@lunora/do 1.0.0-alpha.20 → 1.0.0-alpha.22

package/dist/index.d.mts

@@ -1,3 +1,4 @@
+import { LunoraError } from '@lunora/errors';
 import { SQL } from 'drizzle-orm';
 import { DrizzleSqliteDODatabase } from 'drizzle-orm/durable-sqlite';
 /**
@@ -110,17 +111,13 @@ interface GroupByEntry {
   value: AggregateResult;
 }
 /**
-* Thrown when `count` runs in an RLS-restricted ctx. The structural shape
-* (`name: "LunoraError"`, `code`, `status`) lets the runtime's error mapper
-* route it without an `instanceof` check, so `@lunora/do` stays free of a
-* runtime dependency on `@lunora/server`. Status mirrors the
-* `COUNT_RLS_UNSUPPORTED` entry in the `LunoraErrorCode` taxonomy (422):
-* the operation is invalid in this context, not malformed.
+* Thrown when `count` runs in an RLS-restricted ctx. A `LunoraError` subclass
+* (`code: "COUNT_RLS_UNSUPPORTED"`, `status: 422`) recognised structurally by the
+* runtime's error mapper (via `isLunoraError`), so `@lunora/do` needs no runtime
+* dependency on `@lunora/server`. 422 = the operation is invalid in this context,
+* not malformed.
 */
-declare class CountRlsUnsupportedError extends Error {
-  readonly code: string;
-  override readonly name = "LunoraError";
-  readonly status: number;
+declare class CountRlsUnsupportedError extends LunoraError {
   constructor(table?: string);
 }
 /**
@@ -761,37 +758,6 @@ declare class ReactiveCache {
 * everyone. Anonymous/subscription callers pass `null` (their own bucket).
 */
 declare const reactiveCacheKey: (functionPath: string, args: Record<string, unknown>, identity: null | string) => string;
-/**
-* `ctx.db.system` — a best-effort, read-only reader over Lunora's *system*
-* tables.
-*
-* Convex surfaces a handful of read-only system tables (`_scheduled_functions`,
-* `_storage`, ...) through `ctx.db.system`. Lunora mirrors that surface, but with
-* one load-bearing caveat: **the data these tables expose does not live in the
-* shard's SQLite**. Scheduled functions live in the `SchedulerDO`; storage
-* objects live in R2. So unlike `ctx.db.&lt;table>` — which reads the same
-* transactional SQLite snapshot the mutation writes into — `ctx.db.system`
-* reaches across a network/DO boundary on every call.
-*
-* Consequences callers must keep in mind:
-*
-* Asynchronous + eventually consistent: each `collect()` / `get()` issues a fresh
-* read against the backing source. A row a mutation just scheduled may not yet be
-* visible; a job that just fired may still appear pending.
-*
-* NOT part of the transaction snapshot: reading a system table inside a mutation
-* does not pin it; there is no OCC guard and no subscription dependency is
-* recorded. Treat the result as a point-in-time best effort.
-*
-* Read-only: there is no `insert`/`patch`/`delete`. Mutate scheduled jobs via
-* `ctx.scheduler`, storage objects via `ctx.storage`.
-*
-* The reader is intentionally minimal: `query(table).collect()` returns the full
-* list (no indexes, no filtering, no pagination) and `get(table, id)` resolves a
-* single row. That matches Convex's system-table read surface closely enough for
-* the studio / introspection use cases without re-implementing the query
-* planner against a remote source.
-*/
 /** The system tables `ctx.db.system` can read. */
 type SystemTableName = "_scheduled_functions" | "_storage";
 /**
@@ -1893,14 +1859,12 @@ interface DatabaseWriterLike {
   system?: SystemDatabaseReader;
 }
 /**
-* Thrown by `.unique()` when more than one row matches. Like {@link ConflictError}
-* / `NotFoundError`, `code` / `status` are declared as own properties so the
-* cross-package structural error mapper renders it as a 400 without an
-* `instanceof` check against `@lunora/do`.
+* Thrown by `.unique()` when more than one row matches. A `LunoraError` subclass
+* (`code: "NOT_UNIQUE"`, `status: 400`) recognised structurally by the
+* cross-package transport mapper (via `isLunoraError`) without an `instanceof`
+* check against `@lunora/do`.
 */
-declare class NotUniqueError extends Error {
-  readonly code: string;
-  readonly status: number;
+declare class NotUniqueError extends LunoraError {
   constructor(message?: string);
 }
 /**
@@ -2804,6 +2768,8 @@ interface StudioFeaturesResult {
   analytics: boolean;
   /** `@lunora/auth` is a declared dependency (backs the Users / Sessions / Organizations / Configuration pages). */
   auth: boolean;
+  /** `@lunora/container` / `ctx.containers` is used, the app declares containers, or it is a declared dependency. */
+  containers: boolean;
   /** `@lunora/flags` / `ctx.flags` is used, or it is a declared dependency. */
   flags: boolean;
   /** `@lunora/bindings/kv` / `ctx.kv` is used, or it is a declared dependency. */
@@ -3447,13 +3413,11 @@ declare const clearCapturedMail: (sql: SqlExec) => {
 /**
 * Thrown by `findFirstOrThrow` when no document matches the query.
 *
-* Like `ConflictError`, `code` / `status` are declared as own properties
-* so the cross-package structural error mapper maps it to a 404 without an
-* `instanceof` check against `@lunora/do`.
+* A `LunoraError` subclass (`code: "NOT_FOUND"`, `status: 404`) so the
+* cross-package transport mapper maps it to a 404 structurally (via
+* `isLunoraError`) without an `instanceof` check against `@lunora/do`.
 */
-declare class NotFoundError extends Error {
-  readonly code: string;
-  readonly status: number;
+declare class NotFoundError extends LunoraError {
   constructor(message?: string);
 }
 /**
@@ -3689,24 +3653,6 @@ interface LogEventInput {
 * that want the raw values.
 */
 /**
-* Secure-by-default write-path guard for `ctx.db`.
-*
-* When a schema is marked `defineSchema(...).rls("required")`, the generated
-* user-facing ctx wraps its writer with {@link guardWriter}. The guard denies
-* every read/write against a PROTECTED table (any table not marked `.public()`)
-* so a procedure that forgot `.use(rls(policies))` fails CLOSED — it can never
-* silently see or mutate a protected table through the unwrapped writer.
-*
-* The guard is transparent to the RLS middleware: it hangs the UNWRAPPED writer
-* off {@link RLS_UNWRAP_SYMBOL}, so `@lunora/server`'s `rls()` middleware
-* recovers the raw writer (via the same `Symbol.for` key — no cross-package
-* import) to evaluate policies and issue policy-filtered reads without tripping
-* the guard. Only procedures that NEVER engaged RLS keep talking to the guard.
-*
-* Admin / migration / studio writers (built from `createShardCtxDb` WITHOUT
-* `enforceRls`) are never guarded — they are trusted system paths.
-*/
-/**
 * Well-known symbol the guard hangs the unwrapped writer off of. `Symbol.for`
 * (the cross-realm global registry) lets `@lunora/server`'s RLS middleware read
 * it WITHOUT importing this module — both sides reference the same registered
@@ -3715,14 +3661,12 @@ interface LogEventInput {
 declare const RLS_UNWRAP_SYMBOL: symbol;
 /**
 * Thrown when a raw (non-RLS) handler touches a protected table under a
-* `.rls("required")` schema. `code` / `status` / `table` are own properties (not
-* just inherited prototype state) so structural callers across packages — which
-* deliberately avoid a hard `@lunora/do` runtime dependency — recognise the
-* shape without an `instanceof` check (mirrors `ConflictError`).
-*/
-declare class RlsRequiredError extends Error {
-  readonly code: string;
-  readonly status: number;
+* `.rls("required")` schema. A `LunoraError` subclass (`code: "RLS_REQUIRED"`,
+* `status: 403`) recognised structurally across packages (via `isLunoraError`) —
+* which deliberately avoid a hard `@lunora/do` runtime dependency — without an
+* `instanceof` check. `table` is kept as an own property.
+*/
+declare class RlsRequiredError extends LunoraError {
   readonly table: string;
   constructor(table: string);
 }
@@ -6585,18 +6529,14 @@ type ConflictKind = "conflict" | "occ" | "restrict" | "trigger" | "unique";
 * Thrown by mutation handlers when an optimistic-concurrency check fails (or a
 * related write guard trips — see {@link ConflictKind}).
 *
-* The runtime maps this to a 409 response so clients can decide whether to
-* refetch + retry or surface the conflict. `code` / `status` / `kind` are
-* declared as own properties (not just inherited prototype state) so structural
-* callers across packages — which deliberately avoid taking a hard runtime
-* dependency on `@lunora/do` — can recognise the shape without an `instanceof`
-* check.
-*/
-declare class ConflictError extends Error {
-  readonly code: string;
+* A `LunoraError` subclass (`code: "CONFLICT"`, `status: 409`) so the runtime/DO
+* transport mappers recognise it structurally (via `isLunoraError`) — structural
+* callers across packages still avoid a hard `instanceof` dependency on
+* `@lunora/do`. `kind` is kept as an own property for the metrics layer.
+*/
+declare class ConflictError extends LunoraError {
   /** Why the conflict fired; `occ` is the contention signal the metrics layer counts. */
   readonly kind: ConflictKind;
-  readonly status: number;
   constructor(message?: string, kind?: ConflictKind);
 }
 /**

package/dist/index.d.ts

@@ -1,3 +1,4 @@
+import { LunoraError } from '@lunora/errors';
 import { SQL } from 'drizzle-orm';
 import { DrizzleSqliteDODatabase } from 'drizzle-orm/durable-sqlite';
 /**
@@ -110,17 +111,13 @@ interface GroupByEntry {
   value: AggregateResult;
 }
 /**
-* Thrown when `count` runs in an RLS-restricted ctx. The structural shape
-* (`name: "LunoraError"`, `code`, `status`) lets the runtime's error mapper
-* route it without an `instanceof` check, so `@lunora/do` stays free of a
-* runtime dependency on `@lunora/server`. Status mirrors the
-* `COUNT_RLS_UNSUPPORTED` entry in the `LunoraErrorCode` taxonomy (422):
-* the operation is invalid in this context, not malformed.
+* Thrown when `count` runs in an RLS-restricted ctx. A `LunoraError` subclass
+* (`code: "COUNT_RLS_UNSUPPORTED"`, `status: 422`) recognised structurally by the
+* runtime's error mapper (via `isLunoraError`), so `@lunora/do` needs no runtime
+* dependency on `@lunora/server`. 422 = the operation is invalid in this context,
+* not malformed.
 */
-declare class CountRlsUnsupportedError extends Error {
-  readonly code: string;
-  override readonly name = "LunoraError";
-  readonly status: number;
+declare class CountRlsUnsupportedError extends LunoraError {
   constructor(table?: string);
 }
 /**
@@ -761,37 +758,6 @@ declare class ReactiveCache {
 * everyone. Anonymous/subscription callers pass `null` (their own bucket).
 */
 declare const reactiveCacheKey: (functionPath: string, args: Record<string, unknown>, identity: null | string) => string;
-/**
-* `ctx.db.system` — a best-effort, read-only reader over Lunora's *system*
-* tables.
-*
-* Convex surfaces a handful of read-only system tables (`_scheduled_functions`,
-* `_storage`, ...) through `ctx.db.system`. Lunora mirrors that surface, but with
-* one load-bearing caveat: **the data these tables expose does not live in the
-* shard's SQLite**. Scheduled functions live in the `SchedulerDO`; storage
-* objects live in R2. So unlike `ctx.db.&lt;table>` — which reads the same
-* transactional SQLite snapshot the mutation writes into — `ctx.db.system`
-* reaches across a network/DO boundary on every call.
-*
-* Consequences callers must keep in mind:
-*
-* Asynchronous + eventually consistent: each `collect()` / `get()` issues a fresh
-* read against the backing source. A row a mutation just scheduled may not yet be
-* visible; a job that just fired may still appear pending.
-*
-* NOT part of the transaction snapshot: reading a system table inside a mutation
-* does not pin it; there is no OCC guard and no subscription dependency is
-* recorded. Treat the result as a point-in-time best effort.
-*
-* Read-only: there is no `insert`/`patch`/`delete`. Mutate scheduled jobs via
-* `ctx.scheduler`, storage objects via `ctx.storage`.
-*
-* The reader is intentionally minimal: `query(table).collect()` returns the full
-* list (no indexes, no filtering, no pagination) and `get(table, id)` resolves a
-* single row. That matches Convex's system-table read surface closely enough for
-* the studio / introspection use cases without re-implementing the query
-* planner against a remote source.
-*/
 /** The system tables `ctx.db.system` can read. */
 type SystemTableName = "_scheduled_functions" | "_storage";
 /**
@@ -1893,14 +1859,12 @@ interface DatabaseWriterLike {
   system?: SystemDatabaseReader;
 }
 /**
-* Thrown by `.unique()` when more than one row matches. Like {@link ConflictError}
-* / `NotFoundError`, `code` / `status` are declared as own properties so the
-* cross-package structural error mapper renders it as a 400 without an
-* `instanceof` check against `@lunora/do`.
+* Thrown by `.unique()` when more than one row matches. A `LunoraError` subclass
+* (`code: "NOT_UNIQUE"`, `status: 400`) recognised structurally by the
+* cross-package transport mapper (via `isLunoraError`) without an `instanceof`
+* check against `@lunora/do`.
 */
-declare class NotUniqueError extends Error {
-  readonly code: string;
-  readonly status: number;
+declare class NotUniqueError extends LunoraError {
   constructor(message?: string);
 }
 /**
@@ -2804,6 +2768,8 @@ interface StudioFeaturesResult {
   analytics: boolean;
   /** `@lunora/auth` is a declared dependency (backs the Users / Sessions / Organizations / Configuration pages). */
   auth: boolean;
+  /** `@lunora/container` / `ctx.containers` is used, the app declares containers, or it is a declared dependency. */
+  containers: boolean;
   /** `@lunora/flags` / `ctx.flags` is used, or it is a declared dependency. */
   flags: boolean;
   /** `@lunora/bindings/kv` / `ctx.kv` is used, or it is a declared dependency. */
@@ -3447,13 +3413,11 @@ declare const clearCapturedMail: (sql: SqlExec) => {
 /**
 * Thrown by `findFirstOrThrow` when no document matches the query.
 *
-* Like `ConflictError`, `code` / `status` are declared as own properties
-* so the cross-package structural error mapper maps it to a 404 without an
-* `instanceof` check against `@lunora/do`.
+* A `LunoraError` subclass (`code: "NOT_FOUND"`, `status: 404`) so the
+* cross-package transport mapper maps it to a 404 structurally (via
+* `isLunoraError`) without an `instanceof` check against `@lunora/do`.
 */
-declare class NotFoundError extends Error {
-  readonly code: string;
-  readonly status: number;
+declare class NotFoundError extends LunoraError {
   constructor(message?: string);
 }
 /**
@@ -3689,24 +3653,6 @@ interface LogEventInput {
 * that want the raw values.
 */
 /**
-* Secure-by-default write-path guard for `ctx.db`.
-*
-* When a schema is marked `defineSchema(...).rls("required")`, the generated
-* user-facing ctx wraps its writer with {@link guardWriter}. The guard denies
-* every read/write against a PROTECTED table (any table not marked `.public()`)
-* so a procedure that forgot `.use(rls(policies))` fails CLOSED — it can never
-* silently see or mutate a protected table through the unwrapped writer.
-*
-* The guard is transparent to the RLS middleware: it hangs the UNWRAPPED writer
-* off {@link RLS_UNWRAP_SYMBOL}, so `@lunora/server`'s `rls()` middleware
-* recovers the raw writer (via the same `Symbol.for` key — no cross-package
-* import) to evaluate policies and issue policy-filtered reads without tripping
-* the guard. Only procedures that NEVER engaged RLS keep talking to the guard.
-*
-* Admin / migration / studio writers (built from `createShardCtxDb` WITHOUT
-* `enforceRls`) are never guarded — they are trusted system paths.
-*/
-/**
 * Well-known symbol the guard hangs the unwrapped writer off of. `Symbol.for`
 * (the cross-realm global registry) lets `@lunora/server`'s RLS middleware read
 * it WITHOUT importing this module — both sides reference the same registered
@@ -3715,14 +3661,12 @@ interface LogEventInput {
 declare const RLS_UNWRAP_SYMBOL: symbol;
 /**
 * Thrown when a raw (non-RLS) handler touches a protected table under a
-* `.rls("required")` schema. `code` / `status` / `table` are own properties (not
-* just inherited prototype state) so structural callers across packages — which
-* deliberately avoid a hard `@lunora/do` runtime dependency — recognise the
-* shape without an `instanceof` check (mirrors `ConflictError`).
-*/
-declare class RlsRequiredError extends Error {
-  readonly code: string;
-  readonly status: number;
+* `.rls("required")` schema. A `LunoraError` subclass (`code: "RLS_REQUIRED"`,
+* `status: 403`) recognised structurally across packages (via `isLunoraError`) —
+* which deliberately avoid a hard `@lunora/do` runtime dependency — without an
+* `instanceof` check. `table` is kept as an own property.
+*/
+declare class RlsRequiredError extends LunoraError {
   readonly table: string;
   constructor(table: string);
 }
@@ -6585,18 +6529,14 @@ type ConflictKind = "conflict" | "occ" | "restrict" | "trigger" | "unique";
 * Thrown by mutation handlers when an optimistic-concurrency check fails (or a
 * related write guard trips — see {@link ConflictKind}).
 *
-* The runtime maps this to a 409 response so clients can decide whether to
-* refetch + retry or surface the conflict. `code` / `status` / `kind` are
-* declared as own properties (not just inherited prototype state) so structural
-* callers across packages — which deliberately avoid taking a hard runtime
-* dependency on `@lunora/do` — can recognise the shape without an `instanceof`
-* check.
-*/
-declare class ConflictError extends Error {
-  readonly code: string;
+* A `LunoraError` subclass (`code: "CONFLICT"`, `status: 409`) so the runtime/DO
+* transport mappers recognise it structurally (via `isLunoraError`) — structural
+* callers across packages still avoid a hard `instanceof` dependency on
+* `@lunora/do`. `kind` is kept as an own property for the metrics layer.
+*/
+declare class ConflictError extends LunoraError {
   /** Why the conflict fired; `occ` is the contention signal the metrics layer counts. */
   readonly kind: ConflictKind;
-  readonly status: number;
   constructor(message?: string, kind?: ConflictKind);
 }
 /**

package/dist/index.mjs

@@ -1,40 +1,40 @@
 export { exportShardRows, exportShardTable, importShardRows, parseExportShardArgs, parseImportShardArgs, selectExportTables, validateImportRow } from './packem_shared/exportShardRows-DZEhUeyI.mjs';
-export { AGGREGATE_SQL_FUNCTION, aggregateSqlFunction, matchesStaticWhere, normalizeCountArgument, throwingScheduler } from './packem_shared/AGGREGATE_SQL_FUNCTION-CFk6adSu.mjs';
+export { AGGREGATE_SQL_FUNCTION, aggregateSqlFunction, matchesStaticWhere, normalizeCountArgument, throwingScheduler } from './packem_shared/AGGREGATE_SQL_FUNCTION-CQsu2Xga.mjs';
 export { aggregateTableName, coerceAggregateNumber, encodeAggregateKey, foldAggregateTally, readAggregateValue } from './packem_shared/aggregateTableName-CxNqY1Sl.mjs';
-export { CountRlsUnsupportedError, mergeWhere, planAggregateLookup, selectIndexForAggregate, selectIndexForCount, selectIndexForGroupBy } from './packem_shared/CountRlsUnsupportedError-28ZvvwKS.mjs';
+export { CountRlsUnsupportedError, mergeWhere, planAggregateLookup, selectIndexForAggregate, selectIndexForCount, selectIndexForGroupBy } from './packem_shared/CountRlsUnsupportedError-BGxj0pgS.mjs';
 export { AUTH_METRICS_BUCKETS_TABLE, AUTH_METRICS_BUCKET_MS, AUTH_METRICS_BUCKET_RETENTION, AUTH_METRICS_TABLE, ensureAuthMetricsTables, readAuthMetrics, recordAuthEvent } from './packem_shared/AUTH_METRICS_BUCKETS_TABLE-CiHHYeJi.mjs';
-export { NotUniqueError, assertValidClientId, createShardCtxDb, normalizeIdStructurally } from './packem_shared/NotUniqueError-Do5h_jiW.mjs';
-export { DATA_MIGRATION_STATE_TABLE, readMigrationStatus, runDataMigration } from './packem_shared/DATA_MIGRATION_STATE_TABLE-DfPxn8I0.mjs';
+export { NotUniqueError, assertValidClientId, createShardCtxDb, normalizeIdStructurally } from './packem_shared/NotUniqueError-D1U5SBFR.mjs';
+export { DATA_MIGRATION_STATE_TABLE, readMigrationStatus, runDataMigration } from './packem_shared/DATA_MIGRATION_STATE_TABLE-DB3IYUR3.mjs';
 export { SCAN_DEP, createDependencyTracker, depKey } from './packem_shared/SCAN_DEP-DLJF8dsj.mjs';
 export { renderSql } from './packem_shared/renderSql-D6eUcn2N.mjs';
 export { diffExternalSource } from './packem_shared/diffExternalSource-Cx9HUPJj.mjs';
-export { materializeExternalRows, readExternalSourceBaseline, runExternalSourceTick } from './packem_shared/materializeExternalRows-Bj6EXy50.mjs';
-export { isSourceDue, liftSourceId, pullExternalSourceTick } from './packem_shared/isSourceDue-9mJRJ9Ld.mjs';
+export { materializeExternalRows, readExternalSourceBaseline, runExternalSourceTick } from './packem_shared/materializeExternalRows-DNcvoLRT.mjs';
+export { isSourceDue, liftSourceId, pullExternalSourceTick } from './packem_shared/isSourceDue-BptUN8CR.mjs';
 export { FUNCTION_METRICS_BUCKETS_TABLE, FUNCTION_METRICS_BUCKET_MS, FUNCTION_METRICS_BUCKET_RETENTION, FUNCTION_METRICS_INDEX_TABLE, FUNCTION_METRICS_TABLE, ensureFunctionMetricsTables, readFunctionMetricBuckets, readFunctionMetricIndexHits, readFunctionMetrics, readFunctionMetricsTotals, recordFunctionMetric } from './packem_shared/FUNCTION_METRICS_BUCKETS_TABLE-UDNVD7FS.mjs';
 export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, FLAGS_FUNCTION_PREFIX, RELATION_FUNCTION_PREFIX, facetColumn, listTables, readTablePage, selectMatchingIds } from './packem_shared/ADMIN_FUNCTIONS-DSUQ5fX9.mjs';
 export { LogBuffer } from './packem_shared/LogBuffer-B_Ezju_N.mjs';
 export { MAIL_RETENTION, MAIL_TABLE, clearCapturedMail, ensureMailTable, readCapturedMail, recordCapturedMail } from './packem_shared/MAIL_RETENTION-CPpgl-dX.mjs';
-export { default as NotFoundError } from './packem_shared/NotFoundError-CMuMZt81.mjs';
+export { default as NotFoundError } from './packem_shared/NotFoundError-C70b9hLw.mjs';
 export { armRestore, readBookmark } from './packem_shared/armRestore-BJk53Ro8.mjs';
 export { applySelect, buildSeekWhere, decodeCursor, encodeCursor, normalizeOrderKeys, softDeleteScope } from './packem_shared/applySelect-BvZdFUBT.mjs';
 export { RANK_TIEBREAK, encodePartitionKey, matchesRankStaticWhere, rankTableName, resolveRankPartition, sortColumnName } from './packem_shared/RANK_TIEBREAK-CXhdcA1o.mjs';
 export { ReactiveCache, reactiveCacheKey } from './packem_shared/ReactiveCache-BYlSGY0N.mjs';
 export { serveRelationFanout } from './packem_shared/serveRelationFanout-C5axmGDj.mjs';
-export { DEFAULT_MAX_RELATION_KEYS, assertFlatPredicate, assertShapeShardable, containsRelationPredicate, isRelationPredicate, resolveRelationPredicates } from './packem_shared/DEFAULT_MAX_RELATION_KEYS-DU-Y4-LJ.mjs';
-export { applyOnDelete, fanOutScalarCounts, resolveWith, runRowValidators } from './packem_shared/applyOnDelete-BQ-8ZlZ1.mjs';
-export { RLS_UNWRAP_SYMBOL, RlsRequiredError, guardWriter } from './packem_shared/RLS_UNWRAP_SYMBOL-EtGQdC9d.mjs';
+export { DEFAULT_MAX_RELATION_KEYS, assertFlatPredicate, assertShapeShardable, containsRelationPredicate, isRelationPredicate, resolveRelationPredicates } from './packem_shared/DEFAULT_MAX_RELATION_KEYS-CjM9Y1_G.mjs';
+export { applyOnDelete, fanOutScalarCounts, resolveWith, runRowValidators } from './packem_shared/applyOnDelete-CAwZfp-5.mjs';
+export { RLS_UNWRAP_SYMBOL, RlsRequiredError, guardWriter } from './packem_shared/RLS_UNWRAP_SYMBOL-DnjkqVgY.mjs';
 export { buildFtsMatch, ftsTableName, scoreDocument, stringifySearchText, tokenizeSearch } from './packem_shared/buildFtsMatch-BLEMawrp.mjs';
 export { M as MIN_ADMIN_TOKEN_LENGTH, a as MIN_AUTH_SECRET_LENGTH, b as buildSecurityAudit } from './packem_shared/security-audit-CucgBice.mjs';
 export { SESSION_DO_TTL_DEFAULT, SessionDO } from './packem_shared/SESSION_DO_TTL_DEFAULT-ilPZsVwu.mjs';
-export { ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, ShardDO } from './packem_shared/ROOT_DO_SIZE_WARN_BYTES-BbHQKxG6.mjs';
+export { ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, ShardDO } from './packem_shared/ROOT_DO_SIZE_WARN_BYTES-BQoX61l-.mjs';
 export { SHARD_REGISTRY_DO_NAME, ShardRegistryDO } from './packem_shared/SHARD_REGISTRY_DO_NAME-BsAbi5Mn.mjs';
 export { MAX_SQL_ROWS, assertReadonly, runReadonlySql } from './packem_shared/MAX_SQL_ROWS-dDcFE1YZ.mjs';
-export { createSystemReader } from './packem_shared/createSystemReader-8CzSZP9V.mjs';
-export { ConflictError } from './packem_shared/ConflictError-C0STs6bU.mjs';
+export { createSystemReader } from './packem_shared/createSystemReader-D12eNH13.mjs';
+export { ConflictError } from './packem_shared/ConflictError-CLoq37xH.mjs';
 export { hasTrigger, runTriggers } from './packem_shared/hasTrigger-5N6_Fx0A.mjs';
-export { compileWhereSql } from './packem_shared/compileWhereSql-MW_Lk8nJ.mjs';
-export { CDC_LOG_TABLE, applyCdcChanges, readCdcChanges, trimCdcChanges } from './packem_shared/CDC_LOG_TABLE-DSycmnDf.mjs';
-export { backfillAggregateIndexes, backfillRankIndexes } from './packem_shared/backfillAggregateIndexes-BZsOqDXP.mjs';
-export { runShardMigrations } from './packem_shared/runShardMigrations-nIwoQeOK.mjs';
+export { compileWhereSql } from './packem_shared/compileWhereSql-DE6yfRcQ.mjs';
+export { CDC_LOG_TABLE, applyCdcChanges, readCdcChanges, trimCdcChanges } from './packem_shared/CDC_LOG_TABLE-DZSVKRr7.mjs';
+export { backfillAggregateIndexes, backfillRankIndexes } from './packem_shared/backfillAggregateIndexes-DDoT-UUI.mjs';
+export { runShardMigrations } from './packem_shared/runShardMigrations-DeZr0KZp.mjs';
 export { stableStringify } from './packem_shared/stableStringify-MydiuScU.mjs';
-export { s as subscriptionListDeltas } from './packem_shared/subscription-delivery-Z6nXHvQN.mjs';
+export { s as subscriptionListDeltas } from './packem_shared/subscription-delivery-CK8qga-k.mjs';

package/dist/packem_shared/{AGGREGATE_SQL_FUNCTION-CFk6adSu.mjs → AGGREGATE_SQL_FUNCTION-CQsu2Xga.mjs}

@@ -1,3 +1,5 @@
+import { LunoraError } from '@lunora/errors';
+
 const COUNT_OPTION_KEYS = /* @__PURE__ */ new Set(["baseWhere", "relationBaseWhere", "restrictsCounts", "where"]);
 const matchesStaticWhere = (document, predicate) => {
   for (const [field, expected] of Object.entries(predicate)) {
@@ -38,16 +40,16 @@ const AGGREGATE_SQL_FUNCTION = { avg: "AVG", count: "COUNT", max: "MAX", min: "M
 const aggregateSqlFunction = (op) => {
   const sqlFunction = AGGREGATE_SQL_FUNCTION[op];
   if (sqlFunction === void 0) {
-    throw new Error(`unknown aggregate op "${op}": expected one of ${Object.keys(AGGREGATE_SQL_FUNCTION).join(", ")}`);
+    throw new LunoraError("INTERNAL", `unknown aggregate op "${op}": expected one of ${Object.keys(AGGREGATE_SQL_FUNCTION).join(", ")}`);
   }
   return sqlFunction;
 };
 const throwingScheduler = {
   runAfter: () => {
-    throw new Error("ctx.scheduler: no scheduler configured for triggers. Pass `scheduler` to the ctx-db factory.");
+    throw new LunoraError("INTERNAL", "ctx.scheduler: no scheduler configured for triggers. Pass `scheduler` to the ctx-db factory.");
   },
   runAt: () => {
-    throw new Error("ctx.scheduler: no scheduler configured for triggers. Pass `scheduler` to the ctx-db factory.");
+    throw new LunoraError("INTERNAL", "ctx.scheduler: no scheduler configured for triggers. Pass `scheduler` to the ctx-db factory.");
   }
 };
 

package/dist/packem_shared/{CDC_LOG_TABLE-DSycmnDf.mjs → CDC_LOG_TABLE-DZSVKRr7.mjs}

@@ -1,6 +1,6 @@
 import { sql } from 'drizzle-orm';
 import { r as runDrizzle } from './do-exec-5eQy5cEi.mjs';
-import { ConflictError } from './ConflictError-C0STs6bU.mjs';
+import { ConflictError } from './ConflictError-CLoq37xH.mjs';
 
 const CDC_LOG_TABLE = "__cdc_log";
 const migrateCdcLog = (sql$1) => {

package/dist/packem_shared/{ConflictError-C0STs6bU.mjs → ConflictError-CLoq37xH.mjs}

@@ -1,11 +1,10 @@
-class ConflictError extends Error {
-  code = "CONFLICT";
+import { LunoraError } from '@lunora/errors';
+
+class ConflictError extends LunoraError {
   /** Why the conflict fired; `occ` is the contention signal the metrics layer counts. */
   kind;
-  status = 409;
   constructor(message = "Optimistic concurrency conflict", kind = "conflict") {
-    super(message);
-    this.name = "ConflictError";
+    super("CONFLICT", message, { name: "ConflictError" });
     this.kind = kind;
   }
 }

package/dist/packem_shared/{CountRlsUnsupportedError-28ZvvwKS.mjs → CountRlsUnsupportedError-BGxj0pgS.mjs}

@@ -1,9 +1,9 @@
-class CountRlsUnsupportedError extends Error {
-  code = "COUNT_RLS_UNSUPPORTED";
-  name = "LunoraError";
-  status = 422;
+import { LunoraError } from '@lunora/errors';
+
+class CountRlsUnsupportedError extends LunoraError {
   constructor(table) {
     super(
+      "COUNT_RLS_UNSUPPORTED",
       table === void 0 ? "count() is not supported in an RLS-restricted context" : `count() is not supported on table "${table}" inside an RLS-restricted context`
     );
   }

package/dist/packem_shared/{DATA_MIGRATION_STATE_TABLE-DfPxn8I0.mjs → DATA_MIGRATION_STATE_TABLE-DB3IYUR3.mjs}

@@ -1,3 +1,5 @@
+import { LunoraError } from '@lunora/errors';
+
 const DATA_MIGRATION_STATE_TABLE = "__lunora_migrations";
 const DEFAULT_BATCH_SIZE = 100;
 const STALE_CLAIM_TIMEOUT_MS = 3e4;
@@ -128,7 +130,7 @@ const runDataMigration = async (options) => {
   const batchSize = options.batchSize ?? migration.batchSize ?? DEFAULT_BATCH_SIZE;
   const transform = direction === "up" ? migration.up : migration.down;
   if (!transform) {
-    throw new Error(`data migration "${migration.id}" has no \`${direction}\` transform`);
+    throw new LunoraError("INTERNAL", `data migration "${migration.id}" has no \`${direction}\` transform`);
   }
   let cursor = null;
   let processed = 0;

package/dist/packem_shared/{DEFAULT_MAX_RELATION_KEYS-DU-Y4-LJ.mjs → DEFAULT_MAX_RELATION_KEYS-CjM9Y1_G.mjs}

@@ -1,4 +1,5 @@
-import { distinctValues } from './applyOnDelete-BQ-8ZlZ1.mjs';
+import { LunoraError } from '@lunora/errors';
+import { distinctValues } from './applyOnDelete-CAwZfp-5.mjs';
 
 const RELATION_EXISTS_KEY = "__relationExists";
 
@@ -43,7 +44,7 @@ const containsRelationPredicate = (where, schema, tableName) => {
 };
 const assertFlatPredicate = (where, schema, tableName, op) => {
   if (where && containsRelationPredicate(where, schema, tableName)) {
-    throw new Error(`relation-crossing predicates are not supported in ${op}() — use them in findMany/findFirst or an RLS read policy`);
+    throw new LunoraError("INTERNAL", `relation-crossing predicates are not supported in ${op}() — use them in findMany/findFirst or an RLS read policy`);
   }
 };
 const projectChildKeys = async (relation, childWhere, projectField, context, escalatable) => {
@@ -58,7 +59,8 @@ const projectChildKeys = async (relation, childWhere, projectField, context, esc
     if (escalatable) {
       return KEY_OVERFLOW;
     }
-    throw new Error(
+    throw new LunoraError(
+      "INTERNAL",
       `relation predicate on "${relation.table}" matched ${String(keys.length)} rows, exceeding the ${String(context.maxRelationKeys)}-key limit; narrow the predicate (a same-shard EXISTS push-down lifts this cap)`
     );
   }
@@ -67,7 +69,7 @@ const projectChildKeys = async (relation, childWhere, projectField, context, esc
 const compileOperator = async (operator, relation, childWhere, context, escalatable) => {
   const meta = RELATION_OPERATOR_META[operator];
   if (!meta) {
-    throw new Error(`unknown relation operator "${operator}"`);
+    throw new LunoraError("INTERNAL", `unknown relation operator "${operator}"`);
   }
   const { clause, project } = joinColumns(relation);
   const keys = await projectChildKeys(relation, meta.negateChild ? { NOT: childWhere } : childWhere, project, context, escalatable);
@@ -85,7 +87,7 @@ const compileOperator = async (operator, relation, childWhere, context, escalata
 const buildExistsMarker = async (operator, relation, childWhere, parentTable, context) => {
   const meta = RELATION_OPERATOR_META[operator];
   if (!meta) {
-    throw new Error(`unknown relation operator "${operator}"`);
+    throw new LunoraError("INTERNAL", `unknown relation operator "${operator}"`);
   }
   const base = context.relationBaseWhere?.(relation.table);
   const predicatePart = meta.negateChild ? { NOT: childWhere } : childWhere;
@@ -97,7 +99,7 @@ const buildExistsMarker = async (operator, relation, childWhere, parentTable, co
 const assertCardinality = (operator, name, relation) => {
   const meta = RELATION_OPERATOR_META[operator];
   if (meta && meta.kind !== relation.kind) {
-    throw new Error(`relation operator "${operator}" requires a to-${meta.kind} relation, but "${name}" is to-${relation.kind}`);
+    throw new LunoraError("INTERNAL", `relation operator "${operator}" requires a to-${meta.kind} relation, but "${name}" is to-${relation.kind}`);
   }
 };
 const resolveRelationNode = async (name, relation, predicate, parentTable, context) => {

package/dist/packem_shared/NotFoundError-C70b9hLw.mjs

@@ -0,0 +1,9 @@
+import { LunoraError } from '@lunora/errors';
+
+class NotFoundError extends LunoraError {
+  constructor(message = "Document not found") {
+    super("NOT_FOUND", message, { name: "NotFoundError" });
+  }
+}
+
+export { NotFoundError as default };