@lunora/server 1.0.0-alpha.1 → 1.0.0-alpha.11

package/dist/index.d.ts

@@ -1,10 +1,10 @@
-import { Validator, Infer, v } from '@lunora/values';
+import { Validator, Infer, ValidatorMap, InferValidatorMap, v } from '@lunora/values';
 export { type ColumnValidator, type Id, type Infer, ValidationError, type Validator, type ValidatorKind, v } from '@lunora/values';
-import { ArgsValidator, InferArgs, RegisteredAction, ActionCtx, MutationCtx, RegisteredMutation, QueryCtx, RegisteredQuery, RegisteredStream, FunctionKind, LifecycleEvent, RegisteredLifecycleHook, TableDefinition, RegisteredFunction, VectorIndexDefinition, Schema, AggregateOp, RelationDefinition, GlobalBackend, OnDeleteAction, TriggerBuilder, TriggerDefinition, VectorEmbedder, VectorMetric, AggregateIndexDefinition, RankIndexDefinition } from "./types.js";
+import { ArgsValidator, InferArgs, RegisteredAction, ActionCtx, MutationCtx, RegisteredMutation, QueryCtx, RegisteredQuery, RegisteredStream, FunctionKind, Secrets, LifecycleEvent, RegisteredLifecycleHook, TableDefinition, RegisteredFunction, VectorIndexDefinition, Schema, AggregateOp, DurableObjectJurisdiction, RelationDefinition, GlobalBackend, OnDeleteAction, ExternalSourceDefinition, TriggerBuilder, TriggerDefinition, VectorEmbedder, VectorMetric, AggregateIndexDefinition, RankIndexDefinition } from "./types.js";
 export { type AnyApi, type AuthState, type DatabaseReader, type DatabaseWriter, type FunctionVisibility, type IndexDefinition, type IndexRangeBuilder, type LifecycleEventKind, type LunoraLogger, type PaginationOptions, type PaginationResult, type RankSortKey, type ReadOnlyStorage, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type SearchFilterBuilder, type SearchIndexDefinition, type ShardMode, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerCtx, type TriggerDatabase, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type VectorMatch, type VectorMatches, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, anyApi } from "./types.js";
 import { Context, Hono } from 'hono';
-import { b as Permission, R as Role, T as TypedDefinePolicyInput, a as Policy, D as DefinePolicyInput, W as WhereInput, c as RlsOptions } from "./packem_shared/types.d-BDY0FYHK.js";
-export type { d as PolicyContext, e as PolicyDecision, f as PolicyDecisionOf, P as PolicyOperation } from "./packem_shared/types.d-BDY0FYHK.js";
+import { b as Permission, R as Role, T as TypedDefinePolicyInput, a as Policy, D as DefinePolicyInput, W as WhereInput, c as RlsOptions } from "./packem_shared/types.d-Cxl6ndhm.js";
+export type { d as PolicyContext, e as PolicyDecision, f as PolicyDecisionOf, P as PolicyOperation } from "./packem_shared/types.d-Cxl6ndhm.js";
 export { type CronJob, type CronJobsBuilder, type CronScheduleKind, type DailySchedule, type IntervalSchedule, type MonthlySchedule, type WeeklySchedule, cronJobs } from '@lunora/scheduler';
 import "./data-model.js";
 /**
@@ -187,6 +187,13 @@ declare const initLunora: {
   dataModel: <DataModel>() => DataModelInit<DataModel>;
 };
 /**
+* Build the `ctx.secrets` reader from the worker `env`. `get(name)` resolves
+* `env[name].get()` — the `secrets_store_secrets[]` binding of that name. An
+* absent or non-Secrets-Store binding throws a directed error pointing at the
+* wrangler config; the lookup is lazy, so an unused secret never resolves.
+*/
+declare const createSecrets: (env: Record<string, unknown>) => Secrets;
+/**
 * Redact secrets from a free-form message. Masks, in order: any quoted value
 * whose contents look like a credential (so a value surfaced as `received string
 * "sk_live_…"` is masked even though the surrounding text is not a token); a
@@ -276,7 +283,10 @@ declare const defineEnv: <S extends EnvShape>(shape: S) => EnvAccessor<S>;
 * The runtime's structural error mapper keys off `name === "LunoraError"` plus
 * the numeric `status`, so throwing one of these from a handler or middleware
 * yields the right RPC/HTTP status without any further wiring. `code` carries
-* the machine-readable reason for clients.
+* the machine-readable reason for clients; the optional `data` carries a
+* structured, JSON+wire-encodable payload propagated verbatim to the client
+* (e.g. `{ retryAfterMs }`). Only an explicit `LunoraError`'s `data` crosses the
+* wire — an unhandled throw is still redacted to a generic message server-side.
 */
 declare const CODE_STATUS: {
   readonly BAD_REQUEST: 400;
@@ -322,24 +332,11 @@ declare class LunoraError extends Error {
   override readonly name = "LunoraError";
   readonly code: LunoraErrorCode;
   readonly status: number;
-  constructor(code: LunoraErrorCode, message?: string);
+  /** Structured, JSON+wire-encodable payload surfaced to the client alongside `code`. */
+  readonly data?: unknown;
+  constructor(code: LunoraErrorCode, message?: string, data?: unknown);
 }
 /**
-* The per-table `ctx.db` accessor (the `ctx.db.messages.findMany(...)` form) and
-* the kitcn-style `ctx.orm` namespace, as plain runtime helpers. This is the ONE
-* source of truth for the facade shape, shared by two callers so they can never
-* drift (a drift here is security-relevant — a facade accessor the RLS
-* middleware forgot to re-bind would read around policy). `@lunora/codegen`
-* emits `ctx.db`/`ctx.orm` by calling these over the raw shard writer (and the
-* D1 `globalDb` writer for `.global()` tables); the RLS middleware re-binds the
-* policy tables by calling them over the policy-enforcing wrapped writer.
-*
-* `bindTableFacade(writer, table)` pins `tableName` on the structural writer so
-* callers address rows by id (`get`/`delete`/`patch`/`replace`) or by the bound
-* table (everything else). The binding is identical regardless of which writer
-* is passed — that's the whole point.
-*/
-/**
 * Minimal structural writer the facade binds over. Declared with **method**
 * syntax (not arrow properties) so a more-specifically-typed writer — both
 * `@lunora/do`'s `DatabaseWriterLike` and the RLS middleware's wrapped writer —
@@ -349,7 +346,9 @@ declare class LunoraError extends Error {
 interface FacadeWriterLike {
   aggregate(tableName: string, options: unknown): Promise<unknown>;
   count(tableName: string, where?: unknown): Promise<number>;
-  delete(id: string, expectedTable?: string): Promise<void>;
+  delete(id: string, expectedTable?: string, options?: {
+    hard?: boolean;
+  }): Promise<void>;
   deleteMany?(ids: ReadonlyArray<string>, options?: {
     limit?: number;
   }, expectedTable?: string): Promise<{
@@ -377,6 +376,7 @@ interface FacadeWriterLike {
   rank(tableName: string, indexName: string, options: unknown): Promise<unknown>;
   rankPage(tableName: string, indexName: string, options?: unknown): Promise<unknown>;
   replace(id: string, document: Record<string, unknown>, expectedTable?: string): Promise<void>;
+  restore?(id: string, expectedTable?: string): Promise<void>;
 }
 /** The per-table accessor object returned for the `ctx.db` table form. */
 interface FacadeEntry {
@@ -388,12 +388,16 @@ interface FacadeEntry {
   }) => Promise<{
     deleted: number;
   }>;
+  /** `true` when at least one row matches `where` (or any row exists when omitted). Honors RLS like `findFirst`. */
+  exists: (where?: unknown) => Promise<boolean>;
   findFirst: (args?: unknown) => Promise<unknown>;
   findFirstOrThrow: (args?: unknown) => Promise<unknown>;
   findMany: (args?: unknown) => Promise<unknown>;
   get: (id: string) => Promise<unknown>;
   groupBy: (options: unknown) => Promise<unknown>;
-  insert: (document: Record<string, unknown>) => Promise<string>;
+  /** Physically remove a row (and physically cascade), bypassing `.softDelete()`. */
+  hardDelete: (id: string) => Promise<void>;
+  insert: (document: Record<string, unknown>, options?: FacadeInsertOptions) => Promise<null | string>;
   insertMany: (documents: ReadonlyArray<Record<string, unknown>>, options?: {
     limit?: number;
   }) => Promise<string[]>;
@@ -407,8 +411,47 @@ interface FacadeEntry {
   rank: (indexName: string, options: unknown) => Promise<unknown>;
   rankPage: (indexName: string, options?: unknown) => Promise<unknown>;
   replace: (id: string, document: Record<string, unknown>) => Promise<void>;
+  /** Un-soft-delete a row: clears the `.softDelete()` marker (by-id, so it reaches a row list reads hide). */
+  restore: (id: string) => Promise<void>;
+  /** Insert when no row matches `target`, else patch the match. Composes `findFirst` + `insert`/`patch`, so RLS applies to each step. */
+  upsert: (args: UpsertArgs) => Promise<UpsertResult>;
+  /** Sequential `upsert` over many rows sharing one `target`; returns one result per input row in order. */
+  upsertMany: (args: UpsertManyArgs) => Promise<UpsertResult[]>;
   withSearchIndex: (indexName: string, search: (q: unknown) => unknown) => unknown;
 }
+/** Options accepted by the per-table `insert` accessor. */
+interface FacadeInsertOptions {
+  /**
+  * When `true`, a UNIQUE-constraint breach is swallowed: the insert becomes a
+  * silent no-op and resolves to `null` instead of throwing a `CONFLICT`. Any
+  * other error still propagates. Mirrors better-drizzle's `create({ skipDuplicates })`.
+  */
+  skipDuplicates?: boolean;
+}
+/** The conflict target for `upsert`/`upsertMany`: one field name or a tuple of them. */
+type UpsertTarget = ReadonlyArray<string> | string;
+/** Argument to the per-table `upsert` accessor. */
+interface UpsertArgs {
+  /** Document inserted when no existing row matches the `target`. */
+  create: Record<string, unknown>;
+  /** Field(s) — typically a `.unique()` column or unique index — used to look up an existing row. */
+  target: UpsertTarget;
+  /** Patch applied when an existing row matches the `target`. Defaults to `create`. */
+  update?: Record<string, unknown>;
+}
+/** Result of an `upsert`: the row's id and whether it was freshly inserted (`true`) or updated (`false`). */
+interface UpsertResult {
+  created: boolean;
+  id: string;
+}
+/** Argument to the per-table `upsertMany` accessor — a shared `target` plus per-row create/update payloads. */
+interface UpsertManyArgs {
+  rows: ReadonlyArray<{
+    create: Record<string, unknown>;
+    update?: Record<string, unknown>;
+  }>;
+  target: UpsertTarget;
+}
 /**
 * Bind a structural writer to one table, producing its `ctx.db` table accessor.
 *
@@ -426,7 +469,7 @@ declare const bindTableFacade: (writer: FacadeWriterLike, tableName: string) =>
 interface OrmLike {
   delete: (table: string, id: string) => Promise<void>;
   insert: (table: string) => {
-    values: (document: Record<string, unknown>) => Promise<string>;
+    values: (document: Record<string, unknown>) => Promise<null | string>;
   };
   query: Record<string, FacadeEntry>;
   replace: (table: string, id: string) => {
@@ -631,6 +674,76 @@ interface ContextWithStorage {
 * client then ranges against R2/CDN directly with no Worker hop.
 */
 declare const serveStorageObject: (context: ContextWithStorage, key: string, request: Request) => Promise<Response>;
+/**
+* What the worker does with a resolver's identity when it fails contract
+* validation (a forged / malformed claim set arriving from an untrusted token).
+* `"anonymous"` (default, safe) treats the request as anonymous, so the bad
+* identity never reaches a policy as a valid identity (`ctx.auth.userId`
+* becomes `undefined`). `"reject"` fails the request closed (a `401`) — use
+* when a malformed credential should be a hard error, not a silent downgrade.
+*/
+type IdentityRejectMode = "anonymous" | "reject";
+/** Options for {@link defineIdentity}. */
+interface DefineIdentityOptions {
+  /**
+  * How to handle a resolver identity that violates the contract at the trust
+  * boundary. Defaults to `"anonymous"` (a forged claim set is downgraded to
+  * anonymous rather than flowing in as an unchecked cast).
+  */
+  readonly onInvalid?: IdentityRejectMode;
+}
+/** Result of validating a candidate identity against the contract. */
+type IdentityValidation = {
+  ok: true;
+} | {
+  error: string;
+  ok: false;
+};
+/**
+* A declared identity claim contract. Carries the codegen discovery brand, the
+* declared claim validators, the reject policy, and a runtime `validate`. The
+* `TClaims` type parameter is the inferred claim shape (always extending
+* `{ userId: string }`); it is phantom (no runtime field) and exists so
+* `@lunora/codegen` and {@link InferIdentity} can recover the type.
+*/
+interface IdentityContract<TClaims extends {
+  userId: string;
+} = {
+  userId: string;
+}> {
+  /**
+  * Phantom carrier for the inferred claim type. Never populated at runtime
+  * (`undefined`); present only so the type flows to codegen / {@link InferIdentity}.
+  */
+  readonly __claimType?: TClaims;
+  readonly __lunoraIdentity: true;
+  /** The declared claim validators (a `@lunora/values` validator map). */
+  readonly claims: ValidatorMap;
+  /** Reject policy applied at the trust boundary. See {@link IdentityRejectMode}. */
+  readonly onInvalid: IdentityRejectMode;
+  /**
+  * Validate a resolver's returned identity against the declared claims. On
+  * success the caller keeps the original identity untouched (so undeclared
+  * claims are forwarded verbatim, preserving today's behaviour); on failure
+  * the worker applies the `onInvalid` policy.
+  */
+  validate: (identity: Record<string, unknown>) => IdentityValidation;
+}
+/** Recover the declared claim type from a {@link defineIdentity} contract. */
+type InferIdentity<T> = T extends IdentityContract<infer TClaims> ? TClaims : never;
+/**
+* Declare the identity claim contract. `claims` is a `@lunora/values` validator
+* map whose inferred type must extend `{ userId: string }` — if it does not
+* (e.g. `userId` is missing or not a required string), the argument type
+* collapses to `never` and the call fails to typecheck.
+* @example
+* export const identity = defineIdentity({ userId: v.string(), tenantId: v.optional(v.string()), scopes: v.optional(v.array(v.string())) });
+*/
+declare const defineIdentity: <A extends ValidatorMap>(claims: InferValidatorMap<A> extends {
+  userId: string;
+} ? A : never, options?: DefineIdentityOptions) => IdentityContract<InferValidatorMap<A> & {
+  userId: string;
+}>;
 /** Handler for a connection-lifecycle hook. */
 type LifecycleHandler = (context: MutationCtx, event: LifecycleEvent) => Promise<void> | void;
 /** Register a hook that fires once when a client's WebSocket connects. */
@@ -858,6 +971,55 @@ interface RegisteredMigration extends MigrationDefinition {
 /** Declare an online data migration. See the module docs for runtime semantics. */
 declare const defineMigration: (definition: MigrationDefinition) => RegisteredMigration;
 /**
+* A mutator declaration. `server` is authoritative; `client` is the optimistic
+* twin (optional — omit it to let the optimistic write fall through to the
+* server round-trip with no local preview). Both receive the same validated
+* `args`.
+*/
+interface MutatorDefinition<Args extends ValidatorMap = ValidatorMap, ServerContext = MutationCtx, ClientTx = unknown, R = unknown> {
+  /**
+  * Validator for the mutator's arguments. Validated on the DO before `server`
+  * runs and (when present) on the client before `client` runs, so both impls
+  * see the same parsed shape. Omit for a parameterless mutator.
+  */
+  readonly args?: Args;
+  /**
+  * Optimistic client implementation. Runs in a TanStack DB transaction
+  * against the local collections; its writes are applied immediately and
+  * automatically rolled back / rebased as the authoritative result syncs
+  * back. Pure and side-effect-free beyond the local store. Omit to skip the
+  * local preview.
+  */
+  readonly client?: (tx: ClientTx, args: InferValidatorMap<Args>) => Promise<void> | void;
+  /**
+  * Authoritative server implementation. Runs inside the shard DO with a full
+  * {@link MutationContext} (`ctx.db` writer); its writes append to `__cdc_log`
+  * and poke back to subscribers. This is the source of truth — the client
+  * impl is only a prediction of it.
+  */
+  readonly server: (context: ServerContext, args: InferValidatorMap<Args>) => Promise<R> | R;
+}
+/**
+* A {@link MutatorDefinition} plus the codegen discovery marker and a
+* dispatch-shaped `handler` (validates `args`, then runs `server`) so the DO
+* invokes a mutator exactly like a registered procedure.
+*/
+interface RegisteredMutator<Args extends ValidatorMap = ValidatorMap, ServerContext = MutationCtx, ClientTx = unknown, R = unknown> extends MutatorDefinition<Args, ServerContext, ClientTx, R> {
+  readonly __lunoraMutator: true;
+  /** Validate `rawArgs`, then run the authoritative `server` impl. Used by the DO push path. */
+  readonly handler: (context: ServerContext, rawArgs: Record<string, unknown>) => Promise<R>;
+  /**
+  * Marks the dispatch kind so codegen can register the mutator in the same
+  * `LUNORA_FUNCTIONS` table queries/mutations use — the DO's `handleRpc`
+  * reads `kind === "mutation"` to wrap the authoritative `server` impl in the
+  * shard's BEGIN/COMMIT span (all-or-nothing writes), exactly like an
+  * ordinary `mutation`.
+  */
+  readonly kind: "mutation";
+}
+/** Declare a custom mutator. See the module docs for runtime semantics. */
+declare const defineMutator: <Args extends ValidatorMap = ValidatorMap, ServerContext = MutationCtx, ClientTx = unknown, R = unknown>(definition: MutatorDefinition<Args, ServerContext, ClientTx, R>) => RegisteredMutator<Args, ServerContext, ClientTx, R>;
+/**
 * The prefixed tables a single plugin `P` contributes, or an empty map when it
 * ships no schema extension. Mirrors {@link PrefixedTables} at the plugin level
 * so {@link InstalledTables} can fold a tuple of plugins.
@@ -1168,6 +1330,35 @@ interface TableBuilder<Shape extends Record<string, Validator> = Record<string,
   }) => TableBuilder<Shape>;
   /** Route storage by the named field — one DO per distinct value. */
   shardBy: (field: keyof Shape & string) => TableBuilder<Shape>;
+  /**
+  * Turn on soft delete. Adds a nullable timestamp column (`options.field`,
+  * default `deletedAt`) and changes `ctx.db.&lt;table>.delete()` to **set** it
+  * instead of removing the row; `onDelete: "cascade"` children are recursively
+  * soft-deleted too. **List reads** (`findMany`/`findFirst`/`query()`/`count`/
+  * `aggregate`/relation loads) then hide soft-deleted rows unless they pass
+  * `includeDeleted: true`; by-id `get`/`patch`/`replace` and the new
+  * `restore()` still address the row directly. `hardDelete()` physically
+  * removes it (cascading as a real delete). Note: `includeDeleted` is a read
+  * scope, not access control — anyone who can run the read can set it; a unique
+  * index still rejects a new row that collides with a soft-deleted one (the row
+  * physically persists).
+  */
+  softDelete: (options?: {
+    field?: string;
+  }) => TableBuilder<Shape>;
+  /**
+  * Materialize this table from an external Postgres/MySQL behind Cloudflare
+  * Hyperdrive (plan 077). A system-driven poll loop reads the tenant slice
+  * (`query`, with params bound from `tenantBy`) and lands it in the DO's SQLite,
+  * after which `defineShape` carries it to clients unchanged. Implies
+  * `.externallyManaged()` (rows come from the ingest loop, not user mutations).
+  *
+  * Orthogonal to `.shardBy()` — combine them for per-tenant DOs. **Under
+  * `.shardBy()` `tenantBy` is mandatory** (the tenant-isolation boundary); the
+  * `external_source_unscoped` advisor lint fails the build when it is absent, and
+  * `external_source_on_global` rejects combining `.source()` with `.global()`.
+  */
+  source: (definition: ExternalSourceDefinition) => TableBuilder<Shape>;
   /** Declare named lifecycle triggers fired inline within the write path. */
   triggers: (build: (t: TriggerBuilder<Shape>) => Record<string, TriggerDefinition>) => TableBuilder<Shape>;
   /** Declare a vector index over a single text field on this table. */
@@ -1190,7 +1381,7 @@ interface VectorIndexOptions {
 * Build a table definition. Returned object is both the table definition (for
 * `defineSchema`) and a fluent builder for indexes + sharding metadata.
 */
-declare const defineTable: <Shape extends Record<string, Validator>>(shape: Shape) => TableBuilder<Shape>;
+declare const defineTable: <Shape extends Record<string, Validator>>(inputShape: Shape) => TableBuilder<Shape>;
 /**
 * Declare a standalone vector index (DSL Shape B). Pass the returned value in
 * the `vectorIndexes` map of {@link defineSchema} when the source is derived
@@ -1262,6 +1453,28 @@ type ExtendableSchema<T extends Record<string, TableDefinition>> = {
     readonly key: Key;
   }) => ExtendableSchema<PrefixedTables<X, Key> & T>;
   /**
+  * Pin every Durable Object the app reaches — shards, fan-out, subscriptions,
+  * the scheduler, and `ctx.containers` — to a Cloudflare data-residency
+  * jurisdiction (`"eu"`, `"us"`, `"fedramp"`). Codegen reads this off the
+  * schema and emits it into the generated worker's `createWorker({ jurisdiction })`
+  * (and `ctx.scheduler` / `ctx.containers`). Non-mutating: returns a fresh
+  * `ExtendableSchema`, so it composes with `.rls(...)` / `.extend(...)` in any order.
+  *
+  * ⚠️ **Set this once, before your first deploy — changing or removing it
+  * strands data.** A Durable Object name maps to a *different* ID in each
+  * jurisdiction, so toggling this on an existing app makes every shard, scheduler
+  * job, and session DO resolve to a NEW, empty DO; the previous data stays in the
+  * old jurisdiction's DOs and is no longer reachable. There is no in-place
+  * migration — you would have to export from the old jurisdiction and import
+  * into the new one.
+  *
+  * Note: this pins **DO-backed** state only. D1-backed state — `.global()`
+  * tables and `@lunora/auth` sessions alike — is governed by D1's own location
+  * settings, not this option.
+  * @see https://developers.cloudflare.com/durable-objects/reference/data-location/
+  */
+  jurisdiction: (jurisdiction: DurableObjectJurisdiction) => ExtendableSchema<T>;
+  /**
   * Turn on secure-by-default RLS for the whole schema. Every table is then
   * protected — the DO/D1 write path denies raw, non-RLS `ctx.db` access, so a
   * procedure that forgets `.use(rls(...))` fails closed. Opt a table out with
@@ -1433,7 +1646,7 @@ declare const definePolicy: <Context = unknown>(input: DefinePolicyInput<Context
 * the compile-time surface narrows, so a policy authored either way is
 * discovered identically by the `rls()` chain.
 */
-declare const createPolicyDsl: <DM, REL extends Record<keyof DM, object>>() => <T extends keyof DM, Context = unknown>(input: TypedDefinePolicyInput<DM, REL, T, Context>) => Policy<Context>;
+declare const createPolicyDsl: <DM, REL extends Record<keyof DM, object>, Identity = Record<string, unknown>>() => <T extends keyof DM, Context = unknown>(input: TypedDefinePolicyInput<DM, REL, T, Context, Identity>) => Policy<Context>;
 /**
 * Declare a named permission a policy can check with `ctx.auth.can(...)`. Grant
 * it to a role through `defineRole`'s `permissions`, register those roles with
@@ -1562,7 +1775,9 @@ interface DatabaseWriterLike {
   */
   aggregate: (tableName: string, options: AggregateArgs) => Promise<null | number>;
   count: (tableName: string, whereOrArgs?: CountArgs | WhereInput) => Promise<number>;
-  delete: (id: string, expectedTable?: string) => Promise<void>;
+  delete: (id: string, expectedTable?: string, options?: {
+    hard?: boolean;
+  }) => Promise<void>;
   deleteMany: (ids: ReadonlyArray<string>, options?: {
     limit?: number;
   }, expectedTable?: string) => Promise<{
@@ -1633,6 +1848,7 @@ interface DatabaseWriterLike {
   */
   rankPage: (tableName: string, indexName: string, options?: RankPageArgs) => Promise<QueryPage>;
   replace: (id: string, document: Record<string, unknown>, expectedTable?: string) => Promise<void>;
+  restore?: (id: string, expectedTable?: string) => Promise<void>;
 }
 /**
 * What a procedure's `ctx.db` must structurally satisfy for the middleware
@@ -1656,6 +1872,104 @@ interface RlsContextIn {
 }
 declare const rls: <Context extends RlsContextIn = RlsContextIn>(policies: ReadonlyArray<Policy<Context>>, options?: RlsOptions) => Middleware<Context, Context>;
 /**
+* One `rls()` tag's read policies for a table, paired with the role→permission
+* grants of that SAME middleware. Keeping the role map per-group is what lets a
+* policy's `auth.can(...)` resolve against its own middleware's roles — never a
+* permission registered on a different `rls()` step.
+*/
+interface ScopedReadPolicies {
+  readonly policies: ReadonlyArray<Policy>;
+  readonly rolePermissions: ReadonlyMap<string, ReadonlySet<string>>;
+}
+/** Table-indexed read-policy groups, each scoped to the roles of the rls() middleware that declared it. */
+interface RlsReadRegistry {
+  readonly byTable: ReadonlyMap<string, ReadonlyArray<ScopedReadPolicies>>;
+}
+/** The trusted, server-resolved facts a shape's RLS evaluation runs under. */
+interface ShapeReadWhereRequest {
+  /** The shape ctx (the procedure context a policy `when` reads as `ctx`). */
+  readonly ctx: unknown;
+  /** Resolved identity claims (the socket's verified identity), or `null` when anonymous. */
+  readonly identity: Record<string, unknown> | null;
+  /** `true` when the schema is `.rls("required")` — gates the fail-closed branch. */
+  readonly rlsRequired: boolean;
+  /** Role labels the request carries (drives `auth.can(...)`). */
+  readonly roles: ReadonlyArray<string>;
+  /** The shape's own predicate (`where(ctx, args)`). */
+  readonly shapeWhere: WhereInput;
+  /** Logical table the shape replicates. */
+  readonly table: string;
+  /** `true` when the table is `.public()` (exempt from `.rls("required")` denial). */
+  readonly tablePublic: boolean;
+  /** Verified user id, or `null` when anonymous. */
+  readonly userId: null | string;
+}
+/**
+* Build the read-policy registry from the registered functions (pass
+* `Object.values(LUNORA_FUNCTIONS)`). Only `on: "read"` policies are collected,
+* grouped per `rls()` middleware so each group keeps its own role→permission map
+* (a `(table, when)` pair is de-duplicated within a tag). A tag reused across
+* several procedures (a shared `const guard = rls(...)`) is folded once. This
+* mirrors the request-time `rls()` path exactly: a policy's `auth.can(...)`
+* resolves against the roles of the middleware that declared it, never a union.
+*/
+declare const buildRlsReadRegistry: (functions: Iterable<unknown>) => RlsReadRegistry;
+/**
+* Compute the effective `where` a shape replicates: the table's RLS read
+* base-where AND the shape's own predicate. Returns the shape predicate
+* unchanged for a table with no read policy (a `.public()` or non-RLS table),
+* and the FALSE sentinel (replicate nothing) when a `.rls("required")` schema
+* exposes a protected, policy-less table.
+*/
+declare const composeShapeReadWhere: (registry: RlsReadRegistry, request: ShapeReadWhereRequest) => WhereInput;
+/**
+* A shape declaration. `where` receives the trusted procedure context and the
+* validated client args and returns the same {@link WhereInput} shape the RLS
+* DSL uses, so the DO can AND-merge it with the table's read base-where via the
+* existing where-compiler (zero second predicate implementation).
+*/
+interface ShapeDefinition<Args extends ValidatorMap = ValidatorMap, Context = QueryCtx> {
+  /**
+  * Validator for the client-supplied shape parameters. Validated on the DO
+  * before `where` runs, so a malformed `args` envelope is rejected at the
+  * subscription boundary rather than silently widening the partition. Omit
+  * for a parameterless shape.
+  */
+  readonly args?: Args;
+  /**
+  * Project the replicated rows to these columns (the system columns `_id` and
+  * `_creationTime` are always included). Omit to replicate every column. An
+  * empty array is rejected — it would replicate no data, which is never the
+  * intent.
+  */
+  readonly columns?: ReadonlyArray<string>;
+  /** Logical table this shape replicates a partition of. */
+  readonly table: string;
+  /**
+  * Predicate selecting the rows this shape replicates. AND-composed with the
+  * table's RLS read base-where on the DO. Runs server-side with a trusted
+  * `ctx` (identity/auth the client can't forge) and the validated client
+  * `args`; returns a {@link WhereInput} using the same operator set as the
+  * SQL compiler (`eq`/`in`/`lt`/… + `AND`/`OR`/`NOT`).
+  */
+  readonly where: (context: Context, args: InferValidatorMap<Args>) => WhereInput;
+}
+/** A {@link ShapeDefinition} plus the codegen discovery marker and a dispatch-shaped `compileWhere`. */
+interface RegisteredShape<Args extends ValidatorMap = ValidatorMap, Context = QueryCtx> extends ShapeDefinition<Args, Context> {
+  readonly __lunoraShape: true;
+  /**
+  * Validate `rawArgs`, then evaluate `where` under the trusted `ctx` and
+  * return its {@link WhereInput}. Used by the generated DO's `resolveShape`
+  * override: `ctx` is erased to `unknown` at this dispatch boundary (the DO
+  * builds it from the socket's verified identity and hands it back as the
+  * concrete {@link QueryContext} the predicate expects), exactly like
+  * `RegisteredLunoraFunction.handler` erases its context.
+  */
+  readonly compileWhere: (context: unknown, rawArgs: Record<string, unknown>) => WhereInput;
+}
+/** Declare a replication shape. See the module docs for runtime semantics. */
+declare const defineShape: <Args extends ValidatorMap = ValidatorMap, Context = QueryCtx>(definition: ShapeDefinition<Args, Context>) => RegisteredShape<Args, Context>;
+/**
 * Operations a storage rule can gate. `read` covers `download` / `getMetadata`
 * / `getSignedUrl` / `getUrl`; `write` covers `store` / `generateUploadUrl`;
 * `delete` is `delete`; `list` is a prefix listing (governed via the file
@@ -1738,4 +2052,4 @@ interface StorageContextIn {
 }
 declare const storageRules: <Context extends StorageContextIn = StorageContextIn>(rules: ReadonlyArray<StorageRule<Context>>, options?: StorageRulesOptions) => Middleware<Context, Context>;
 declare const VERSION = "0.0.0";
-export { type ActionBuilder, type ActionCtx, type AggregateIndexDefinition, type AggregateIndexOptions, type AggregateOp, type ArgsValidator, type Component, type ComponentFunctions, type CreateOptions, type DataModelInit, type DefineComponentOptions, type DefinePluginOptions, type DefinePolicyInput, type DefinePresenceOptions, type DefineStorageRuleInput, type EmptyArgs, type EnvAccessor, type EnvKeyFailure, type EnvShape, type ExtendableSchema, type FacadeEntry, type FacadeWriterLike, type FunctionKind, type HttpActionCtx, type HttpActionHandler, type HttpMethod, type HttpRoute, type HttpRouteBuilder, type HttpRouteFactory, type HttpRouteHandlerOptions, type HttpStreamHandlerOptions, type InferArgs, type InferEnv, type InlineAggregateIndexOptions, type InlineRankIndexOptions, type InternalActionBuilder, type InternalMutationBuilder, type InternalQueryBuilder, type LifecycleEvent, type LifecycleHandler, type LunoraBuilders, LunoraEnvError, LunoraError, type LunoraErrorCode, type LunoraHttpApp, type LunoraHttpEnv, type LunoraRouteHandler, type ManyRelation, type MaskColumns, type MaskContext, type MaskFn, type MaskOptions, type MaskPolicies, type MaskStrategy, type Middleware, type MiddlewareNext, type MigrationDefinition, type MigrationDocument, type MigrationTransform, type MutationBuilder, type MutationCtx, type OnDeleteAction, type OneRelation, type OrmLike, DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, type Permission, type Plugin, type Policy, type PrefixedTables, type PresenceComponent, type PresenceFunctions, type PresenceMember, type ProtectPublicOptions, type QueryBuilder, type QueryCtx, type RankIndexDefinition, type RankIndexOptions, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMigration, type RegisteredMutation, type RegisteredQuery, type RegisteredStream, type RelationBuilder, type RelationDefinition, type RlsOptions, type Role, type Schema, type SchemaExtension, type StorageOperation, type StorageRule, type StorageRuleContext, type StorageRuleDecision, type StorageRulesOptions, type TableBuilder, type TableDefinition, type TerminalKind, type TriggerBuilder, type TriggerDefinition, type TypedDefinePolicyInput, VERSION, type VectorEmbedder, type VectorIndexDefinition, type VectorIndexOptions, type VectorMetric, type VectorizeOptions, type WhereInput, asBucketStorage, bindOrm, bindTableFacade, composePluginMiddleware, createPolicyDsl, defineAggregateIndex, defineComponent, defineEnv, defineMigration, definePermission, definePlugin, definePolicies, definePolicy, definePresence, defineRankIndex, defineRole, defineSchema, defineSchemaExtension, defineStorageRule, defineStorageRules, defineTable, defineVectorIndex, httpAction, httpRoute, httpRouter, initLunora, installPlugins, mask, mergeSchemaExtension, onConnect, onDisconnect, presenceExtension, protectPublic, redactSecrets, rls, serveStorageObject, storageRules };
+export { type ActionBuilder, type ActionCtx, type AggregateIndexDefinition, type AggregateIndexOptions, type AggregateOp, type ArgsValidator, type Component, type ComponentFunctions, type CreateOptions, type DataModelInit, type DefineComponentOptions, type DefineIdentityOptions, type DefinePluginOptions, type DefinePolicyInput, type DefinePresenceOptions, type DefineStorageRuleInput, type DurableObjectJurisdiction, type EmptyArgs, type EnvAccessor, type EnvKeyFailure, type EnvShape, type ExtendableSchema, type FacadeEntry, type FacadeWriterLike, type FunctionKind, type HttpActionCtx, type HttpActionHandler, type HttpMethod, type HttpRoute, type HttpRouteBuilder, type HttpRouteFactory, type HttpRouteHandlerOptions, type HttpStreamHandlerOptions, type IdentityContract, type IdentityRejectMode, type IdentityValidation, type InferArgs, type InferEnv, type InferIdentity, type InlineAggregateIndexOptions, type InlineRankIndexOptions, type InternalActionBuilder, type InternalMutationBuilder, type InternalQueryBuilder, type LifecycleEvent, type LifecycleHandler, type LunoraBuilders, LunoraEnvError, LunoraError, type LunoraErrorCode, type LunoraHttpApp, type LunoraHttpEnv, type LunoraRouteHandler, type ManyRelation, type MaskColumns, type MaskContext, type MaskFn, type MaskOptions, type MaskPolicies, type MaskStrategy, type Middleware, type MiddlewareNext, type MigrationDefinition, type MigrationDocument, type MigrationTransform, type MutationBuilder, type MutationCtx, type MutatorDefinition, type OnDeleteAction, type OneRelation, type OrmLike, DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, type Permission, type Plugin, type Policy, type PrefixedTables, type PresenceComponent, type PresenceFunctions, type PresenceMember, type ProtectPublicOptions, type QueryBuilder, type QueryCtx, type RankIndexDefinition, type RankIndexOptions, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMigration, type RegisteredMutation, type RegisteredMutator, type RegisteredQuery, type RegisteredShape, type RegisteredStream, type RelationBuilder, type RelationDefinition, type RlsOptions, type RlsReadRegistry, type Role, type Schema, type SchemaExtension, type ShapeDefinition, type ShapeReadWhereRequest, type StorageOperation, type StorageRule, type StorageRuleContext, type StorageRuleDecision, type StorageRulesOptions, type TableBuilder, type TableDefinition, type TerminalKind, type TriggerBuilder, type TriggerDefinition, type TypedDefinePolicyInput, VERSION, type VectorEmbedder, type VectorIndexDefinition, type VectorIndexOptions, type VectorMetric, type VectorizeOptions, type WhereInput, asBucketStorage, bindOrm, bindTableFacade, buildRlsReadRegistry, composePluginMiddleware, composeShapeReadWhere, createPolicyDsl, createSecrets, defineAggregateIndex, defineComponent, defineEnv, defineIdentity, defineMigration, defineMutator, definePermission, definePlugin, definePolicies, definePolicy, definePresence, defineRankIndex, defineRole, defineSchema, defineSchemaExtension, defineShape, defineStorageRule, defineStorageRules, defineTable, defineVectorIndex, httpAction, httpRoute, httpRouter, initLunora, installPlugins, mask, mergeSchemaExtension, onConnect, onDisconnect, presenceExtension, protectPublic, redactSecrets, rls, serveStorageObject, storageRules };

package/dist/index.mjs

@@ -1,23 +1,28 @@
 export { default as asBucketStorage } from './packem_shared/asBucketStorage-Cnxd9y2q.mjs';
-export { initLunora } from './packem_shared/initLunora-CATvPsVt.mjs';
-export { LunoraEnvError, defineEnv, redactSecrets } from './packem_shared/defineEnv-DjFkpkSP.mjs';
-export { LunoraError } from './packem_shared/LunoraError-DhggBJZF.mjs';
-export { bindOrm, bindTableFacade } from './packem_shared/bindTableFacade-DCuyr46L.mjs';
-export { httpAction, httpRoute, httpRouter, serveStorageObject } from './packem_shared/httpAction-B7FYUEgr.mjs';
+export { initLunora } from './packem_shared/initLunora-lxwHTEV3.mjs';
+export { createSecrets } from './packem_shared/createSecrets-TsIP9lOa.mjs';
+export { LunoraEnvError, defineEnv, redactSecrets } from './packem_shared/LunoraEnvError-DjFkpkSP.mjs';
+export { LunoraError } from './packem_shared/LunoraError-DN7Zhhvu.mjs';
+export { bindOrm, bindTableFacade } from './packem_shared/bindOrm-Ce57S3N9.mjs';
+export { httpAction, httpRoute, httpRouter, serveStorageObject } from './packem_shared/httpAction-FLwfsePg.mjs';
+export { defineIdentity } from './packem_shared/defineIdentity-B_9YD46A.mjs';
 export { onConnect, onDisconnect } from './packem_shared/onConnect-CIPXKPyw.mjs';
 export { defineMigration } from './packem_shared/defineMigration-CAJLr6fx.mjs';
-export { composePluginMiddleware, defineComponent, definePlugin, defineSchemaExtension, installPlugins, mergeSchemaExtension } from './packem_shared/defineSchemaExtension-Ck5_TUO8.mjs';
-export { PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, definePresence, presenceExtension } from './packem_shared/definePresence-D5LtwGl0.mjs';
+export { defineMutator } from './packem_shared/defineMutator-EIXAWhs9.mjs';
+export { composePluginMiddleware, defineComponent, definePlugin, defineSchemaExtension, installPlugins, mergeSchemaExtension } from './packem_shared/composePluginMiddleware-Ck5_TUO8.mjs';
+export { PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, definePresence, presenceExtension } from './packem_shared/PRESENCE_DEFAULT_TTL_MS-D8viLY1S.mjs';
 export { protectPublic } from './packem_shared/protectPublic-BjFkQ_Or.mjs';
-export { defineAggregateIndex, defineRankIndex, defineSchema, defineTable, defineVectorIndex } from './packem_shared/defineAggregateIndex-DzqxtAyV.mjs';
+export { defineAggregateIndex, defineRankIndex, defineSchema, defineTable, defineVectorIndex } from './packem_shared/defineAggregateIndex-ZdyU78gh.mjs';
+export { defineShape } from './packem_shared/defineShape-CJ27Wx7o.mjs';
 export { anyApi } from './types.mjs';
 export { cronJobs } from '@lunora/scheduler';
 export { ValidationError, v } from '@lunora/values';
-export { createPolicyDsl, definePermission, definePolicies, definePolicy, defineRole } from './packem_shared/definePolicy-De67zPDS.mjs';
+export { buildRlsReadRegistry, composeShapeReadWhere } from './packem_shared/buildRlsReadRegistry-1jexWrb3.mjs';
+export { createPolicyDsl, definePermission, definePolicies, definePolicy, defineRole } from './packem_shared/createPolicyDsl-De67zPDS.mjs';
 export { defineStorageRule, defineStorageRules } from './packem_shared/defineStorageRule-qu0mpilX.mjs';
-export { mask } from './packem_shared/mask-CkZJHHMM.mjs';
-export { rls } from './packem_shared/rls-Zhf5wEeJ.mjs';
-export { storageRules } from './packem_shared/storageRules-4a30FSpI.mjs';
+export { mask } from './packem_shared/mask-BV_jNzsN.mjs';
+export { rls } from './packem_shared/rls-2Jhd0uev.mjs';
+export { storageRules } from './packem_shared/storageRules-Cje6Woea.mjs';
 
 const VERSION = "0.0.0";
 

package/dist/packem_shared/{LunoraError-DhggBJZF.mjs → LunoraError-DN7Zhhvu.mjs}

@@ -41,10 +41,13 @@ class LunoraError extends Error {
   name = "LunoraError";
   code;
   status;
-  constructor(code, message) {
+  /** Structured, JSON+wire-encodable payload surfaced to the client alongside `code`. */
+  data;
+  constructor(code, message, data) {
     super(message ?? code);
     this.code = code;
     this.status = CODE_STATUS[code];
+    this.data = data;
   }
 }
 

package/dist/packem_shared/{definePresence-D5LtwGl0.mjs → PRESENCE_DEFAULT_TTL_MS-D8viLY1S.mjs}

@@ -1,9 +1,9 @@
 import { v } from '@lunora/values';
-import { initLunora } from './initLunora-CATvPsVt.mjs';
-import { LunoraError } from './LunoraError-DhggBJZF.mjs';
+import { initLunora } from './initLunora-lxwHTEV3.mjs';
+import { LunoraError } from './LunoraError-DN7Zhhvu.mjs';
 import { onDisconnect } from './onConnect-CIPXKPyw.mjs';
-import { defineSchemaExtension, defineComponent } from './defineSchemaExtension-Ck5_TUO8.mjs';
-import { defineTable } from './defineAggregateIndex-DzqxtAyV.mjs';
+import { defineSchemaExtension, defineComponent } from './composePluginMiddleware-Ck5_TUO8.mjs';
+import { defineTable } from './defineAggregateIndex-ZdyU78gh.mjs';
 
 const DEFAULT_TTL_MS = 3e4;
 const MAX_DATA_BYTES = 4096;