@lunora/queue 1.0.0-alpha.1 → 1.0.0-alpha.100

package/dist/index.d.ts

@@ -1,9 +1,11 @@
+import { QueueBindingLike, MessageBatchLike, MessageLike, QueueSendOptions, MessageSendRequestLike, QueueSendBatchOptions } from '@lunora/platform';
+export type { MessageBatchLike, MessageLike, MessageSendRequestLike, QueueBindingLike, QueueContentType, QueueRetryOptions, QueueSendBatchOptions, QueueSendOptions } from '@lunora/platform';
 /**
-* Shared types for dispatching a Lunora function back into the worker from a
-* server-initiated context (a workflow body, a queue handler, a scheduled job).
-* Node-safe — no Cloudflare runtime imports — so the consumers stay unit-testable
-* with plain-object doubles.
-*/
+ * Shared types for dispatching a Lunora function back into the worker from a
+ * server-initiated context (a workflow body, a queue handler, a scheduled job).
+ * Node-safe — no Cloudflare runtime imports — so the consumers stay unit-testable
+ * with plain-object doubles.
+ */
 /** Opaque generated function reference (`api.foo.bar`), carrying its dispatch id. */
 interface FunctionReference {
   __lunoraRef: string;
@@ -12,8 +14,45 @@ interface FunctionReference {
 type ArgsOf<F> = F extends FunctionReference ? Record<string, unknown> : never;
 /** Options for a function call made via a dispatch runner. */
 interface RunFunctionOptions {
+  /**
+   * The at-least-once dedup key for THIS ONE CALL, sent to the dispatch
+   * endpoint as the body's `id` and forwarded to the shard as the
+   * replay-dedup `mutationId` — so a redelivery that re-runs the same call
+   * applies it exactly once instead of twice.
+   *
+   * Must be unique per call and stable across redeliveries. It is NOT
+   * {@link RunFunctionOptions.messageId}: the shard's dedup table is keyed
+   * `(identity, mutationId)` with no function path in it, and every
+   * server-initiated dispatch shares the `"system:"` identity, so reusing
+   * one id across two calls makes the second return the FIRST call's cached
+   * result without ever executing. A per-message id is 1:N with the calls a
+   * handler makes; this is 1:1.
+   *
+   * `@lunora/queue`'s `message.run` derives one automatically as
+   * `<messageId>#<n>`, `n` counting that message's calls in order. That is
+   * stable across redeliveries because the handler replays from the start —
+   * it relies on the handler issuing its `run` calls in a DETERMINISTIC
+   * order, which at-least-once replay already assumes. A handler whose call
+   * order varies per attempt (branching on `Date.now()`, `Math.random()`,
+   * or unordered concurrent settles) must pass its own stable ids instead.
+   *
+   * Optional; when omitted the dispatch is at-least-once.
+   */
+  dedupId?: string;
+  /**
+   * Correlate this call with a caller-defined message/item id (e.g. a queue
+   * message's `id`), for failure attribution only — never sent to the
+   * dispatch endpoint. Carried onto the `LunoraError` a deterministic
+   * dispatch failure throws, so a batching consumer (`@lunora/queue`'s push
+   * handler) can read it back and attribute the failure to the one item that
+   * caused it instead of the whole batch. Deliberately NOT the dedup key —
+   * see {@link RunFunctionOptions.dedupId}. Optional and inert when omitted.
+   */
+  messageId?: string;
   /** Route the call to a specific shard (defaults to the worker's root shard). */
   shardKey?: string;
+  /** Abort the dispatch after this many ms; the abort is retryable. Overrides the runner's default. */
+  timeoutMs?: number;
 }
 /** Invoke a Lunora function (query/mutation/action) by reference. The shape of `ctx.run`. */
 type DispatchRunFunction = <F extends FunctionReference>(function_: F, args?: ArgsOf<F>, options?: RunFunctionOptions) => Promise<unknown>;
@@ -24,66 +63,11 @@ interface DispatchLogger {
   info: (message: unknown, ...rest: unknown[]) => void;
   warn: (message: unknown, ...rest: unknown[]) => void;
 }
-/** Build a {@link DispatchLogger} that prefixes every line with `prefix` (e.g. `[queue:email]`). */
-/** How a queue message body is serialized on the wire (Cloudflare default `"json"`). */
-type QueueContentType = "bytes" | "json" | "text" | "v8";
-/** Options for a single `producer.send(body, options?)`. */
-interface QueueSendOptions {
-  /** Wire serialization for this message (defaults to the queue's content type). */
-  contentType?: QueueContentType;
-  /** Per-message delivery delay in seconds (0–43200, i.e. up to 12 hours). */
-  delaySeconds?: number;
-}
-/** Options for a `producer.sendBatch(messages, options?)`. */
-interface QueueSendBatchOptions {
-  /** Delivery delay applied to the whole batch, in seconds. */
-  delaySeconds?: number;
-}
-/** One entry in a `sendBatch` call — a body plus optional per-message overrides. */
-interface MessageSendRequestLike<Body = unknown> {
-  body: Body;
-  contentType?: QueueContentType;
-  delaySeconds?: number;
-}
-/**
-* Minimal structural projection of workers-types' `Queue&lt;Body>` (the producer
-* binding). The real binding's `send`/`sendBatch` resolve to a metadata object;
-* we widen the return to `Promise&lt;unknown>` so a plain-object fake satisfies it.
-*/
-interface QueueBindingLike<Body = unknown> {
-  send: (message: Body, options?: QueueSendOptions) => Promise<unknown>;
-  sendBatch: (messages: Iterable<MessageSendRequestLike<Body>>, options?: QueueSendBatchOptions) => Promise<unknown>;
-}
-/** Options for retrying a message / batch (`message.retry({ delaySeconds })`). */
-interface QueueRetryOptions {
-  delaySeconds?: number;
-}
-/** Structural mirror of workers-types' `Message&lt;Body>` (one delivered message). */
-interface MessageLike<Body = unknown> {
-  /** Acknowledge this message so it is not redelivered. */
-  ack: () => void;
-  readonly attempts: number;
-  readonly body: Body;
-  readonly id: string;
-  /** Explicitly retry this message (optionally after a delay). */
-  retry: (options?: QueueRetryOptions) => void;
-  readonly timestamp: Date;
-}
-/** Structural mirror of workers-types' `MessageBatch&lt;Body>` handed to a consumer. */
-interface MessageBatchLike<Body = unknown> {
-  /** Acknowledge every message in the batch. */
-  ackAll: () => void;
-  readonly messages: ReadonlyArray<MessageLike<Body>>;
-  /** The queue name this batch was delivered from (`batch.queue`), used to route. */
-  readonly queue: string;
-  /** Retry every message in the batch (optionally after a delay). */
-  retryAll: (options?: QueueRetryOptions) => void;
-}
 /**
-* The typed producer bound to `ctx.queues.&lt;name>`. Sending is a side effect, so
-* the generated context exposes this only on `MutationCtx` / `ActionCtx` (never
-* the deterministic `QueryCtx`), mirroring `ctx.scheduler` / `ctx.workflows`.
-*/
+ * The typed producer bound to `ctx.queues.<name>`. Sending is a side effect, so
+ * the generated context exposes this only on `MutationCtx` / `ActionCtx` (never
+ * the deterministic `QueryCtx`), mirroring `ctx.scheduler` / `ctx.workflows`.
+ */
 interface QueueProducer<Body = unknown> {
   /** Enqueue one message. */
   send: (body: Body, options?: QueueSendOptions) => Promise<void>;
@@ -91,36 +75,62 @@ interface QueueProducer<Body = unknown> {
   sendBatch: (messages: Iterable<MessageSendRequestLike<Body>>, options?: QueueSendBatchOptions) => Promise<void>;
 }
 /**
-* `ctx.queues` — the map of declared queue export names → typed producers.
-* Codegen narrows this to the exact export names; the package keeps it open so
-* `createQueues` stays schema-agnostic.
-*/
-interface Queues {
-  [exportName: string]: QueueProducer;
-}
+ * `ctx.queues` — the map of declared queue export names → typed producers.
+ * Keyed by the exact export names `createQueueContext` / `createQueues` are
+ * handed, so `queues.jobs` is a `QueueProducer` rather than `QueueProducer |
+ * undefined` under `noUncheckedIndexedAccess`. `Name` defaults to `string`
+ * (an open map) for schema-agnostic callers.
+ */
+type Queues<Name extends string = string> = Readonly<Record<Name, QueueProducer>>;
 /** Options the package-level `createQueues` factory takes. */
-interface LunoraQueuesOptions {
+interface LunoraQueuesOptions<Name extends string = string> {
   /** Map of `lunora/queues.ts` export name → Cloudflare `Queue` producer binding. */
-  bindings: Record<string, QueueBindingLike>;
+  bindings: Record<Name, QueueBindingLike>;
 }
 /**
-* The context handed to a `defineQueue` handler. Decoupled from `@lunora/server`
-* (like the workflow run context): to touch data, call a Lunora mutation/action
-* via `ctx.run(api.x.y, args)` — the dispatch goes through the same
-* `/_lunora/scheduler/dispatch` path the SchedulerDO and workflows use.
-*/
+ * The context handed to a `defineQueue` handler. Decoupled from `@lunora/server`
+ * (like the workflow run context): to touch data, call a Lunora mutation/action
+ * via `ctx.run(api.x.y, args)` — the dispatch goes through the same
+ * `/_lunora/scheduler/dispatch` path the SchedulerDO and workflows use.
+ */
 interface QueueRunContext {
   /** The worker `env` (bindings + vars). */
   readonly env: Record<string, unknown>;
   /** Queue-name-prefixed logger. */
   readonly log: DispatchLogger;
-  /** Invoke a Lunora function (query/mutation/action) by reference. */
+  /**
+   * Invoke a Lunora function (query/mutation/action) by reference.
+   *
+   * Batch-unaware: a failure it throws is attributed to nothing, so a
+   * deterministic failure retries the whole batch. Inside the `batch.messages`
+   * loop, prefer {@link QueueMessage.run}, which pins the call to its message.
+   */
   readonly run: DispatchRunFunction;
 }
+/**
+ * One delivered message as the push handler sees it: the Cloudflare `Message`
+ * plus `run` — a {@link QueueRunContext.run} pinned to THIS message.
+ *
+ * Prefer `message.run(api.x.y, args)` over `ctx.run(...)` inside the batch
+ * loop. The pin is what lets the dispatcher attribute a deterministic dispatch
+ * failure (400/403/404/422) to the one message that caused it: that message is
+ * acked and every other one is retried, instead of the whole batch being
+ * re-delivered because of a single poison message. A plain `ctx.run` call
+ * carries no message id, so its failure stays unattributed and the whole batch
+ * retries.
+ */
+interface QueueMessage<Body = unknown> extends MessageLike<Body> {
+  /** {@link QueueRunContext.run}, pinned to this message for failure attribution. */
+  readonly run: DispatchRunFunction;
+}
+/** The delivered batch as the push handler sees it — {@link QueueMessage}s rather than bare `Message`s. */
+interface QueueMessageBatch<Body = unknown> extends Omit<MessageBatchLike<Body>, "messages"> {
+  readonly messages: ReadonlyArray<QueueMessage<Body>>;
+}
 /** Whether a declared queue is consumed by this worker (push) or polled externally (pull). */
 type QueueConsumerMode = "pull" | "push";
 /** The handler body run for each delivered batch (push consumers only). */
-type QueueHandler<Body = unknown> = (context: QueueRunContext, batch: MessageBatchLike<Body>) => Promise<void> | void;
+type QueueHandler<Body = unknown> = (context: QueueRunContext, batch: QueueMessageBatch<Body>) => Promise<void> | void;
 /** Push-consumer batch/retry tuning, mirrored onto the wrangler `queues.consumers[]` entry. */
 interface QueueConsumerTuning {
   /** Name of the dead-letter queue messages land in after `maxRetries`. */
@@ -129,7 +139,9 @@ interface QueueConsumerTuning {
   maxBatchSize?: number;
   /** Max seconds to wait before delivering a partial batch (0–60, default 5). */
   maxBatchTimeout?: number;
-  /** Max delivery attempts before a message is dropped / dead-lettered (default 3). */
+  /** Max concurrent consumer invocations (1–250). Unset lets Cloudflare autoscale. Not emulated by Miniflare in dev. */
+  maxConcurrency?: number;
+  /** Retries **after** the initial delivery, before a message is dropped / dead-lettered. Default 3, so up to 4 deliveries in total. */
   maxRetries?: number;
   /** Delay in seconds before a failed batch is retried. */
   retryDelay?: number;
@@ -137,135 +149,325 @@ interface QueueConsumerTuning {
 /** The config object passed to `defineQueue`. */
 interface QueueConfig<Body = unknown> extends QueueConsumerTuning {
   /**
-  * The push-consumer body. Required for `mode: "push"` (the default); omit it
-  * for `mode: "pull"`, where an external worker polls the queue over HTTP.
-  */
+   * The push-consumer body. Required for `mode: "push"` (the default); omit it
+   * for `mode: "pull"`, where an external worker polls the queue over HTTP.
+   */
   handler?: QueueHandler<Body>;
   /** How this queue is consumed. Defaults to `"push"`. */
   mode?: QueueConsumerMode;
   /**
-  * Stable wrangler queue name (`queues.producers[].queue`). Defaults to the
-  * kebab-cased export name (`emailQueue` → `email-queue`).
-  */
+   * Stable wrangler queue name (`queues.producers[].queue`). Defaults to the
+   * kebab-cased export name (`emailQueue` → `email-queue`).
+   */
   name?: string;
 }
 /** The branded result of `defineQueue`, discovered by codegen + config. */
 interface QueueDefinition<Body = unknown> extends QueueConfig<Body> {
   /**
-  * Phantom carrier for the message body type, so codegen can type the
-  * generated `ctx.queues.&lt;name>` producer as `QueueProducer&lt;Body>` from
-  * `typeof &lt;export>`. Never assigned at runtime (type-only).
-  */
+   * Phantom carrier for the message body type, so codegen can type the
+   * generated `ctx.queues.<name>` producer as `QueueProducer<Body>` from
+   * `typeof <export>`. Never assigned at runtime (type-only).
+   */
   readonly __lunoraBody?: Body;
   /** Runtime brand identifying a `defineQueue` result. */
   isLunoraQueue: true;
 }
+/**
+ * The typed publisher bound to `ctx.topics.<name>`. A publish is one send to
+ * **each** subscription's queue, in parallel, so it is not atomic: when one send
+ * fails the call rejects, and a retry re-delivers to the subscriptions whose send
+ * already succeeded. Delivery is at-least-once per subscription — make handlers
+ * idempotent. A topic with no subscriptions publishes to nobody.
+ */
+interface TopicPublisher<Payload = unknown> {
+  /** Publish one message to every subscription. */
+  publish: (payload: Payload, options?: QueueSendOptions) => Promise<void>;
+  /** Publish a batch (at most 100) to every subscription in one send per subscription. */
+  publishBatch: (messages: Iterable<MessageSendRequestLike<Payload>>, options?: QueueSendBatchOptions) => Promise<void>;
+}
+/** `ctx.topics` — declared topic export names → typed publishers, keyed like {@link Queues}. */
+type Topics<Name extends string = string> = Readonly<Record<Name, TopicPublisher>>;
+/** The branded result of `defineTopic`, discovered by codegen. Carries no deploy config of its own. */
+interface TopicDefinition<Payload = unknown> {
+  /**
+   * Phantom carrier for the payload type, so codegen can type `ctx.topics.<name>`.
+   * Named like {@link QueueDefinition}'s so one emitted helper reads both. Never
+   * assigned at runtime.
+   */
+  readonly __lunoraBody?: Payload;
+  /** Runtime brand identifying a `defineTopic` result. */
+  isLunoraTopic: true;
+}
+/** The config passed to `defineSubscription`: a push consumer's handler plus its own retry/DLQ tuning. */
+interface SubscriptionConfig<Payload = unknown> extends QueueConsumerTuning {
+  handler: QueueHandler<Payload>;
+  /**
+   * Stable wrangler queue name for this subscription. Defaults to the
+   * kebab-cased export name, exactly like a `defineQueue` export.
+   */
+  name?: string;
+}
+/**
+ * The branded result of `defineSubscription`: a push {@link QueueDefinition}
+ * (so dispatch, retries, the DLQ, wrangler reconcile and the studio treat it as
+ * the queue it is) tagged with the topic it consumes.
+ */
+interface SubscriptionDefinition<Payload = unknown> extends QueueDefinition<Payload> {
+  handler: QueueHandler<Payload>;
+  mode: "push";
+  /** The topic this subscription consumes. */
+  topic: TopicDefinition<Payload>;
+}
+/** Wiring info for one declared topic, emitted by codegen into the generated shard. */
+interface TopicBindingSpec<Name extends string = string> {
+  /** The `lunora/queues.ts` topic export name, e.g. `signups`. */
+  exportName: Name;
+  /** One entry per subscription: its export name and its `Queue` producer binding. */
+  subscriptions: ReadonlyArray<{
+    binding: string;
+    exportName: string;
+  }>;
+}
 /** Wiring info for one declared queue, emitted by codegen into the generated shard/handler. */
-interface QueueBindingSpec {
+interface QueueBindingSpec<Name extends string = string> {
   /** The Cloudflare `Queue` producer binding name, e.g. `QUEUE_EMAIL`. */
   binding: string;
   /** The `lunora/queues.ts` export name, e.g. `emailQueue`. */
-  exportName: string;
+  exportName: Name;
   /** The stable wrangler queue name, e.g. `email-queue`. */
   name: string;
 }
-/**
-* Build the `ctx.queues` map for a request: resolve every spec's `env[binding]`
-* into the `exportName → Queue binding` map and wrap it in {@link createQueues}.
-* A spec whose binding is absent from `env` is skipped here — the helpful "no
-* queue named …" error is raised lazily by `ctx.queues.&lt;name>.send(...)` when
-* the missing queue is actually used.
-*/
-declare const createQueueContext: (env: Record<string, unknown>, specs: ReadonlyArray<QueueBindingSpec>) => Queues;
-/**
-* Build the `ctx.queues` map from `lunora/queues.ts` export name → Cloudflare
-* `Queue` binding. Each property is a typed {@link QueueProducer}; accessing an
-* export whose binding is absent throws a directed error naming the declared
-* queues (raised lazily on first use).
-*/
-declare const createQueues: (options: LunoraQueuesOptions) => Queues;
-/**
-* The wrangler producer binding name for a queue export: `emailQueue` →
-* `QUEUE_EMAIL_QUEUE`, `email` → `QUEUE_EMAIL`. The `QUEUE_` prefix namespaces
-* these away from `SHARD`/`SESSION`/`SCHEDULER`/`WORKFLOW_*`/`CONTAINER_*` so a
-* queue export can never collide with the built-in bindings.
-*/
-declare const queueBindingName: (exportName: string) => string;
-/**
-* The stable queue name wrangler registers (`queues.producers[].queue` and
-* `queues.consumers[].queue`): `emailQueue` → `email-queue`. Used as the
-* deployed queue's identifier when no explicit `name` override is given.
-*/
-declare const queueDefaultName: (exportName: string) => string;
-/**
-* Declare a Cloudflare Queue deployed alongside the app. Pure validation +
-* branding: codegen discovers the export, emits the typed `ctx.queues.&lt;name>`
-* producer and (for push consumers) the worker `queue()` dispatch; the config
-* layer reconciles the wrangler `queues.producers[]` / `queues.consumers[]`
-* entries from the same definition.
-*
-* ```ts
-* // lunora/queues.ts
-* import { defineQueue } from "@lunora/queue";
-* import { api } from "./_generated/api";
-*
-* export const emailQueue = defineQueue&lt;{ to: string }>({
-*     handler: async (ctx, batch) => {
-*         for (const message of batch.messages) {
-*             await ctx.run(api.email.send, { to: message.body.to });
-*             message.ack();
-*         }
-*     },
-* });
-* ```
-*
-* Enqueue from a mutation or action: `await ctx.queues.emailQueue.send({ to })`.
-*
-* ⚠️ **Privileged dispatch.** A push handler's `ctx.run(...)` calls back into
-* Lunora functions over the admin-authenticated dispatch endpoint (the same
-* trusted path the scheduler and workflows use), so those calls run with the
-* system identity — **end-user RLS is not applied**. Treat a queue handler as
-* trusted server code: validate `message.body` (it may be attacker-influenced if
-* anything user-facing can enqueue) before acting on it, and don't forward an
-* unchecked body straight into a privileged mutation.
-*/
-declare const defineQueue: <Body = unknown>(config: QueueConfig<Body>) => QueueDefinition<Body>;
-/** True when a value is a `defineQueue` result (the runtime brand check). */
-declare const isQueueDefinition: (value: unknown) => value is QueueDefinition;
 /** One declared queue, keyed for batch routing by its stable wrangler name. */
 interface QueueRegistryEntry {
   /**
-  * The `defineQueue` result (carries the push handler). The body type is
-  * erased to `any` here because the registry is heterogeneous — different
-  * queues carry different message bodies, and the handler param is
-  * contravariant, so a precise `QueueDefinition&lt;Body>` would not be assignable
-  * to a shared `unknown`-bodied slot. Runtime dispatch passes the delivered
-  * batch straight through, so the erasure is type-only.
-  */
+   * The queue's own producer binding on `env` (`QUEUE_*`). A message whose
+   * dispatch is declined on its last delivery is re-enqueued through it (see
+   * {@link resolveDeclinedBatch}); without it that message is dead-lettered or
+   * dropped, and logged. Codegen always emits it.
+   */
+  binding?: string;
+  /**
+   * The `defineQueue` result (carries the push handler). The body type is
+   * erased to `any` here because the registry is heterogeneous — different
+   * queues carry different message bodies, and the handler param is
+   * contravariant, so a precise `QueueDefinition<Body>` would not be assignable
+   * to a shared `unknown`-bodied slot. Runtime dispatch passes the delivered
+   * batch straight through, so the erasure is type-only.
+   */
   definition: QueueDefinition<any>;
   /** The `lunora/queues.ts` export name, for log correlation. */
   exportName: string;
 }
 /** Map of stable wrangler queue name → registry entry, built by codegen. */
 type QueueRegistry = Record<string, QueueRegistryEntry>;
+/** The disposition a consumer left one message in for a single delivery attempt. */
+type QueueMessageOutcome = "ack" | "error" | "retry";
+/**
+ * One consumed message as captured by {@link dispatchQueueBatch} and handed to an
+ * {@link QueueCaptureSink}. Structurally matches `@lunora/do`'s
+ * `RecordQueueMessageInput` (the reserved `recordQueueMessage` admin RPC payload);
+ * the two packages share only this contract, so keep them in sync by hand.
+ */
+interface CapturedQueueMessage {
+  /** Delivery attempt number for this message (`message.attempts`). */
+  attempts: number;
+  /** The message body (JSON-encoded + capped by the catcher). */
+  body: unknown;
+  /**
+   * `true` when this failed delivery was the message's last (its retries are
+   * exhausted) AND the queue declares a `deadLetterQueue` for it to land in.
+   * Stays `false` for a queue with no DLQ, where the broker drops the
+   * exhausted message instead — `attempts > maxRetries` with
+   * `outcome !== "ack"` is what identifies that case.
+   *
+   * Read from the `defineQueue` DECLARATION, because a consumer has no
+   * runtime API that exposes its deployed `queues.consumers[]` settings. It is
+   * true of the deployed broker only as far as Lunora's binding reconcile (run
+   * by `lunora dev`, `deploy` and `prepare`) keeps the two in step: it writes
+   * every declared tuning field onto the consumer, including onto one that
+   * already exists, and takes a field back out once `defineQueue` drops it
+   * (it records what `defineQueue` declared in `package.json`
+   * `lunora.queueTuning`). The gaps that remain: a field changed by hand to
+   * another value than the declared one is
+   * kept when the declaration drops it, so a hand-set DLQ still reads
+   * `false` here; a `--env` deploy retunes the `env.<name>` consumers but
+   * never writes their `dead_letter_queue`, which that block names itself;
+   * and a bare `wrangler deploy` over a hand-edited consumer can disagree
+   * too. Nothing on this side can see any of it.
+   */
+  deadLettered: boolean;
+  /** Handler error message when `outcome` is `error`; absent otherwise. */
+  error?: string;
+  /** The `lunora/queues.ts` export name that consumed it. */
+  exportName: string;
+  /** The delivered message id (`message.id`). */
+  messageId: string;
+  /** How the handler disposed of the message this attempt. */
+  outcome: QueueMessageOutcome;
+  /** The stable wrangler queue name the batch was delivered from (`batch.queue`). */
+  queue: string;
+  /** Original message timestamp in epoch-ms (`message.timestamp`). */
+  timestamp: number;
+}
+/**
+ * Persists a batch of consumed messages. The codegen worker wires this to POST the
+ * batch to the root shard's `recordQueueMessage` admin RPC (the dev queue catcher).
+ * Best-effort by contract: {@link dispatchQueueBatch} swallows a rejection so a
+ * capture failure never changes delivery semantics.
+ */
+type QueueCaptureSink = (messages: CapturedQueueMessage[]) => Promise<void> | void;
 interface DispatchOptions {
+  /**
+   * Optional capture sink. When set, every message's final disposition is
+   * turned into a record and handed to this sink after the handler runs.
+   * Omitted in production unless queue capture is enabled, so a consumer pays
+   * no record-building or sink cost by default. Delivery semantics — including
+   * poison-message isolation — do not depend on it.
+   */
+  capture?: QueueCaptureSink;
   /** Worker `env`, forwarded to the queue run context. */
   env: Record<string, unknown>;
   /** Injectable fetch for the `ctx.run` dispatcher (tests). */
   fetchImpl?: typeof fetch;
+  /**
+   * W3C `traceparent` of the consumer invocation's own trace, supplied by the
+   * runtime's `queue()` entry. Forwarded on every `ctx.run` dispatch so the
+   * functions a handler calls are CHILDREN of the queue span instead of a set of
+   * unrelated root traces. Absent (a hand-built dispatch, a unit test) keeps the
+   * prior behaviour: the callee mints its own trace.
+   */
+  traceparent?: string;
 }
 /**
-* Look up the handler for `batch.queue` and invoke it with a fresh
-* `QueueRunContext`. Throws a directed error when no push handler is registered
-* for the delivered queue (a misconfiguration — the consumer was declared
-* `pull`, or the queue name drifted from the `defineQueue` export).
-*/
+ * Look up the handler for `batch.queue` and invoke it with a fresh
+ * `QueueRunContext`. Throws a directed error when no push handler is registered
+ * for the delivered queue (a misconfiguration — the consumer was declared
+ * `pull`, or the queue name drifted from the `defineQueue` export). The
+ * registry already carries every per-environment name wrangler.jsonc maps to a
+ * declared producer binding (see codegen's `emitQueues`), so the lookup stays exact.
+ */
 declare const dispatchQueueBatch: (batch: MessageBatchLike, registry: QueueRegistry, options: DispatchOptions) => Promise<void>;
+/** A Worker `env` projected as a plain record (vars, secrets, and bindings are `unknown`-valued). */
+type QueueEnv = Record<string, unknown>;
+/** Options for {@link createQueueCaptureSink}. */
+interface QueueCaptureOptions {
+  /** Pin the consumed-message log to a Cloudflare data-residency jurisdiction (match the worker's `jurisdiction`). */
+  jurisdiction?: string;
+  /** Shard the consumed-message log lives on; override if the worker sets a custom `defaultShardKey`. */
+  rootShard?: string;
+}
+/**
+ * Whether consumed queue messages should be captured into the studio's log.
+ * Explicit `LUNORA_QUEUE_CAPTURE` (`"1"`/`"true"` vs `"0"`/`"false"`) always wins;
+ * unset, capture is on only in a development environment. Mirrors
+ * `@lunora/mail`'s `shouldCaptureMail` so mail and queue dev capture toggle the
+ * same way.
+ */
+declare const shouldCaptureQueue: (env: QueueEnv) => boolean;
+/**
+ * Build the {@link QueueCaptureSink} that records a processed batch into the
+ * studio's root-shard consumed-message log via the reserved `recordQueueMessage`
+ * admin RPC. Best-effort by contract: without the `SHARD` binding or
+ * `LUNORA_ADMIN_TOKEN` it no-ops, and `dispatchQueueBatch` swallows a
+ * rejection, so capture never changes delivery semantics.
+ */
+declare const createQueueCaptureSink: (env: QueueEnv, options?: QueueCaptureOptions) => QueueCaptureSink;
+/**
+ * Build the `ctx.queues` map for a request: resolve every spec's `env[binding]`
+ * into the `exportName → Queue binding` map and wrap it in {@link createQueues}.
+ * A spec whose binding is absent from `env` is skipped here — the helpful "no
+ * queue named …" error is raised lazily by `ctx.queues.<name>.send(...)` when
+ * the missing queue is actually used.
+ */
+declare const createQueueContext: <Name extends string>(env: Record<string, unknown>, specs: ReadonlyArray<QueueBindingSpec<Name>>) => Queues<Name>;
+/**
+ * Build the `ctx.queues` map from `lunora/queues.ts` export name → Cloudflare
+ * `Queue` binding. Each property is a typed {@link QueueProducer}; accessing an
+ * export whose binding is absent throws a directed error naming the declared
+ * queues (raised lazily on first use).
+ */
+declare const createQueues: <Name extends string>(options: LunoraQueuesOptions<Name>) => Queues<Name>;
+/**
+ * The wrangler producer binding name for a queue export: `emailQueue` →
+ * `QUEUE_EMAIL_QUEUE`, `email` → `QUEUE_EMAIL`. The `QUEUE_` prefix namespaces
+ * these away from `SHARD`/`SESSION`/`SCHEDULER`/`CONTAINER_*` so a
+ * queue export can never collide with the built-in bindings.
+ */
+declare const queueBindingName: (exportName: string) => string;
+/**
+ * The stable queue name wrangler registers (`queues.producers[].queue` and
+ * `queues.consumers[].queue`): `emailQueue` → `email-queue`. Used as the
+ * deployed queue's identifier when no explicit `name` override is given.
+ */
+declare const queueDefaultName: (exportName: string) => string;
+/**
+ * Declare a Cloudflare Queue deployed alongside the app. Pure validation +
+ * branding: codegen discovers the export, emits the typed `ctx.queues.<name>`
+ * producer and (for push consumers) the worker `queue()` dispatch; the config
+ * layer reconciles the wrangler `queues.producers[]` / `queues.consumers[]`
+ * entries from the same definition.
+ *
+ * ```ts
+ * // lunora/queues.ts
+ * import { defineQueue } from "@lunora/queue";
+ * import { api } from "./_generated/api";
+ *
+ * export const emailQueue = defineQueue<{ to: string }>({
+ *     handler: async (ctx, batch) => {
+ *         for (const message of batch.messages) {
+ *             await message.run(api.email.send, { to: message.body.to });
+ *             message.ack();
+ *         }
+ *     },
+ * });
+ * ```
+ *
+ * Enqueue from a mutation or action: `await ctx.queues.emailQueue.send({ to })`.
+ *
+ * `message.run(...)` is `ctx.run(...)` pinned to that message — prefer it inside
+ * the batch loop. A deterministic failure (400/403/404/422) from a pinned call
+ * is attributed to its message: that one is acked and the rest are retried,
+ * instead of one poison message re-delivering (and eventually dead-lettering)
+ * the whole batch.
+ *
+ * ⚠️ **Privileged dispatch.** A push handler's `ctx.run(...)` calls back into
+ * Lunora functions over the admin-authenticated dispatch endpoint (the same
+ * trusted path the scheduler and workflows use), so those calls run with the
+ * system identity — **end-user RLS is not applied**. Treat a queue handler as
+ * trusted server code: validate `message.body` (it may be attacker-influenced if
+ * anything user-facing can enqueue) before acting on it, and don't forward an
+ * unchecked body straight into a privileged mutation.
+ */
+declare const defineQueue: <Body = unknown>(config: QueueConfig<Body>) => QueueDefinition<Body>;
+/** True when a value is a `defineQueue` result (the runtime brand check). */
+declare const isQueueDefinition: (value: unknown) => value is QueueDefinition;
 interface RunContextOptions {
   env: Record<string, unknown>;
   exportName: string;
   fetchImpl?: typeof fetch;
+  /** The consumer invocation's `traceparent`, so `ctx.run` joins the queue's trace. */
+  traceparent?: string;
 }
 /** Assemble the {@link QueueRunContext} passed to a `defineQueue` handler. */
 declare const createQueueRunContext: (options: RunContextOptions) => QueueRunContext;
-export { type ArgsOf, type FunctionReference, type LunoraQueuesOptions, type MessageBatchLike, type MessageLike, type MessageSendRequestLike, type QueueBindingLike, type QueueBindingSpec, type QueueConfig, type QueueConsumerMode, type QueueConsumerTuning, type QueueContentType, type QueueDefinition, type QueueHandler, type DispatchLogger as QueueLogger, type QueueProducer, type QueueRegistry, type QueueRegistryEntry, type QueueRetryOptions, type QueueRunContext, type DispatchRunFunction as QueueRunFunction, type QueueSendBatchOptions, type QueueSendOptions, type Queues, type RunFunctionOptions, createQueueContext, createQueueRunContext, createQueues, defineQueue, dispatchQueueBatch, isQueueDefinition, queueBindingName, queueDefaultName };
+/**
+ * Declare a topic in `lunora/queues.ts`. The payload type is the only thing a
+ * topic carries; delivery config lives on each subscription.
+ */
+declare const defineTopic: <Payload = unknown>() => TopicDefinition<Payload>;
+/**
+ * Subscribe to a topic. The result is a push queue definition — export it from
+ * `lunora/queues.ts` and it deploys, retries and dead-letters exactly like a
+ * `defineQueue` export of the same name.
+ *
+ * ⚠️ Same trust model as a queue handler: `message.run(...)` dispatches with the
+ * system identity, so validate `message.body` before acting on it.
+ */
+declare const defineSubscription: <Payload>(topic: TopicDefinition<Payload>, config: SubscriptionConfig<Payload>) => SubscriptionDefinition<Payload>;
+/**
+ * Build `ctx.topics` for a request from the Worker `env` and the codegen-emitted
+ * specs. A topic with no subscriptions publishes to nobody; a topic with an
+ * unbound subscription rejects every publish (see {@link unboundPublisher}).
+ */
+declare const createTopicContext: <Name extends string>(env: Record<string, unknown>, specs: ReadonlyArray<TopicBindingSpec<Name>>) => Topics<Name>;
+export { type ArgsOf, type CapturedQueueMessage, type FunctionReference, type LunoraQueuesOptions, type QueueBindingSpec, type QueueCaptureOptions, type QueueCaptureSink, type QueueConfig, type QueueConsumerMode, type QueueConsumerTuning, type QueueDefinition, type QueueEnv, type QueueHandler, type DispatchLogger as QueueLogger, type QueueMessage, type QueueMessageBatch, type QueueProducer, type QueueRegistry, type QueueRegistryEntry, type QueueRunContext, type DispatchRunFunction as QueueRunFunction, type Queues, type RunFunctionOptions, type SubscriptionConfig, type SubscriptionDefinition, type TopicBindingSpec, type TopicDefinition, type TopicPublisher, type Topics, createQueueCaptureSink, createQueueContext, createQueueRunContext, createQueues, createTopicContext, defineQueue, defineSubscription, defineTopic, dispatchQueueBatch, isQueueDefinition, queueBindingName, queueDefaultName, shouldCaptureQueue };

package/dist/index.mjs

@@ -1,5 +1 @@
-export { createQueueContext } from './packem_shared/createQueueContext-D0XCdCsd.mjs';
-export { default as createQueues } from './packem_shared/createQueues-14-vSICK.mjs';
-export { defineQueue, isQueueDefinition, queueBindingName, queueDefaultName } from './packem_shared/defineQueue-D40gREfg.mjs';
-export { dispatchQueueBatch } from './packem_shared/dispatchQueueBatch-DVMmBISH.mjs';
-export { createQueueRunContext } from './packem_shared/createQueueRunContext-DVqG7Oyk.mjs';
+import{createQueueCaptureSink as t,shouldCaptureQueue as o}from"./packem_shared/createQueueCaptureSink-CSOPftvj.mjs";import{createQueueContext as i}from"./packem_shared/createQueueContext-BelEY_4M.mjs";import{createQueues as n}from"./packem_shared/createQueues-AS-deVhl.mjs";import{defineQueue as f,isQueueDefinition as c,queueBindingName as x,queueDefaultName as m}from"./packem_shared/defineQueue-TY4-i3nG.mjs";import{dispatchQueueBatch as d}from"./packem_shared/dispatchQueueBatch-D030OrmN.mjs";import{c as C}from"./packem_shared/run-context-CoNKhXT_.mjs";import{createTopicContext as l,defineSubscription as q,defineTopic as B}from"./packem_shared/createTopicContext-jtRf138F.mjs";export{t as createQueueCaptureSink,i as createQueueContext,C as createQueueRunContext,n as createQueues,l as createTopicContext,f as defineQueue,q as defineSubscription,B as defineTopic,d as dispatchQueueBatch,c as isQueueDefinition,x as queueBindingName,m as queueDefaultName,o as shouldCaptureQueue};

package/dist/packem_shared/createQueueCaptureSink-CSOPftvj.mjs

@@ -0,0 +1 @@
+import{LunoraError as E}from"@lunora/errors";const _="__lunora_admin__:recordQueueMessage",N="__root__",f=/^(?:dev(?:elopment)?|local(?:host)?|test)$/iu,p=["CF_ENV","ENVIRONMENT","NODE_ENV","WORKER_ENV"],T=5e3,O=o=>{const t=o.LUNORA_QUEUE_CAPTURE;if(typeof t=="string"){const e=t.toLowerCase();if(e==="1"||e==="true")return!0;if(e==="0"||e==="false")return!1;console.warn(`@lunora/queue: unrecognized LUNORA_QUEUE_CAPTURE value "${t}" — expected "1"/"true" or "0"/"false"; falling back to environment detection.`)}return p.some(e=>{const r=o[e];return typeof r=="string"&&f.test(r)})},h=(o,t={})=>{const e=t.rootShard??N;return async r=>{if(r.length===0)return;const i=o.SHARD,s=typeof o.LUNORA_ADMIN_TOKEN=="string"?o.LUNORA_ADMIN_TOKEN:void 0;if(i===void 0||s===void 0)return;let a=i;if(t.jurisdiction!==void 0){if(typeof i.jurisdiction!="function")throw new TypeError(`@lunora/queue: Durable Object namespace does not support jurisdiction("${t.jurisdiction}") — update @cloudflare/workers-types or remove the jurisdiction option`);a=i.jurisdiction(t.jurisdiction)}const l=a.get(a.idFromName(e)),u=new AbortController,d=setTimeout(()=>{u.abort()},T);try{const n=await l.fetch("https://shard.internal/rpc",{body:JSON.stringify({args:{messages:r},functionPath:_}),headers:{authorization:`Bearer ${s}`,"content-type":"application/json"},method:"POST",signal:u.signal});if(!n.ok){const c=await n.text().catch(()=>"");throw new E("INTERNAL",`@lunora/queue: capture write to the root shard failed (${String(n.status)} ${n.statusText})${c===""?"":`: ${c}`}`)}await n.body?.cancel()}finally{clearTimeout(d)}}};export{h as createQueueCaptureSink,O as shouldCaptureQueue};

package/dist/packem_shared/createQueueContext-BelEY_4M.mjs

@@ -0,0 +1 @@
+import{resolveQueueBinding as r,createQueues as s}from"./createQueues-AS-deVhl.mjs";const u=(t,i)=>{const e={};for(const n of i){const o=r(t,n.binding);o&&(e[n.exportName]=o)}return s({bindings:e})};export{u as createQueueContext};