@lunora/codegen 1.0.0-alpha.54 → 1.0.0-alpha.56

package/dist/packem_shared/emitApp-B671iU7r.mjs

@@ -0,0 +1,413 @@
+import{c as w,w as E}from"./emit-Dr6XSLfW.mjs";const D=e=>`has${e.charAt(0).toUpperCase()}${e.slice(1)}`,m=w.map(({appMethod:e,key:t})=>[D(t),e.method,e.configKey,e.doc]),g=e=>m.some(([t])=>e[t]),A=e=>e?['import * as lunoraIdentityContract from "../identity.js";']:[],x=(e,t)=>e?['import type { CreateAccessResolverOptions } from "@lunora/cloudflare-access";',`import { createAccessResolver${t?", composeResolvers":""} } from "@lunora/cloudflare-access";`]:[],R=e=>e?['import { createKvIntrospectorFromEnv } from "@lunora/bindings/kv";']:[],O=e=>e?['import notifyConfig from "../notify.js";']:[],k=e=>(e.emailAgents?.length??0)>0,C=e=>k(e)?['import { dispatchAgentEmail } from "@lunora/agent/inbound";']:[],L=e=>k(e)?['import * as lunoraAgentDefinitions from "../agents.js";']:[],T=e=>{const{hasAccess:t,hasAuth:r,hasFramework:a,hasGlobal:n,hasHyperdriveGlobal:o,hasKv:l,hasQueue:s,hasScheduler:u,hasStorage:d,hasWorkflow:h,useUmbrella:c,wantsOpenApi:p,wantsOpenRpc:v}=e,i=c?"lunorash/runtime":"@lunora/runtime",b=["ExecutionContextLike","LunoraWorker","Route","ScheduledControllerLike","ShardNamespaceLike","WorkerOptions"];n&&b.push("GlobalIntrospector"),a&&b.push("FrameworkHostHandler");const f=[...n||o?["createCrossShardRelationCapabilities"]:[],"createWorker","resolveLogArchiveFromEnv",...a?["withFrameworkWorker"]:[]].join(", ");return[...r?['import type { LunoraAuth, LunoraAuthOptions } from "@lunora/auth";','import { createAuth, createAuthAdmin, createAuthAuditReader, d1Executor, ensureMigrated, handleAuthRequest, lunoraD1Adapter } from "@lunora/auth";']:[],...x(t,r),...n?['import type { D1CtxDbOptions, D1DatabaseLike, D1Exec } from "@lunora/d1";','import { createD1CtxDb, facetGlobalColumn, listGlobalTables, readGlobalTablePage } from "@lunora/d1";']:[],...o?['import type { HyperdriveEngine } from "@lunora/hyperdrive/global";','import { createHyperdriveGlobalCtxDb } from "@lunora/hyperdrive/global";','import type { SqlCtxDbOptions, SqlExec } from "@lunora/sql-store";']:[],...R(l),...u?['import type { DurableObjectNamespaceLike } from "@lunora/scheduler";','import { createScheduler } from "@lunora/scheduler";']:[],...d?['import type { R2BucketLike, Storage } from "@lunora/storage";','import { createBucketStorage, createStorage } from "@lunora/storage";']:[],...h?['import { createWorkflowsRestClient } from "@lunora/workflow";']:[],...C(e),`import type { ${[...b].toSorted((S,y)=>S.localeCompare(y)).join(", ")} } from "${i}";`,`import { ${f} } from "${i}";`,"",...A(e.identity),...L(e),...n||o?['import schema from "../schema.js";']:[],...O(e.hasNotify),'import { LUNORA_CRONS } from "./crons.js";','import { LUNORA_FUNCTIONS } from "./functions.js";',...s?['import { createQueueCaptureSink, dispatchQueueBatch, shouldCaptureQueue } from "@lunora/queue";','import { LUNORA_QUEUE_REGISTRY } from "./queues.js";']:[],...p?['import { openApiSpec } from "./openapi.js";']:[],...v?['import { openRpcSpec } from "./openrpc.js";']:[],'import { createShardDO } from "./shard.js";']},$=e=>[...e.hasStorage?[`/** \`.storage(...)\` declaration — one bucket (required) plus optional extra named buckets and signed-URL config. Backs \`ctx.storage\` AND the studio file browser. */
+interface StorageDeclaration<Env> {
+    /** The default R2 bucket binding (the bare \`ctx.storage\`). */
+    bucket: Selector<Env, R2BucketLike>;
+    /** Extra named buckets, reached via \`ctx.storage.bucket("name")\` and the studio's bucket picker. */
+    buckets?: Record<string, Selector<Env, R2BucketLike>>;
+    /** Public base URL signed/public object URLs resolve against. */
+    publicBaseUrl?: Selector<Env, string>;
+    /** HMAC secret for signed URLs. */
+    signingSecret?: Selector<Env, string>;
+}`]:[],...e.hasScheduler?["/** `.scheduler(...)` declaration — the `SchedulerDO` namespace plus the worker origin its callbacks dispatch back to. Backs `ctx.scheduler` AND the studio's scheduled-jobs view. */\ninterface SchedulerDeclaration<Env> {\n    /** The `SchedulerDO` namespace binding (typically `env.SCHEDULER`). */\n    namespace: Selector<Env, DurableObjectNamespaceLike & ShardNamespaceLike>;\n    /** The worker origin the `SchedulerDO` dispatches HTTP job callbacks back to. */\n    origin?: Selector<Env, string>;\n}"]:[],...e.hasGlobal?["/** `.global(...)` declaration — the D1 binding backing `.global()` tables. Backs cross-tenant `ctx.db` reads/writes AND the studio's global data browser. */\ninterface GlobalDeclaration<Env> {\n    /** The D1 binding (typically `env.DB`). */\n    d1: Selector<Env, D1DatabaseLike>;\n    /** The worker origin used to fan reverse cross-backend relations across shards. Without it, such a relation throws a clear error. */\n    origin?: Selector<Env, string>;\n}"]:[],...e.hasHyperdriveGlobal?['/** `.hyperdriveGlobal(...)` declaration — backs `.global({ backend: "hyperdrive" })` tables on a Postgres/MySQL database via Hyperdrive. Stays reactive: the writer is injected as `globalDb` and the broadcast hook drives live queries. */\ninterface HyperdriveGlobalDeclaration<Env> {\n    /** The Hyperdrive engine — selects the Postgres or MySQL dialect. */\n    engine: HyperdriveEngine;\n    /** Build the `SqlExec` from `env` — e.g. `buildPgExec(fromPostgresJs(postgres(env.HYPERDRIVE.connectionString)))`. Cache the driver on the DO instance; rebuild lazily after hibernation. */\n    exec: (env: Env) => SqlExec;\n    /** The worker origin used to fan reverse cross-backend relations across shards. Without it, such a relation throws a clear error. */\n    origin?: Selector<Env, string>;\n}']:[],...e.hasAuth?["/** `.auth(...)` declaration — better-auth options plus the D1 binding its SQL adapter reads. The builder owns the lazy build + `ensureMigrated` dance and wires `authHandler` / `resolveIdentity` / `authAdmin`. */\ninterface AuthDeclaration<Env> {\n    /** The D1 binding the auth SQL adapter is wired over (via `lunoraD1Adapter`). */\n    d1: Selector<Env, unknown>;\n    /** Build the better-auth options from `env` (secret, plugins, email/password, …). */\n    options: (env: Env) => LunoraAuthOptions;\n}"]:[]],q=e=>[...e.hasAccess?["    private accessSelector?: Selector<Env, CreateAccessResolverOptions>;"]:[],"    private adminToken?: Selector<Env, string>;",...e.hasAuth?["    private authDeclaration?: AuthDeclaration<Env>;"]:[],"    private readonly extendFns: ((env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>)[] = [];",...e.hasGlobal?["    private globalDeclaration?: GlobalDeclaration<Env>;"]:[],...e.hasHyperdriveGlobal?["    private hyperdriveGlobalDeclaration?: HyperdriveGlobalDeclaration<Env>;"]:[],"    private readonly routeMap: Record<string, Route> = {};",...e.hasScheduler?["    private schedulerDeclaration?: SchedulerDeclaration<Env>;"]:[],...g(e)?["    private readonly shardExtras: Partial<ShardConfig> = {};"]:[],"    private shardSelector?: Selector<Env, ShardNamespaceLike>;",...e.hasStorage?["    private storageDeclaration?: StorageDeclaration<Env>;"]:[]],j=e=>m.filter(([t])=>e[t]).map(([,t,r,a])=>`    /** ${a} */
+    public ${t}(factory: NonNullable<ShardConfig["${r}"]>): this {
+        this.shardExtras.${r} = factory;
+
+        return this;
+    }`),I=e=>[...e.hasAccess?["    /** Wire Cloudflare Access (Zero Trust) — verifies the `Cf-Access-Jwt-Assertion` JWT and feeds the identity into `ctx.auth` / RLS via `resolveIdentity`. When `.auth(...)` is also configured, Access is composed ahead of it (Access wins when its JWT is present; everyone else falls through to the app session). */\n    public access(selector: Selector<Env, CreateAccessResolverOptions>): this {\n        this.accessSelector = selector;\n\n        return this;\n    }"]:[],`    /** Bearer token gating the \`/_lunora/admin/*\` endpoints the studio calls. */
+    public admin(selector: Selector<Env, string>): this {
+        this.adminToken = selector;
+
+        return this;
+    }`,...e.hasAuth?[`    /** Wire better-auth — the builder lazily builds the instance, runs \`ensureMigrated\`, and dispatches \`/api/auth/*\` inside the worker (instrumented for the auth-failure SLO). */
+    public auth(declaration: AuthDeclaration<Env>): this {
+        this.authDeclaration = declaration;
+
+        return this;
+    }`]:[],"    /** Escape hatch — merge raw `WorkerOptions` (anything not yet sugared) over the derived options at build time. The second `derived` argument is a snapshot of the options assembled so far (after `.auth(...)` etc.), so you can compose rather than clobber — e.g. wrap `derived.resolveIdentity` instead of replacing it. */\n    public extend(fn: (env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>): this {\n        this.extendFns.push(fn);\n\n        return this;\n    }",...e.hasGlobal?[`    /** Back \`.global()\` (cross-tenant) tables with D1 — wires \`ctx.db\` routing, the studio global browser, and reverse cross-shard relations. */
+    public global(declaration: GlobalDeclaration<Env>): this {
+        this.globalDeclaration = declaration;
+
+        return this;
+    }`]:[],...e.hasHyperdriveGlobal?[`    /** Back \`.global({ backend: "hyperdrive" })\` tables with a Postgres/MySQL database via Hyperdrive — wires reactive \`ctx.db\` routing through the shared store core. */
+    public hyperdriveGlobal(declaration: HyperdriveGlobalDeclaration<Env>): this {
+        this.hyperdriveGlobalDeclaration = declaration;
+
+        return this;
+    }`]:[],`    /** Cloudflare Email Routing entry — exposes the top-level \`email\` handler. */
+    public onEmail(handler: (env: Env) => (message: unknown, env: unknown, context: ExecutionContextLike) => Promise<void>): this {
+        this.emailHandler = handler;
+
+        return this;
+    }`,`    /** Mount a custom HTTP route (e.g. an asset-serving or test endpoint). Key is \`"METHOD path"\`, \`"path"\`, or a path prefix matched by the runtime. */
+    public route(key: string, handler: Route): this {
+        this.routeMap[key] = handler;
+
+        return this;
+    }`,...e.hasScheduler?[`    /** Wire the \`SchedulerDO\` — backs \`ctx.scheduler\` and the studio's scheduled-jobs view. */
+    public scheduler(declaration: SchedulerDeclaration<Env>): this {
+        this.schedulerDeclaration = declaration;
+
+        return this;
+    }`]:[],`    /** The shard Durable Object namespace (typically \`env.SHARD\`) — required: every app routes RPC + WebSocket traffic through it. */
+    public shard(selector: Selector<Env, ShardNamespaceLike>): this {
+        this.shardSelector = selector;
+
+        return this;
+    }`,...e.hasStorage?[`    /** Wire R2 storage — backs \`ctx.storage\` (incl. multi-bucket) and the studio file browser, from one declaration. */
+    public storage(declaration: StorageDeclaration<Env>): this {
+        this.storageDeclaration = declaration;
+
+        return this;
+    }`]:[],...j(e)],W=e=>{const t=[...e.hasGlobal?[`            ...(this.globalDeclaration
+                ? {
+                      d1: (rawEnv: Record<string, unknown>, request?: { identity?: Record<string, unknown>; userId?: string | null }) => {
+                          const env = rawEnv as Env;
+                          const database = this.globalDeclaration?.d1(env);
+
+                          if (!database) {
+                              return undefined;
+                          }
+
+                          const origin = this.globalDeclaration?.origin?.(env);
+                          const crossShard = origin
+                              ? createCrossShardRelationCapabilities({ identity: request?.identity, origin, userId: request?.userId ?? undefined })
+                              : undefined;
+
+                          return createD1CtxDb({
+                              ...(crossShard ? { crossShardCounter: crossShard.crossShardCounter, crossShardReader: crossShard.crossShardReader } : {}),
+                              auth: { identity: request?.identity ?? null, userId: request?.userId ?? null },
+                              exec: buildExec(database),
+                              schema: schema as unknown as D1CtxDbOptions["schema"],
+                          });
+                      },
+                  }
+                : {}),`]:[],...e.hasHyperdriveGlobal?[`            ...(this.hyperdriveGlobalDeclaration
+                ? {
+                      hyperdriveGlobal: (rawEnv: Record<string, unknown>, request?: { identity?: Record<string, unknown>; userId?: string | null }) => {
+                          const env = rawEnv as Env;
+                          const exec = this.hyperdriveGlobalDeclaration?.exec(env) as SqlExec | undefined;
+
+                          if (!exec) {
+                              return undefined;
+                          }
+
+                          const origin = this.hyperdriveGlobalDeclaration?.origin?.(env);
+                          const crossShard = origin
+                              ? createCrossShardRelationCapabilities({ identity: request?.identity, origin, userId: request?.userId ?? undefined })
+                              : undefined;
+
+                          return createHyperdriveGlobalCtxDb({
+                              ...(crossShard ? { crossShardCounter: crossShard.crossShardCounter, crossShardReader: crossShard.crossShardReader } : {}),
+                              auth: { identity: request?.identity ?? null, userId: request?.userId ?? null },
+                              engine: this.hyperdriveGlobalDeclaration?.engine as HyperdriveEngine,
+                              exec,
+                              schema: schema as unknown as SqlCtxDbOptions["schema"],
+                          });
+                      },
+                  }
+                : {}),`]:[],...e.hasScheduler?[`            ...(this.schedulerDeclaration
+                ? {
+                      scheduler: (rawEnv: Record<string, unknown>) => {
+                          const env = rawEnv as Env;
+                          const namespace = this.schedulerDeclaration?.namespace(env);
+                          const origin = this.schedulerDeclaration?.origin?.(env);
+
+                          return namespace && origin ? createScheduler({${e.jurisdiction?` jurisdiction: ${JSON.stringify(e.jurisdiction)},`:""} namespace, originUrl: origin }) : undefined;
+                      },
+                  }
+                : {}),`]:[],...e.hasStorage?["            ...(this.storageDeclaration ? { storage: (rawEnv: Record<string, unknown>) => this.resolveStorage(rawEnv as Env) } : {}),"]:[],...g(e)?["            ...this.shardExtras,"]:[]];return t.length>0?`
+${t.join(`
+`)}
+        `:""},N=e=>[...e.hasScheduler?[`        if (this.schedulerDeclaration) {
+            options.schedulerDO = this.schedulerDeclaration.namespace(env);
+        }`]:[],...e.hasWorkflow?[`        options.workflowsClient = (workflowEnv) => {
+            const source = workflowEnv as Record<string, unknown>;
+            const accountId = source["CLOUDFLARE_ACCOUNT_ID"];
+            const apiToken = source["CLOUDFLARE_API_TOKEN"];
+
+            return typeof accountId === "string" && accountId !== "" && typeof apiToken === "string" && apiToken !== ""
+                ? createWorkflowsRestClient({ accountId, apiToken })
+                : undefined;
+        };`]:[],...e.hasGlobal?[`        if (this.globalDeclaration) {
+            const database = this.globalDeclaration.d1(env);
+
+            if (database) {
+                options.d1 = database;
+                options.globalIntrospector = buildGlobalIntrospector(database);
+            }
+        }`]:[],...e.hasStorage?[`        if (this.storageDeclaration) {
+            Object.assign(options, this.buildStorageAdmin(env));
+        }`]:[],...e.hasKv?["        options.kvIntrospector = createKvIntrospectorFromEnv(env);"]:[],...e.hasNotify?["        options.notifySubscriptionStore = notifyConfig.store ? notifyConfig.store(env) : undefined;"]:[],"        options.logArchive = resolveLogArchiveFromEnv(env);",...e.hasAuth?[`        if (this.authDeclaration) {
+            options.authHandler = (request) => {
+                const auth = getAuth();
+
+                return auth ? handleAuthRequest(auth, request) : Promise.resolve(undefined);
+            };
+            options.resolveIdentity = async (request) => {
+                const auth = getAuth();
+
+                if (!auth) {
+                    return null;
+                }
+
+                const session = await auth.api.getSession({ headers: (request as Request).headers });
+
+                return session?.user?.id ? { userId: session.user.id } : null;
+            };
+            const authInstance = getAuth();
+
+            options.authAdmin = authInstance ? createAuthAdmin(authInstance) : undefined;
+            options.authAuditReader = createAuthAuditReader(d1Executor(this.authDeclaration.d1(env) as never));
+        }`]:[],...e.hasAccess?[e.hasAuth?`        if (this.accessSelector) {
+            const accessResolver = createAccessResolver(this.accessSelector(env));
+            const fallback = options.resolveIdentity;
+
+            options.resolveIdentity = fallback ? composeResolvers(accessResolver, fallback) : accessResolver;
+        }`:`        if (this.accessSelector) {
+            options.resolveIdentity = createAccessResolver(this.accessSelector(env));
+        }`]:[],...e.voiceAgents&&e.voiceAgents.length>0?[`        options.voiceAgents = {
+${e.voiceAgents.map(t=>`            ${JSON.stringify(t.exportName)}: (env as Record<string, unknown>)[${JSON.stringify(t.bindingName)}] as ShardNamespaceLike,`).join(`
+`)}
+        };`]:[]],G=e=>["            cronJobs: LUNORA_CRONS,","            functions: LUNORA_FUNCTIONS,",...e.identity?[`            identity: lunoraIdentityContract.${e.identity.exportName},`]:[],...e.jurisdiction?[`            jurisdiction: ${JSON.stringify(e.jurisdiction)},`]:[],...e.wantsOpenApi?["            openApiSpec,"]:[],...e.wantsOpenRpc?["            openRpcSpec,"]:[],...e.hasQueue?["            queue: (batch: unknown, queueEnv: unknown, _context: ExecutionContextLike): Promise<void> =>","                dispatchQueueBatch(batch as Parameters<typeof dispatchQueueBatch>[0], LUNORA_QUEUE_REGISTRY, {","                    capture: shouldCaptureQueue(queueEnv as Record<string, unknown>)",`                        ? createQueueCaptureSink(queueEnv as Record<string, unknown>${e.jurisdiction?`, { jurisdiction: ${JSON.stringify(e.jurisdiction)} }`:""})`,"                        : undefined,","                    env: queueEnv as Record<string, unknown>,","                }),"]:[],"            routes: this.routeMap,","            shardDO: this.shardSelector?.(env) ?? (undefined as unknown as ShardNamespaceLike),"],B=e=>e?`
+    /** Resolve the storage capability (single or multi-bucket) for the DO side. */
+    private resolveStorage(env: Env): Storage | undefined {
+        const declaration = this.storageDeclaration;
+
+        if (!declaration) {
+            return undefined;
+        }
+
+        const defaultBucket = declaration.bucket(env);
+
+        if (!defaultBucket) {
+            return undefined;
+        }
+
+        const make = (bucket: R2BucketLike): Storage =>
+            createStorage({ bucket, publicBaseUrl: declaration.publicBaseUrl?.(env), signingSecret: declaration.signingSecret?.(env) });
+        const extraEntries = Object.entries(declaration.buckets ?? {})
+            .map(([name, selector]) => [name, selector(env)] as const)
+            .filter((entry): entry is [string, R2BucketLike] => Boolean(entry[1]));
+
+        if (extraEntries.length === 0) {
+            return make(defaultBucket);
+        }
+
+        const map: Record<string, Storage> = { default: make(defaultBucket) };
+
+        for (const [name, bucket] of extraEntries) {
+            map[name] = make(bucket);
+        }
+
+        return createBucketStorage(map, { default: "default" });
+    }
+
+    /** Derive the studio file-browser admin functions from the same buckets \`.storage()\` declared. */
+    private buildStorageAdmin(env: Env): Partial<WorkerOptions> {
+        const declaration = this.storageDeclaration;
+
+        if (!declaration) {
+            return {};
+        }
+
+        const defaultBucket = declaration.bucket(env);
+
+        if (!defaultBucket) {
+            return {};
+        }
+
+        const make = (bucket: R2BucketLike): Storage =>
+            createStorage({ bucket, publicBaseUrl: declaration.publicBaseUrl?.(env), signingSecret: declaration.signingSecret?.(env) });
+        const buckets: Record<string, Storage> = { default: make(defaultBucket) };
+
+        for (const [name, selector] of Object.entries(declaration.buckets ?? {})) {
+            const bucket = selector(env);
+
+            if (bucket) {
+                buckets[name] = make(bucket);
+            }
+        }
+
+        const pick = (name?: string): Storage => buckets[name !== undefined && name !== "" ? name : "default"] ?? buckets.default;
+        const hasSigning = Boolean(declaration.publicBaseUrl?.(env) && declaration.signingSecret?.(env));
+
+        return {
+            storageBuckets: Object.keys(buckets),
+            storageDelete: (key: string, opts?: { bucket?: string }) => pick(opts?.bucket).delete(key),
+            storageList: (prefix?: string, opts?: { bucket?: string; cursor?: string; limit?: number }) => pick(opts?.bucket).list(prefix, opts),
+            storageSignedUrl: hasSigning
+                ? (key: string, opts?: { bucket?: string; expiresInSeconds?: number }) => pick(opts?.bucket).getSignedUrl(key, { expiresInSeconds: opts?.expiresInSeconds })
+                : undefined,
+            storageUpload: (key: string, body: ArrayBuffer, opts?: { bucket?: string; contentType?: string }) => pick(opts?.bucket).upload(key, body, opts),
+        };
+    }
+`:"",H=e=>e?`
+/** Adapt the raw D1 binding to \`@lunora/d1\`'s \`D1Exec\` (reads via \`all\`, writes via \`run\`). */
+const buildExec = (database: D1DatabaseLike): D1Exec => ({
+    all: async (sql, parameters) => {
+        const result = await database
+            .prepare(sql)
+            .bind(...parameters)
+            .all<Record<string, unknown>>();
+
+        return result.results;
+    },
+    run: async (sql, parameters) => {
+        await database
+            .prepare(sql)
+            .bind(...parameters)
+            .run();
+    },
+});
+
+/** Introspect \`.global()\` (D1-backed) tables for the studio's global data browser. */
+const buildGlobalIntrospector = (database: D1DatabaseLike): GlobalIntrospector => {
+    const exec = buildExec(database);
+
+    return {
+        facetColumn: (options) => facetGlobalColumn(exec, schema as never, options),
+        listTables: () => listGlobalTables(exec, schema as never),
+        readTablePage: (options) => readGlobalTablePage(exec, schema as never, options),
+    };
+};
+`:"",U=e=>[...e.hasAuth?["AuthDeclaration"]:[],"ComposedApp",...e.hasGlobal?["GlobalDeclaration"]:[],...e.hasScheduler?["SchedulerDeclaration"]:[],"Selector",...e.hasStorage?["StorageDeclaration"]:[]].toSorted((t,r)=>t.localeCompare(r)).join(", "),F=e=>{const{hasAuth:t}=e,r=$(e),a=N(e),n=t?`        let auth: LunoraAuth | null = null;
+`:"",o=t?`
+        const ensureAuth = async (env: Env): Promise<void> => {
+            if (!this.authDeclaration || auth) {
+                return;
+            }
+
+            auth = createAuth({ ...this.authDeclaration.options(env), database: lunoraD1Adapter(this.authDeclaration.d1(env) as never) });
+            // Apply the better-auth schema lazily on first request (raw-D1 Kysely
+            // migrator). For production run the migrate command ahead of deploy.
+            await ensureMigrated(createAuth({ ...this.authDeclaration.options(env), database: this.authDeclaration.d1(env) as never }));
+        };
+`:"",l=t?`
+                await ensureAuth(env);`:"",s=t?"() => auth":"() => null",u=t?"getAuth: () => LunoraAuth | null":"_getAuth: () => null",d=e.hasFramework?`        const buildWorker = (env: Env): LunoraWorker =>
+            host ? withFrameworkWorker(host, (hostEnv) => this.buildWorkerOptions(hostEnv as Env, ${s})) : createWorker(this.buildWorkerOptions(env, ${s}));`:`        const buildWorker = (env: Env): LunoraWorker => createWorker(this.buildWorkerOptions(env, ${s}));`,h=e.hasFramework?"host?: FrameworkHostHandler":"",c=e.emailAgents??[],p=c.length>0?`        composed.email = dispatchAgentEmail([
+${c.map(i=>`            { agent: lunoraAgentDefinitions.${i.exportName}, binding: ${JSON.stringify(i.bindingName)} },`).join(`
+`)}
+        ]);
+
+`:"",v=`    /** Materialise the standalone Cloudflare worker + \`ShardDO\` class. */
+    public build(): ComposedApp {
+        return this.assemble();
+    }${e.hasFramework?"\n\n    /** Compose Lunora's realtime plane INTO a meta-framework's Cloudflare handler (SvelteKit/Astro/Nuxt). The framework `host` serves everything except the reserved `/_lunora/*` endpoints; pass the adapter-emitted worker (e.g. SvelteKit's `_worker.js`, Astro's `handle`). */\n    public buildFrameworkWorker(host: FrameworkHostHandler): ComposedApp {\n        return this.assemble(host);\n    }":""}`;return`${E}${T(e).join(`
+`)}
+
+/** Read a value off the per-request \`env\`. Returns \`undefined\` to leave the capability unconfigured (its \`ctx.*\`/admin surface stays a clear-error stub). */
+type Selector<Env, T> = (env: Env) => T | undefined;
+${g(e)?"\n/** The generated `createShardDO` config — the long-tail `.ai()` / `.kv()` / … methods pass straight through to it. */\ntype ShardConfig = NonNullable<Parameters<typeof createShardDO>[0]>;\n":""}
+${r.join(`
+
+`)}${r.length>0?`
+
+`:""}/** The composed app: a Cloudflare module worker (\`fetch\` / \`scheduled\` / optional \`email\`) plus the \`ShardDO\` class binding. */
+interface ComposedApp extends LunoraWorker {
+    /** Cloudflare Email Routing entry — present only when \`.onEmail(...)\` was configured. */
+    email?: (message: unknown, env: unknown, context: ExecutionContextLike) => Promise<void>;
+    /** The generated shard Durable Object class — re-export it as a named export so wrangler can bind it. */
+    ShardDO: ReturnType<typeof createShardDO>;
+}
+
+/**
+ * Fluent worker-composition builder. Records each capability declaration, then
+ * \`.build()\` fans them into the DO-side \`createShardDO\` factory and the
+ * worker-side \`createWorker\` options — constructing the worker lazily on the
+ * first request so per-isolate singletons are built once.
+ */
+class AppBuilder<Env extends object> {
+${q(e).join(`
+`)}
+
+    private emailHandler?: (env: Env) => (message: unknown, env: unknown, context: ExecutionContextLike) => Promise<void>;
+
+${I(e).join(`
+
+`)}
+
+${v}
+
+    /** Build the shard DO + compose the worker (standalone or framework-hosted), wrapping the lazy per-isolate singletons + auth init. */
+    private assemble(${h}): ComposedApp {
+        const ShardDO = createShardDO({${W(e)}});
+
+        // Per-isolate singletons: the worker (and auth instance) are expensive to
+        // build, so the first request constructs them and every later request on
+        // the same isolate reuses them.
+        let worker: LunoraWorker | null = null;
+${n}${o}
+${d}
+
+        const composed: ComposedApp = {
+            ShardDO,
+            fetch: async (request: Request, rawEnv: unknown, context: ExecutionContextLike): Promise<Response> => {
+                const env = rawEnv as Env;${l}
+                worker ??= buildWorker(env);
+
+                return worker.fetch(request, rawEnv, context);
+            },
+            scheduled: async (controller: ScheduledControllerLike, rawEnv: unknown, context: ExecutionContextLike): Promise<void> => {
+                worker ??= buildWorker(rawEnv as Env);
+
+                return worker.scheduled(controller, rawEnv, context);
+            },
+            serverQuery: (request, rawEnv, reference, args, options) => {
+                worker ??= buildWorker(rawEnv as Env);
+
+                return worker.serverQuery(request, rawEnv, reference, args, options);
+            },${e.hasQueue?`
+            queue: async (batch: unknown, rawEnv: unknown, context: ExecutionContextLike): Promise<void> => {
+                worker ??= buildWorker(rawEnv as Env);
+
+                return worker.queue?.(batch, rawEnv, context);
+            },`:""}
+        };
+
+${p}        if (this.emailHandler) {
+            const handler = this.emailHandler;
+
+            composed.email = (message, rawEnv, context) => handler(rawEnv as Env)(message, rawEnv, context);
+        }
+
+        return composed;
+    }
+${B(e.hasStorage)}
+    /** Fan the recorded declarations into the worker-side \`createWorker\` options. */
+    private buildWorkerOptions(env: Env, ${u}): WorkerOptions {
+        const options: WorkerOptions = {
+${G(e).join(`
+`)}
+        };
+
+        if (this.adminToken) {
+            options.adminToken = this.adminToken(env);
+        }
+
+${a.join(`
+
+`)}${a.length>0?`
+
+`:""}        for (const fn of this.extendFns) {
+            Object.assign(options, fn(env, { ...options }));
+        }
+
+        return options;
+    }
+}
+${H(e.hasGlobal)}
+/**
+ * Start composing the app. Chain the capability methods, then \`.build()\`.
+ *
+ * \`Env\` is constrained to \`object\`, not \`Record<string, unknown>\`: an \`interface Env\`
+ * — which is what wrangler's generated \`worker-configuration.d.ts\` gives you, and
+ * what any app with its own bindings declares — is NOT assignable to an index
+ * signature, so the stricter bound forced every real app to write
+ * \`type AppEnv = Env & Record<string, unknown>\`. The builder only ever reads \`env\`
+ * through the selectors you pass it, so the looser bound costs nothing.
+ */
+const defineApp = <Env extends object>(): AppBuilder<Env> => new AppBuilder<Env>();
+
+export { AppBuilder, defineApp };
+export type { ${U(e)} };
+`};export{F as emitApp};

package/dist/packem_shared/formatAdvisories-DZvv-0MG.mjs

@@ -0,0 +1,2 @@
+import{runAdvisor as i}from"@lunora/advisor";const n=e=>[...e.indexes.map(s=>({fields:s.fields,kind:"index",name:s.name,unique:s.unique})),...e.searchIndexes.map(s=>({fields:[s.field,...s.filterFields??[]],kind:"search",name:s.name})),...e.rankIndexes.map(s=>({fields:[...s.sortBy.map(a=>a.field),...s.partitionBy??[]],kind:"rank",name:s.name})),...e.vectorIndexes.filter(s=>s.field!==void 0).map(s=>({fields:[s.field],kind:"vector",name:s.name})),...(e.geoIndexes??[]).map(s=>({fields:[s.field],kind:"geo",name:s.name}))],r=e=>{const s={};for(const[a,t]of Object.entries(e.shape))s[a]=t.kind==="optional"?t.inner?.kind??"optional":t.kind;return s},l=e=>({rlsMode:e.rlsMode,tables:e.tables.map(s=>({externallyManaged:s.externallyManaged??!1,externalSource:s.externalSource?{hasReconcile:s.externalSource.hasReconcile??!1,hasSoftDelete:s.externalSource.hasSoftDelete??!1,hasTenantBy:s.externalSource.hasTenantBy,mode:s.externalSource.mode,unanalyzable:s.externalSource.unanalyzable}:void 0,columnKinds:r(s),fields:Object.keys(s.shape),indexes:n(s),isPublic:s.isPublic??!1,name:s.name,relations:s.relations.map(a=>({field:a.field,kind:a.kind,name:a.name,onDelete:a.onDelete,references:a.references,table:a.table})),shardKind:typeof s.shardMode=="string"?s.shardMode:"shardBy",softDelete:s.softDelete,ttl:s.ttl}))}),o=e=>e.map(s=>({exportName:s.exportName,file:`lunora/${s.filePath}.ts`,table:s.table})),d=e=>i({adminRoutes:e.adminRoutes,aiRawRuns:e.aiRawRuns,aiToolSideEffects:e.aiToolSideEffects,argumentDerivedFetches:e.argumentDerivedFetches,argValidators:e.argumentValidators,authApiCalls:e.authApiCalls,authConfigs:e.authConfigs,browserUrlAccesses:e.browserUrlAccesses,configCalls:e.configCalls,containerKeyAccesses:e.containerKeyAccesses,containerOverrides:e.containerOverrides,containers:e.containers,exportSinks:e.exportSinks,failOpenGuards:e.failOpenGuards,flagSecurityDefaults:e.flagSecurityDefaults,geoIndexUsages:e.geoIndexUsages,httpActionGuards:e.httpActionGuards,httpHeaderWrites:e.httpHeaderWrites,identityClaimReads:e.identityClaimReads,imageDeliveryUrlAccesses:e.imageDeliveryUrlAccesses,inserts:e.inserts,kvKeyAccesses:e.kvKeyAccesses,mailRecipientAccesses:e.mailRecipientAccesses,maskProcedures:e.maskProcedures,maskStrategies:e.maskStrategies,mutatorWrites:e.mutatorWrites,nondeterministicCalls:e.nondeterministicCalls,normalizeIdAuthorizations:e.normalizeIdAuthorizations,notifyCalls:e.notifyCalls,notifyConfig:e.notifyConfig,ownerFieldWrites:e.ownerFieldWrites,unrestrictedWhereBranches:e.unrestrictedWhereBranches,paymentWebhooks:e.paymentWebhooks,privilegedDispatches:e.privilegedDispatches,procedureProtections:e.procedureProtections,queries:e.queries??[],queues:e.queues,r2sqlCalls:e.r2sqlCalls,ratelimitKeySelectors:e.ratelimitKeySelectors,rawRowReturns:e.rawRowReturns,relationLoads:e.relationLoads,rlsProcedures:e.rlsProcedures,schema:l(e.schema),secretLiterals:e.secretLiterals,shapes:e.shapes===void 0?void 0:o(e.shapes),softDeleteReads:e.softDeleteReads,sqlInterpolations:e.sqlInterpolations,storageKeyAccesses:e.storageKeyAccesses,storageUploads:e.storageUploads,vectorNamespaceAccesses:e.vectorNamespaceAccesses,workflowCalls:e.workflowCalls,workflows:e.workflows,wranglerVariables:e.wranglerVariables},{source:"static"}),m=e=>{if(e.length===0)return"";const s=`@lunora/codegen: ${String(e.length)} schema advisor finding${e.length===1?"":"s"}`,a=e.map(t=>`  [${t.level}] ${t.name}: ${t.detail}`);return[s,...a].join(`
+`)};export{m as formatAdvisories,d as lintSchema};

package/dist/packem_shared/parse-validator-CSDlMEvE.mjs

@@ -0,0 +1 @@
+import{LunoraError as l}from"@lunora/errors";import{Node as r}from"ts-morph";const c=/^[A-Za-z_$][\w$]*$/u,d=new Set(["$defaultFn","$onUpdateFn","$type","default","defaultNow","nullable","unique"]),p=(n,t)=>{const e={notNull:!0,...n.column};switch(t){case"$defaultFn":case"default":case"defaultNow":{e.hasDefault=!0;break}case"$onUpdateFn":{e.hasOnUpdate=!0;break}case"$type":break;case"nullable":{e.notNull=!1;break}case"unique":{e.unique=!0;break}}return{...n,column:e}},k=new Set(["any","bigint","boolean","bytes","date","geoPoint","null","number","string","timestamp"]),f=new Set(["check","meta"]),o=n=>r.isCallExpression(n)?b(n):{kind:"any",sourceText:n.getText()},g=n=>{const t={};for(const e of n.getProperties()){if(!r.isPropertyAssignment(e))continue;const s=e.getNameNode();if(r.isComputedPropertyName(s))continue;const i=e.getInitializer();if(!i)continue;const a=e.getName();if(!c.test(a))throw new l("INTERNAL",`@lunora/codegen: field name is not a valid JS identifier: ${JSON.stringify(a)}`);t[a]=o(i)}return t},u=(n,t)=>n&&r.isExpression(n)?o(n):t,m=n=>n===void 0?"undefined":r.isStringLiteral(n)||r.isNoSubstitutionTemplateLiteral(n)?JSON.stringify(n.getLiteralValue()):n.getText(),y=(n,t)=>{if(k.has(n))return{kind:n};const[e,s]=t;switch(n){case"array":return{inner:u(e,{kind:"any"}),kind:"array"};case"from":return{kind:"from"};case"id":return{kind:"id",tableName:e&&r.isStringLiteral(e)?e.getLiteralText():"_unknown_"};case"literal":return{kind:"literal",literalValue:m(e)};case"object":return e&&r.isObjectLiteralExpression(e)?{kind:"object",shape:g(e)}:{kind:"object",shape:{}};case"optional":return{inner:u(e,{kind:"any"}),kind:"optional"};case"record":return{keyType:u(e,{kind:"string"}),kind:"record",valueType:u(s,{kind:"any"})};case"storage":return e&&r.isStringLiteral(e)?{bucket:e.getLiteralText(),kind:"storage"}:{kind:"storage"};case"union":return{kind:"union",members:t.filter(i=>r.isExpression(i)).map(i=>o(i))};default:throw new l("INTERNAL",`Unsupported validator kind: ${n}`)}},b=n=>{const t=n.getExpression();if(!r.isPropertyAccessExpression(t))return{kind:"any",sourceText:n.getText()};const e=t.getName(),s=n.getArguments();if(d.has(e)){const i=t.getExpression(),a=r.isExpression(i)?o(i):{kind:"any"};return p(a,e)}if(f.has(e)){const i=t.getExpression(),a=r.isExpression(i)?o(i):{kind:"any"};return e==="check"?{...a,hasRefinement:!0}:a}return y(e,s)};export{g as d,o as s};

package/dist/packem_shared/paths-BmX5O1sG.mjs

@@ -0,0 +1 @@
+const a=/\/index$/u,l=/[^\dA-Za-z]/gu,c=e=>e.replace(a,"").replaceAll(l,"_");export{c as n};

package/dist/packem_shared/redact-CQ8-to6l.mjs

@@ -0,0 +1 @@
+const s=/[\w+/=-]{40,}/u,d=/[a-z]/u,i=/[A-Z]/u,n=/\d/u,k=/\b(?:[\da-f]{32,}|[\dA-F]{32,})\b/u,a=t=>{const e=s.exec(t)?.[0];return e===void 0?!1:d.test(e)&&i.test(e)&&n.test(e)},r=t=>k.test(t),u=/\b(?:sk|rk)_live_[\dA-Za-z]{20,}/u,_=/\bAKIA[\dA-Z]{16}\b/u,c=/\bgh[posru]_[\dA-Za-z]{36,}/u,A=/\bsk-[\dA-Za-z]{32,}/u,b=/\bxox[abprs]-[\dA-Za-z-]{10,}/u,o=/-----BEGIN(?: [A-Z]+)? PRIVATE KEY-----/u,h=[{kind:"stripe_live_key",test:t=>u.test(t)},{kind:"aws_access_key",test:t=>_.test(t)},{kind:"github_token",test:t=>c.test(t)},{kind:"openai_key",test:t=>A.test(t)},{kind:"slack_token",test:t=>b.test(t)},{kind:"private_key",test:t=>o.test(t)},{kind:"high_entropy",test:a},{kind:"hex_secret",test:r}],p=t=>h.find(e=>e.test(t))?.kind,E=t=>`${t.slice(0,4)}…(${String(t.length)} chars)`;export{h as SECRET_RULES,E as redact,p as secretKindOf};

package/dist/packem_shared/schemaFromIr-R1ZFzVyy.mjs

@@ -0,0 +1 @@
+const n=e=>{try{return JSON.parse(e)}catch{const t=e.trim();return t.length>=2&&(t.startsWith("'")||t.startsWith('"'))&&t.at(-1)===t[0]?t.slice(1,-1):t}},a=e=>{const t={};return e.column!==void 0&&(t.column={defaultValue:e.column.hasDefault===!0?null:void 0,notNull:e.column.notNull,unique:e.column.unique}),e.inner!==void 0&&(t.inner=a(e.inner)),e.members!==void 0&&(t.members=e.members.map(r=>a(r))),e.shape!==void 0&&(t.shape=Object.fromEntries(Object.entries(e.shape).map(([r,l])=>[r,a(l)]))),e.tableName!==void 0&&(t.tableName=e.tableName),e.literalValue!==void 0&&(t.value=n(e.literalValue)),e.keyType!==void 0&&(t.keyValidator=a(e.keyType)),e.valueType!==void 0&&(t.valueValidator=a(e.valueType)),{_meta:t,kind:e.kind}},i=e=>({tables:Object.fromEntries(e.tables.map(t=>[t.name,{shape:Object.fromEntries(Object.entries(t.shape).map(([r,l])=>[r,a(l)]))}]))});export{i as schemaFromIr};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/codegen",
-  "version": "1.0.0-alpha.54",
+  "version": "1.0.0-alpha.56",
   "description": "Code generator for Lunora: emits _generated/{api,server,dataModel}.ts from your schema",
   "keywords": [
     "cloudflare",
@@ -46,8 +46,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/advisor": "1.0.0-alpha.34",
-    "@lunora/agent": "1.0.0-alpha.10",
+    "@lunora/advisor": "1.0.0-alpha.35",
+    "@lunora/agent": "1.0.0-alpha.11",
     "@lunora/container": "1.0.0-alpha.16",
     "@lunora/errors": "1.0.0-alpha.8",
     "@lunora/queue": "1.0.0-alpha.10",

package/dist/packem_shared/AGENTS_FILENAME-Cxx7wiSs.mjs

@@ -1,158 +0,0 @@
-import { existsSync } from 'node:fs';
-import { join } from 'node:path';
-import { agentDefaultName, agentClassName, agentBindingName, voiceBindingName, voiceClassName } from '@lunora/agent/naming';
-import { LunoraError } from '@lunora/errors';
-import { Node, SyntaxKind } from 'ts-morph';
-import { diagnosticAt } from './CodegenDiagnosticError-DyQ5FwkM.mjs';
-
-const AGENTS_FILENAME = "agents.ts";
-const isDefineAgent = (identifier) => {
-  const symbol = identifier.getSymbol();
-  if (!symbol) {
-    return identifier.getText() === "defineAgent";
-  }
-  for (const declaration of symbol.getDeclarations()) {
-    if (!Node.isImportSpecifier(declaration)) {
-      continue;
-    }
-    if (declaration.getImportDeclaration().getModuleSpecifierValue() !== "@lunora/agent") {
-      return false;
-    }
-    return declaration.getNameNode().getText() === "defineAgent";
-  }
-  return false;
-};
-const stringProperty = (expression, exportName, property) => {
-  if (Node.isStringLiteral(expression) || Node.isNoSubstitutionTemplateLiteral(expression)) {
-    return expression.getLiteralValue();
-  }
-  throw diagnosticAt(
-    expression,
-    `agent "${exportName}": \`${property}\` must be a static string literal — it is deploy configuration codegen writes into wrangler.jsonc`
-  );
-};
-const booleanProperty = (expression, exportName, property) => {
-  if (expression.getKind() === SyntaxKind.TrueKeyword) {
-    return true;
-  }
-  if (expression.getKind() === SyntaxKind.FalseKeyword) {
-    return false;
-  }
-  throw diagnosticAt(
-    expression,
-    `agent "${exportName}": \`${property}\` must be a static boolean literal — it is deploy configuration codegen writes into the ctx.agents wiring spec`
-  );
-};
-const agentFromCall = (call, exportName) => {
-  const argument = call.getArguments()[0];
-  if (!argument || !Node.isObjectLiteralExpression(argument)) {
-    throw diagnosticAt(call, `agent "${exportName}": defineAgent must be passed an inline object literal`);
-  }
-  const ir = {
-    bindingName: agentBindingName(exportName),
-    className: agentClassName(exportName),
-    exportName,
-    name: agentDefaultName(exportName)
-  };
-  const nameProperty = argument.getProperty("name");
-  if (nameProperty && Node.isPropertyAssignment(nameProperty)) {
-    ir.name = stringProperty(nameProperty.getInitializerOrThrow(), exportName, "name");
-  }
-  const publicRunProperty = argument.getProperty("publicRun");
-  if (publicRunProperty && Node.isPropertyAssignment(publicRunProperty) && booleanProperty(publicRunProperty.getInitializerOrThrow(), exportName, "publicRun")) {
-    ir.publicRun = true;
-  }
-  const voiceProperty = argument.getProperty("voice");
-  if (voiceProperty && Node.isPropertyAssignment(voiceProperty)) {
-    const voiceInitializer = voiceProperty.getInitializerOrThrow();
-    if (!Node.isObjectLiteralExpression(voiceInitializer)) {
-      throw diagnosticAt(
-        voiceInitializer,
-        `agent "${exportName}": \`voice\` must be an inline object literal — its presence tells codegen to emit the voice-session Durable Object`
-      );
-    }
-    ir.voice = true;
-    ir.voiceBindingName = voiceBindingName(exportName);
-    ir.voiceClassName = voiceClassName(exportName);
-  }
-  if (argument.getProperty("onEmail")) {
-    ir.onEmail = true;
-  }
-  return ir;
-};
-const unwrapToCallExpression = (node) => {
-  let current = node;
-  while (current && (Node.isAsExpression(current) || Node.isSatisfiesExpression(current) || Node.isParenthesizedExpression(current))) {
-    current = current.getExpression();
-  }
-  return current && Node.isCallExpression(current) ? current : void 0;
-};
-const agentsFromSource = (source) => {
-  const agents = [];
-  for (const declaration of source.getVariableDeclarations()) {
-    if (!declaration.isExported()) {
-      continue;
-    }
-    const call = unwrapToCallExpression(declaration.getInitializer());
-    if (!call) {
-      continue;
-    }
-    const callee = call.getExpression();
-    if (!Node.isIdentifier(callee) || !isDefineAgent(callee)) {
-      continue;
-    }
-    const nameNode = declaration.getNameNode();
-    if (!Node.isIdentifier(nameNode)) {
-      throw diagnosticAt(nameNode, "defineAgent exports must be plain named exports (no destructuring)");
-    }
-    agents.push(agentFromCall(call, nameNode.getText()));
-  }
-  return agents;
-};
-const assertUniqueNames = (agents) => {
-  const seenNames = /* @__PURE__ */ new Map();
-  const seenBindings = /* @__PURE__ */ new Map();
-  const seenClasses = /* @__PURE__ */ new Map();
-  for (const agent of agents) {
-    const priorName = seenNames.get(agent.name);
-    if (priorName !== void 0) {
-      throw new LunoraError(
-        "DUPLICATE_AGENT_NAME",
-        `Duplicate agent name "${agent.name}": produced by both "${priorName}" and "${agent.exportName}". Deployed agent names must be unique across the project.`,
-        { status: 500 }
-      );
-    }
-    seenNames.set(agent.name, agent.exportName);
-    const priorBinding = seenBindings.get(agent.bindingName);
-    if (priorBinding !== void 0) {
-      throw new LunoraError(
-        "DUPLICATE_AGENT_BINDING",
-        `Duplicate agent binding "${agent.bindingName}": produced by both "${priorBinding}" and "${agent.exportName}". Agent export names must yield unique binding names.`,
-        { status: 500 }
-      );
-    }
-    seenBindings.set(agent.bindingName, agent.exportName);
-    const priorClass = seenClasses.get(agent.className);
-    if (priorClass !== void 0) {
-      throw new LunoraError(
-        "DUPLICATE_AGENT_CLASS",
-        `Duplicate agent class "${agent.className}": produced by both "${priorClass}" and "${agent.exportName}". Agent export names must yield unique generated class names.`,
-        { status: 500 }
-      );
-    }
-    seenClasses.set(agent.className, agent.exportName);
-  }
-};
-const discoverAgents = (project, lunoraDirectory) => {
-  const agentsPath = join(lunoraDirectory, AGENTS_FILENAME);
-  if (!existsSync(agentsPath)) {
-    return [];
-  }
-  const source = project.getSourceFile(agentsPath) ?? project.addSourceFileAtPath(agentsPath);
-  const agents = agentsFromSource(source);
-  agents.sort((a, b) => a.exportName.localeCompare(b.exportName));
-  assertUniqueNames(agents);
-  return agents;
-};
-
-export { AGENTS_FILENAME, discoverAgents };