@lunora/codegen 1.0.0-alpha.55 → 1.0.0-alpha.56

package/dist/packem_shared/emitApp-DbMM8iHe.mjs

@@ -1,706 +0,0 @@
-import { A as APP_METHOD_CAPABILITIES, G as GENERATED_HEADER } from './emit-DIbr7U31.mjs';
-
-const hasFlagKey = (key) => `has${key.charAt(0).toUpperCase()}${key.slice(1)}`;
-const LONG_TAIL = APP_METHOD_CAPABILITIES.map(
-  ({ appMethod, key }) => [hasFlagKey(key), appMethod.method, appMethod.configKey, appMethod.doc]
-);
-const hasAnyLongTail = (options) => LONG_TAIL.some(([flag]) => options[flag]);
-const buildIdentityImports = (identity) => identity ? [`import * as lunoraIdentityContract from "../identity.js";`] : [];
-const buildAccessImports = (hasAccess, hasAuth) => hasAccess ? [
-  `import type { CreateAccessResolverOptions } from "@lunora/cloudflare-access";`,
-  `import { createAccessResolver${hasAuth ? ", composeResolvers" : ""} } from "@lunora/cloudflare-access";`
-] : [];
-const buildKvImports = (hasKv) => hasKv ? [`import { createKvIntrospectorFromEnv } from "@lunora/bindings/kv";`] : [];
-const buildNotifyImports = (hasNotify) => hasNotify ? [`import notifyConfig from "../notify.js";`] : [];
-const hasEmailAgents = (options) => (options.emailAgents?.length ?? 0) > 0;
-const buildInboundImports = (options) => hasEmailAgents(options) ? [`import { dispatchAgentEmail } from "@lunora/agent/inbound";`] : [];
-const buildAgentDefinitionsImport = (options) => hasEmailAgents(options) ? [`import * as lunoraAgentDefinitions from "../agents.js";`] : [];
-const buildImportLines = (options) => {
-  const {
-    hasAccess,
-    hasAuth,
-    hasFramework,
-    hasGlobal,
-    hasHyperdriveGlobal,
-    hasKv,
-    hasQueue,
-    hasScheduler,
-    hasStorage,
-    hasWorkflow,
-    useUmbrella,
-    wantsOpenApi,
-    wantsOpenRpc
-  } = options;
-  const runtimeModule = useUmbrella ? "lunorash/runtime" : "@lunora/runtime";
-  const runtimeTypeImports = ["ExecutionContextLike", "LunoraWorker", "Route", "ScheduledControllerLike", "ShardNamespaceLike", "WorkerOptions"];
-  if (hasGlobal) {
-    runtimeTypeImports.push("GlobalIntrospector");
-  }
-  if (hasFramework) {
-    runtimeTypeImports.push("FrameworkHostHandler");
-  }
-  const runtimeValueImports = [
-    ...hasGlobal || hasHyperdriveGlobal ? ["createCrossShardRelationCapabilities"] : [],
-    "createWorker",
-    "resolveLogArchiveFromEnv",
-    ...hasFramework ? ["withFrameworkWorker"] : []
-  ].join(", ");
-  return [
-    ...hasAuth ? [
-      `import type { LunoraAuth, LunoraAuthOptions } from "@lunora/auth";`,
-      `import { createAuth, createAuthAdmin, createAuthAuditReader, d1Executor, ensureMigrated, handleAuthRequest, lunoraD1Adapter } from "@lunora/auth";`
-    ] : [],
-    ...buildAccessImports(hasAccess, hasAuth),
-    ...hasGlobal ? [
-      `import type { D1CtxDbOptions, D1DatabaseLike, D1Exec } from "@lunora/d1";`,
-      `import { createD1CtxDb, facetGlobalColumn, listGlobalTables, readGlobalTablePage } from "@lunora/d1";`
-    ] : [],
-    ...hasHyperdriveGlobal ? [
-      `import type { HyperdriveEngine } from "@lunora/hyperdrive/global";`,
-      `import { createHyperdriveGlobalCtxDb } from "@lunora/hyperdrive/global";`,
-      `import type { SqlCtxDbOptions, SqlExec } from "@lunora/sql-store";`
-    ] : [],
-    ...buildKvImports(hasKv),
-    ...hasScheduler ? [`import type { DurableObjectNamespaceLike } from "@lunora/scheduler";`, `import { createScheduler } from "@lunora/scheduler";`] : [],
-    ...hasStorage ? [`import type { R2BucketLike, Storage } from "@lunora/storage";`, `import { createBucketStorage, createStorage } from "@lunora/storage";`] : [],
-    ...hasWorkflow ? [`import { createWorkflowsRestClient } from "@lunora/workflow";`] : [],
-    ...buildInboundImports(options),
-    `import type { ${[...runtimeTypeImports].toSorted((a, b) => a.localeCompare(b)).join(", ")} } from "${runtimeModule}";`,
-    `import { ${runtimeValueImports} } from "${runtimeModule}";`,
-    ``,
-    ...buildIdentityImports(options.identity),
-    ...buildAgentDefinitionsImport(options),
-    ...hasGlobal || hasHyperdriveGlobal ? [`import schema from "../schema.js";`] : [],
-    ...buildNotifyImports(options.hasNotify),
-    `import { LUNORA_CRONS } from "./crons.js";`,
-    `import { LUNORA_FUNCTIONS } from "./functions.js";`,
-    ...hasQueue ? [
-      `import { createQueueCaptureSink, dispatchQueueBatch, shouldCaptureQueue } from "@lunora/queue";`,
-      `import { LUNORA_QUEUE_REGISTRY } from "./queues.js";`
-    ] : [],
-    ...wantsOpenApi ? [`import { openApiSpec } from "./openapi.js";`] : [],
-    ...wantsOpenRpc ? [`import { openRpcSpec } from "./openrpc.js";`] : [],
-    `import { createShardDO } from "./shard.js";`
-  ];
-};
-const buildDeclarationBlocks = (options) => [
-  ...options.hasStorage ? [
-    `/** \`.storage(...)\` declaration — one bucket (required) plus optional extra named buckets and signed-URL config. Backs \`ctx.storage\` AND the studio file browser. */
-interface StorageDeclaration<Env> {
-    /** The default R2 bucket binding (the bare \`ctx.storage\`). */
-    bucket: Selector<Env, R2BucketLike>;
-    /** Extra named buckets, reached via \`ctx.storage.bucket("name")\` and the studio's bucket picker. */
-    buckets?: Record<string, Selector<Env, R2BucketLike>>;
-    /** Public base URL signed/public object URLs resolve against. */
-    publicBaseUrl?: Selector<Env, string>;
-    /** HMAC secret for signed URLs. */
-    signingSecret?: Selector<Env, string>;
-}`
-  ] : [],
-  ...options.hasScheduler ? [
-    `/** \`.scheduler(...)\` declaration — the \`SchedulerDO\` namespace plus the worker origin its callbacks dispatch back to. Backs \`ctx.scheduler\` AND the studio's scheduled-jobs view. */
-interface SchedulerDeclaration<Env> {
-    /** The \`SchedulerDO\` namespace binding (typically \`env.SCHEDULER\`). */
-    namespace: Selector<Env, DurableObjectNamespaceLike & ShardNamespaceLike>;
-    /** The worker origin the \`SchedulerDO\` dispatches HTTP job callbacks back to. */
-    origin?: Selector<Env, string>;
-}`
-  ] : [],
-  ...options.hasGlobal ? [
-    `/** \`.global(...)\` declaration — the D1 binding backing \`.global()\` tables. Backs cross-tenant \`ctx.db\` reads/writes AND the studio's global data browser. */
-interface GlobalDeclaration<Env> {
-    /** The D1 binding (typically \`env.DB\`). */
-    d1: Selector<Env, D1DatabaseLike>;
-    /** The worker origin used to fan reverse cross-backend relations across shards. Without it, such a relation throws a clear error. */
-    origin?: Selector<Env, string>;
-}`
-  ] : [],
-  ...options.hasHyperdriveGlobal ? [
-    `/** \`.hyperdriveGlobal(...)\` declaration — backs \`.global({ backend: "hyperdrive" })\` tables on a Postgres/MySQL database via Hyperdrive. Stays reactive: the writer is injected as \`globalDb\` and the broadcast hook drives live queries. */
-interface HyperdriveGlobalDeclaration<Env> {
-    /** The Hyperdrive engine — selects the Postgres or MySQL dialect. */
-    engine: HyperdriveEngine;
-    /** Build the \`SqlExec\` from \`env\` — e.g. \`buildPgExec(fromPostgresJs(postgres(env.HYPERDRIVE.connectionString)))\`. Cache the driver on the DO instance; rebuild lazily after hibernation. */
-    exec: (env: Env) => SqlExec;
-    /** The worker origin used to fan reverse cross-backend relations across shards. Without it, such a relation throws a clear error. */
-    origin?: Selector<Env, string>;
-}`
-  ] : [],
-  ...options.hasAuth ? [
-    `/** \`.auth(...)\` declaration — better-auth options plus the D1 binding its SQL adapter reads. The builder owns the lazy build + \`ensureMigrated\` dance and wires \`authHandler\` / \`resolveIdentity\` / \`authAdmin\`. */
-interface AuthDeclaration<Env> {
-    /** The D1 binding the auth SQL adapter is wired over (via \`lunoraD1Adapter\`). */
-    d1: Selector<Env, unknown>;
-    /** Build the better-auth options from \`env\` (secret, plugins, email/password, …). */
-    options: (env: Env) => LunoraAuthOptions;
-}`
-  ] : []
-];
-const buildFieldLines = (options) => [
-  ...options.hasAccess ? [`    private accessSelector?: Selector<Env, CreateAccessResolverOptions>;`] : [],
-  `    private adminToken?: Selector<Env, string>;`,
-  ...options.hasAuth ? [`    private authDeclaration?: AuthDeclaration<Env>;`] : [],
-  `    private readonly extendFns: ((env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>)[] = [];`,
-  ...options.hasGlobal ? [`    private globalDeclaration?: GlobalDeclaration<Env>;`] : [],
-  ...options.hasHyperdriveGlobal ? [`    private hyperdriveGlobalDeclaration?: HyperdriveGlobalDeclaration<Env>;`] : [],
-  `    private readonly routeMap: Record<string, Route> = {};`,
-  ...options.hasScheduler ? [`    private schedulerDeclaration?: SchedulerDeclaration<Env>;`] : [],
-  ...hasAnyLongTail(options) ? [`    private readonly shardExtras: Partial<ShardConfig> = {};`] : [],
-  `    private shardSelector?: Selector<Env, ShardNamespaceLike>;`,
-  ...options.hasStorage ? [`    private storageDeclaration?: StorageDeclaration<Env>;`] : []
-];
-const buildLongTailMethods = (options) => LONG_TAIL.filter(([flag]) => options[flag]).map(
-  ([, name, key, document_]) => `    /** ${document_} */
-    public ${name}(factory: NonNullable<ShardConfig["${key}"]>): this {
-        this.shardExtras.${key} = factory;
-
-        return this;
-    }`
-);
-const buildMethodBlocks = (options) => [
-  ...options.hasAccess ? [
-    `    /** Wire Cloudflare Access (Zero Trust) — verifies the \`Cf-Access-Jwt-Assertion\` JWT and feeds the identity into \`ctx.auth\` / RLS via \`resolveIdentity\`. When \`.auth(...)\` is also configured, Access is composed ahead of it (Access wins when its JWT is present; everyone else falls through to the app session). */
-    public access(selector: Selector<Env, CreateAccessResolverOptions>): this {
-        this.accessSelector = selector;
-
-        return this;
-    }`
-  ] : [],
-  `    /** Bearer token gating the \`/_lunora/admin/*\` endpoints the studio calls. */
-    public admin(selector: Selector<Env, string>): this {
-        this.adminToken = selector;
-
-        return this;
-    }`,
-  ...options.hasAuth ? [
-    `    /** Wire better-auth — the builder lazily builds the instance, runs \`ensureMigrated\`, and dispatches \`/api/auth/*\` inside the worker (instrumented for the auth-failure SLO). */
-    public auth(declaration: AuthDeclaration<Env>): this {
-        this.authDeclaration = declaration;
-
-        return this;
-    }`
-  ] : [],
-  `    /** Escape hatch — merge raw \`WorkerOptions\` (anything not yet sugared) over the derived options at build time. The second \`derived\` argument is a snapshot of the options assembled so far (after \`.auth(...)\` etc.), so you can compose rather than clobber — e.g. wrap \`derived.resolveIdentity\` instead of replacing it. */
-    public extend(fn: (env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>): this {
-        this.extendFns.push(fn);
-
-        return this;
-    }`,
-  ...options.hasGlobal ? [
-    `    /** Back \`.global()\` (cross-tenant) tables with D1 — wires \`ctx.db\` routing, the studio global browser, and reverse cross-shard relations. */
-    public global(declaration: GlobalDeclaration<Env>): this {
-        this.globalDeclaration = declaration;
-
-        return this;
-    }`
-  ] : [],
-  ...options.hasHyperdriveGlobal ? [
-    `    /** Back \`.global({ backend: "hyperdrive" })\` tables with a Postgres/MySQL database via Hyperdrive — wires reactive \`ctx.db\` routing through the shared store core. */
-    public hyperdriveGlobal(declaration: HyperdriveGlobalDeclaration<Env>): this {
-        this.hyperdriveGlobalDeclaration = declaration;
-
-        return this;
-    }`
-  ] : [],
-  `    /** Cloudflare Email Routing entry — exposes the top-level \`email\` handler. */
-    public onEmail(handler: (env: Env) => (message: unknown, env: unknown, context: ExecutionContextLike) => Promise<void>): this {
-        this.emailHandler = handler;
-
-        return this;
-    }`,
-  `    /** Mount a custom HTTP route (e.g. an asset-serving or test endpoint). Key is \`"METHOD path"\`, \`"path"\`, or a path prefix matched by the runtime. */
-    public route(key: string, handler: Route): this {
-        this.routeMap[key] = handler;
-
-        return this;
-    }`,
-  ...options.hasScheduler ? [
-    `    /** Wire the \`SchedulerDO\` — backs \`ctx.scheduler\` and the studio's scheduled-jobs view. */
-    public scheduler(declaration: SchedulerDeclaration<Env>): this {
-        this.schedulerDeclaration = declaration;
-
-        return this;
-    }`
-  ] : [],
-  `    /** The shard Durable Object namespace (typically \`env.SHARD\`) — required: every app routes RPC + WebSocket traffic through it. */
-    public shard(selector: Selector<Env, ShardNamespaceLike>): this {
-        this.shardSelector = selector;
-
-        return this;
-    }`,
-  ...options.hasStorage ? [
-    `    /** Wire R2 storage — backs \`ctx.storage\` (incl. multi-bucket) and the studio file browser, from one declaration. */
-    public storage(declaration: StorageDeclaration<Env>): this {
-        this.storageDeclaration = declaration;
-
-        return this;
-    }`
-  ] : [],
-  ...buildLongTailMethods(options)
-];
-const buildShardFactoryBody = (options) => {
-  const entries = [
-    ...options.hasGlobal ? [
-      `            ...(this.globalDeclaration
-                ? {
-                      d1: (rawEnv: Record<string, unknown>, request?: { identity?: Record<string, unknown>; userId?: string | null }) => {
-                          const env = rawEnv as Env;
-                          const database = this.globalDeclaration?.d1(env);
-
-                          if (!database) {
-                              return undefined;
-                          }
-
-                          const origin = this.globalDeclaration?.origin?.(env);
-                          const crossShard = origin
-                              ? createCrossShardRelationCapabilities({ identity: request?.identity, origin, userId: request?.userId ?? undefined })
-                              : undefined;
-
-                          return createD1CtxDb({
-                              ...(crossShard ? { crossShardCounter: crossShard.crossShardCounter, crossShardReader: crossShard.crossShardReader } : {}),
-                              auth: { identity: request?.identity ?? null, userId: request?.userId ?? null },
-                              exec: buildExec(database),
-                              schema: schema as unknown as D1CtxDbOptions["schema"],
-                          });
-                      },
-                  }
-                : {}),`
-    ] : [],
-    ...options.hasHyperdriveGlobal ? [
-      `            ...(this.hyperdriveGlobalDeclaration
-                ? {
-                      hyperdriveGlobal: (rawEnv: Record<string, unknown>, request?: { identity?: Record<string, unknown>; userId?: string | null }) => {
-                          const env = rawEnv as Env;
-                          const exec = this.hyperdriveGlobalDeclaration?.exec(env) as SqlExec | undefined;
-
-                          if (!exec) {
-                              return undefined;
-                          }
-
-                          const origin = this.hyperdriveGlobalDeclaration?.origin?.(env);
-                          const crossShard = origin
-                              ? createCrossShardRelationCapabilities({ identity: request?.identity, origin, userId: request?.userId ?? undefined })
-                              : undefined;
-
-                          return createHyperdriveGlobalCtxDb({
-                              ...(crossShard ? { crossShardCounter: crossShard.crossShardCounter, crossShardReader: crossShard.crossShardReader } : {}),
-                              auth: { identity: request?.identity ?? null, userId: request?.userId ?? null },
-                              engine: this.hyperdriveGlobalDeclaration?.engine as HyperdriveEngine,
-                              exec,
-                              schema: schema as unknown as SqlCtxDbOptions["schema"],
-                          });
-                      },
-                  }
-                : {}),`
-    ] : [],
-    ...options.hasScheduler ? [
-      `            ...(this.schedulerDeclaration
-                ? {
-                      scheduler: (rawEnv: Record<string, unknown>) => {
-                          const env = rawEnv as Env;
-                          const namespace = this.schedulerDeclaration?.namespace(env);
-                          const origin = this.schedulerDeclaration?.origin?.(env);
-
-                          return namespace && origin ? createScheduler({${options.jurisdiction ? ` jurisdiction: ${JSON.stringify(options.jurisdiction)},` : ""} namespace, originUrl: origin }) : undefined;
-                      },
-                  }
-                : {}),`
-    ] : [],
-    ...options.hasStorage ? [`            ...(this.storageDeclaration ? { storage: (rawEnv: Record<string, unknown>) => this.resolveStorage(rawEnv as Env) } : {}),`] : [],
-    ...hasAnyLongTail(options) ? [`            ...this.shardExtras,`] : []
-  ];
-  return entries.length > 0 ? `
-${entries.join("\n")}
-        ` : "";
-};
-const buildWorkerOptionLines = (options) => [
-  ...options.hasScheduler ? [
-    `        if (this.schedulerDeclaration) {
-            options.schedulerDO = this.schedulerDeclaration.namespace(env);
-        }`
-  ] : [],
-  ...options.hasWorkflow ? [
-    // Resolve the Workflows REST client from the request env so the studio's
-    // \`/_lunora/admin/workflows*\` proxy can read instance/step state; returns
-    // undefined (→ "not configured") until the CF account id + API token are set.
-    `        options.workflowsClient = (workflowEnv) => {
-            const source = workflowEnv as Record<string, unknown>;
-            const accountId = source["CLOUDFLARE_ACCOUNT_ID"];
-            const apiToken = source["CLOUDFLARE_API_TOKEN"];
-
-            return typeof accountId === "string" && accountId !== "" && typeof apiToken === "string" && apiToken !== ""
-                ? createWorkflowsRestClient({ accountId, apiToken })
-                : undefined;
-        };`
-  ] : [],
-  ...options.hasGlobal ? [
-    `        if (this.globalDeclaration) {
-            const database = this.globalDeclaration.d1(env);
-
-            if (database) {
-                options.d1 = database;
-                options.globalIntrospector = buildGlobalIntrospector(database);
-            }
-        }`
-  ] : [],
-  ...options.hasStorage ? [
-    `        if (this.storageDeclaration) {
-            Object.assign(options, this.buildStorageAdmin(env));
-        }`
-  ] : [],
-  // The studio's KV browser is wired zero-config: `createKvIntrospectorFromEnv`
-  // scans `env` for every bound Workers KV namespace, so each `kv_namespaces`
-  // entry in wrangler.jsonc appears under its binding name (any name, any count)
-  // with no manual `createKvIntrospector` call. A deployment with no KV binding
-  // yields an empty namespace list rather than crashing.
-  ...options.hasKv ? [`        options.kvIntrospector = createKvIntrospectorFromEnv(env);`] : [],
-  // The studio's Notifications page reads the app's registered `@lunora/notify`
-  // device subscriptions through the SAME store the handlers register into. The
-  // store is built from `env` via `lunora/notify.ts`'s `defineNotify({ store })`;
-  // when no `store` is configured (the in-memory default), the gated
-  // `__lunora_admin__:listPushSubscriptions` RPC returns an empty device list.
-  ...options.hasNotify ? [`        options.notifySubscriptionStore = notifyConfig.store ? notifyConfig.store(env) : undefined;`] : [],
-  // The studio's Logs → Archive feed is wired zero-config: when the operator sets
-  // `LUNORA_LOG_ARCHIVE_TABLE` (the R2 Data Catalog table `pipelineLogSink` writes
-  // to), the durable archive becomes readable; unset ⇒ `undefined` ⇒ the feed
-  // reports "not configured". The R2 SQL credentials come from `R2_SQL_*` env vars.
-  `        options.logArchive = resolveLogArchiveFromEnv(env);`,
-  ...options.hasAuth ? [
-    `        if (this.authDeclaration) {
-            options.authHandler = (request) => {
-                const auth = getAuth();
-
-                return auth ? handleAuthRequest(auth, request) : Promise.resolve(undefined);
-            };
-            options.resolveIdentity = async (request) => {
-                const auth = getAuth();
-
-                if (!auth) {
-                    return null;
-                }
-
-                const session = await auth.api.getSession({ headers: (request as Request).headers });
-
-                return session?.user?.id ? { userId: session.user.id } : null;
-            };
-            const authInstance = getAuth();
-
-            options.authAdmin = authInstance ? createAuthAdmin(authInstance) : undefined;
-            options.authAuditReader = createAuthAuditReader(d1Executor(this.authDeclaration.d1(env) as never));
-        }`
-  ] : [],
-  // Cloudflare Access — runs AFTER the auth block so it can compose ahead of
-  // the better-auth resolver rather than clobber it. With `.auth()` present,
-  // a request carrying a verified Access JWT is authenticated by Access and
-  // everyone else falls through to the app session; without it, Access is the
-  // sole resolver.
-  ...options.hasAccess ? [
-    options.hasAuth ? `        if (this.accessSelector) {
-            const accessResolver = createAccessResolver(this.accessSelector(env));
-            const fallback = options.resolveIdentity;
-
-            options.resolveIdentity = fallback ? composeResolvers(accessResolver, fallback) : accessResolver;
-        }` : `        if (this.accessSelector) {
-            options.resolveIdentity = createAccessResolver(this.accessSelector(env));
-        }`
-  ] : [],
-  // Voice-enabled agents: map each export name to its `VOICE_*` Durable Object
-  // namespace so the runtime serves `/_lunora/voice/<exportName>`. Read off
-  // `env` structurally (the binding is provisioned by the config layer's
-  // reconcile step, so it may not be on the generated `Env` type). Emitted only
-  // when at least one agent opted into voice — voice-free output is unchanged.
-  ...options.voiceAgents && options.voiceAgents.length > 0 ? [
-    `        options.voiceAgents = {
-${options.voiceAgents.map(
-      (agent) => `            ${JSON.stringify(agent.exportName)}: (env as Record<string, unknown>)[${JSON.stringify(agent.bindingName)}] as ShardNamespaceLike,`
-    ).join("\n")}
-        };`
-  ] : []
-];
-const buildBaseWorkerOptions = (options) => [
-  `            cronJobs: LUNORA_CRONS,`,
-  `            functions: LUNORA_FUNCTIONS,`,
-  // The declared `defineIdentity(...)` contract — wires the runtime trust
-  // boundary so `wrapResolverWithContract` validates every resolved identity
-  // against it before it becomes `ctx.auth`. Emitted only when the app declares
-  // a contract, so apps without one keep unchanged output.
-  ...options.identity ? [`            identity: lunoraIdentityContract.${options.identity.exportName},`] : [],
-  // Schema `.jurisdiction("…")` pins every DO the worker reaches to the
-  // Cloudflare data-residency region. Emitted only when declared, so apps
-  // without it keep the un-pinned global namespace (and unchanged output).
-  ...options.jurisdiction ? [`            jurisdiction: ${JSON.stringify(options.jurisdiction)},`] : [],
-  ...options.wantsOpenApi ? [`            openApiSpec,`] : [],
-  ...options.wantsOpenRpc ? [`            openRpcSpec,`] : [],
-  // The push-consumer handler backing the worker's `queue(batch, …)` entry:
-  // routes each delivered batch to its `defineQueue` handler. Built from
-  // `@lunora/queue` here (keeping the runtime decoupled) and wired only when the
-  // app declares push queues in `lunora/queues.ts`. In a dev environment (or with
-  // `LUNORA_QUEUE_CAPTURE`), every consumed message is recorded into the studio's
-  // Queues log via the root shard's `recordQueueMessage` admin RPC.
-  ...options.hasQueue ? [
-    `            queue: (batch: unknown, queueEnv: unknown, _context: ExecutionContextLike): Promise<void> =>`,
-    `                dispatchQueueBatch(batch as Parameters<typeof dispatchQueueBatch>[0], LUNORA_QUEUE_REGISTRY, {`,
-    `                    capture: shouldCaptureQueue(queueEnv as Record<string, unknown>)`,
-    `                        ? createQueueCaptureSink(queueEnv as Record<string, unknown>${options.jurisdiction ? `, { jurisdiction: ${JSON.stringify(options.jurisdiction)} }` : ""})`,
-    `                        : undefined,`,
-    `                    env: queueEnv as Record<string, unknown>,`,
-    `                }),`
-  ] : [],
-  `            routes: this.routeMap,`,
-  `            shardDO: this.shardSelector?.(env) ?? (undefined as unknown as ShardNamespaceLike),`
-];
-const buildStorageHelpers = (hasStorage) => hasStorage ? `
-    /** Resolve the storage capability (single or multi-bucket) for the DO side. */
-    private resolveStorage(env: Env): Storage | undefined {
-        const declaration = this.storageDeclaration;
-
-        if (!declaration) {
-            return undefined;
-        }
-
-        const defaultBucket = declaration.bucket(env);
-
-        if (!defaultBucket) {
-            return undefined;
-        }
-
-        const make = (bucket: R2BucketLike): Storage =>
-            createStorage({ bucket, publicBaseUrl: declaration.publicBaseUrl?.(env), signingSecret: declaration.signingSecret?.(env) });
-        const extraEntries = Object.entries(declaration.buckets ?? {})
-            .map(([name, selector]) => [name, selector(env)] as const)
-            .filter((entry): entry is [string, R2BucketLike] => Boolean(entry[1]));
-
-        if (extraEntries.length === 0) {
-            return make(defaultBucket);
-        }
-
-        const map: Record<string, Storage> = { default: make(defaultBucket) };
-
-        for (const [name, bucket] of extraEntries) {
-            map[name] = make(bucket);
-        }
-
-        return createBucketStorage(map, { default: "default" });
-    }
-
-    /** Derive the studio file-browser admin functions from the same buckets \`.storage()\` declared. */
-    private buildStorageAdmin(env: Env): Partial<WorkerOptions> {
-        const declaration = this.storageDeclaration;
-
-        if (!declaration) {
-            return {};
-        }
-
-        const defaultBucket = declaration.bucket(env);
-
-        if (!defaultBucket) {
-            return {};
-        }
-
-        const make = (bucket: R2BucketLike): Storage =>
-            createStorage({ bucket, publicBaseUrl: declaration.publicBaseUrl?.(env), signingSecret: declaration.signingSecret?.(env) });
-        const buckets: Record<string, Storage> = { default: make(defaultBucket) };
-
-        for (const [name, selector] of Object.entries(declaration.buckets ?? {})) {
-            const bucket = selector(env);
-
-            if (bucket) {
-                buckets[name] = make(bucket);
-            }
-        }
-
-        const pick = (name?: string): Storage => buckets[name !== undefined && name !== "" ? name : "default"] ?? buckets.default;
-        const hasSigning = Boolean(declaration.publicBaseUrl?.(env) && declaration.signingSecret?.(env));
-
-        return {
-            storageBuckets: Object.keys(buckets),
-            storageDelete: (key: string, opts?: { bucket?: string }) => pick(opts?.bucket).delete(key),
-            storageList: (prefix?: string, opts?: { bucket?: string; cursor?: string; limit?: number }) => pick(opts?.bucket).list(prefix, opts),
-            storageSignedUrl: hasSigning
-                ? (key: string, opts?: { bucket?: string; expiresInSeconds?: number }) => pick(opts?.bucket).getSignedUrl(key, { expiresInSeconds: opts?.expiresInSeconds })
-                : undefined,
-            storageUpload: (key: string, body: ArrayBuffer, opts?: { bucket?: string; contentType?: string }) => pick(opts?.bucket).upload(key, body, opts),
-        };
-    }
-` : "";
-const buildGlobalHelpers = (hasGlobal) => hasGlobal ? `
-/** Adapt the raw D1 binding to \`@lunora/d1\`'s \`D1Exec\` (reads via \`all\`, writes via \`run\`). */
-const buildExec = (database: D1DatabaseLike): D1Exec => ({
-    all: async (sql, parameters) => {
-        const result = await database
-            .prepare(sql)
-            .bind(...parameters)
-            .all<Record<string, unknown>>();
-
-        return result.results;
-    },
-    run: async (sql, parameters) => {
-        await database
-            .prepare(sql)
-            .bind(...parameters)
-            .run();
-    },
-});
-
-/** Introspect \`.global()\` (D1-backed) tables for the studio's global data browser. */
-const buildGlobalIntrospector = (database: D1DatabaseLike): GlobalIntrospector => {
-    const exec = buildExec(database);
-
-    return {
-        facetColumn: (options) => facetGlobalColumn(exec, schema as never, options),
-        listTables: () => listGlobalTables(exec, schema as never),
-        readTablePage: (options) => readGlobalTablePage(exec, schema as never, options),
-    };
-};
-` : "";
-const buildExportedTypes = (options) => [
-  ...options.hasAuth ? ["AuthDeclaration"] : [],
-  "ComposedApp",
-  ...options.hasGlobal ? ["GlobalDeclaration"] : [],
-  ...options.hasScheduler ? ["SchedulerDeclaration"] : [],
-  "Selector",
-  ...options.hasStorage ? ["StorageDeclaration"] : []
-].toSorted((a, b) => a.localeCompare(b)).join(", ");
-const emitApp = (options) => {
-  const { hasAuth } = options;
-  const declarationBlocks = buildDeclarationBlocks(options);
-  const workerOptionLines = buildWorkerOptionLines(options);
-  const authState = hasAuth ? `        let auth: LunoraAuth | null = null;
-` : "";
-  const ensureAuthBlock = hasAuth ? `
-        const ensureAuth = async (env: Env): Promise<void> => {
-            if (!this.authDeclaration || auth) {
-                return;
-            }
-
-            auth = createAuth({ ...this.authDeclaration.options(env), database: lunoraD1Adapter(this.authDeclaration.d1(env) as never) });
-            // Apply the better-auth schema lazily on first request (raw-D1 Kysely
-            // migrator). For production run the migrate command ahead of deploy.
-            await ensureMigrated(createAuth({ ...this.authDeclaration.options(env), database: this.authDeclaration.d1(env) as never }));
-        };
-` : "";
-  const ensureAuthCall = hasAuth ? `
-                await ensureAuth(env);` : "";
-  const getAuthArgument = hasAuth ? `() => auth` : `() => null`;
-  const getAuthParameter = hasAuth ? `getAuth: () => LunoraAuth | null` : `_getAuth: () => null`;
-  const buildWorkerLine = options.hasFramework ? `        const buildWorker = (env: Env): LunoraWorker =>
-            host ? withFrameworkWorker(host, (hostEnv) => this.buildWorkerOptions(hostEnv as Env, ${getAuthArgument})) : createWorker(this.buildWorkerOptions(env, ${getAuthArgument}));` : `        const buildWorker = (env: Env): LunoraWorker => createWorker(this.buildWorkerOptions(env, ${getAuthArgument}));`;
-  const assembleParameter = options.hasFramework ? `host?: FrameworkHostHandler` : ``;
-  const emailAgents = options.emailAgents ?? [];
-  const emailAgentsBlock = emailAgents.length > 0 ? `        composed.email = dispatchAgentEmail([
-${emailAgents.map((agent) => `            { agent: lunoraAgentDefinitions.${agent.exportName}, binding: ${JSON.stringify(agent.bindingName)} },`).join("\n")}
-        ]);
-
-` : "";
-  const buildTerminals = `    /** Materialise the standalone Cloudflare worker + \`ShardDO\` class. */
-    public build(): ComposedApp {
-        return this.assemble();
-    }${options.hasFramework ? `
-
-    /** Compose Lunora's realtime plane INTO a meta-framework's Cloudflare handler (SvelteKit/Astro/Nuxt). The framework \`host\` serves everything except the reserved \`/_lunora/*\` endpoints; pass the adapter-emitted worker (e.g. SvelteKit's \`_worker.js\`, Astro's \`handle\`). */
-    public buildFrameworkWorker(host: FrameworkHostHandler): ComposedApp {
-        return this.assemble(host);
-    }` : ``}`;
-  return `${GENERATED_HEADER}${buildImportLines(options).join("\n")}
-
-/** Read a value off the per-request \`env\`. Returns \`undefined\` to leave the capability unconfigured (its \`ctx.*\`/admin surface stays a clear-error stub). */
-type Selector<Env, T> = (env: Env) => T | undefined;
-${hasAnyLongTail(options) ? `
-/** The generated \`createShardDO\` config — the long-tail \`.ai()\` / \`.kv()\` / … methods pass straight through to it. */
-type ShardConfig = NonNullable<Parameters<typeof createShardDO>[0]>;
-` : ""}
-${declarationBlocks.join("\n\n")}${declarationBlocks.length > 0 ? "\n\n" : ""}/** The composed app: a Cloudflare module worker (\`fetch\` / \`scheduled\` / optional \`email\`) plus the \`ShardDO\` class binding. */
-interface ComposedApp extends LunoraWorker {
-    /** Cloudflare Email Routing entry — present only when \`.onEmail(...)\` was configured. */
-    email?: (message: unknown, env: unknown, context: ExecutionContextLike) => Promise<void>;
-    /** The generated shard Durable Object class — re-export it as a named export so wrangler can bind it. */
-    ShardDO: ReturnType<typeof createShardDO>;
-}
-
-/**
- * Fluent worker-composition builder. Records each capability declaration, then
- * \`.build()\` fans them into the DO-side \`createShardDO\` factory and the
- * worker-side \`createWorker\` options — constructing the worker lazily on the
- * first request so per-isolate singletons are built once.
- */
-class AppBuilder<Env extends Record<string, unknown>> {
-${buildFieldLines(options).join("\n")}
-
-    private emailHandler?: (env: Env) => (message: unknown, env: unknown, context: ExecutionContextLike) => Promise<void>;
-
-${buildMethodBlocks(options).join("\n\n")}
-
-${buildTerminals}
-
-    /** Build the shard DO + compose the worker (standalone or framework-hosted), wrapping the lazy per-isolate singletons + auth init. */
-    private assemble(${assembleParameter}): ComposedApp {
-        const ShardDO = createShardDO({${buildShardFactoryBody(options)}});
-
-        // Per-isolate singletons: the worker (and auth instance) are expensive to
-        // build, so the first request constructs them and every later request on
-        // the same isolate reuses them.
-        let worker: LunoraWorker | null = null;
-${authState}${ensureAuthBlock}
-${buildWorkerLine}
-
-        const composed: ComposedApp = {
-            ShardDO,
-            fetch: async (request: Request, rawEnv: unknown, context: ExecutionContextLike): Promise<Response> => {
-                const env = rawEnv as Env;${ensureAuthCall}
-                worker ??= buildWorker(env);
-
-                return worker.fetch(request, rawEnv, context);
-            },
-            scheduled: async (controller: ScheduledControllerLike, rawEnv: unknown, context: ExecutionContextLike): Promise<void> => {
-                worker ??= buildWorker(rawEnv as Env);
-
-                return worker.scheduled(controller, rawEnv, context);
-            },
-            serverQuery: (request, rawEnv, reference, args, options) => {
-                worker ??= buildWorker(rawEnv as Env);
-
-                return worker.serverQuery(request, rawEnv, reference, args, options);
-            },${options.hasQueue ? `
-            queue: async (batch: unknown, rawEnv: unknown, context: ExecutionContextLike): Promise<void> => {
-                worker ??= buildWorker(rawEnv as Env);
-
-                return worker.queue?.(batch, rawEnv, context);
-            },` : ""}
-        };
-
-${emailAgentsBlock}        if (this.emailHandler) {
-            const handler = this.emailHandler;
-
-            composed.email = (message, rawEnv, context) => handler(rawEnv as Env)(message, rawEnv, context);
-        }
-
-        return composed;
-    }
-${buildStorageHelpers(options.hasStorage)}
-    /** Fan the recorded declarations into the worker-side \`createWorker\` options. */
-    private buildWorkerOptions(env: Env, ${getAuthParameter}): WorkerOptions {
-        const options: WorkerOptions = {
-${buildBaseWorkerOptions(options).join("\n")}
-        };
-
-        if (this.adminToken) {
-            options.adminToken = this.adminToken(env);
-        }
-
-${workerOptionLines.join("\n\n")}${workerOptionLines.length > 0 ? "\n\n" : ""}        for (const fn of this.extendFns) {
-            Object.assign(options, fn(env, { ...options }));
-        }
-
-        return options;
-    }
-}
-${buildGlobalHelpers(options.hasGlobal)}
-/** Start composing the app. Chain the capability methods, then \`.build()\`. */
-const defineApp = <Env extends Record<string, unknown>>(): AppBuilder<Env> => new AppBuilder<Env>();
-
-export { AppBuilder, defineApp };
-export type { ${buildExportedTypes(options)} };
-`;
-};
-
-export { emitApp };