@lunora/codegen 1.0.0-alpha.335 → 1.0.0-alpha.337

package/dist/packem_shared/{shard-CsfiXxV0.mjs → shard-BCqz_05A.mjs}

@@ -1,4 +1,4 @@
-import{LunoraError as de}from"@lunora/errors";import{serializeSchemaSnapshot as Ht,hashSchemaSnapshot as Vt}from"./SCHEMA_SNAPSHOT_VERSION-C0oHwiJZ.mjs";import{isHyperdriveGlobalTable as Kt,isD1GlobalTable as Gt}from"./isD1GlobalTable-udvHAAzD.mjs";import{r as Qt}from"./json-data-Chfs2Cz5.mjs";import{r as E,e as Jt,a as zt,b as Yt,c as Xt,d as Zt,f as er,g as tr,h as rr,i as nr,j as ar,k as sr,l as or,m as ir,n as dr,o as cr,p as lr,q as ur}from"./shard-runtime-BpoCV-aM.mjs";import{u as Y,i as hr,a as pr,I as mr,c as gr,G as fr,d as br}from"./shared-DnCokNcE.mjs";import{p as wr}from"./platform-8oj7iXQy.mjs";import{i as yr}from"./schema-BgM8A3XV.mjs";const h=(n,e)=>`((): (() => ${e}) => { let cached: ${e} | undefined; return () => (cached ??= JSON.parse(${JSON.stringify(JSON.stringify(n))}) as ${e}); })()`,ce=["categories","description","facing","level","remediation","title"],vr=n=>{const e={};return{advisoryRows:n.map(a=>{let r=e[a.name];return r||(r=Object.fromEntries(ce.filter(o=>o in a).map(o=>[o,a[o]])),e[a.name]=r),Object.fromEntries(Object.entries(a).filter(([o,d])=>!ce.includes(o)||JSON.stringify(d)!==JSON.stringify(r[o])))}),advisoryRules:e}},kr=`        /**
+import{LunoraError as he}from"@lunora/errors";import{serializeSchemaSnapshot as Jt,hashSchemaSnapshot as Yt}from"./SCHEMA_SNAPSHOT_VERSION-C7Um0EnM.mjs";import{isHyperdriveGlobalTable as zt,isD1GlobalTable as Xt}from"./isD1GlobalTable-udvHAAzD.mjs";import{r as Zt}from"./json-data-Chfs2Cz5.mjs";import{r as $,e as er,a as tr,b as rr,c as nr,d as ar,f as sr,g as or,h as ir,i as dr,j as cr,k as lr,l as ur,m as hr,n as pr,o as mr,p as gr,q as fr}from"./shard-runtime-ByYXjCKY.mjs";import{u as re,h as br,s as wr,a as yr,I as vr,c as kr,G as Sr,d as Rr}from"./shared-8vTRkL2-.mjs";import{p as xr}from"./platform-8oj7iXQy.mjs";import{i as Ar}from"./schema-BgM8A3XV.mjs";const u=(n,t)=>`((): (() => ${t}) => { let cached: ${t} | undefined; return () => (cached ??= JSON.parse(${JSON.stringify(JSON.stringify(n))}) as ${t}); })()`,pe=["categories","description","facing","level","remediation","title"],Or=n=>{const t={};return{advisoryRows:n.map(a=>{let r=t[a.name];return r||(r=Object.fromEntries(pe.filter(o=>o in a).map(o=>[o,a[o]])),t[a.name]=r),Object.fromEntries(Object.entries(a).filter(([o,d])=>!pe.includes(o)||JSON.stringify(d)!==JSON.stringify(r[o])))}),advisoryRules:t}},Dr=`        /**
          * The bare writer every admin/maintenance entry point writes through.
          *
          * Admin and maintenance writes go through the SAME reactive-cache hooks as a
@@ -30,7 +30,7 @@ import{LunoraError as de}from"@lunora/errors";import{serializeSchemaSnapshot as
                 schema: schema as unknown as SchemaLike,
                 sql: this.sql as SqlExec,
             });
-        }`,g=(n="")=>`            const writer = this.adminWriter(${n});`,Sr=`${kr}
+        }`,w=(n="")=>`            const writer = this.adminWriter(${n});`,Tr=`${Dr}
 
         protected override async runShardDataMigration(args: RunShardMigrationArgs): Promise<MigrationRunResult> {
             this.ensureMigrated();
@@ -47,21 +47,27 @@ import{LunoraError as de}from"@lunora/errors";import{serializeSchemaSnapshot as
                 throw new LunoraError("MIGRATION_NOT_FOUND", \`data migration "\${args.id}" is not registered\`, { status: 404 });
             }
 
-${g()}
-
-            return runDataMigration({
-                ...(args.batchSize === undefined ? {} : { batchSize: args.batchSize }),
-                ...(args.direction === undefined ? {} : { direction: args.direction }),
-                ...(args.dryRun === undefined ? {} : { dryRun: args.dryRun }),
-                ...(args.maxBatches === undefined ? {} : { maxBatches: args.maxBatches }),
-                migration: migration as unknown as DataMigrationLike,
-                // Flush after each batch so live migrationStatus subscribers see
-                // progress mid-run (the base method records the reserved state
-                // table the raw-SQL progress write is invisible to the tracker).
-                onBatch: () => this.flushMigrationProgress(),
-                sql: this.sql as SqlExec,
-                writer,
-            });
+${w()}
+
+            try {
+                return await runDataMigration({
+                    ...(args.batchSize === undefined ? {} : { batchSize: args.batchSize }),
+                    ...(args.direction === undefined ? {} : { direction: args.direction }),
+                    ...(args.dryRun === undefined ? {} : { dryRun: args.dryRun }),
+                    ...(args.maxBatches === undefined ? {} : { maxBatches: args.maxBatches }),
+                    migration: migration as unknown as DataMigrationLike,
+                    // Flush after each batch so live migrationStatus subscribers see
+                    // progress mid-run (the base method records the reserved state
+                    // table the raw-SQL progress write is invisible to the tracker).
+                    onBatch: () => this.flushMigrationProgress(),
+                    sql: this.sql as SqlExec,
+                    writer,
+                });
+            } finally {
+                // The de-dup that unblocks a deferred UNIQUE index runs through here;
+                // let the next call rebuild it now instead of after the retry interval.
+                this.migrationRetryAt = 0;
+            }
         }
 
         protected override async runShardWrite(args: RunShardWriteArgs, headroom?: TransactionHeadroomTracker): Promise<RunShardWriteResult> {
@@ -80,7 +86,7 @@ ${g()}
 
             this.ensureMigrated();
 
-${g("headroom ?? this.transactionHeadroom()")}
+${w("headroom ?? this.transactionHeadroom()")}
 
             if (args.op === "insert") {
                 const id = await writer.insert(args.table, args.doc ?? {});
@@ -135,7 +141,7 @@ ${g("headroom ?? this.transactionHeadroom()")}
         protected override async runShardExport(args: RunShardExportArgs): Promise<ExportRow[]> {
             this.ensureMigrated();
 
-${g()}
+${w()}
 
             const rows: ExportRow[] = [];
 
@@ -152,7 +158,7 @@ ${g()}
         protected override async runShardImport(args: RunShardImportArgs): Promise<ImportShardResult> {
             this.ensureMigrated();
 
-${g()}
+${w()}
 
             // \`importShardRows\` inserts with \`allowExplicitId\`, so a source
             // database's \`_id\`s carry across verbatim and every foreign key
@@ -163,7 +169,7 @@ ${g()}
         protected override async runShardRankBefore(args: RunShardRankBeforeArgs): Promise<{ before: number; total: number }> {
             this.ensureMigrated();
 
-${g()}
+${w()}
 
             // \`rankBefore\` is optional on \`DatabaseWriterLike\` (the D1 twin omits it),
             // but the shard writer from \`createShardCtxDb\` always defines it.
@@ -181,7 +187,7 @@ ${g()}
         protected override async runShardFindRelated(args: RunShardFindRelatedArgs): Promise<RelatedPage> {
             this.ensureMigrated();
 
-${g()}
+${w()}
 
             // \`related\` is optional on \`DatabaseWriterLike\` (the D1 twin omits it),
             // but the shard writer from \`createShardCtxDb\` always defines it — it
@@ -199,7 +205,7 @@ ${g()}
         protected override async runShardRankPage(args: RunShardRankPageArgs): Promise<ShardRankPageResult> {
             this.ensureMigrated();
 
-${g()}
+${w()}
 
             // \`rankPageRows\` is optional on \`DatabaseWriterLike\` (the D1 twin omits it),
             // but the shard writer from \`createShardCtxDb\` always defines it. The sort
@@ -220,21 +226,21 @@ ${g()}
         protected override async runShardApplyCdc(args: RunShardApplyCdcArgs): Promise<{ applied: number }> {
             this.ensureMigrated();
 
-${g()}
+${w()}
 
             await applyCdcChanges(writer, args.changes);
 
             return { applied: args.changes.length };
-        }`,Rr=({actionOnlyBuild:n,actionOnlyFields:e,agentsBuild:t,agentsContextField:a,containersBuild:r,containersContextField:o,databaseOptions:d,everyContextBuild:f,everyContextField:v,facadeBlock:l,globalDatabaseLine:b,lazyFunctions:c=!1,notifyBuild:L,ormContextField:S,paymentsBuild:R,paymentsContextField:I,queuesBuild:P,queuesContextField:k,topicsBuild:N,topicsContextField:i,vectorsBuild:w,vectorsContextField:M,workflowsBuild:$,workflowsContextField:q})=>{const x=e.length>0,F=S===""?"{ db }":"{ db, orm: bindOrm(facade) }",U=S===""?"":`
-                orm: databaseContext.orm,`,O=S===""?"":`
-                                orm: { configurable: true, enumerable: true, value: mutationDatabase.orm, writable: true },`,u=x?`
+        }`,_r=({actionOnlyBuild:n,actionOnlyFields:t,agentsBuild:e,agentsContextField:a,containersBuild:r,containersContextField:o,databaseOptions:d,everyContextBuild:m,everyContextField:g,facadeBlock:h,globalDatabaseLine:x,hasSensitiveArgs:S=!1,lazyFunctions:f=!1,notifyBuild:c,ormContextField:y,paymentsBuild:M,paymentsContextField:A,queuesBuild:q,queuesContextField:F,topicsBuild:R,topicsContextField:U,vectorsBuild:i,vectorsContextField:v,workflowsBuild:E,workflowsContextField:B})=>{const I=t.length>0,C=y===""?"{ db }":"{ db, orm: bindOrm(facade) }",j=y===""?"":`
+                orm: databaseContext.orm,`,W=y===""?"":`
+                                orm: { configurable: true, enumerable: true, value: mutationDatabase.orm, writable: true },`,O=I?`
             // ActionCtx-only helpers (external, non-deterministic I/O): constructed
             // and attached only for an \`action\` so query/mutation ctx never carry them.
             if (isAction) {
-${n.replaceAll(/^(?=.)/gmu,"    ")}${e.map(p=>`                ctx.${p} = ${p};`).join(`
+${n.replaceAll(/^(?=.)/gmu,"    ")}${t.map(p=>`                ctx.${p} = ${p};`).join(`
 `)}
             }
-`:"";return`        private buildCtx(options: { bookmarks?: DispatchBookmark | undefined; functionPath?: string | undefined; headroom?: TransactionHeadroomTracker | undefined; identity?: SubscriptionIdentity | undefined; kind?: "query" | undefined; onRead?: ((table: string, idOrScan?: string) => void) | undefined; onReadRange?: ((range: KeyRange) => void) | undefined; scope?: QueryReadScope | undefined; trusted?: boolean | undefined } = {}): unknown {
+`:"";return`        private buildCtx(options: { bookmarks?: DispatchBookmark | undefined; functionPath?: string | undefined; headroom?: TransactionHeadroomTracker | undefined; identity?: SubscriptionIdentity | undefined; kind?: "query" | undefined; onRead?: ((table: string, idOrScan?: string) => void) | undefined; onReadRange?: ((range: KeyRange) => void) | undefined; scope?: QueryReadScope | undefined; sensitive?: SensitiveScope | undefined; trusted?: boolean | undefined } = {}): unknown {
             const env = (this.env ?? {}) as Record<string, unknown>;
             // The caller context this ctx runs under, resolved ONCE on one
             // discriminant. When the caller threads an explicit identity
@@ -261,7 +267,7 @@ ${n.replaceAll(/^(?=.)/gmu,"    ")}${e.map(p=>`                ctx.${p} = ${p};`
                 };
             })();
             const { identity, ip, userId } = caller;
-${w}${f}${r}${$}${P}${N}${t}
+${i}${m}${r}${E}${q}${R}${e}
             // Which dispatch this ctx belongs to. Drives the two deferral facades
             // below and the \`ctx.run*\` caller guard; a ctx built for an
             // admin/lifecycle path has no registered function, and so no kind. An
@@ -357,7 +363,7 @@ ${w}${f}${r}${$}${P}${N}${t}
             // dispatch's wide-event handle.
             const observability = config.observability?.(env);
             const logFunctionPath = options.functionPath ?? "";
-            const log = this.makeLogger(logFunctionPath, observability);
+            const log = this.makeLogger(logFunctionPath, observability, undefined, options.sensitive);
             const traceAnchor = this.resolveDispatchAnchor(Boolean(options.identity));
 
             // \`ctx.span\`: the handle onto the DISPATCH's own span — the wide-event
@@ -365,9 +371,9 @@ ${w}${f}${r}${$}${P}${N}${t}
             // and are folded into the one span it already emits, instead of
             // becoming N separate log lines. Shares \`traceAnchor\` with \`ctx.trace\`
             // so both write to the same trace.
-            const span = this.makeDispatchSpan(traceAnchor, observability);
+            const span = this.makeDispatchSpan(traceAnchor, observability, options.sensitive);
 
-${b}            // \`ctx.db\`, wrapped in automatic instrumentation: by default this
+${x}            // \`ctx.db\`, wrapped in automatic instrumentation: by default this
             // adds aggregate counters (call count, total time, per-operation
             // breakdown) to the wide event rather than a span per call, so a
             // handler making hundreds of queries stays readable. See
@@ -375,20 +381,20 @@ ${b}            // \`ctx.db\`, wrapped in automatic instrumentation: by default
             // Schema triggers close over this DB's scheduler, so a composed
             // mutation must rebuild its DB and table/ORM views with its own queue.
             const makeDatabaseContext = (scheduler: SchedulerLike) => {
-                const db: DatabaseWriterLike = this.instrumentDb(createShardCtxDb(${d}), logFunctionPath, traceAnchor, observability);
-${l}                return ${F};
+                const db: DatabaseWriterLike = this.instrumentDb(createShardCtxDb(${d}), logFunctionPath, traceAnchor, observability, options.sensitive);
+${h}                return ${C};
             };
             const databaseContext = makeDatabaseContext(scheduler);
             const db = databaseContext.db;
-${R}
+${M}
 
             // \`ctx.trace\` / \`ctx.metrics\`: spans and measurements to the same sink.
             // The trace anchor is threaded explicitly for the same reason \`identity\`
             // is — a deferred caller (a subscription re-run) must not inherit the
             // writing mutation's trace from the shared per-request field.
-            const trace = this.makeTracer(logFunctionPath, observability, traceAnchor);
-            const metrics = this.makeMetrics(logFunctionPath, observability);
-${L}
+            const trace = this.makeTracer(logFunctionPath, observability, traceAnchor, options.sensitive);
+            const metrics = this.makeMetrics(logFunctionPath, observability, options.sensitive);
+${c}
             // \`ctx.now\`: the wall-clock instant (epoch ms) this function began,
             // captured ONCE so the whole handler body sees a single stable value.
             // A \`query\` handler is re-run by every live subscription that reads it,
@@ -418,7 +424,7 @@ ${L}
                 // \`traceparent\` propagation, so time spent in a downstream service
                 // is visible and its spans join this trace. Degrades to the bare
                 // global when no sink is configured.
-                fetch: this.makeFetch(logFunctionPath, traceAnchor, observability),
+                fetch: this.makeFetch(logFunctionPath, traceAnchor, observability, options.sensitive),
                 // A GETTER, not a plain field, so the reactive cache can tell a
                 // handler that reads the caller's address from the majority that
                 // never do. \`ctx.ip\` is per-request state the memo must be keyed
@@ -439,25 +445,32 @@ ${L}
                 // to the handler so code that signs its own URLs (a copy-in
                 // \`createStorage\`) can fall back to it too. \`undefined\` for a
                 // query and for a deferred dispatch, for the reasons given there.
-                origin: requestOrigin,${U}
+                origin: requestOrigin,${j}
                 scheduler,
                 span,
                 storage: contextStorage,
-                trace,${M}${v}${I}${o}${q}${k}${i}${a}
+                trace,${v}${g}${A}${o}${B}${F}${U}${a}${S?`
+                [Symbol.for("lunora.admitSensitiveArgs")]: (args: Record<string, unknown>, names: ReadonlySet<string>): void => this.admitSensitiveValues(options.sensitive, args, names),`:""}
             };
-${x?`            const isAction = contextKind === "action";
-`:""}${u}
-${c?`            const captureScope = (): (() => void) => {
+${I?`            const isAction = contextKind === "action";
+`:""}${O}
+${f?`            const captureScope = (): (() => void) => {
                 const requestScope = this.captureRequestScope();
                 return () => this.restoreRequestScope(requestScope);
             };
 
 `:""}            const installRun = (target: Record<string, unknown>, kind: typeof contextKind): void => {
-                target.runAction = (reference: FunctionReference, fnArgs: Record<string, unknown>) => dispatchRun("action", reference.__lunoraRef, fnArgs, target, kind${c?", undefined, captureScope":""});
+                target.runAction = (reference: FunctionReference, fnArgs: Record<string, unknown>) => {
+                    // The callee runs inside this invocation, so its marked arguments are scrubbed here too.
+                    this.admitSensitiveArgs(options.sensitive, reference.__lunoraRef, fnArgs);
+
+                    return dispatchRun("action", reference.__lunoraRef, fnArgs, target, kind${f?", undefined, captureScope":""});
+                };
                 // The composed mutation runs under the SAME wrapper the top-level RPC
                 // uses, so "do the transactional work in a mutation and call it from the
                 // action" — the recipe the docs give for atomicity — actually is atomic.
                 target.runMutation = (reference: FunctionReference, fnArgs: Record<string, unknown>) => {
+                    this.admitSensitiveArgs(options.sensitive, reference.__lunoraRef, fnArgs);
                     // An action can start sibling mutations concurrently. Each owns its
                     // context and deferral queues; only calls from an admitted mutation
                     // inherit that mutation's transaction.
@@ -469,7 +482,7 @@ ${c?`            const captureScope = (): (() => void) => {
 
                             return Object.defineProperties({}, {
                                 ...Object.getOwnPropertyDescriptors(target),
-                                db: { configurable: true, enumerable: true, value: mutationDatabase.db, writable: true },${O}
+                                db: { configurable: true, enumerable: true, value: mutationDatabase.db, writable: true },${W}
                                 scheduler: { configurable: true, enumerable: true, value: mutationScheduler, writable: true },
                                 storage: { configurable: true, enumerable: true, value: withDeferredDeletes(storage), writable: true },
                             });
@@ -479,7 +492,7 @@ ${c?`            const captureScope = (): (() => void) => {
                         installRun(mutationCtx, kind);
                     }
 
-                    return dispatchRun("mutation", reference.__lunoraRef, fnArgs, mutationCtx, kind, async (work) => this.runMutationTransaction(mutationCtx, work)${c?", captureScope":""});
+                    return dispatchRun("mutation", reference.__lunoraRef, fnArgs, mutationCtx, kind, async (work) => this.runMutationTransaction(mutationCtx, work)${f?", captureScope":""});
                 };
                 // \`ctx.runQuery(ref, args, { untracked: true })\` runs the sub-query on
                 // its OWN query context, built without the subscription's read-footprint
@@ -494,18 +507,21 @@ ${c?`            const captureScope = (): (() => void) => {
                 // to the shared per-request fields, which a concurrent RPC may have
                 // re-set, and an RLS-scoped sub-query would then read as the wrong user
                 // from the wrong address. A tracked call runs on \`queryContext()\` below.
-                target.runQuery = (reference: FunctionReference, fnArgs: Record<string, unknown>, runOptions?: { untracked?: boolean }) =>
-                    dispatchRun(
+                target.runQuery = (reference: FunctionReference, fnArgs: Record<string, unknown>, runOptions?: { untracked?: boolean }) => {
+                    this.admitSensitiveArgs(options.sensitive, reference.__lunoraRef, fnArgs);
+
+                    return dispatchRun(
                         "query",
                         reference.__lunoraRef,
                         fnArgs,
                         runOptions?.untracked === true
-                            ? this.buildCtx({ bookmarks: options.bookmarks, functionPath: options.functionPath, headroom: options.headroom, identity: caller, kind: "query", scope: options.scope })
+                            ? this.buildCtx({ bookmarks: options.bookmarks, functionPath: options.functionPath, headroom: options.headroom, identity: caller, kind: "query", scope: options.scope, sensitive: options.sensitive })
                             : queryContext(),
-                        kind,${c?`
+                        kind,${f?`
                         undefined,
                         captureScope,`:""}
                     );
+                };
             };
 
             // A query composed from a mutation or action runs on a QUERY view of
@@ -526,7 +542,7 @@ ${c?`            const captureScope = (): (() => void) => {
 
                 if (queryView === undefined) {
                     const descriptors: PropertyDescriptorMap = Object.getOwnPropertyDescriptors(ctx);
-${e.map(p=>`                    delete descriptors.${p};
+${t.map(p=>`                    delete descriptors.${p};
 `).join("")}                    // Writable and configurable, like the plain fields they replace.
                     const field = (value: unknown): PropertyDescriptor => ({ configurable: true, enumerable: true, value, writable: true });
 
@@ -545,7 +561,7 @@ ${e.map(p=>`                    delete descriptors.${p};
             installRun(ctx, contextKind);
 
             return ctx;
-        }`},le=`// Bound in-process \`ctx.run*\` composition depth so a self- or cyclically-
+        }`},me=`// Bound in-process \`ctx.run*\` composition depth so a self- or cyclically-
 // referencing call fails loudly with a clear error instead of overflowing the
 // stack. Tracked across the awaited handler chain (one DO invocation is
 // single-threaded), so the counter reflects true nesting depth.
@@ -611,7 +627,7 @@ const dispatchRun = async (
     } finally {
         runDepth -= 1;
     }
-};`,xr=n=>n?le.replace("    runTransactional?: (work: () => Promise<unknown>) => Promise<unknown>,",`    runTransactional?: (work: () => Promise<unknown>) => Promise<unknown>,
+};`,Er=n=>n?me.replace("    runTransactional?: (work: () => Promise<unknown>) => Promise<unknown>,",`    runTransactional?: (work: () => Promise<unknown>) => Promise<unknown>,
     captureScope?: () => () => void,`).replace(`    try {
         // A mutation composed from an action`,`    try {
         let loaded = getLoadedFunction(functionPath);
@@ -632,7 +648,20 @@ const dispatchRun = async (
 
         const loadedFunction = loaded;
 
-        // A mutation composed from an action`).replaceAll("registered.handler","loadedFunction.handler"):le,Or=`        public override async handleRpc(functionPath: string, args: Record<string, unknown>, headroom?: TransactionHeadroomTracker, scope?: QueryReadScope, bookmarks?: DispatchBookmark): Promise<unknown> {
+        // A mutation composed from an action`).replaceAll("registered.handler","loadedFunction.handler"):me,Ir=`        public override async handleRpc(functionPath: string, args: Record<string, unknown>, headroom?: TransactionHeadroomTracker, scope?: QueryReadScope, bookmarks?: DispatchBookmark, sensitive?: SensitiveScope): Promise<unknown> {
+            // A dispatch that did not come through the shard's \`/rpc\` (a scheduled call,
+            // a lifecycle hook, an admin run) has no scope of its own, so it opens one here
+            // and releases it when the handler settles.
+            if (sensitive === undefined) {
+                const own = this.openSensitiveScope(functionPath, args);
+
+                try {
+                    return await this.handleRpc(functionPath, args, headroom, scope, bookmarks, own);
+                } finally {
+                    own.clear();
+                }
+            }
+
 __PREPARE_FUNCTION__            const registered = LUNORA_FUNCTIONS[functionPath];
 
             // Internal functions are reachable server-side only: via \`ctx.run*\`
@@ -643,7 +672,7 @@ __PREPARE_FUNCTION__            const registered = LUNORA_FUNCTIONS[functionPath
                 throw new LunoraError("FUNCTION_NOT_FOUND", \`function not registered: \${functionPath}\`);
             }
 
-            this.ensureMigrated();
+            this.ensureServable();
 
             // \`headroom\`, when the caller supplied one, is threaded straight
             // through to \`buildCtx\` — bypassing its \`this.transactionHeadroom()\`
@@ -659,7 +688,7 @@ __PREPARE_FUNCTION__            const registered = LUNORA_FUNCTIONS[functionPath
             // our dep set — and ours out of theirs. A dispatch with no scope (a
             // mutation, an action, a cache-less shard) builds unbound hooks that
             // stamp no deps.
-            const ctx = this.buildCtx({ bookmarks, functionPath, headroom, scope, trusted: registered.lifecycle === "init" });
+            const ctx = this.buildCtx({ bookmarks, functionPath, headroom, scope, sensitive, trusted: registered.lifecycle === "init" });
 
             // A mutation's writes must commit all-or-nothing, so its dispatch runs
             // under \`runMutationTransaction\` — the ONE place that opens the span,
@@ -816,14 +845,14 @@ __COMMITTED_CATCH__            } finally {
         // \`ctx.scheduler\` call that reached the buffer in the first place.
         protected override scheduleOutboxScheduler(): SchedulerLike | undefined {
             return config.scheduler?.((this.env ?? {}) as Record<string, unknown>) as SchedulerLike | undefined;
-        }`,Ar=`        protected override async executeSubscription(functionPath: string, args: Record<string, unknown>, identity?: SubscriptionIdentity): Promise<{ ranges?: Map<string, KeyRange[]>; result: unknown; tables: Set<string> } | null> {
+        }`,Cr=`        protected override async executeSubscription(functionPath: string, args: Record<string, unknown>, identity?: SubscriptionIdentity): Promise<{ ranges?: Map<string, KeyRange[]>; result: unknown; tables: Set<string> } | null> {
             const registered = LUNORA_FUNCTIONS[functionPath];
 
             if (!registered || registered.kind !== "query" || registered.visibility === "internal") {
                 return null;
             }
 
-__PREPARE_FUNCTION__            this.ensureMigrated();
+__PREPARE_FUNCTION__            this.ensureServable();
 
             const footprint = createReadFootprint();
             // Identity is threaded EXPLICITLY from the (deferred/interleaved)
@@ -846,7 +875,7 @@ __PREPARE_FUNCTION__            this.ensureMigrated();
                 return null;
             }
 
-            this.ensureMigrated();
+            this.ensureServable();
 
             return {
                 ...(registered.durable ? { durable: registered.durable as { ttlMs?: number } } : {}),
@@ -857,7 +886,7 @@ __PREPARE_FUNCTION__            this.ensureMigrated();
                 // \`ctx.auth\` stream as nobody — or as a concurrent RPC's caller.
                 iterator: (signal) => (registered.handler as (context: unknown, args: Record<string, unknown>, signal: AbortSignal) => AsyncIterable<unknown>)(this.buildCtx({ functionPath, identity }), args, signal),
             };
-        }`,Dr=`            } catch (error) {
+        }`,Lr=`            } catch (error) {
                 // The write committed before this failed. Mark the error so the caller can tell
                 // a durable write from a rollback: the rethrow still reaches the caller unchanged.
                 if (typeof error === "object" && error !== null) {
@@ -865,13 +894,13 @@ __PREPARE_FUNCTION__            this.ensureMigrated();
                 }
 
                 throw error;
-`,Tr=(n,e=!1)=>{const t=e?`            const registeredBeforeLoad = LUNORA_FUNCTIONS[functionPath];
+`,Pr=(n,t=!1)=>{const e=t?`            const registeredBeforeLoad = LUNORA_FUNCTIONS[functionPath];
 
             if (registeredBeforeLoad?.visibility === "internal" && !this.isSystemDispatch()) {
                 throw new LunoraError("FUNCTION_NOT_FOUND", "function not registered: " + functionPath);
             }
 
-`:"",a=e?`            const requestScope = this.captureRequestScope();
+`:"",a=t?`            const requestScope = this.captureRequestScope();
             const preparation = this.prepareFunction(functionPath, "rpc");
 
             if (preparation !== undefined) {
@@ -882,21 +911,33 @@ __PREPARE_FUNCTION__            this.ensureMigrated();
                 }
             }
 
-`:"";return Or.replace("__COMMITTED_CATCH__",n?Dr:"").replace("__PREPARE_FUNCTION__",`${t}${a}`)},Cr=n=>{const e={};for(const t of n.tables){const a={};for(const[r,o]of Object.entries(t.shape)){const d=Y(o);d.kind==="id"&&d.tableName!==void 0&&(a[r]=d.tableName)}Object.keys(a).length>0&&(e[t.name]=a)}return e},_r=n=>{const e={};for(const t of n.tables){const a=[];for(const[r,o]of Object.entries(t.shape))Y(o).kind==="storage"&&a.push(r);a.length>0&&(e[t.name]=a)}return e},Er=n=>{const e={};for(const t of n.tables){const a=[...t.indexes.map(r=>({fields:[...r.fields],name:r.name,type:"index",...r.unique===!0?{unique:!0}:{}})),...t.searchIndexes.map(r=>({fields:[r.field,...r.filterFields??[]],name:r.name,type:"search"})),...(t.geoIndexes??[]).map(r=>({fields:[r.field],name:r.name,type:"geo"})),...t.rankIndexes.map(r=>({fields:r.sortBy.map(o=>o.field),name:r.name,type:"rank"})),...t.vectorIndexes.map(r=>({fields:r.field===void 0?[]:[r.field],name:r.name,type:"vector"}))];a.length>0&&(e[t.name]=a)}return e},Lr=n=>{const e=[];for(const t of n.tables)!t.ttl||t.shardMode==="global"||e.push({...t.ttl.after===void 0?{}:{after:t.ttl.after},field:t.ttl.field,...t.softDelete?{softDeleteField:t.softDelete.field}:{},table:t.name});return e},Ir=n=>{if(n.kind!=="union"||n.members===void 0||n.members.length===0)return;const e=[];for(const t of n.members){if(t.kind!=="literal"||t.literalValue===void 0)return;try{const a=JSON.parse(t.literalValue);if(typeof a!="string")return;e.push(a)}catch{return}}return e},Pr=(n,e,t)=>{const a=Y(e),r={name:n,optional:hr(e),type:a.kind};if(a.kind==="id"&&a.tableName!==void 0){r.ref=a.tableName;const d=t.get(n);d!==void 0&&(r.onDelete=d)}a.kind==="storage"&&(r.isStorage=!0,a.bucket!==void 0&&(r.bucket=a.bucket));const o=Ir(a);return o!==void 0&&(r.enumValues=o),a.column?.notNull===!1&&(r.nullable=!0),r},Nr=n=>{const e={};for(const t of n.tables){const a=[{name:"_id",optional:!1,pk:!0,type:"id"},{name:"_creationTime",optional:!1,type:"number"},...t.commitOrdered===!0?[{name:"_commitSeq",optional:!1,type:"number"}]:[]],r=new Map(t.relations.flatMap(o=>o.kind==="one"?[[o.field,o.onDelete]]:[]));for(const[o,d]of Object.entries(t.shape))a.push(Pr(o,d,r));e[t.name]=a}return e},Mr=({hasMutators:n,hasShapes:e,rlsData:t})=>{const a=e?`
-        protected override resolveShape(name: string, args: Record<string, unknown>, identity?: SubscriptionIdentity): { columns?: readonly string[]; effectiveWhere?: WhereInput; global?: boolean; table: string } | undefined {
+`:"";return Ir.replace("__COMMITTED_CATCH__",n?Lr:"").replace("__PREPARE_FUNCTION__",`${e}${a}`)},Nr=n=>{const t={};for(const e of n.tables){const a={};for(const[r,o]of Object.entries(e.shape)){const d=re(o);d.kind==="id"&&d.tableName!==void 0&&(a[r]=d.tableName)}Object.keys(a).length>0&&(t[e.name]=a)}return t},$r=n=>{const t={};for(const e of n.tables){const a=[];for(const[r,o]of Object.entries(e.shape))re(o).kind==="storage"&&a.push(r);a.length>0&&(t[e.name]=a)}return t},Mr=n=>{const t={};for(const e of n.tables){const a=[...e.indexes.map(r=>({fields:[...r.fields],name:r.name,type:"index",...r.unique===!0?{unique:!0}:{}})),...e.searchIndexes.map(r=>({fields:[r.field,...r.filterFields??[]],name:r.name,type:"search"})),...(e.geoIndexes??[]).map(r=>({fields:[r.field],name:r.name,type:"geo"})),...e.rankIndexes.map(r=>({fields:r.sortBy.map(o=>o.field),name:r.name,type:"rank"})),...e.vectorIndexes.map(r=>({fields:r.field===void 0?[]:[r.field],name:r.name,type:"vector"}))];a.length>0&&(t[e.name]=a)}return t},qr=n=>{const t=[];for(const e of n.tables)!e.ttl||e.shardMode==="global"||t.push({...e.ttl.after===void 0?{}:{after:e.ttl.after},field:e.ttl.field,...e.softDelete?{softDeleteField:e.softDelete.field}:{},table:e.name});return t},Fr=n=>{if(n.kind!=="union"||n.members===void 0||n.members.length===0)return;const t=[];for(const e of n.members){if(e.kind!=="literal"||e.literalValue===void 0)return;try{const a=JSON.parse(e.literalValue);if(typeof a!="string")return;t.push(a)}catch{return}}return t},Ur=(n,t,e)=>{const a=re(t),r={name:n,optional:br(t),type:a.kind};if(a.kind==="id"&&a.tableName!==void 0){r.ref=a.tableName;const d=e.get(n);d!==void 0&&(r.onDelete=d)}a.kind==="storage"&&(r.isStorage=!0,a.bucket!==void 0&&(r.bucket=a.bucket));const o=Fr(a);return o!==void 0&&(r.enumValues=o),a.column?.notNull===!1&&(r.nullable=!0),r},Br=n=>{const t={};for(const e of n.tables){const a=[{name:"_id",optional:!1,pk:!0,type:"id"},{name:"_creationTime",optional:!1,type:"number"},...e.commitOrdered===!0?[{name:"_commitSeq",optional:!1,type:"number"}]:[]],r=new Map(e.relations.flatMap(o=>o.kind==="one"?[[o.field,o.onDelete]]:[]));for(const[o,d]of Object.entries(e.shape))a.push(Ur(o,d,r));t[e.name]=a}return t},jr=({hasMutators:n,hasSensitiveShapes:t,hasShapes:e,rlsData:a})=>{const r="{ columns?: readonly string[]; effectiveWhere?: WhereInput; global?: boolean; table: string } | undefined",o=t?`        protected override resolveShape(name: string, args: Record<string, unknown>, identity?: SubscriptionIdentity): ${r} {
+            const sensitive = this.openSensitiveScope(\`__shape__:\${name}\`, args);
+
+            try {
+                return this.resolveShapeWithScope(name, args, identity, sensitive);
+            } catch (error) {
+                throw this.maskSensitiveError(error, sensitive);
+            } finally {
+                sensitive.clear();
+            }
+        }
+
+        private resolveShapeWithScope(name: string, args: Record<string, unknown>, identity: SubscriptionIdentity | undefined, sensitive: SensitiveScope): ${r} {`:`        protected override resolveShape(name: string, args: Record<string, unknown>, identity?: SubscriptionIdentity): ${r} {`,m=e?`
+${o}
             const shape = LUNORA_SHAPES[name];
 
             if (!shape) {
                 return undefined;
             }
 
-            this.ensureMigrated();
+            this.ensureServable();
 
             // Trusted ctx from the socket's OWN verified identity — the client
             // supplies only the shape name + args; \`compileWhere\` validates the
             // args then runs the shape's \`where(ctx, args)\` under that identity,
             // so which rows replicate is a server decision (reads-as-permissions).
-            const ctx = this.buildCtx({ functionPath: \`__shape__:\${name}\`, identity });
+            const ctx = this.buildCtx({ functionPath: \`__shape__:\${name}\`, identity${t?", sensitive":""} });
             // \`ownerField\` resolves an \`owner: true\` shape: only here is the table's
             // \`.ownedBy(field)\` column in scope, so the DO hands it to the shape
             // rather than every shape restating the ownership check in its \`where\`.
@@ -945,14 +986,14 @@ __PREPARE_FUNCTION__            this.ensureMigrated();
 
             return { ...(shape.columns === undefined ? {} : { columns: shape.columns }), effectiveWhere, global: isGlobal, table: shape.table };
         }
-`:"",r=e?[...new Set(t.policies.filter(l=>l.on==="read"&&l.table!=="").map(l=>l.table))].toSorted((l,b)=>l.localeCompare(b)):[],o=r.length>0?`
+`:"",g=e?[...new Set(a.policies.filter(c=>c.on==="read"&&c.table!=="").map(c=>c.table))].toSorted((c,y)=>c.localeCompare(y)):[],h=g.length>0?`
 /** Refuses to boot a shape that would replicate around the read policies its table is governed by (\`defineShape({ use })\` is how a shape opts in; \`use: []\` acknowledges an ungoverned one). */
-assertShapesDeclareReadPolicies(LUNORA_SHAPES, ${JSON.stringify(r)}, (schema as unknown as { rlsMode?: string }).rlsMode === "required");
+assertShapesDeclareReadPolicies(LUNORA_SHAPES, ${JSON.stringify(g)}, (schema as unknown as { rlsMode?: string }).rlsMode === "required");
 `:"";return{customMutatorOverride:n?`
         protected override isCustomMutator(functionPath: string): boolean {
             return LUNORA_MUTATOR_PATHS.has(functionPath);
         }
-`:"",shapeGuardImport:e?"assertShapeShardable, ":"",shapeReadPolicyAssertion:o,shapeReadPolicyImport:o===""?"":"assertShapesDeclareReadPolicies, ",shapeResolveOverride:a}},$r=(n,e)=>n?`
+`:"",shapeGuardImport:e?"assertShapeShardable, ":"",shapeReadPolicyAssertion:h,shapeReadPolicyImport:h===""?"":"assertShapesDeclareReadPolicies, ",shapeResolveOverride:m}},Wr=(n,t)=>n?`
         protected override async readGlobalShapeRows(resolved: { columns?: readonly string[]; effectiveWhere?: WhereInput; global?: boolean; table: string }, identity?: SubscriptionIdentity): Promise<Array<{ doc: Record<string, unknown>; id: string }>> {
             const env = this.env as Record<string, unknown>;
             // A shape read performs no writes, so the widened request only needs
@@ -972,7 +1013,7 @@ assertShapesDeclareReadPolicies(LUNORA_SHAPES, ${JSON.stringify(r)}, (schema as
                 ...(identity?.identity === undefined ? {} : { identity: identity.identity }),
                 ...(identity?.userId === undefined ? {} : { userId: identity.userId }),
             };
-            const globalDb: DatabaseWriterLike = ${e}?.(env, globalRequest) ?? globalDbStub;
+            const globalDb: DatabaseWriterLike = ${t}?.(env, globalRequest) ?? globalDbStub;
             const rows: Array<{ doc: Record<string, unknown>; id: string }> = [];
 
             let cursor: null | string = null;
@@ -1014,11 +1055,11 @@ assertShapesDeclareReadPolicies(LUNORA_SHAPES, ${JSON.stringify(r)}, (schema as
             // a \`defineShape\`. The Hyperdrive factory simply never reads it.
             const bookmark = this.getInboundBookmark();
             const globalRequest = { ...this.globalCdcOptions(config.cdc ?? false), ...(bookmark === undefined ? {} : { bookmark }) };
-            const globalDb: DatabaseWriterLike = ${e}?.(env, globalRequest) ?? globalDbStub;
+            const globalDb: DatabaseWriterLike = ${t}?.(env, globalRequest) ?? globalDbStub;
 
             return globalDb.cdcChangedTables?.(sinceSeq, cursorOnly === undefined ? {} : { cursorOnly });
         }
-`:"",qr=n=>({externalSourceOverride:n?`
+`:"",Hr=n=>({externalSourceOverride:n?`
         protected override async pollExternalSources(trace?: TraceRefLike): Promise<number | undefined> {
             const env = (this.env ?? {}) as Record<string, unknown>;
             const sourced = Object.entries((schema as unknown as SchemaLike).tables)
@@ -1171,8 +1212,8 @@ assertShapesDeclareReadPolicies(LUNORA_SHAPES, ${JSON.stringify(r)}, (schema as
 `:"",sourceClientCacheConst:n?`
 const sourceClientCache = new WeakMap<object, Map<string, SourceClientLike>>();
 const sourcePollAtCache = new WeakMap<object, Map<string, number>>();
-`:""}),Fr=(n,e)=>{const t=e.length>0,r=n?E("vectorsStub: VectorSearchLike","ctx.vectors: no vectors configured. Pass `vectors` to createShardDO().",["deleteByIds","getByIds","query","upsert","upsertMany","upsertNow"]):"",o=t?`            const vectorShardKey = this.currentShardKey();
-`:"",d=t?"namespace: vectorShardKey === ROOT_SHARD_NAME ? undefined : vectorShardKey, ":"",v=`, { ${["deferAfterCommit: (work) => this.deferAfterCommit(work)",...t?["namespace: vectorShardKey === ROOT_SHARD_NAME ? undefined : vectorShardKey",`shardedIndexNames: [${e.map(c=>JSON.stringify(c)).join(", ")}]`]:[]].join(", ")} }`,l=n?`
+`:""}),Vr=(n,t)=>{const e=t.length>0,r=n?$("vectorsStub: VectorSearchLike","ctx.vectors: no vectors configured. Pass `vectors` to createShardDO().",["deleteByIds","getByIds","query","upsert","upsertMany","upsertNow"]):"",o=e?`            const vectorShardKey = this.currentShardKey();
+`:"",d=e?"namespace: vectorShardKey === ROOT_SHARD_NAME ? undefined : vectorShardKey, ":"",g=`, { ${["deferAfterCommit: (work) => this.deferAfterCommit(work)",...e?["namespace: vectorShardKey === ROOT_SHARD_NAME ? undefined : vectorShardKey",`shardedIndexNames: [${t.map(S=>JSON.stringify(S)).join(", ")}]`]:[]].join(", ")} }`,h=n?`
             const vectorSync = this.vectorSync(env);
             // Vectorize lives outside this shard's SQLite, so a query whose result
             // depends on a similarity search cannot be proven current on reconnect —
@@ -1189,7 +1230,7 @@ const sourcePollAtCache = new WeakMap<object, Map<string, number>>();
             }
 
             const lunora = createVectors({ indexes: config.vectors(env) });
-${o}            const vectors = createContextVectors(lunora${v});
+${o}            const vectors = createContextVectors(lunora${g});
 
             return {
                 backfill: createVectorBackfillSync({ ${d}schema: schema as unknown as VectorSchemaLike, upsertMany: lunora.upsertMany, vectors }),
@@ -1215,14 +1256,14 @@ ${o}            const vectors = createContextVectors(lunora${v});
                 ordered: async (read, work) => this.runOrderedAfterWrites(read, work),
             });
         }
-`:"",vectorsBuild:l,vectorsStub:r}},Xr=({advisories:n=[],advisorProcedures:e=[],agents:t=[],capabilities:a=new Set,containers:r=[],env:o,flagKeys:d=[],hasFlags:f=!1,hasNotify:v=!1,hasRooms:l=!1,hasSockets:b=!1,lazyFunctions:c=!1,hasVectors:L=!0,liveStreamDeclarations:S=[],liveStreams:R=!1,maskMetadata:I,mutators:P=[],queues:k=[],rlsMetadata:N,schema:i,schemaSnapshot:w,shapes:M=[],storageRules:$,studioFeatures:q,services:x=[],topics:F=[],useUmbrella:U=!1,workflows:O=[]})=>{const u=br(U),B=P.length>0,p=M.length>0,ue=w===void 0?"":Ht(w),he=w===void 0?"":`
+`:"",vectorsBuild:h,vectorsStub:r}},on=({advisories:n=[],advisorProcedures:t=[],agents:e=[],capabilities:a=new Set,containers:r=[],env:o,flagKeys:d=[],hasFlags:m=!1,hasNotify:g=!1,hasRooms:h=!1,hasSecretValues:x=!1,hasSensitiveArgs:S=!1,hasSockets:f=!1,lazyFunctions:c=!1,hasVectors:y=!0,liveStreamDeclarations:M=[],liveStreams:A=!1,maskMetadata:q,mutators:F=[],queues:R=[],rlsMetadata:U,schema:i,schemaSnapshot:v,shapes:E=[],storageRules:B,studioFeatures:I,services:C=[],topics:j=[],useUmbrella:W=!1,workflows:O=[]})=>{const l=Rr(W),H=F.length>0,p=E.length>0,D=E.some(s=>wr(s.args).length>0),V=S||D,ge=v===void 0?"":Jt(v),fe=v===void 0?"":`
 /** Structural schema snapshot + its content hash, recorded in the shard's \`__lunora_schema_history\` ledger on cold start so the studio can show a schema-version timeline and diff any two versions. */
-const LUNORA_SCHEMA_SNAPSHOT: { hash: string; json: string } = { hash: ${JSON.stringify(Vt(w))}, json: ${JSON.stringify(ue)} };
-`,pe=w===void 0?"":", schemaSnapshot: LUNORA_SCHEMA_SNAPSHOT",y=Jt(a),T=zt(f,u.flags),j=Yt(d,f,u.flags),W=ur(v),H=Xt(o),{build:me,contextField:ge,importLines:fe,specs:be}=Zt(wr(k)),{build:we,contextField:ye,importLines:ve,specs:ke}=er(F,k),V=tr(x,u.server),{build:Se,contextField:Re,importLines:xe,specs:Oe}=rr(r,i.jurisdiction),{build:Ae,contextField:De,importLines:Te,specs:Ce}=nr(O),{build:_e,contextField:Ee,importLines:Le,specs:Ie}=ar(t),{build:Pe,configField:Ne,contextField:Me,imports:$e,stub:qe}=sr(a.has("payments")),Fe=n,{advisoryRules:Ue,advisoryRows:Be}=vr(Fe),je=e,X=N??{policies:[],roles:[]},We=I??{columns:[]},He=$??{rules:[]},Ve=q??{analytics:!1,auth:!1,containers:!1,flags:!1,kv:!1,mail:!1,notifications:!1,payments:!1,privacy:!1,queues:!1,scheduler:!1,storage:!1,vectors:!1,workflows:!1},{constant:Ke,override:Ge}=or(O),{constant:Qe,override:Je}=ir(k),m=L&&i.vectorIndexes.length>0,K=new Set(i.tables.filter(s=>yr(s)).map(s=>s.name)),Z=m&&i.vectorIndexes.some(s=>K.has(s.table)),A=i.tables.some(s=>s.shardMode==="global"),G=dr(K),Q=i.tables.some(s=>Kt(s)),ee=i.tables.some(s=>Gt(s)),C=i.tables.some(s=>s.externalSource!==void 0),te=i.tables.some(s=>s.memory===!0),J=i.tables.some(s=>s.shardMode!=="global"&&s.searchIndexes.length>0);if(ee&&Q)throw new de("INTERNAL",'lunora codegen: mixing `.global()` (D1) and `.global({ backend: "hyperdrive" })` tables in one app is not supported yet — use a single global backend.');const z=i.tables.length>0,ze=Cr(i),Ye=Er(i),Xe=Nr(i),Ze=_r(i),re=Lr(i),ne=cr(m,O.length>0,k.length>0,f,J);p&&ne.push("WhereInput");const ae=lr(A),{customMutatorOverride:et,shapeGuardImport:tt,shapeReadPolicyAssertion:rt,shapeReadPolicyImport:nt,shapeResolveOverride:at}=Mr({hasMutators:B,hasShapes:p,rlsData:X}),D=R?S:[];for(const s of D)if(pr(s.exportName,"live stream export name"),!mr.test(s.filePath))throw new de("INTERNAL",`@lunora/codegen: refusing to emit import for unsafe live stream file path: ${JSON.stringify(s.filePath)}`);const st=c?[]:D.map(s=>`import { ${s.exportName} as liveStream_${s.exportName} } from "../${s.filePath}.js";`),ot=`        protected override liveStreams() {
-            return { ${D.map(s=>`${gr(s.id)}: liveStream_${s.exportName}`).join(", ")} };
+const LUNORA_SCHEMA_SNAPSHOT: { hash: string; json: string } = { hash: ${JSON.stringify(Yt(v))}, json: ${JSON.stringify(ge)} };
+`,be=v===void 0?"":", schemaSnapshot: LUNORA_SCHEMA_SNAPSHOT",k=er(a),L=tr(m,l.flags),K=rr(d,m,l.flags),G=fr(g),Q=nr(o),{build:we,contextField:ye,importLines:ve,specs:ke}=ar(xr(R)),{build:Se,contextField:Re,importLines:xe,specs:Ae}=sr(j,R),J=or(C,l.server),{build:Oe,contextField:De,importLines:Te,specs:_e}=ir(r,i.jurisdiction),{build:Ee,contextField:Ie,importLines:Ce,specs:Le}=dr(O),{build:Pe,contextField:Ne,importLines:$e,specs:Me}=cr(e,x&&e.length>0),{build:qe,configField:Fe,contextField:Ue,imports:Be,stub:je}=lr(a.has("payments")),We=n,{advisoryRules:He,advisoryRows:Ve}=Or(We),Ke=t,ne=U??{policies:[],roles:[]},Ge=q??{columns:[]},Qe=B??{rules:[]},Je=I??{analytics:!1,auth:!1,containers:!1,flags:!1,kv:!1,mail:!1,notifications:!1,payments:!1,privacy:!1,queues:!1,scheduler:!1,storage:!1,vectors:!1,workflows:!1},{constant:Ye,override:ze}=ur(O),{constant:Xe,override:Ze}=hr(R),b=y&&i.vectorIndexes.length>0,Y=new Set(i.tables.filter(s=>Ar(s)).map(s=>s.name)),ae=b&&i.vectorIndexes.some(s=>Y.has(s.table)),T=i.tables.some(s=>s.shardMode==="global"),z=pr(Y),X=i.tables.some(s=>zt(s)),se=i.tables.some(s=>Xt(s)),P=i.tables.some(s=>s.externalSource!==void 0),oe=i.tables.some(s=>s.memory===!0),Z=i.tables.some(s=>s.shardMode!=="global"&&s.searchIndexes.length>0);if(se&&X)throw new he("INTERNAL",'lunora codegen: mixing `.global()` (D1) and `.global({ backend: "hyperdrive" })` tables in one app is not supported yet — use a single global backend.');const ee=i.tables.length>0,et=Nr(i),tt=Mr(i),rt=Br(i),nt=$r(i),ie=qr(i),te=mr(b,O.length>0,R.length>0,m,Z);p&&te.push("WhereInput"),D&&te.push("SensitiveScope");const de=gr(T),{customMutatorOverride:at,shapeGuardImport:st,shapeReadPolicyAssertion:ot,shapeReadPolicyImport:it,shapeResolveOverride:dt}=jr({hasMutators:H,hasSensitiveShapes:D,hasShapes:p,rlsData:ne}),_=A?M:[];for(const s of _)if(yr(s.exportName,"live stream export name"),!vr.test(s.filePath))throw new he("INTERNAL",`@lunora/codegen: refusing to emit import for unsafe live stream file path: ${JSON.stringify(s.filePath)}`);const ct=c?[]:_.map(s=>`import { ${s.exportName} as liveStream_${s.exportName} } from "../${s.filePath}.js";`),lt=`        protected override liveStreams() {
+            return { ${_.map(s=>`${kr(s.id)}: liveStream_${s.exportName}`).join(", ")} };
         }
-`,it=`        private readonly liveStreamLoaders = new Map<string, () => Promise<{ validatePublish: (topic: string, payload: unknown) => unknown }>>([
-${D.map(s=>`            [${JSON.stringify(s.id)}, () => import("../${s.filePath}.js").then((module) => module.${s.exportName})],`).join(`
+`,ut=`        private readonly liveStreamLoaders = new Map<string, () => Promise<{ validatePublish: (topic: string, payload: unknown) => unknown }>>([
+${_.map(s=>`            [${JSON.stringify(s.id)}, () => import("../${s.filePath}.js").then((module) => module.${s.exportName})],`).join(`
 `)}
         ]);
 
@@ -1243,11 +1284,11 @@ ${D.map(s=>`            [${JSON.stringify(s.id)}, () => import("../${s.filePath}
         protected override liveStreams() {
             return Object.fromEntries(this.loadedLiveStreams);
         }
-`;let se="";D.length>0&&(se=c?it:ot);const _=[`import type { ${ne.join(", ")} } from "${u.do}";`,`import { applyCdcChanges, createStableIdFactory, ${J?"backfillSearchIndexes, ":""}${m?"backfillVectorIndexes, ":""}buildReprojectionMigration, ${te?"clearMemoryTables, ":""}${tt}createReadFootprint, createShardCtxDb, exportShardRows, importShardRows, ${C?"isSourceDue, pullExternalSourceIncrementalTick, pullExternalSourceTick, ":""}markUnvouchableReads, ${Z?"ROOT_SHARD_NAME, ":""}runDataMigration, runShardMigrations, ${ae.importFragment}ShardDO as ShardDOBase } from "${u.do}";`,...C?[`import type { ExternalSourceLike, SourceClientLike, TraceRefLike } from "${u.do}";`]:[],p?`import { asBucketStorage, ${nt}beginDeferredDeletes, beginDeferredSchedules, composeShapeReadWhere, createSecrets, flushDeferredDeletes, LunoraError, withDeferredDeletes, withDeferredSchedules } from "${u.server}";`:`import { asBucketStorage, beginDeferredDeletes, beginDeferredSchedules, createSecrets, flushDeferredDeletes, LunoraError, withDeferredDeletes, withDeferredSchedules } from "${u.server}";`];z&&_.push(`import { bindOrm, bindTableFacade } from "${u.server}";`),m&&_.push('import type { SchemaLike as VectorSchemaLike, VectorBackfillSync, VectorizeIndexLike, VectorSearchLike } from "@lunora/bindings/vectors";','import { createContextVectors, createVectorBackfillSync, createVectors, createVectorSyncHook, vectorBackfillTargets } from "@lunora/bindings/vectors";'),_.push(...y.importLines,...T.importLines,...W.importLines,...H.importLines,...xe,...Te,...fe,...ve,...V.importLines,...Le,...$e,"",'import schema from "../schema.js";',...st,`import { ${["LUNORA_FUNCTIONS","LUNORA_LIFECYCLE_HOOKS","LUNORA_MIGRATIONS",...c?["getLoadedFunction","loadFunction"]:[],...B?["LUNORA_MUTATOR_PATHS"]:[],...l?["LUNORA_ROOMS"]:[],...b?["LUNORA_SOCKETS"]:[],...p?["LUNORA_SHAPES"]:[]].join(", ")} } from "./functions.js";`);const dt=m?`
-    vectors?: (env: Record<string, unknown>) => Record<string, VectorizeIndexLike>;`:"",ct=ee?`
-    d1?: (env: Record<string, unknown>, request?: { bookmark?: string; cdc?: boolean; cdcRetentionMs?: number; identity?: Record<string, unknown>; onBookmark?: (bookmark: string | undefined) => void; userId?: string }) => DatabaseWriterLike | undefined;`:"",lt=Q?`
-    hyperdriveGlobal?: (env: Record<string, unknown>, request?: { cdc?: boolean; cdcRetentionMs?: number; identity?: Record<string, unknown>; userId?: string }) => DatabaseWriterLike | undefined;`:"",ut=C?`
-    sourceClient?: (env: Record<string, unknown>, binding: string) => { query: <Row = Record<string, unknown>>(text: string, params?: readonly unknown[]) => Promise<Row[]> } | undefined;`:"",ht="ctx.db.<globalTable>: no global backend configured. Pass `d1` or `hyperdriveGlobal` to createShardDO().",pt="ctx.scheduler: no scheduler configured. Pass `scheduler` to createShardDO().",mt="ctx.storage: no storage configured. Pass `storage` to createShardDO().",gt=A?E("globalDbStub: DatabaseWriterLike",ht,["aggregate","count","delete","explain","findFirst","findFirstOrThrow","findMany","get","groupBy","insert","normalizeId","patch","query","rank","rankPage","replace"],{sync:["normalizeId","query"]}):"",{vectorSyncMethod:ft,vectorsBuild:bt,vectorsStub:wt}=Fr(m,Z?i.vectorIndexes.filter(s=>K.has(s.table)).map(s=>s.name):[]),yt=`{
+`;let ce="";_.length>0&&(ce=c?ut:lt);const N=[`import type { ${te.join(", ")} } from "${l.do}";`,`import { applyCdcChanges, createStableIdFactory, ${Z?"backfillSearchIndexes, ":""}${b?"backfillVectorIndexes, ":""}buildReprojectionMigration, ${oe?"clearMemoryTables, ":""}${st}createReadFootprint, createShardCtxDb, exportShardRows, importShardRows, ${P?"isSourceDue, pullExternalSourceIncrementalTick, pullExternalSourceTick, ":""}markUnvouchableReads, ${ae?"ROOT_SHARD_NAME, ":""}runDataMigration, runShardMigrations, ${de.importFragment}ShardDO as ShardDOBase } from "${l.do}";`,...P?[`import type { ExternalSourceLike, SourceClientLike, TraceRefLike } from "${l.do}";`]:[],p?`import { asBucketStorage, ${it}beginDeferredDeletes, beginDeferredSchedules, composeShapeReadWhere, createSecrets, flushDeferredDeletes, LunoraError, withDeferredDeletes, withDeferredSchedules } from "${l.server}";`:`import { asBucketStorage, beginDeferredDeletes, beginDeferredSchedules, createSecrets, flushDeferredDeletes, LunoraError, withDeferredDeletes, withDeferredSchedules } from "${l.server}";`];ee&&N.push(`import { bindOrm, bindTableFacade } from "${l.server}";`),b&&N.push('import type { SchemaLike as VectorSchemaLike, VectorBackfillSync, VectorizeIndexLike, VectorSearchLike } from "@lunora/bindings/vectors";','import { createContextVectors, createVectorBackfillSync, createVectors, createVectorSyncHook, vectorBackfillTargets } from "@lunora/bindings/vectors";'),N.push(...k.importLines,...L.importLines,...G.importLines,...Q.importLines,...Te,...Ce,...ve,...xe,...J.importLines,...$e,...Be,...V?[`import { sensitiveArgumentNames } from "${l.values}";`]:[],"",'import schema from "../schema.js";',...ct,`import { ${["LUNORA_FUNCTIONS","LUNORA_LIFECYCLE_HOOKS","LUNORA_MIGRATIONS",...c?["getLoadedFunction","loadFunction"]:[],...H?["LUNORA_MUTATOR_PATHS"]:[],...h?["LUNORA_ROOMS"]:[],...f?["LUNORA_SOCKETS"]:[],...p?["LUNORA_SHAPES"]:[]].join(", ")} } from "./functions.js";`);const ht=b?`
+    vectors?: (env: Record<string, unknown>) => Record<string, VectorizeIndexLike>;`:"",pt=se?`
+    d1?: (env: Record<string, unknown>, request?: { bookmark?: string; cdc?: boolean; cdcRetentionMs?: number; identity?: Record<string, unknown>; onBookmark?: (bookmark: string | undefined) => void; userId?: string }) => DatabaseWriterLike | undefined;`:"",mt=X?`
+    hyperdriveGlobal?: (env: Record<string, unknown>, request?: { cdc?: boolean; cdcRetentionMs?: number; identity?: Record<string, unknown>; userId?: string }) => DatabaseWriterLike | undefined;`:"",gt=P?`
+    sourceClient?: (env: Record<string, unknown>, binding: string) => { query: <Row = Record<string, unknown>>(text: string, params?: readonly unknown[]) => Promise<Row[]> } | undefined;`:"",ft="ctx.db.<globalTable>: no global backend configured. Pass `d1` or `hyperdriveGlobal` to createShardDO().",bt="ctx.scheduler: no scheduler configured. Pass `scheduler` to createShardDO().",wt="ctx.storage: no storage configured. Pass `storage` to createShardDO().",yt=T?$("globalDbStub: DatabaseWriterLike",ft,["aggregate","count","delete","explain","findFirst","findFirstOrThrow","findMany","get","groupBy","insert","normalizeId","patch","query","rank","rankPage","replace"],{sync:["normalizeId","query"]}):"",{vectorSyncMethod:vt,vectorsBuild:kt,vectorsStub:St}=Vr(b,ae?i.vectorIndexes.filter(s=>Y.has(s.table)).map(s=>s.name):[]),Rt=`{
                 ...this.ctxDbTuning(),
                 auth: { identity: identity ?? null, userId: userId ?? null },
                 broadcast: (delta) => {
@@ -1287,7 +1328,7 @@ ${D.map(s=>`            [${JSON.stringify(s.id)}, () => import("../${s.filePath}
                 // fallback rather than reporting into a no-op.
                 ...(options.onReadRange !== undefined
                     ? { onReadRange: options.onReadRange }
-                    : options.scope === undefined ? {} : { onReadRange: this.getCtxDbReadRangeHook(options.scope) }),${m?`
+                    : options.scope === undefined ? {} : { onReadRange: this.getCtxDbReadRangeHook(options.scope) }),${b?`
                 // Vectorize is outside this shard's SQLite and cannot roll back, so
                 // the sync is held until the mutation's transaction has COMMITTED
                 // (\`deferAfterCommit\`) instead of running inline. Inline, a write
@@ -1299,11 +1340,11 @@ ${D.map(s=>`            [${JSON.stringify(s.id)}, () => import("../${s.filePath}
                 scheduler,
                 schema: schema as unknown as SchemaLike,
                 sql: this.sql as SqlExec,
-                storage,${A?`
+                storage,${T?`
                 globalDb,`:""}
-            }`,vt=m?`
-                vectors,`:"",kt=z?`
-                orm: bindOrm(facade),`:"",oe=Q?"config.hyperdriveGlobal":"config.d1",St=A?`            const bookmark = this.getInboundBookmark();
+            }`,xt=b?`
+                vectors,`:"",At=ee?`
+                orm: bindOrm(facade),`:"",le=X?"config.hyperdriveGlobal":"config.d1",Ot=T?`            const bookmark = this.getInboundBookmark();
             const globalRequest = {
                 ...this.globalCdcOptions(config.cdc ?? false),
                 ...(bookmark === undefined ? {} : { bookmark }),
@@ -1311,26 +1352,65 @@ ${D.map(s=>`            [${JSON.stringify(s.id)}, () => import("../${s.filePath}
                 onBookmark: (bookmarkValue: string | undefined) => { if (options.bookmarks !== undefined) { options.bookmarks.value = bookmarkValue; } },
                 ...(userId === undefined ? {} : { userId }),
             };
-            const globalDb: DatabaseWriterLike = ${oe}?.(env, globalRequest) ?? globalDbStub;
-`:"",Rt=$r(p&&A,oe),xt=l?`        protected override roomHandlerPath(topic: string): string | undefined {
+            const globalDb: DatabaseWriterLike = ${le}?.(env, globalRequest) ?? globalDbStub;
+`:"",Dt=Wr(p&&T,le),Tt=h?`        protected override roomHandlerPath(topic: string): string | undefined {
             // Own properties only: a plain object would resolve \`toString\` and the like to inherited functions.
             return Object.hasOwn(LUNORA_ROOMS, topic) ? LUNORA_ROOMS[topic] : undefined;
         }
-`:"",Ot=b?`        protected override socketRoute(path: string): { auth: boolean; functionPath: string } | undefined {
+`:"",_t=f?`        protected override socketRoute(path: string): { auth: boolean; functionPath: string } | undefined {
             return LUNORA_SOCKETS[path];
         }
-`:"",{externalSourceOverride:At,sourceBootstrap:Dt,sourceClientCacheConst:Tt}=qr(C),Ct=`
+`:"",{externalSourceOverride:Et,sourceBootstrap:It,sourceClientCacheConst:Ct}=Hr(P),Lt=`
+        private shardInitDeferred = false;
+        private deferredShardInit?: Promise<void>;
+
         protected override async runShardInit(): Promise<void> {
             this.ensureMigrated();
-${te?`            clearMemoryTables(this.sql as SqlExec, schema as unknown as SchemaLike);
+${oe?`            clearMemoryTables(this.sql as SqlExec, schema as unknown as SchemaLike);
 `:""}
+            if (this.blockedUniqueIndexes.length > 0) {
+                this.shardInitDeferred = true;
+
+                return;
+            }
+
             await this.dispatchShardInit();
         }
-`,_t=re.length>0?`
+
+        protected override async ensureShardInit(): Promise<void> {
+            await super.ensureShardInit();
+
+            if (!this.shardInitDeferred) {
+                return;
+            }
+
+            try {
+                this.ensureMigrated();
+            } catch (error: unknown) {
+                this.recordShardInitError("__shard_init__", error);
+
+                return;
+            }
+
+            if (this.blockedUniqueIndexes.length > 0) {
+                return;
+            }
+
+            this.deferredShardInit ??= (async (): Promise<void> => {
+                try {
+                    await this.dispatchShardInit();
+                } finally {
+                    this.shardInitDeferred = false;
+                }
+            })();
+
+            await this.deferredShardInit;
+        }
+`,Pt=ie.length>0?`
             if (LUNORA_TTL_SWEEPS.length > 0) {
                 void this.scheduleTtlSweep();
             }
-`:"",Et=`
+`:"",Nt=`
         public constructor(state: ShardDOState, env: unknown) {
             super(state, env, {
                 // Every writer this file builds spreads the ctxDbTuning() slice —
@@ -1347,7 +1427,7 @@ ${te?`            clearMemoryTables(this.sql as SqlExec, schema as unknown as Sc
                 // exists — a trigger that fails first still flushes and fuses.
                 ...(config.observability === undefined ? {} : { telemetrySink: () => config.observability?.((env ?? {}) as Record<string, unknown>) }),
             });
-${Dt}${_t}        }
+${It}${Pt}        }
 
         protected override isCacheableQuery(functionPath: string): boolean {
             // NOT \`kind === "query"\` alone. A cache hit answers without running
@@ -1371,7 +1451,7 @@ ${Dt}${_t}        }
         protected override isPaidFunction(functionPath: string): boolean {
             return LUNORA_FUNCTIONS[functionPath]?.x402 !== undefined;
         }
-`,ie=c?`
+`,ue=c?`
         protected override prepareFunction(functionPath: string, reason: "rpc" | "subscription" | "stream" | "reactor"): Promise<void> | undefined {
             const registered = LUNORA_FUNCTIONS[functionPath];
             const allowsInternal = reason === "reactor" || (reason === "rpc" && this.isSystemDispatch());
@@ -1386,25 +1466,38 @@ ${Dt}${_t}        }
 
             return loadFunction(functionPath).then(() => undefined);
         }
-`:"",Lt=ie===""?`
+`:"",$t=ue===""?`
 
-`:`${ie}
-`,It=xr(c),Pt=c?`            const preparation = this.prepareFunction(functionPath, "subscription");
+`:`${ue}
+`,Mt=V?`
+        protected override sensitiveArgNames(functionPath: string): ReadonlySet<string> {
+            const registered = LUNORA_FUNCTIONS[functionPath];${D?`
+            const shape = functionPath.startsWith("__shape__:") ? LUNORA_SHAPES[functionPath.slice("__shape__:".length)] : undefined;`:""}
+            const fromValidators = sensitiveArgumentNames(registered?.args ?? ${D?"shape?.args ?? ":""}{});
+
+            if (registered?.sensitiveArgs === undefined) {
+                return fromValidators;
+            }
+
+            return new Set([...registered.sensitiveArgs, ...fromValidators]);
+        }
+
+`:"",qt=Er(c),Ft=c?`            const preparation = this.prepareFunction(functionPath, "subscription");
             if (preparation !== undefined) await preparation;
-`:"",Nt=Ar.replace("__PREPARE_FUNCTION__",Pt),Mt=Tr(l,c),$t=z?`
+`:"",Ut=Cr.replace("__PREPARE_FUNCTION__",Ft),Bt=Pr(h,c),jt=ee?`
             const facade = db as unknown as Record<string, ReturnType<typeof bindTableFacade>>;
 ${i.tables.map(s=>`            facade[${JSON.stringify(s.name)}] = bindTableFacade(db, ${JSON.stringify(s.name)});`).join(`
 `)}
-`:"",qt=`${y.everyBuild}${T.build}${H.build}
+`:"",Wt=`${k.everyBuild}${L.build}${Q.build}
             const secrets = createSecrets(env);
-`,Ft=`${y.everyFields}${T.contextField}${W.contextField}${H.contextField}
-                secrets,`,Ut=W.build,Bt=R?`
+`,Ht=`${k.everyFields}${L.contextField}${G.contextField}${Q.contextField}
+                secrets,`,Vt=G.build,Kt=A?`
             const live = {
                 publish: async (ref: { __lunoraLive: string; topic: string }, payload: unknown, publishOptions?: { shardKey?: string }): Promise<void> => {
                     await this.publishLiveFromAction(ref.topic, payload, { ...publishOptions, stream: ref.__lunoraLive });
                 },
             };
-`:"",jt=[...y.actionFields,...x.length>0?["services"]:[],...R?["live"]:[]],Wt=`${y.actionBuild}${V.build}${Bt}`;return`${fr}${_.join(`
+`:"",Gt=[...k.actionFields,...C.length>0?["services"]:[],...A?["live"]:[]],Qt=`${k.actionBuild}${J.build}${Kt}`;return`${Sr}${N.join(`
 `)}
 
 type FunctionKind = "action" | "mutation" | "query";
@@ -1414,13 +1507,13 @@ interface FunctionReference {
 }
 
 /** Foreign-key columns per table (\`v.id("target")\` fields) for the data browser. */
-const LUNORA_TABLE_REFS = ${h(ze,"Record<string, Record<string, string>>")};
+const LUNORA_TABLE_REFS = ${u(et,"Record<string, Record<string, string>>")};
 
 /** Declared indexes per table (secondary, search, geo, rank, vector) for the schema viewer. */
-const LUNORA_TABLE_INDEXES = ${h(Ye,'Record<string, Array<{ fields: string[]; name: string; type: "geo" | "index" | "rank" | "search" | "vector"; unique?: boolean }>>')};
+const LUNORA_TABLE_INDEXES = ${u(tt,'Record<string, Array<{ fields: string[]; name: string; type: "geo" | "index" | "rank" | "search" | "vector"; unique?: boolean }>>')};
 
 /** Columns per table (typed, with PK/FK markers) for the studio's schema diagram, served via \`__lunora_admin__:describeTable\`. */
-const LUNORA_TABLE_COLUMNS = ${h(Xe,`Record<
+const LUNORA_TABLE_COLUMNS = ${u(rt,`Record<
     string,
     Array<{
         bucket?: string;
@@ -1437,16 +1530,16 @@ const LUNORA_TABLE_COLUMNS = ${h(Xe,`Record<
 >`)};
 
 /** Storage-key columns per table (\`v.storage(...)\` fields) for the file browser's records↔files join. */
-const LUNORA_STORAGE_COLUMNS = ${h(Ze,"Record<string, string[]>")};
+const LUNORA_STORAGE_COLUMNS = ${u(nt,"Record<string, string[]>")};
 
 /** Declarative TTL policies (\`.ttl(field, { after? })\`) the DO alarm sweep auto-expires rows for. */
-const LUNORA_TTL_SWEEPS = ${Qt(re,"Array<{ after?: number; field: string; softDeleteField?: string; table: string }>")};
+const LUNORA_TTL_SWEEPS = ${Zt(ie,"Array<{ after?: number; field: string; softDeleteField?: string; table: string }>")};
 
 /** Static schema advisories (computed by @lunora/advisor at codegen time) served via \`__lunora_admin__:getAdvisories\`. */
-const LUNORA_ADVISORY_RULES = ${h(Ue,"Record<string, Partial<AdvisoryFinding>>")};
+const LUNORA_ADVISORY_RULES = ${u(He,"Record<string, Partial<AdvisoryFinding>>")};
 
 /** Per-finding rows; rule-level text lives once in \`LUNORA_ADVISORY_RULES\` and is merged back on first read. */
-const LUNORA_ADVISORY_ROWS = ${h(Be,"Array<Partial<AdvisoryFinding> & { name: string }>")};
+const LUNORA_ADVISORY_ROWS = ${u(Ve,"Array<Partial<AdvisoryFinding> & { name: string }>")};
 
 const LUNORA_ADVISORIES = ((): (() => AdvisoryFinding[]) => {
     let cached: AdvisoryFinding[] | undefined;
@@ -1454,20 +1547,23 @@ const LUNORA_ADVISORIES = ((): (() => AdvisoryFinding[]) => {
 })();
 
 /** Every declared procedure (discovered by @lunora/codegen) served via \`__lunora_admin__:getAdvisorProcedures\` — the health map's denominator. */
-const LUNORA_ADVISOR_PROCEDURES = ${h(je,"AdvisorProcedure[]")};
+const LUNORA_ADVISOR_PROCEDURES = ${u(Ke,"AdvisorProcedure[]")};
 
 /** Read-only RLS metadata (policies + roles discovered from \`.use(rls(...))\` chains) served via \`__lunora_admin__:rlsPolicies\` for the studio's RLS inspector. */
-const LUNORA_RLS_METADATA = ${h(X,"RlsPoliciesResult")};
-${rt}
+const LUNORA_RLS_METADATA = ${u(ne,"RlsPoliciesResult")};
+${ot}
 /** Read-only masking metadata (table + column + strategy discovered from \`.use(mask(...))\` chains) served via \`__lunora_admin__:maskPolicies\` for the studio's data-browser mask preview. */
-const LUNORA_MASK_METADATA = ${h(We,"MaskPoliciesResult")};
+const LUNORA_MASK_METADATA = ${u(Ge,"MaskPoliciesResult")};
 
 /** Read-only storage access-rule metadata (discovered from \`.use(storageRules(...))\` chains) served via \`__lunora_admin__:storageRules\` for the studio's access-rules view. */
-const LUNORA_STORAGE_RULES = ${h(He,"StorageRulesResult")};
+const LUNORA_STORAGE_RULES = ${u(Qe,"StorageRulesResult")};
 
 /** Which optional package-backed features this app wires up (discovered from imports / \`ctx.*\` reads / schema signals) served via \`__lunora_admin__:studioFeatures\` so the studio hides nav pages whose package isn't enabled. */
-const LUNORA_STUDIO_FEATURES = ${h(Ve,"StudioFeaturesResult")};
-${he}${G.constant}${j.constant}${Ke}${Qe}${Oe}${Ce}${be}${ke}${V.specs}${Ie}
+const LUNORA_STUDIO_FEATURES = ${u(Je,"StudioFeaturesResult")};
+
+/** How long a shard with a UNIQUE index blocked by duplicate rows serves the cached diagnostic before re-attempting the build. */
+const BLOCKED_MIGRATION_RETRY_MS = 5000;
+${fe}${z.constant}${K.constant}${Ye}${Xe}${_e}${Le}${ke}${Ae}${J.specs}${Me}
 export interface ShardDOConfig {
     /** Opt into change-data-capture: records a post-image to \`__cdc_log\` on every write (backs streaming export + replay-PITR). */
     cdc?: boolean;
@@ -1484,25 +1580,27 @@ export interface ShardDOConfig {
     /** \`unknown\` because \`@lunora/scheduler\`'s \`Scheduler\` is not assignable to \`SchedulerLike\`; the shard casts it. */
     scheduler?: (env: Record<string, unknown>) => unknown;
     /** \`origin\` is the origin the current \`/rpc\` request reached the worker on — the fallback base for signed object URLs when no \`publicBaseUrl\` is configured. \`undefined\` off the synchronous dispatch path. */
-    storage?: (env: Record<string, unknown>, origin?: string) => unknown;${dt}${y.configFields}${T.configField}${Ne}${ct}${lt}${ut}${G.configField}
+    storage?: (env: Record<string, unknown>, origin?: string) => unknown;${ht}${k.configFields}${L.configField}${Fe}${pt}${mt}${gt}${z.configField}
 }
-${E("schedulerStub",pt,["cancel","runAfter","runAt"])}${E("storageStub",mt,["createMultipartUpload","delete","download","generateUploadUrl","getMetadata","getPresignedUrl","getSignedUrl","getUrl","head","list","resumeMultipartUpload","store","upload"],{sync:["getUrl","resumeMultipartUpload"]})}${gt}${Tt}${wt}${y.stubs}${qe}
-${It}
+${$("schedulerStub",bt,["cancel","runAfter","runAt"])}${$("storageStub",wt,["createMultipartUpload","delete","download","generateUploadUrl","getMetadata","getPresignedUrl","getSignedUrl","getUrl","head","list","resumeMultipartUpload","store","upload"],{sync:["getUrl","resumeMultipartUpload"]})}${yt}${Ct}${St}${k.stubs}${je}
+${qt}
 
 /**
  * Build the project's shard Durable Object. Export the result as \`ShardDO\`
  * from the worker entry so wrangler binds it by name.
  */
 export const createShardDO = (config: ShardDOConfig = {}): new (state: ShardDOState, env: unknown) => ShardDOBase =>
-    class extends ShardDOBase {${Et}
-        private migrated = false;${Lt}${Mt}
-${ae.override}
-${Nt}
-${et}${at}${Rt}${At}
+    class extends ShardDOBase {${Nt}
+        private blockedUniqueIndexes: readonly string[] = [];
+        private migrated = false;
+        private migrationRetryAt = 0;${$t}${Mt}${Bt}
+${de.override}
+${Ut}
+${at}${dt}${Dt}${Et}
         protected override lifecycleHookPaths(event: "connect" | "disconnect" | "init" | "reactor" | "whisper"): readonly string[] {
             return LUNORA_LIFECYCLE_HOOKS[event];
         }
-${xt}${Ot}${se}${G.override}${Ct}
+${Tt}${_t}${ce}${z.override}${Lt}
         // One \`onQueryChange\` dispatch. Mirrors \`executeSubscription\` — the
         // socket-terminated half of the same reactivity — and differs only in who
         // consumes the result: the base's \`dispatchReactors\` stores the digest as
@@ -1540,7 +1638,7 @@ ${c?`            const requestScope = this.captureRequestScope();
                 return undefined;
             }
 
-            this.ensureMigrated();
+            this.ensureServable();
 
             const footprint = createReadFootprint();
             const ctx = this.buildCtx({ functionPath, headroom: this.subscriptionHeadroom(), onRead: footprint.onRead, onReadRange: footprint.onReadRange, trusted: true });
@@ -1601,7 +1699,7 @@ ${c?`            const requestScope = this.captureRequestScope();
         protected override studioFeatures(): StudioFeaturesResult {
             return LUNORA_STUDIO_FEATURES();
         }
-${j.evaluateOverride}${j.subscriptionOverride}${Ge}${Je}
+${K.evaluateOverride}${K.subscriptionOverride}${ze}${Ze}
         protected override advisories(): AdvisoryFinding[] {
             return LUNORA_ADVISORIES();
         }
@@ -1610,17 +1708,44 @@ ${j.evaluateOverride}${j.subscriptionOverride}${Ge}${Je}
             return LUNORA_ADVISOR_PROCEDURES();
         }
 
-${Sr}
+${Tr}
 
+        /**
+         * Migrate the base schema. A UNIQUE index that existing duplicate rows block
+         * is deferred, not thrown: the rest of the pass completes so the admin path
+         * (including the data migration that de-duplicates the table) keeps working.
+         * User dispatch goes through \`ensureServable\`, which refuses until the
+         * index exists. \`migrated\` stays false while one is outstanding, but the
+         * retry (a schema-ledger write plus a full-table duplicate scan per blocked
+         * index) runs at most once per \`BLOCKED_MIGRATION_RETRY_MS\`; in between,
+         * callers see the cached diagnostics. The first call after a cold start
+         * always migrates, and an admin data migration resets the clock so the
+         * de-dup that unblocks the index takes effect on the next call.
+         */
         protected override ensureMigrated(): void {
             if (this.migrated) {
                 return;
             }
 
-            runShardMigrations(this.sql as SqlExec, schema as unknown as SchemaLike, { cdc: config.cdc ?? false${pe} });
-            this.migrated = true;
+            const now = Date.now();
+
+            if (this.blockedUniqueIndexes.length > 0 && now < this.migrationRetryAt) {
+                return;
+            }
+
+            this.blockedUniqueIndexes = runShardMigrations(this.sql as SqlExec, schema as unknown as SchemaLike, { cdc: config.cdc ?? false, deferBlockedUniqueIndexes: true${be} });
+            this.migrated = this.blockedUniqueIndexes.length === 0;
+            this.migrationRetryAt = now + BLOCKED_MIGRATION_RETRY_MS;
+        }
+
+        private ensureServable(): void {
+            this.ensureMigrated();
+
+            if (this.blockedUniqueIndexes.length > 0) {
+                throw new LunoraError("INTERNAL", this.blockedUniqueIndexes.join("; "));
+            }
         }
-${J?`
+${Z?`
         protected override runShardSearchBackfill(options: { maxPages?: number }): SearchBackfillProgress {
             // Migrations create the fts5 companions; without them every backfill
             // statement would raise "no such table" on a shard that has never
@@ -1629,7 +1754,7 @@ ${J?`
 
             return backfillSearchIndexes(this.sql as SqlExec, schema as unknown as SchemaLike, options);
         }
-`:""}${ft}
-${Rr({lazyFunctions:c,actionOnlyFields:jt,agentsBuild:_e,agentsContextField:Ee,containersBuild:Se,containersContextField:Re,databaseOptions:yt,everyContextBuild:qt,everyContextField:Ft,facadeBlock:$t,globalDatabaseLine:St,notifyBuild:Ut,ormContextField:kt,paymentsBuild:Pe,paymentsContextField:Me,queuesBuild:me,queuesContextField:ge,topicsBuild:we,topicsContextField:ye,vectorsBuild:bt,vectorsContextField:vt,workflowsBuild:Ae,workflowsContextField:De,actionOnlyBuild:Wt})}
+`:""}${vt}
+${_r({hasSensitiveArgs:V,lazyFunctions:c,actionOnlyFields:Gt,agentsBuild:Pe,agentsContextField:Ne,containersBuild:Oe,containersContextField:De,databaseOptions:Rt,everyContextBuild:Wt,everyContextField:Ht,facadeBlock:jt,globalDatabaseLine:Ot,notifyBuild:Vt,ormContextField:At,paymentsBuild:qe,paymentsContextField:Ue,queuesBuild:we,queuesContextField:ye,topicsBuild:Se,topicsContextField:Re,vectorsBuild:kt,vectorsContextField:xt,workflowsBuild:Ee,workflowsContextField:Ie,actionOnlyBuild:Qt})}
     };
-`};export{_r as b,Xr as e};
+`};export{$r as b,on as e};