) => {
-  const bareTables = parseExtensionTables(options);
+const namespaceExtension = (key, bareTables, bareVectorIndexes) => {
   const bareNames = new Set(bareTables.map((table) => table.name));
   const tables = bareTables.map((table) => namespaceExtensionTable(table, key, bareNames));
-  const vectorIndexes = parseExtensionVectorIndexes(options).map((index) => {
+  const vectorIndexes = bareVectorIndexes.map((index) => {
     return { ...index, name: prefixTableName(key, index.name), table: rewriteReference(index.table, key, bareNames) };
   });
   return { tables, vectorIndexes };
 };
-const mergeExtendCall = (extendCall) => {
+const mergeExtension = (key, options) => namespaceExtension(key, parseExtensionTables(options), parseExtensionVectorIndexes(options));
+const mergeExtendCall = (extendCall, projectRoot) => {
   const extendArgument = extendCall.getArguments()[0];
   if (!extendArgument) {
     return void 0;
   }
   const resolved = resolveSchemaExtensionCall(extendArgument);
   if (!resolved) {
+    if (projectRoot !== void 0) {
+      const fromPackage = resolvePackageExtension(extendArgument, projectRoot);
+      if (fromPackage) {
+        return namespaceExtension(fromPackage.key, fromPackage.bareTables, fromPackage.bareVectorIndexes);
+      }
+    }
     console.warn(
-      `@lunora/codegen: skipping \`.extend(${extendArgument.getText()})\` — its \`defineSchemaExtension(...)\` definition could not be resolved from local sources (cross-package node_modules/.d.ts resolution is a deferred phase). Extension tables will be absent from the generated types.`
+      `@lunora/codegen: skipping \`.extend(${extendArgument.getText()})\` — its \`defineSchemaExtension(...)\` could not be resolved from local sources, and ${projectRoot === void 0 ? "no project root was available to resolve the package" : "the package could not be imported/introspected"}. Extension tables will be absent from the generated types.`
     );
     return void 0;
   }
@@ -481,6 +783,36 @@ const extendCallsOf = (defineSchemaCall) => {
   }
   return calls;
 };
+const chainedStringLiteralArgument = (defineSchemaCall, methodName, noun, allowed, expected) => {
+  let current = defineSchemaCall;
+  for (; ; ) {
+    const parent = current.getParent();
+    if (!parent || !Node.isPropertyAccessExpression(parent)) {
+      break;
+    }
+    const callParent = parent.getParent();
+    if (!callParent || !Node.isCallExpression(callParent)) {
+      break;
+    }
+    if (parent.getName() === methodName) {
+      const argument = callParent.getArguments()[0];
+      if (!argument || !Node.isStringLiteral(argument)) {
+        throw diagnosticAt(callParent, `\`.${methodName}(...)\` expects a string literal (${expected})`);
+      }
+      const value = argument.getLiteralText();
+      if (!allowed.has(value)) {
+        throw diagnosticAt(argument, `unknown ${noun} ${JSON.stringify(value)} — expected ${expected}`);
+      }
+      return value;
+    }
+    current = callParent;
+  }
+  return void 0;
+};
+const JURISDICTIONS = /* @__PURE__ */ new Set(["eu", "fedramp", "us"]);
+const jurisdictionOf = (defineSchemaCall) => chainedStringLiteralArgument(defineSchemaCall, "jurisdiction", "jurisdiction", JURISDICTIONS, '"eu", "us", or "fedramp"');
+const RLS_MODES = /* @__PURE__ */ new Set(["required"]);
+const rlsModeOf = (defineSchemaCall) => chainedStringLiteralArgument(defineSchemaCall, "rls", "rls mode", RLS_MODES, '"required"');
 const parseBaseTables = (object) => {
   const tables = [];
   for (const property of object.getProperties()) {
@@ -496,11 +828,11 @@ const parseBaseTables = (object) => {
   }
   return tables;
 };
-const applyExtensions = (defineSchemaCall, tables) => {
+const applyExtensions = (defineSchemaCall, tables, projectRoot) => {
   const existingTableNames = new Set(tables.map((table) => table.name));
   const vectorIndexes = [];
   for (const extendCall of extendCallsOf(defineSchemaCall)) {
-    const merged = mergeExtendCall(extendCall);
+    const merged = mergeExtendCall(extendCall, projectRoot);
     if (!merged) {
       continue;
     }
@@ -518,14 +850,14 @@ const applyExtensions = (defineSchemaCall, tables) => {
   }
   return vectorIndexes;
 };
-const discoverSchema = (project, schemaPath) => {
+const discoverSchema = (project, schemaPath, projectRoot) => {
   const file = project.addSourceFileAtPath(schemaPath);
   const defineSchemaCall = file.getDescendantsOfKind(SyntaxKind.CallExpression).find((call) => {
     const callee = call.getExpression();
     return Node.isIdentifier(callee) && callee.getText() === "defineSchema";
   });
   if (!defineSchemaCall) {
-    throw new Error(`defineSchema() not found in ${schemaPath}`);
+    throw new LunoraError("INTERNAL", `defineSchema() not found in ${schemaPath}`);
   }
   const argument = defineSchemaCall.getArguments()[0];
   if (!argument || !Node.isObjectLiteralExpression(argument)) {
@@ -534,9 +866,9 @@ const discoverSchema = (project, schemaPath) => {
   const tables = parseBaseTables(argument);
   const standaloneArgument = defineSchemaCall.getArguments()[1];
   const standaloneVectorIndexes = standaloneArgument && Node.isObjectLiteralExpression(standaloneArgument) ? parseStandaloneVectorIndexes(standaloneArgument) : [];
-  const extensionStandaloneVectorIndexes = applyExtensions(defineSchemaCall, tables);
+  const extensionStandaloneVectorIndexes = applyExtensions(defineSchemaCall, tables, projectRoot);
   const vectorIndexes = [...tables.flatMap((table) => table.vectorIndexes), ...standaloneVectorIndexes, ...extensionStandaloneVectorIndexes];
-  return { tables, vectorIndexes };
+  return { jurisdiction: jurisdictionOf(defineSchemaCall), rlsMode: rlsModeOf(defineSchemaCall), tables, vectorIndexes };
 };
 
 export { discoverSchema as default };

package/dist/packem_shared/{discoverStorageRulesMetadata-DAqJUxUv.mjs → discoverStorageRulesMetadata-CFHByjIl.mjs}

@@ -1,5 +1,5 @@
 import { Node } from 'ts-morph';
-import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall } from './discoverFunctions-DEgAcRuD.mjs';
+import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall } from './discoverFunctions-BJdF7lRs.mjs';
 
 const STORAGE_OPERATIONS = /* @__PURE__ */ new Set(["delete", "list", "read", "write"]);
 const isStorageRulesCall = (node) => {

package/dist/packem_shared/{emitApp-CzSxVDaG.mjs → emitApp-DKt3rPtr.mjs}

@@ -1,4 +1,4 @@
-import { GENERATED_HEADER } from './GENERATED_HEADER-CuLyj0WQ.mjs';
+import { GENERATED_HEADER } from './GENERATED_HEADER-f6nMvllu.mjs';
 
 const LONG_TAIL = [
   ["hasAi", "ai", "ai", "Override the Workers AI binding backing `ctx.ai` (defaults to `env.AI`)."],
@@ -22,8 +22,28 @@ const LONG_TAIL = [
   ["hasVectors", "vectors", "vectors", "Wire the Vectorize index map backing `ctx.vectors`."]
 ];
 const hasAnyLongTail = (options) => LONG_TAIL.some(([flag]) => options[flag]);
+const buildIdentityImports = (identity) => identity ? [`import * as lunoraIdentityContract from "../identity.js";`] : [];
+const buildAccessImports = (hasAccess, hasAuth) => hasAccess ? [
+  `import type { CreateAccessResolverOptions } from "@lunora/cloudflare-access";`,
+  `import { createAccessResolver${hasAuth ? ", composeResolvers" : ""} } from "@lunora/cloudflare-access";`
+] : [];
+const buildKvImports = (hasKv) => hasKv ? [`import { createKvIntrospectorFromEnv } from "@lunora/bindings/kv";`] : [];
 const buildImportLines = (options) => {
-  const { hasAuth, hasFramework, hasGlobal, hasHyperdriveGlobal, hasScheduler, hasStorage, hasWorkflow, useUmbrella, wantsOpenApi, wantsOpenRpc } = options;
+  const {
+    hasAccess,
+    hasAuth,
+    hasFramework,
+    hasGlobal,
+    hasHyperdriveGlobal,
+    hasKv,
+    hasQueue,
+    hasScheduler,
+    hasStorage,
+    hasWorkflow,
+    useUmbrella,
+    wantsOpenApi,
+    wantsOpenRpc
+  } = options;
   const runtimeModule = useUmbrella ? "lunorash/runtime" : "@lunora/runtime";
   const runtimeTypeImports = ["ExecutionContextLike", "LunoraWorker", "Route", "ScheduledControllerLike", "ShardNamespaceLike", "WorkerOptions"];
   if (hasGlobal) {
@@ -42,6 +62,7 @@ const buildImportLines = (options) => {
       `import type { LunoraAuth, LunoraAuthOptions } from "@lunora/auth";`,
       `import { createAuth, createAuthAdmin, ensureMigrated, handleAuthRequest, lunoraD1Adapter } from "@lunora/auth";`
     ] : [],
+    ...buildAccessImports(hasAccess, hasAuth),
     ...hasGlobal ? [
       `import type { D1CtxDbOptions, D1DatabaseLike, D1Exec } from "@lunora/d1";`,
       `import { createD1CtxDb, facetGlobalColumn, listGlobalTables, readGlobalTablePage } from "@lunora/d1";`
@@ -51,15 +72,18 @@ const buildImportLines = (options) => {
       `import { createHyperdriveGlobalCtxDb } from "@lunora/hyperdrive/global";`,
       `import type { SqlCtxDbOptions, SqlExec } from "@lunora/sql-store";`
     ] : [],
+    ...buildKvImports(hasKv),
     ...hasScheduler ? [`import type { DurableObjectNamespaceLike } from "@lunora/scheduler";`, `import { createScheduler } from "@lunora/scheduler";`] : [],
     ...hasStorage ? [`import type { R2BucketLike, Storage } from "@lunora/storage";`, `import { createBucketStorage, createStorage } from "@lunora/storage";`] : [],
     ...hasWorkflow ? [`import { createWorkflowsRestClient } from "@lunora/workflow";`] : [],
     `import type { ${[...runtimeTypeImports].toSorted((a, b) => a.localeCompare(b)).join(", ")} } from "${runtimeModule}";`,
     `import { ${runtimeValueImports} } from "${runtimeModule}";`,
     ``,
+    ...buildIdentityImports(options.identity),
     ...hasGlobal || hasHyperdriveGlobal ? [`import schema from "../schema.js";`] : [],
     `import { LUNORA_CRONS } from "./crons.js";`,
     `import { LUNORA_FUNCTIONS } from "./functions.js";`,
+    ...hasQueue ? [`import { dispatchQueueBatch } from "@lunora/queue";`, `import { LUNORA_QUEUE_REGISTRY } from "./queues.js";`] : [],
     ...wantsOpenApi ? [`import { openApiSpec } from "./openapi.js";`] : [],
     ...wantsOpenRpc ? [`import { openRpcSpec } from "./openrpc.js";`] : [],
     `import { createShardDO } from "./shard.js";`
@@ -119,9 +143,10 @@ interface AuthDeclaration<Env> {
   ] : []
 ];
 const buildFieldLines = (options) => [
+  ...options.hasAccess ? [`    private accessSelector?: Selector<Env, CreateAccessResolverOptions>;`] : [],
   `    private adminToken?: Selector<Env, string>;`,
   ...options.hasAuth ? [`    private authDeclaration?: AuthDeclaration<Env>;`] : [],
-  `    private readonly extendFns: ((env: Env) => Partial<WorkerOptions>)[] = [];`,
+  `    private readonly extendFns: ((env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>)[] = [];`,
   ...options.hasGlobal ? [`    private globalDeclaration?: GlobalDeclaration<Env>;`] : [],
   ...options.hasHyperdriveGlobal ? [`    private hyperdriveGlobalDeclaration?: HyperdriveGlobalDeclaration<Env>;`] : [],
   `    private readonly routeMap: Record<string, Route> = {};`,
@@ -139,6 +164,14 @@ const buildLongTailMethods = (options) => LONG_TAIL.filter(([flag]) => options[f
     }`
 );
 const buildMethodBlocks = (options) => [
+  ...options.hasAccess ? [
+    `    /** Wire Cloudflare Access (Zero Trust) — verifies the \`Cf-Access-Jwt-Assertion\` JWT and feeds the identity into \`ctx.auth\` / RLS via \`resolveIdentity\`. When \`.auth(...)\` is also configured, Access is composed ahead of it (Access wins when its JWT is present; everyone else falls through to the app session). */
+    public access(selector: Selector<Env, CreateAccessResolverOptions>): this {
+        this.accessSelector = selector;
+
+        return this;
+    }`
+  ] : [],
   `    /** Bearer token gating the \`/_lunora/admin/*\` endpoints the studio calls. */
     public admin(selector: Selector<Env, string>): this {
         this.adminToken = selector;
@@ -153,8 +186,8 @@ const buildMethodBlocks = (options) => [
         return this;
     }`
   ] : [],
-  `    /** Escape hatch — merge raw \`WorkerOptions\` (anything not yet sugared) over the derived options at build time. */
-    public extend(fn: (env: Env) => Partial<WorkerOptions>): this {
+  `    /** Escape hatch — merge raw \`WorkerOptions\` (anything not yet sugared) over the derived options at build time. The second \`derived\` argument is a snapshot of the options assembled so far (after \`.auth(...)\` etc.), so you can compose rather than clobber — e.g. wrap \`derived.resolveIdentity\` instead of replacing it. */
+    public extend(fn: (env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>): this {
         this.extendFns.push(fn);
 
         return this;
@@ -274,7 +307,7 @@ const buildShardFactoryBody = (options) => {
                           const namespace = this.schedulerDeclaration?.namespace(env);
                           const origin = this.schedulerDeclaration?.origin?.(env);
 
-                          return namespace && origin ? createScheduler({ namespace, originUrl: origin }) : undefined;
+                          return namespace && origin ? createScheduler({${options.jurisdiction ? ` jurisdiction: ${JSON.stringify(options.jurisdiction)},` : ""} namespace, originUrl: origin }) : undefined;
                       },
                   }
                 : {}),`
@@ -321,6 +354,12 @@ const buildWorkerOptionLines = (options) => [
             Object.assign(options, this.buildStorageAdmin(env));
         }`
   ] : [],
+  // The studio's KV browser is wired zero-config: `createKvIntrospectorFromEnv`
+  // scans `env` for every bound Workers KV namespace, so each `kv_namespaces`
+  // entry in wrangler.jsonc appears under its binding name (any name, any count)
+  // with no manual `createKvIntrospector` call. A deployment with no KV binding
+  // yields an empty namespace list rather than crashing.
+  ...options.hasKv ? [`        options.kvIntrospector = createKvIntrospectorFromEnv(env);`] : [],
   ...options.hasAuth ? [
     `        if (this.authDeclaration) {
             options.authHandler = (request) => {
@@ -343,13 +382,45 @@ const buildWorkerOptionLines = (options) => [
 
             options.authAdmin = authInstance ? createAuthAdmin(authInstance) : undefined;
         }`
+  ] : [],
+  // Cloudflare Access — runs AFTER the auth block so it can compose ahead of
+  // the better-auth resolver rather than clobber it. With `.auth()` present,
+  // a request carrying a verified Access JWT is authenticated by Access and
+  // everyone else falls through to the app session; without it, Access is the
+  // sole resolver.
+  ...options.hasAccess ? [
+    options.hasAuth ? `        if (this.accessSelector) {
+            const accessResolver = createAccessResolver(this.accessSelector(env));
+            const fallback = options.resolveIdentity;
+
+            options.resolveIdentity = fallback ? composeResolvers(accessResolver, fallback) : accessResolver;
+        }` : `        if (this.accessSelector) {
+            options.resolveIdentity = createAccessResolver(this.accessSelector(env));
+        }`
   ] : []
 ];
 const buildBaseWorkerOptions = (options) => [
   `            cronJobs: LUNORA_CRONS,`,
   `            functions: LUNORA_FUNCTIONS,`,
+  // The declared `defineIdentity(...)` contract — wires the runtime trust
+  // boundary so `wrapResolverWithContract` validates every resolved identity
+  // against it before it becomes `ctx.auth`. Emitted only when the app declares
+  // a contract, so apps without one keep unchanged output.
+  ...options.identity ? [`            identity: lunoraIdentityContract.${options.identity.exportName},`] : [],
+  // Schema `.jurisdiction("…")` pins every DO the worker reaches to the
+  // Cloudflare data-residency region. Emitted only when declared, so apps
+  // without it keep the un-pinned global namespace (and unchanged output).
+  ...options.jurisdiction ? [`            jurisdiction: ${JSON.stringify(options.jurisdiction)},`] : [],
   ...options.wantsOpenApi ? [`            openApiSpec,`] : [],
   ...options.wantsOpenRpc ? [`            openRpcSpec,`] : [],
+  // The push-consumer handler backing the worker's `queue(batch, …)` entry:
+  // routes each delivered batch to its `defineQueue` handler. Built from
+  // `@lunora/queue` here (keeping the runtime decoupled) and wired only when the
+  // app declares push queues in `lunora/queues.ts`.
+  ...options.hasQueue ? [
+    `            queue: (batch: unknown, queueEnv: unknown, _context: ExecutionContextLike): Promise<void> =>`,
+    `                dispatchQueueBatch(batch as Parameters<typeof dispatchQueueBatch>[0], LUNORA_QUEUE_REGISTRY, { env: queueEnv as Record<string, unknown> }),`
+  ] : [],
   `            routes: this.routeMap,`,
   `            shardDO: this.shardSelector?.(env) ?? (undefined as unknown as ShardNamespaceLike),`
 ];
@@ -558,7 +629,12 @@ ${buildWorkerLine}
                 worker ??= buildWorker(rawEnv as Env);
 
                 return worker.serverQuery(request, rawEnv, reference, args, options);
-            },
+            },${options.hasQueue ? `
+            queue: async (batch: unknown, rawEnv: unknown, context: ExecutionContextLike): Promise<void> => {
+                worker ??= buildWorker(rawEnv as Env);
+
+                return worker.queue?.(batch, rawEnv, context);
+            },` : ""}
         };
 
         if (this.emailHandler) {
@@ -581,7 +657,7 @@ ${buildBaseWorkerOptions(options).join("\n")}
         }
 
 ${workerOptionLines.join("\n\n")}${workerOptionLines.length > 0 ? "\n\n" : ""}        for (const fn of this.extendFns) {
-            Object.assign(options, fn(env));
+            Object.assign(options, fn(env, { ...options }));
         }
 
         return options;