@lunora/codegen 1.0.0-alpha.304 → 1.0.0-alpha.306

package/dist/packem_shared/{emitApp-CJe2L06A.mjs → emitApp-BOUdd-2R.mjs}

@@ -1,4 +1,4 @@
-import{APP_METHOD_CAPABILITIES as k}from"./CAPABILITY_PROBES-brcmKenl.mjs";import{i as S}from"./schema-BgM8A3XV.mjs";import{G as E}from"./shared-DnCokNcE.mjs";const D={configKey:"vectors",doc:"Wire the Vectorize index map backing `ctx.vectors`.",method:"vectors"},g=e=>[...k.filter(({key:r})=>e.capabilities.has(r)).map(({appMethod:r})=>r),...e.hasVectors?[D]:[]],m=e=>g(e).length>0,v=e=>(e.emailAgents?.length??0)>0,d=e=>e.tables.some(r=>S(r)),R=e=>e.hasScheduler?`
+import{APP_METHOD_CAPABILITIES as k}from"./CAPABILITY_PROBES-brcmKenl.mjs";import{i as S}from"./schema-BgM8A3XV.mjs";import{G as E}from"./shared-DnCokNcE.mjs";const D={configKey:"vectors",doc:"Wire the Vectorize index map backing `ctx.vectors`.",method:"vectors"},m=e=>[...k.filter(({key:r})=>e.capabilities.has(r)).map(({appMethod:r})=>r),...e.hasVectors?[D]:[]],g=e=>m(e).length>0,v=e=>(e.emailAgents?.length??0)>0,d=e=>e.tables.some(r=>S(r)),R=e=>e.hasScheduler?`
     /** Resolve the \`SchedulerDO\`-backed scheduler for this env; \`undefined\` until the namespace is wired. */
     private resolveScheduler(env: Env): ReturnType<typeof createScheduler> | undefined {
         const namespace = this.schedulerDeclaration?.namespace(env);
@@ -332,7 +332,7 @@ const buildGlobalCdcApplier =
 
         return request.changes.length;
     };
-`:"",C=e=>[...e.hasStorage?["/** `.storage(...)` declaration — one bucket (required) plus optional extra named buckets and signed-URL config. Backs `ctx.storage` AND the studio file browser. */\ninterface StorageDeclaration<Env> {\n    /** The default R2 bucket binding (the bare `ctx.storage`). */\n    bucket: Selector<Env, R2BucketLike>;\n    /** Extra named buckets, reached via `ctx.storage.bucket(\"name\")` and the studio's bucket picker. */\n    buckets?: Record<string, Selector<Env, R2BucketLike>>;\n    /** Public base URL signed/public object URLs resolve against. Omit it and `ctx.storage` in a mutation, action or HTTP handler (and the studio's copy-URL) signs against the origin the request reached the worker on — no per-environment value to ship. Queries get no such fallback (a live query re-runs with no request behind it), so a query that signs URLs needs this set. */\n    publicBaseUrl?: Selector<Env, string>;\n    /** R2 S3-API credentials (`{ accountId, accessKeyId, secretAccessKey, bucket, jurisdiction? }`) enabling `ctx.storage.getPresignedUrl` — native S3 presigned URLs that hit R2 directly, bypassing the worker. Omit to use only the worker-signed `getSignedUrl` path. */\n    s3?: Selector<Env, R2S3Credentials>;\n    /** HMAC secret for signed URLs. */\n    signingSecret?: Selector<Env, string>;\n}"]:[],...e.hasScheduler?["/** `.scheduler(...)` declaration — the `SchedulerDO` namespace. Backs `ctx.scheduler` AND the studio's scheduled-jobs view. The origin its callbacks dispatch back to is not declared here: the DO reads `env.LUNORA_ORIGIN_URL` at fire time, because a caller-supplied dispatch target would be an SSRF vector. */\ninterface SchedulerDeclaration<Env> {\n    /** The `SchedulerDO` namespace binding (typically `env.SCHEDULER`). */\n    namespace: Selector<Env, DurableObjectNamespaceLike & ShardNamespaceLike>;\n}"]:[],...e.hasGlobal?["/** `.global(...)` declaration — the D1 binding backing `.global()` tables. Backs cross-tenant `ctx.db` reads/writes AND the studio's global data browser. */\ninterface GlobalDeclaration<Env> {\n    /** The D1 binding (typically `env.DB`). */\n    d1: Selector<Env, D1DatabaseLike>;\n    /** The worker origin used to fan reverse cross-backend relations across shards. Without it, such a relation throws a clear error. */\n    origin?: Selector<Env, string>;\n}"]:[],...e.hasHyperdriveGlobal?['/** `.hyperdriveGlobal(...)` declaration — backs `.global({ backend: "hyperdrive" })` tables on a Postgres/MySQL database via Hyperdrive. Stays reactive: the writer is injected as `globalDb` and the broadcast hook drives live queries. */\ninterface HyperdriveGlobalDeclaration<Env> {\n    /** The Hyperdrive engine — selects the Postgres or MySQL dialect. */\n    engine: HyperdriveEngine;\n    /** Build the `SqlExec` from `env` — e.g. `buildPgExec(fromPostgresJs(postgres(env.HYPERDRIVE.connectionString)))`. Cache the driver on the DO instance; rebuild lazily after hibernation. */\n    exec: (env: Env) => SqlExec;\n    /** The worker origin used to fan reverse cross-backend relations across shards. Without it, such a relation throws a clear error. */\n    origin?: Selector<Env, string>;\n}']:[],...e.hasAuth?['/** `.auth(...)` declaration — better-auth options plus the storage the adapter reads. Give it `d1` (the default) or `namespace` (a Durable Object that hosts the auth tables), never both. The builder owns the lazy build + `ensureMigrated` dance and wires `authHandler` / `resolveIdentity` / `authAdmin`. */\ninterface AuthDeclaration<Env> {\n    /** The D1 binding the auth SQL adapter is wired over (via `lunoraD1Adapter`). Omit only when using `namespace`. */\n    d1?: Selector<Env, unknown>;\n    /** Shared secret the worker presents on the object\'s internal session route. REQUIRED with `namespace`: the binding is reachable from any worker bound to it, so the secret — not the binding — is the authorization boundary. Without it identity resolution fails closed. */\n    internalSecret?: Selector<Env, string>;\n    /** Name of the Durable Object instance holding the auth tables. Defaults to `"auth"`. Set it to run separate auth objects (per deployment, per tenant) off one namespace. */\n    objectName?: Selector<Env, string>;\n    /** The auth Durable Object namespace — the DO-backed mode. Needed for `@better-auth/scim`, which requires native transactions that D1 has none of. The object owns the auth tables, so `/api/auth/*` and identity resolution both go through it. Typed as `AuthNamespaceLike` because `createDoAuthWiring` resolves through `idFromName` + `get` and has no `getByName` fallback — both members are load-bearing here, and `ShardNamespaceLike` leaves both optional. */\n    namespace?: Selector<Env, AuthNamespaceLike>;\n    /** Build the better-auth options from `env` (secret, plugins, email/password, …). */\n    options: (env: Env) => LunoraAuthOptions;\n}']:[]],O=e=>[...e.hasAccess?["    private accessSelector?: Selector<Env, CreateAccessResolverOptions | undefined>;"]:[],"    private adminToken?: Selector<Env, string>;",...e.hasAuth?["    private authDeclaration?: AuthDeclaration<Env>;"]:[],"    private cdcEnabled = false;","    private reactiveCacheConfig: boolean | { maxBytes?: number; maxEntries?: number } = false;",'    private maxRelationKeysLimit?: ShardConfig["maxRelationKeys"];','    private observabilitySink?: ShardConfig["observability"];','    private relationExistsPushDownMode?: ShardConfig["relationExistsPushDown"];',"    private readonly extendFns: ((env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>)[] = [];",...e.hasGlobal?["    private globalDeclaration?: GlobalDeclaration<Env>;"]:[],...e.hasHyperdriveGlobal?["    private hyperdriveGlobalDeclaration?: HyperdriveGlobalDeclaration<Env>;"]:[],"    private httpRouterApp?: HttpRouterLike;","    private readonly routeMap: Record<string, Route> = {};",...e.hasScheduler?["    private schedulerDeclaration?: SchedulerDeclaration<Env>;"]:[],...m(e)?["    private readonly shardExtras: Partial<ShardConfig> = {};"]:[],...d(e)?["    private shardRegistrySelector?: Selector<Env, ShardNamespaceLike>;"]:[],"    private shardSelector?: Selector<Env, ShardNamespaceLike>;",...e.hasSourcedTables?['    private sourceClientFactory?: NonNullable<ShardConfig["sourceClient"]>;']:[],...e.hasStorage?["    private storageDeclaration?: StorageDeclaration<Env>;"]:[]],T=e=>g(e).map(({configKey:r,doc:t,method:a})=>`    /** ${t} */
+`:"",C=e=>[...e.hasStorage?["/** `.storage(...)` declaration — one bucket (required) plus optional extra named buckets and signed-URL config. Backs `ctx.storage` AND the studio file browser. */\ninterface StorageDeclaration<Env> {\n    /** The default R2 bucket binding (the bare `ctx.storage`). */\n    bucket: Selector<Env, R2BucketLike>;\n    /** Extra named buckets, reached via `ctx.storage.bucket(\"name\")` and the studio's bucket picker. */\n    buckets?: Record<string, Selector<Env, R2BucketLike>>;\n    /** Public base URL signed/public object URLs resolve against. Omit it and `ctx.storage` in a mutation, action or HTTP handler (and the studio's copy-URL) signs against the origin the request reached the worker on — no per-environment value to ship. Queries get no such fallback (a live query re-runs with no request behind it), so a query that signs URLs needs this set. */\n    publicBaseUrl?: Selector<Env, string>;\n    /** R2 S3-API credentials (`{ accountId, accessKeyId, secretAccessKey, bucket, jurisdiction? }`) enabling `ctx.storage.getPresignedUrl` — native S3 presigned URLs that hit R2 directly, bypassing the worker. Omit to use only the worker-signed `getSignedUrl` path. */\n    s3?: Selector<Env, R2S3Credentials>;\n    /** HMAC secret for signed URLs. */\n    signingSecret?: Selector<Env, string>;\n}"]:[],...e.hasScheduler?["/** `.scheduler(...)` declaration — the `SchedulerDO` namespace. Backs `ctx.scheduler` AND the studio's scheduled-jobs view. The origin its callbacks dispatch back to is not declared here: the DO reads `env.LUNORA_ORIGIN_URL` at fire time, because a caller-supplied dispatch target would be an SSRF vector. */\ninterface SchedulerDeclaration<Env> {\n    /** The `SchedulerDO` namespace binding (typically `env.SCHEDULER`). */\n    namespace: Selector<Env, DurableObjectNamespaceLike & ShardNamespaceLike>;\n}"]:[],...e.hasGlobal?["/** `.global(...)` declaration — the D1 binding backing `.global()` tables. Backs cross-tenant `ctx.db` reads/writes AND the studio's global data browser. */\ninterface GlobalDeclaration<Env> {\n    /** The D1 binding (typically `env.DB`). */\n    d1: Selector<Env, D1DatabaseLike>;\n    /** The worker origin used to fan reverse cross-backend relations across shards. Without it, such a relation throws a clear error. */\n    origin?: Selector<Env, string>;\n}"]:[],...e.hasHyperdriveGlobal?['/** `.hyperdriveGlobal(...)` declaration — backs `.global({ backend: "hyperdrive" })` tables on a Postgres/MySQL database via Hyperdrive. Stays reactive: the writer is injected as `globalDb` and the broadcast hook drives live queries. */\ninterface HyperdriveGlobalDeclaration<Env> {\n    /** The Hyperdrive engine — selects the Postgres or MySQL dialect. */\n    engine: HyperdriveEngine;\n    /** Build the `SqlExec` from `env` — e.g. `buildPgExec(fromPostgresJs(postgres(env.HYPERDRIVE.connectionString)))`. Cache the driver on the DO instance; rebuild lazily after hibernation. */\n    exec: (env: Env) => SqlExec;\n    /** The worker origin used to fan reverse cross-backend relations across shards. Without it, such a relation throws a clear error. */\n    origin?: Selector<Env, string>;\n}']:[],...e.hasAuth?['/** `.auth(...)` declaration — better-auth options plus the storage the adapter reads. Give it `d1` (the default) or `namespace` (a Durable Object that hosts the auth tables), never both. The builder owns the lazy build + `ensureMigrated` dance and wires `authHandler` / `resolveIdentity` / `authAdmin`. */\ninterface AuthDeclaration<Env> {\n    /** The D1 binding the auth SQL adapter is wired over (via `lunoraD1Adapter`). Omit only when using `namespace`. */\n    d1?: Selector<Env, unknown>;\n    /** Shared secret the worker presents on the object\'s internal session route. REQUIRED with `namespace`: the binding is reachable from any worker bound to it, so the secret — not the binding — is the authorization boundary. Without it identity resolution fails closed. */\n    internalSecret?: Selector<Env, string>;\n    /** Name of the Durable Object instance holding the auth tables. Defaults to `"auth"`. Set it to run separate auth objects (per deployment, per tenant) off one namespace. */\n    objectName?: Selector<Env, string>;\n    /** The auth Durable Object namespace — the DO-backed mode. Needed for `@better-auth/scim`, which requires native transactions that D1 has none of. The object owns the auth tables, so `/api/auth/*` and identity resolution both go through it. Typed as `AuthNamespaceLike` because `createDoAuthWiring` resolves through `idFromName` + `get` and has no `getByName` fallback — both members are load-bearing here, and `ShardNamespaceLike` leaves both optional. */\n    namespace?: Selector<Env, AuthNamespaceLike>;\n    /** Build the better-auth options from `env` (secret, plugins, email/password, …). */\n    options: (env: Env) => LunoraAuthOptions;\n}']:[]],O=e=>[...e.hasAccess?["    private accessSelector?: Selector<Env, CreateAccessResolverOptions | undefined>;"]:[],"    private adminToken?: Selector<Env, string>;",...e.hasAuth?["    private authDeclaration?: AuthDeclaration<Env>;"]:[],"    private cdcEnabled = false;","    private reactiveCacheConfig: boolean | { maxBytes?: number; maxEntries?: number } = false;",'    private maxRelationKeysLimit?: ShardConfig["maxRelationKeys"];','    private observabilitySink?: ShardConfig["observability"];','    private relationExistsPushDownMode?: ShardConfig["relationExistsPushDown"];',"    private readonly extendFns: ((env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>)[] = [];",...e.hasGlobal?["    private globalDeclaration?: GlobalDeclaration<Env>;"]:[],...e.hasHyperdriveGlobal?["    private hyperdriveGlobalDeclaration?: HyperdriveGlobalDeclaration<Env>;"]:[],"    private httpRouterApp?: HttpRouterLike;","    private readonly routeMap: Record<string, Route> = {};",...e.hasScheduler?["    private schedulerDeclaration?: SchedulerDeclaration<Env>;"]:[],...g(e)?["    private readonly shardExtras: Partial<ShardConfig> = {};"]:[],...d(e)?["    private shardRegistrySelector?: Selector<Env, ShardNamespaceLike>;"]:[],"    private shardSelector?: Selector<Env, ShardNamespaceLike>;",...e.hasSourcedTables?['    private sourceClientFactory?: NonNullable<ShardConfig["sourceClient"]>;']:[],...e.hasStorage?["    private storageDeclaration?: StorageDeclaration<Env>;"]:[]],T=e=>m(e).map(({configKey:r,doc:t,method:a})=>`    /** ${t} */
     public ${a}(factory: (env: Env) => ReturnType<NonNullable<ShardConfig["${r}"]>>): this {
         this.shardExtras.${r} = factory as NonNullable<ShardConfig["${r}"]>;
 
@@ -396,7 +396,7 @@ const buildGlobalCdcApplier =
         this.storageDeclaration = declaration;
 
         return this;
-    }`]:[],...T(e)],q=e=>{const r=a=>e.hasScheduler?`
+    }`]:[],...T(e)],I=e=>{const r=a=>e.hasScheduler?`
                               ...(this.schedulerDeclaration ? { scheduler: this.resolveScheduler(env) as unknown as ${a}["scheduler"] } : {}),`:"",t=["            cdc: this.cdcEnabled,","            reactiveCache: this.reactiveCacheConfig,","            ...(this.maxRelationKeysLimit === undefined ? {} : { maxRelationKeys: this.maxRelationKeysLimit }),","            ...(this.observabilitySink === undefined ? {} : { observability: this.observabilitySink }),","            ...(this.relationExistsPushDownMode === undefined ? {} : { relationExistsPushDown: this.relationExistsPushDownMode }),",...e.hasGlobal?[`            ...(this.globalDeclaration
                 ? {
                       d1: (rawEnv: Record<string, unknown>, request?: { bookmark?: string; cdc?: boolean; cdcRetentionMs?: number; identity?: Record<string, unknown>; onBookmark?: (bookmark: string | undefined) => void; userId?: string | null }) => {
@@ -468,13 +468,13 @@ const buildGlobalCdcApplier =
                 ? {
                       scheduler: (rawEnv: Record<string, unknown>) => this.resolveScheduler(rawEnv as Env),
                   }
-                : {}),`]:[],...d(e)?["            ...(this.shardRegistrySelector ? { shardRegistry: (rawEnv: Record<string, unknown>) => this.shardRegistrySelector?.(rawEnv as Env) } : {}),"]:[],...e.hasSourcedTables?["            ...(this.sourceClientFactory === undefined ? {} : { sourceClient: this.sourceClientFactory }),"]:[],...e.hasStorage?["            ...(this.storageDeclaration ? { storage: (rawEnv: Record<string, unknown>, origin?: string) => this.resolveStorage(rawEnv as Env, origin) } : {}),"]:[],...m(e)?["            ...this.shardExtras,"]:[]];return t.length>0?`
+                : {}),`]:[],...d(e)?["            ...(this.shardRegistrySelector ? { shardRegistry: (rawEnv: Record<string, unknown>) => this.shardRegistrySelector?.(rawEnv as Env) } : {}),"]:[],...e.hasSourcedTables?["            ...(this.sourceClientFactory === undefined ? {} : { sourceClient: this.sourceClientFactory }),"]:[],...e.hasStorage?["            ...(this.storageDeclaration ? { storage: (rawEnv: Record<string, unknown>, origin?: string) => this.resolveStorage(rawEnv as Env, origin) } : {}),"]:[],...g(e)?["            ...this.shardExtras,"]:[]];return t.length>0?`
 ${t.join(`
 `)}
-        `:""},I=e=>e?['import * as lunoraIdentityContract from "../identity.js";']:[],L=(e,r)=>e?['import type { CreateAccessResolverOptions } from "@lunora/cloudflare-access";',`import { createAccessResolver${r?", composeResolvers":""} } from "@lunora/cloudflare-access";`]:[],j=e=>e?['import { createKvIntrospectorFromEnv } from "@lunora/bindings/kv";']:[],G=e=>e?['import { createVectorAdminIntrospector } from "@lunora/bindings/vectors";']:[],B=e=>e?['import type { D1CtxDbOptions, D1DatabaseLike, D1Exec } from "@lunora/d1";','import { applyCdcChanges, createD1CtxDb, emitD1QueryCost, exportGlobalRows, facetGlobalColumn, importGlobalRows, listGlobalTables, readD1CdcChanges, readGlobalTablePage, retryingExec } from "@lunora/d1";']:[],P=e=>e?['import notifyConfig from "../notify.js";']:[],W=e=>v(e)?['import { dispatchAgentEmail } from "@lunora/agent/inbound";']:[],_=e=>v(e)?['import * as lunoraAgentDefinitions from "../agents.js";']:[],$=e=>{const{hasFramework:r,hasGlobal:t,hasHyperdriveGlobal:a,hasQueue:n,useUmbrella:o}=e,i=o?"lunorash/runtime":"@lunora/runtime",l=["ExecutionContextLike","HttpRouterLike","LunoraWorker","Route","ScheduledControllerLike","ShardNamespaceLike","WorkerOptions",...n?["TriggerTrace"]:[],...t?["GlobalIntrospector"]:[],...e.tables.length>0?["ShardingInfo"]:[],...r?["FrameworkHostHandler"]:[]],c=[...t||a?["createCrossShardRelationCapabilities"]:[],...d(e)?["createDynamicShardRegistry","createQueryCoordinator"]:[],"createWorker",...e.jurisdiction?["declareAppJurisdiction"]:[],"resolveLogArchiveFromEnv",...r?["withFrameworkWorker"]:[]].join(", ");return[`import type { ${[...l].toSorted((s,h)=>s.localeCompare(h)).join(", ")} } from "${i}";`,`import { ${c} } from "${i}";`]},H=e=>{const{hasAccess:r,hasAuth:t,hasGlobal:a,hasHyperdriveGlobal:n,hasKvIntrospector:o,hasQueue:i,hasScheduler:l,hasStorage:c,hasWorkflow:s,wantsOpenApi:h,wantsOpenRpc:u}=e;return[...t?['import type { AuthNamespaceLike, LunoraAuth, LunoraAuthOptions } from "@lunora/auth";','import { authDiscoveryPathsFor, createAuth, createAuthAdmin, createAuthAuditReader, createDoAuthWiring, d1Executor, handleAuthDiscoveryRequest, handleAuthRequest, lunoraD1Adapter } from "@lunora/auth";']:[],...L(r,t),...B(a),...n?['import type { HyperdriveEngine } from "@lunora/hyperdrive/global";','import { createHyperdriveGlobalCtxDb } from "@lunora/hyperdrive/global";','import type { SqlCtxDbOptions, SqlExec } from "@lunora/sql-store";']:[],...j(o),...G(e.hasVectors),...l?['import type { DurableObjectNamespaceLike } from "@lunora/scheduler";','import { createScheduler } from "@lunora/scheduler";']:[],...c?['import type { R2BucketLike, R2S3Credentials, Storage } from "@lunora/storage";','import { createBucketStorage, createStorage } from "@lunora/storage";']:[],...s?['import { createWorkflowsRestClient } from "@lunora/workflow";']:[],...W(e),...$(e),"",...I(e.identity),..._(e),...a||n?['import schema from "../schema.js";']:[],...P(e.hasNotify),'import { LUNORA_CRONS } from "./crons.js";','import { LUNORA_FUNCTIONS } from "./functions.js";',...i?['import { createQueueCaptureSink, dispatchQueueBatch, shouldCaptureQueue } from "@lunora/queue";','import { LUNORA_QUEUE_REGISTRY } from "./queues.js";']:[],...e.wantsArchitecture?['import { architecture } from "./architecture.js";']:[],...h?['import { openApiSpec } from "./openapi.js";']:[],...u?['import { openRpcSpec } from "./openrpc.js";']:[],'import { createShardDO } from "./shard.js";',...e.hasVectors?['import { LUNORA_VECTOR_INDEXES } from "./vectors.js";']:[]]},U=e=>e.jurisdiction&&e.jurisdictionPinsAuth===!0?`
+        `:""},q=e=>e?['import * as lunoraIdentityContract from "../identity.js";']:[],L=(e,r)=>e?['import type { CreateAccessResolverOptions } from "@lunora/cloudflare-access";',`import { createAccessResolver${r?", composeResolvers":""} } from "@lunora/cloudflare-access";`]:[],j=e=>e?['import { createKvIntrospectorFromEnv } from "@lunora/bindings/kv";']:[],B=e=>e?['import { createVectorAdminIntrospector } from "@lunora/bindings/vectors";']:[],G=e=>e?['import type { D1CtxDbOptions, D1DatabaseLike, D1Exec } from "@lunora/d1";','import { applyCdcChanges, createD1CtxDb, emitD1QueryCost, exportGlobalRows, facetGlobalColumn, importGlobalRows, listGlobalTables, readD1CdcChanges, readGlobalTablePage, retryingExec } from "@lunora/d1";']:[],P=e=>e?['import notifyConfig from "../notify.js";']:[],_=e=>v(e)?['import { dispatchAgentEmail } from "@lunora/agent/inbound";']:[],W=e=>v(e)?['import * as lunoraAgentDefinitions from "../agents.js";']:[],M=e=>{const{hasFramework:r,hasGlobal:t,hasHyperdriveGlobal:a,hasQueue:s,useUmbrella:o}=e,i=o?"lunorash/runtime":"@lunora/runtime",c=["ExecutionContextLike","HttpRouterLike","LunoraWorker","Route","ScheduledControllerLike","ShardNamespaceLike","WorkerOptions",...s?["TriggerTrace"]:[],...t?["GlobalIntrospector"]:[],...e.tables.length>0?["ShardingInfo"]:[],...r?["FrameworkHostHandler"]:[]],l=[...t||a?["createCrossShardRelationCapabilities"]:[],...d(e)?["createDynamicShardRegistry","createQueryCoordinator"]:[],"createWorker",...e.jurisdiction?["declareAppJurisdiction"]:[],"resolveLogArchiveFromEnv",...e.hasAuth?["memoizeIdentity"]:[],...r?["withFrameworkWorker"]:[]].join(", ");return[`import type { ${[...c].toSorted((n,h)=>n.localeCompare(h)).join(", ")} } from "${i}";`,`import { ${l} } from "${i}";`]},H=e=>{const{hasAccess:r,hasAuth:t,hasGlobal:a,hasHyperdriveGlobal:s,hasKvIntrospector:o,hasQueue:i,hasScheduler:c,hasStorage:l,hasWorkflow:n,wantsOpenApi:h,wantsOpenRpc:u}=e;return[...t?['import type { AuthNamespaceLike, LunoraAuth, LunoraAuthOptions } from "@lunora/auth";','import { authDiscoveryPathsFor, createAuth, createAuthAdmin, createAuthAuditReader, createDoAuthWiring, d1Executor, handleAuthDiscoveryRequest, handleAuthRequest, lunoraD1Adapter } from "@lunora/auth";']:[],...L(r,t),...G(a),...s?['import type { HyperdriveEngine } from "@lunora/hyperdrive/global";','import { createHyperdriveGlobalCtxDb } from "@lunora/hyperdrive/global";','import type { SqlCtxDbOptions, SqlExec } from "@lunora/sql-store";']:[],...j(o),...B(e.hasVectors),...c?['import type { DurableObjectNamespaceLike } from "@lunora/scheduler";','import { createScheduler } from "@lunora/scheduler";']:[],...l?['import type { R2BucketLike, R2S3Credentials, Storage } from "@lunora/storage";','import { createBucketStorage, createStorage } from "@lunora/storage";']:[],...n?['import { createWorkflowsRestClient } from "@lunora/workflow";']:[],..._(e),...M(e),"",...q(e.identity),...W(e),...a||s?['import schema from "../schema.js";']:[],...P(e.hasNotify),'import { LUNORA_CRONS } from "./crons.js";','import { LUNORA_FUNCTIONS } from "./functions.js";',...i?['import { createQueueCaptureSink, dispatchQueueBatch, shouldCaptureQueue } from "@lunora/queue";','import { LUNORA_QUEUE_REGISTRY } from "./queues.js";']:[],...e.wantsArchitecture?['import { architecture } from "./architecture.js";']:[],...h?['import { openApiSpec } from "./openapi.js";']:[],...u?['import { openRpcSpec } from "./openrpc.js";']:[],'import { createShardDO } from "./shard.js";',...e.hasVectors?['import { LUNORA_VECTOR_INDEXES } from "./vectors.js";']:[]]},$=e=>e.jurisdiction&&e.jurisdictionPinsAuth===!0?`
                 // The schema's jurisdiction pins the auth object like every other DO.
-                jurisdiction: ${JSON.stringify(e.jurisdiction)},`:"",M=e=>typeof e=="string"?`{ mode: { kind: ${JSON.stringify(e)} } }`:`{ mode: { field: ${JSON.stringify(e.field)}, kind: "shardBy" } }`,F=e=>[...e.tables.length>0?[`        const tableSharding = new Map<string, ShardingInfo>([
-${e.tables.map(r=>`            [${JSON.stringify(r.name)}, ${M(r.shardMode)}],`).join(`
+                jurisdiction: ${JSON.stringify(e.jurisdiction)},`:"",U=e=>typeof e=="string"?`{ mode: { kind: ${JSON.stringify(e)} } }`:`{ mode: { field: ${JSON.stringify(e.field)}, kind: "shardBy" } }`,F=e=>[...e.tables.length>0?[`        const tableSharding = new Map<string, ShardingInfo>([
+${e.tables.map(r=>`            [${JSON.stringify(r.name)}, ${U(r.shardMode)}],`).join(`
 `)}
         ]);
 
@@ -551,7 +551,7 @@ ${e.tables.map(r=>`            [${JSON.stringify(r.name)}, ${M(r.shardMode)}],`)
                 // Memoised on the declaration: a framework-hosted worker rebuilds these
                 // options per request, and \`options(env)\` rebuilds every plugin.
                 discoveryPaths: authDiscoveryPathsFor(authDeclaration, env),
-                internalSecret: authDeclaration.internalSecret?.(env),${U(e)}
+                internalSecret: authDeclaration.internalSecret?.(env),${$(e)}
                 namespace: authNamespace(env),
                 objectName: authDeclaration.objectName?.(env),
             });
@@ -627,6 +627,88 @@ ${e.tables.map(r=>`            [${JSON.stringify(r.name)}, ${M(r.shardMode)}],`)
 
             options.authAdmin = authInstance ? createAuthAdmin(authInstance) : undefined;
             options.authAuditReader = createAuthAuditReader(d1Executor(authD1(env) as never));
+        }
+
+        // Both modes pay a session lookup per request (the auth object hop, or a D1
+        // read), and the runtime resolves identity once per RPC and per fan-out leg.
+        // Memoise per credential. The default window is the shorter of 60s and
+        // better-auth's cookie-cache \`maxAge\`; \`LUNORA_IDENTITY_CACHE_MS\` overrides it, \`0\`
+        // disables the cross-request cache. The memoised \`getSession\` result may itself
+        // come from better-auth's cookie cache, so the worst case is the two stacked: a
+        // revoked session or a changed role can resolve for up to the memo window PLUS the
+        // cookie-cache \`maxAge\` (about 120s with the presets).
+        //
+        // An app that switched the cookie cache OFF (the \`strict\` session preset) asked
+        // for fast revocation, so its default is per-request memoisation only; the env var
+        // still opts back in. Read from the declared options at runtime, the one place
+        // the chosen policy is visible.
+        //
+        // Built once per \`env\` object and kept for this assembled worker: a framework-hosted
+        // worker rebuilds these options on every request, and a fresh memo per build
+        // would never hit. A different \`env\` object gets its own memo.
+        if (options.resolveIdentity) {
+            let memo = identityMemos.get(env);
+
+            if (!memo) {
+                // A wrangler var may be a JSON number (\`0\`) or a string. A blank string is
+                // unset, not \`0\` (\`Number("")\` is 0); anything else non-numeric is unset too.
+                const identityCacheRaw = (env as { LUNORA_IDENTITY_CACHE_MS?: unknown }).LUNORA_IDENTITY_CACHE_MS;
+                let identityCacheMs = Number.NaN;
+
+                if (typeof identityCacheRaw === "number") {
+                    identityCacheMs = identityCacheRaw;
+                } else if (typeof identityCacheRaw === "string" && identityCacheRaw.trim() !== "") {
+                    identityCacheMs = Number(identityCacheRaw);
+                }
+
+                // \`options(env)\` is application code. A scheduled, queue or serverQuery event must
+                // not fail to construct — and so never run — because that callback throws, so a
+                // throw is caught rather than escaping.
+                let defaultMs: number;
+
+                try {
+                    const cookieCache = authDeclaration?.options(env).session?.cookieCache;
+                    // better-auth's \`maxAge\` is in SECONDS; createAuth fills 60 when it is unset.
+                    const cookieCacheSeconds = typeof cookieCache?.maxAge === "number" && cookieCache.maxAge >= 0 ? cookieCache.maxAge : 60;
+
+                    // createAuth fills \`{ enabled: true, maxAge: 60 }\` only when \`cookieCache\` is absent; a partial
+                    // object without \`enabled: true\` has NO cookie cache, so the memo stays per-request there.
+                    defaultMs = cookieCache === undefined || cookieCache.enabled === true ? Math.min(60_000, cookieCacheSeconds * 1000) : 0;
+                } catch {
+                    // The policy is unreadable. Fall back to PER-REQUEST memoisation, not the 60s
+                    // window: a 60s cross-request cache would let a revoked session keep
+                    // resolving for a minute, which is exactly what the \`strict\` preset turned
+                    // off. Construction still does not fail, so the event still runs.
+                    defaultMs = 0;
+                }
+
+                memo = memoizeIdentity(options.resolveIdentity, {
+                    // better-auth resolves the session from ALL request headers, so the key
+                    // must cover every header a supported plugin authenticates on: the
+                    // session cookie, \`Authorization\` (bearer / jwt) and \`x-api-key\` (apiKey).
+                    cacheKey: (request: Request) => {
+                        const parts = ["authorization", "cookie", "x-api-key"].map((name) => request.headers.get(name) ?? "");
+
+                        if (parts.every((part) => part === "")) {
+                            return undefined;
+                        }
+
+                        const key = parts.join("\\u0000");
+
+                        // The map is bounded in ENTRIES, not in key size, so a client with one
+                        // valid session could add a junk cookie per request and grow it without
+                        // bound. Skip the cache for an oversized credential set rather than
+                        // truncating the key, which could collide with a different credential and
+                        // hand back the wrong identity.
+                        return key.length > 4_096 ? undefined : key;
+                    },
+                    maxEntries: 2_000,
+                    ttlMs: Number.isFinite(identityCacheMs) && identityCacheMs >= 0 ? identityCacheMs : defaultMs,
+                });
+                identityMemos.set(env, memo);
+            }
+
+            options.resolveIdentity = memo;
         }`]:[],...e.hasAccess?[e.hasAuth?`        if (this.accessSelector) {
             const accessResolver = createAccessResolver(this.accessSelector(env));
             const fallback = options.resolveIdentity;
@@ -637,9 +719,15 @@ ${e.tables.map(r=>`            [${JSON.stringify(r.name)}, ${M(r.shardMode)}],`)
         }`]:[],...e.voiceAgents&&e.voiceAgents.length>0?[`        options.voiceAgents = {
 ${e.voiceAgents.map(r=>`            ${JSON.stringify(r.exportName)}: (env as Record<string, unknown>)[${JSON.stringify(r.bindingName)}] as ShardNamespaceLike,`).join(`
 `)}
-        };`]:[]],J=e=>["            cronJobs: LUNORA_CRONS,","            functions: LUNORA_FUNCTIONS,",...e.identity?[`            identity: lunoraIdentityContract.${e.identity.exportName},`]:[],...e.jurisdiction?[`            jurisdiction: ${JSON.stringify(e.jurisdiction)},`]:[],...e.wantsArchitecture?["            architecture,"]:[],...e.wantsOpenApi?["            openApiSpec,"]:[],...e.wantsOpenRpc?["            openRpcSpec,"]:[],...e.hasQueue?["            queue: (batch: unknown, queueEnv: unknown, _context: ExecutionContextLike, trigger: TriggerTrace): Promise<void> =>","                dispatchQueueBatch(batch as Parameters<typeof dispatchQueueBatch>[0], LUNORA_QUEUE_REGISTRY, {","                    capture: shouldCaptureQueue(queueEnv as Record<string, unknown>)",`                        ? createQueueCaptureSink(queueEnv as Record<string, unknown>${e.jurisdiction?`, { jurisdiction: ${JSON.stringify(e.jurisdiction)} }`:""})`,"                        : undefined,","                    env: queueEnv as Record<string, unknown>,","                    traceparent: trigger.traceparent,","                }),"]:[],"            ...(this.httpRouterApp ? { httpRouter: this.httpRouterApp } : {}),","            routes: this.routeMap,","            shardDO: this.shardSelector?.(env) ?? (undefined as unknown as ShardNamespaceLike),"],K=e=>[...e.hasAuth?["AuthDeclaration"]:[],"ComposedApp",...e.hasGlobal?["GlobalDeclaration"]:[],"LunoraConfig",...e.hasScheduler?["SchedulerDeclaration"]:[],"Selector",...e.hasStorage?["StorageDeclaration"]:[]].toSorted((r,t)=>r.localeCompare(t)).join(", "),X=e=>{const r=(e.hasVectors??!0)&&(e.vectorIndexCount??0)>0,t={...e,hasVectors:r},{hasAuth:a}=t,n=C(t),o=Q(t),i=a?`        let auth: LunoraAuth | null = null;
+        };`]:[]],J=e=>["            cronJobs: LUNORA_CRONS,","            functions: LUNORA_FUNCTIONS,",...e.identity?[`            identity: lunoraIdentityContract.${e.identity.exportName},`]:[],...e.jurisdiction?[`            jurisdiction: ${JSON.stringify(e.jurisdiction)},`]:[],...e.wantsArchitecture?["            architecture,"]:[],...e.wantsOpenApi?["            openApiSpec,"]:[],...e.wantsOpenRpc?["            openRpcSpec,"]:[],...e.hasQueue?["            queue: (batch: unknown, queueEnv: unknown, _context: ExecutionContextLike, trigger: TriggerTrace): Promise<void> =>","                dispatchQueueBatch(batch as Parameters<typeof dispatchQueueBatch>[0], LUNORA_QUEUE_REGISTRY, {","                    capture: shouldCaptureQueue(queueEnv as Record<string, unknown>)",`                        ? createQueueCaptureSink(queueEnv as Record<string, unknown>${e.jurisdiction?`, { jurisdiction: ${JSON.stringify(e.jurisdiction)} }`:""})`,"                        : undefined,","                    env: queueEnv as Record<string, unknown>,","                    traceparent: trigger.traceparent,","                }),"]:[],"            ...(this.httpRouterApp ? { httpRouter: this.httpRouterApp } : {}),","            routes: this.routeMap,","            shardDO: this.shardSelector?.(env) ?? (undefined as unknown as ShardNamespaceLike),"],K=e=>e?`
+/** The identity memo per \`env\` object, owned by one assembled worker. */
+type IdentityMemoStore = WeakMap<object, ReturnType<typeof memoizeIdentity>>;
+`:"",V=e=>[...e.hasAuth?["AuthDeclaration"]:[],"ComposedApp",...e.hasGlobal?["GlobalDeclaration"]:[],"LunoraConfig",...e.hasScheduler?["SchedulerDeclaration"]:[],"Selector",...e.hasStorage?["StorageDeclaration"]:[]].toSorted((r,t)=>r.localeCompare(t)).join(", "),Z=e=>{const r=(e.hasVectors??!0)&&(e.vectorIndexCount??0)>0,t={...e,hasVectors:r},{hasAuth:a}=t,s=C(t),o=Q(t),i=a?`        let auth: LunoraAuth | null = null;
         let authInit: Promise<void> | null = null;
-`:"",l=a?`
+        // One memo per env for THIS assembled worker: a framework-hosted worker rebuilds its options per
+        // request and must reuse it, but a second \`assemble()\` has its own auth closure and must not share.
+        const identityMemos: IdentityMemoStore = new WeakMap();
+`:"",c=a?`
         const initAuth = async (env: Env): Promise<void> => {
             if (!this.authDeclaration) {
                 return;
@@ -691,9 +779,9 @@ ${e.voiceAgents.map(r=>`            ${JSON.stringify(r.exportName)}: (env as Rec
                 authInit = null;
                 throw error;
             }));
-`:"",c=a?`
-                await ensureAuth(env);`:"",s=a?"() => auth":"() => null",h=a?"getAuth: () => LunoraAuth | null":"_getAuth: () => null",u=t.hasFramework?`        const buildWorker = (env: Env): LunoraWorker =>
-            host ? withFrameworkWorker(host, (hostEnv) => this.buildWorkerOptions(hostEnv as Env, ${s})) : createWorker(this.buildWorkerOptions(env, ${s}));`:`        const buildWorker = (env: Env): LunoraWorker => createWorker(this.buildWorkerOptions(env, ${s}));`,y=t.hasFramework?"host?: FrameworkHostHandler":"",p=t.emailAgents??[],f=p.length>0?`        composed.email = dispatchAgentEmail([
+`:"",l=a?`
+                await ensureAuth(env);`:"",n=a?"() => auth, identityMemos":"() => null",h=a?"getAuth: () => LunoraAuth | null, identityMemos: IdentityMemoStore":"_getAuth: () => null",u=t.hasFramework?`        const buildWorker = (env: Env): LunoraWorker =>
+            host ? withFrameworkWorker(host, (hostEnv) => this.buildWorkerOptions(hostEnv as Env, ${n})) : createWorker(this.buildWorkerOptions(env, ${n}));`:`        const buildWorker = (env: Env): LunoraWorker => createWorker(this.buildWorkerOptions(env, ${n}));`,y=t.hasFramework?"host?: FrameworkHostHandler":"",p=t.emailAgents??[],f=p.length>0?`        composed.email = dispatchAgentEmail([
 ${p.map(b=>`            { agent: lunoraAgentDefinitions.${b.exportName}, className: ${JSON.stringify(b.className)} },`).join(`
 `)}
         ]);
@@ -709,15 +797,15 @@ type Selector<Env, T> = (env: Env) => T | undefined;
 
 /** The generated \`createShardDO\` config — \`.observability()\`, \`.maxRelationKeys()\` and the long-tail \`.ai()\` / \`.kv()\` / … methods pass straight through to it. */
 type ShardConfig = NonNullable<Parameters<typeof createShardDO>[0]>;
-${t.jurisdiction?`
+${K(a)}${t.jurisdiction?`
 // Module scope, so every isolate loading this script (the worker and each Durable
 // Object class it exports) knows the schema's jurisdiction before a request runs.
 // \`@lunora/mail\` reads it to pin its shard RPC like every other DO path.
 declareAppJurisdiction(${JSON.stringify(t.jurisdiction)});
 `:""}
-${n.join(`
+${s.join(`
 
-`)}${n.length>0?`
+`)}${s.length>0?`
 
 `:""}/** The composed app: a Cloudflare module worker (\`fetch\` / \`scheduled\` / optional \`email\`) plus the \`ShardDO\` class binding. */
 interface ComposedApp extends LunoraWorker {
@@ -747,19 +835,19 @@ ${w}
 
     /** Build the shard DO + compose the worker (standalone or framework-hosted), wrapping the lazy per-isolate singletons + auth init. */
     private assemble(${y}): ComposedApp {
-        const ShardDO = createShardDO({${q(t)}});
+        const ShardDO = createShardDO({${I(t)}});
 
         // Per-isolate singletons: the worker (and auth instance) are expensive to
         // build, so the first request constructs them and every later request on
         // the same isolate reuses them.
         let worker: LunoraWorker | null = null;
-${i}${l}
+${i}${c}
 ${u}
 
         const composed: ComposedApp = {
             ShardDO,
             fetch: async (request: Request, rawEnv: unknown, context: ExecutionContextLike): Promise<Response> => {
-                const env = rawEnv as Env;${c}
+                const env = rawEnv as Env;${l}
                 worker ??= buildWorker(env);
 
                 return worker.fetch(request, rawEnv, context);
@@ -863,5 +951,5 @@ interface LunoraConfig<Env extends object = object> {
 const defineApp = <Env extends object>(): AppBuilder<Env> => new AppBuilder<Env>();
 
 export { AppBuilder, defineApp };
-export type { ${K(t)} };
-`};export{X as emitApp};
+export type { ${V(t)} };
+`};export{Z as emitApp};

package/dist/packem_shared/{emitShard-zun44Krh.mjs → emitShard-D_dkDtuY.mjs}

@@ -1 +1 @@
-import"./SCHEMA_SNAPSHOT_VERSION-C0oHwiJZ.mjs";import"./isD1GlobalTable-udvHAAzD.mjs";import"./json-data-Chfs2Cz5.mjs";import{e as d}from"./shard-QKj9rp3r.mjs";import"./shard-runtime-BX0xmo0P.mjs";import"./shared-DnCokNcE.mjs";import"./platform-8oj7iXQy.mjs";import"./schema-BgM8A3XV.mjs";export{d as default};
+import"./SCHEMA_SNAPSHOT_VERSION-C0oHwiJZ.mjs";import"./isD1GlobalTable-udvHAAzD.mjs";import"./json-data-Chfs2Cz5.mjs";import{e as d}from"./shard-Av4rUyYS.mjs";import"./shard-runtime-CkTgY8tL.mjs";import"./shared-DnCokNcE.mjs";import"./platform-8oj7iXQy.mjs";import"./schema-BgM8A3XV.mjs";export{d as default};

package/dist/packem_shared/{shard-QKj9rp3r.mjs → shard-Av4rUyYS.mjs}

@@ -1,4 +1,4 @@
-import{LunoraError as Rt}from"@lunora/errors";import{serializeSchemaSnapshot as xt,hashSchemaSnapshot as At}from"./SCHEMA_SNAPSHOT_VERSION-C0oHwiJZ.mjs";import{isHyperdriveGlobalTable as Ot,isD1GlobalTable as Dt}from"./isD1GlobalTable-udvHAAzD.mjs";import{r as Tt}from"./json-data-Chfs2Cz5.mjs";import{r as L,e as Et,a as Lt,b as Ct,c as It,d as _t,f as Mt,g as Pt,h as Nt,i as $t,j as qt,k as Ft,l as Ut,m as Bt,n as Wt,o as jt,p as Ht,q as Vt}from"./shard-runtime-BX0xmo0P.mjs";import{u as K,i as Kt,G as Gt,d as Qt}from"./shared-DnCokNcE.mjs";import{p as zt}from"./platform-8oj7iXQy.mjs";import{i as Jt}from"./schema-BgM8A3XV.mjs";const h=(n,e)=>`((): (() => ${e}) => { let cached: ${e} | undefined; return () => (cached ??= JSON.parse(${JSON.stringify(JSON.stringify(n))}) as ${e}); })()`,te=["categories","description","facing","level","remediation","title"],Yt=n=>{const e={};return{advisoryRows:n.map(a=>{let r=e[a.name];return r||(r=Object.fromEntries(te.filter(s=>s in a).map(s=>[s,a[s]])),e[a.name]=r),Object.fromEntries(Object.entries(a).filter(([s,d])=>!te.includes(s)||JSON.stringify(d)!==JSON.stringify(r[s])))}),advisoryRules:e}},Xt=`        /**
+import{LunoraError as Rt}from"@lunora/errors";import{serializeSchemaSnapshot as xt,hashSchemaSnapshot as At}from"./SCHEMA_SNAPSHOT_VERSION-C0oHwiJZ.mjs";import{isHyperdriveGlobalTable as Ot,isD1GlobalTable as Dt}from"./isD1GlobalTable-udvHAAzD.mjs";import{r as Tt}from"./json-data-Chfs2Cz5.mjs";import{r as L,e as Et,a as Lt,b as Ct,c as It,d as _t,f as Mt,g as Pt,h as Nt,i as $t,j as qt,k as Ft,l as Ut,m as Bt,n as Wt,o as jt,p as Ht,q as Vt}from"./shard-runtime-CkTgY8tL.mjs";import{u as K,i as Kt,G as Gt,d as Qt}from"./shared-DnCokNcE.mjs";import{p as zt}from"./platform-8oj7iXQy.mjs";import{i as Jt}from"./schema-BgM8A3XV.mjs";const h=(n,e)=>`((): (() => ${e}) => { let cached: ${e} | undefined; return () => (cached ??= JSON.parse(${JSON.stringify(JSON.stringify(n))}) as ${e}); })()`,te=["categories","description","facing","level","remediation","title"],Yt=n=>{const e={};return{advisoryRows:n.map(a=>{let r=e[a.name];return r||(r=Object.fromEntries(te.filter(s=>s in a).map(s=>[s,a[s]])),e[a.name]=r),Object.fromEntries(Object.entries(a).filter(([s,d])=>!te.includes(s)||JSON.stringify(d)!==JSON.stringify(r[s])))}),advisoryRules:e}},Xt=`        /**
          * The bare writer every admin/maintenance entry point writes through.
          *
          * Admin and maintenance writes go through the SAME reactive-cache hooks as a
@@ -1069,7 +1069,7 @@ assertShapesDeclareReadPolicies(LUNORA_SHAPES, ${JSON.stringify(r)}, (schema as
 `:"",sourceClientCacheConst:n?`
 const sourceClientCache = new WeakMap<object, Map<string, SourceClientLike>>();
 const sourcePollAtCache = new WeakMap<object, Map<string, number>>();
-`:""}),mr=(n,e)=>{const t=e.length>0,r=n?L("vectorsStub: VectorSearchLike","ctx.vectors: no vectors configured. Pass `vectors` to createShardDO().",["deleteByIds","getByIds","query","upsert","upsertNow"]):"",s=t?`            const vectorShardKey = this.currentShardKey();
+`:""}),mr=(n,e)=>{const t=e.length>0,r=n?L("vectorsStub: VectorSearchLike","ctx.vectors: no vectors configured. Pass `vectors` to createShardDO().",["deleteByIds","getByIds","query","upsert","upsertMany","upsertNow"]):"",s=t?`            const vectorShardKey = this.currentShardKey();
 `:"",d=t?"namespace: vectorShardKey === ROOT_SHARD_NAME ? undefined : vectorShardKey, ":"",f=`, { ${["deferAfterCommit: (work) => this.deferAfterCommit(work)",...t?["namespace: vectorShardKey === ROOT_SHARD_NAME ? undefined : vectorShardKey",`shardedIndexNames: [${e.map(S=>JSON.stringify(S)).join(", ")}]`]:[]].join(", ")} }`,c=n?`
             const vectorSync = this.vectorSync(env);
             // Vectorize lives outside this shard's SQLite, so a query whose result

package/dist/packem_shared/{shard-runtime-BX0xmo0P.mjs → shard-runtime-CkTgY8tL.mjs}

@@ -115,7 +115,7 @@ const LUNORA_FLAG_KEYS = ${b(e,'ReadonlyArray<{ key: string; type: "boolean" | "
                 telemetry: { metrics, trace },
             });
 `,configField:`
-    ai?: (env: Record<string, unknown>) => AiBindingLike;`,importLines:['import type { AiBindingLike, LunoraAi } from "@lunora/ai";','import { createAi } from "@lunora/ai";'],stub:""}),S=()=>({build:`
+    ai?: (env: Record<string, unknown>) => AiBindingLike;`,importLines:['import type { AiBindingLike, LunoraAi } from "@lunora/ai/create";','import { createAi } from "@lunora/ai/create";'],stub:""}),S=()=>({build:`
             const access = accessFacade(identity, userId);
 `,configField:"",importLines:['import { accessFacade } from "@lunora/cloudflare-access/context";'],stub:""}),w=()=>({build:`
             const r2sqlEnv = env as Record<string, unknown>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/codegen",
-  "version": "1.0.0-alpha.304",
+  "version": "1.0.0-alpha.306",
   "description": "Code generator for Lunora: emits _generated/{api,server,dataModel}.ts from your schema",
   "keywords": [
     "cloudflare",
@@ -46,8 +46,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/advisor": "1.0.0-alpha.217",
-    "@lunora/agent": "1.0.0-alpha.207",
+    "@lunora/advisor": "1.0.0-alpha.218",
+    "@lunora/agent": "1.0.0-alpha.208",
     "@lunora/container": "1.0.0-alpha.75",
     "@lunora/errors": ">=1.0.0-alpha.51 <2.0.0-0",
     "@lunora/platform": "1.0.0-alpha.64",