@lunora/server 1.0.0-alpha.1 → 1.0.0-alpha.11

package/dist/types.d.mts

@@ -5,6 +5,14 @@ type ArgsValidator = ValidatorMap;
 type InferArgs<A extends ArgsValidator> = InferValidatorMap<A>;
 /** Storage backend for a `.global()` table: D1 (default) or a Postgres/MySQL database via Cloudflare Hyperdrive (PlanetScale, Neon, …). */
 type GlobalBackend = "d1" | "hyperdrive";
+/**
+* Cloudflare Durable Object data-residency jurisdiction declared via
+* `defineSchema(...).jurisdiction("…")`. Restricts where every DO the app
+* reaches runs and persists data (GDPR, FedRAMP, US data residency). Widening
+* union — Cloudflare adds values over time.
+* @see https://developers.cloudflare.com/durable-objects/reference/data-location/
+*/
+type DurableObjectJurisdiction = "eu" | "fedramp" | "us";
 /** How a table is routed at runtime. */
 type ShardMode = {
   backend?: GlobalBackend;
@@ -15,6 +23,51 @@ type ShardMode = {
 } | {
   kind: "root";
 };
+/** Poll cadence for a sourced table — `"manual"` (pull only on an explicit trigger) or a fixed interval. */
+type ExternalSourceRefresh = "manual" | {
+  everyMs: number;
+};
+/**
+* Delete-detection mode for external-source ingest. `"full-pull"` (default) reads
+* the whole tenant membership each tick and diffs it, so it observes upstream
+* deletes; `"incremental"` pulls only changed rows (cheap) and is blind to deletes
+* unless paired with a soft-delete column or a `reconcileEveryMs` full-pull sweep.
+*/
+type ExternalSourceMode = "full-pull" | "incremental";
+/**
+* Config for `.source(...)` (plan 077): declares a table as **materialized from an
+* external Postgres/MySQL behind Cloudflare Hyperdrive**, not written by user
+* mutations. A system-driven poll loop reads the tenant slice and lands it in the
+* DO's SQLite (via the validated CDC writer), after which `defineShape` carries it
+* to clients unchanged. Orthogonal to `shardMode` — a sourced table almost always
+* also `.shardBy()`s, in which case `tenantBy` is the mandatory tenant-isolation
+* boundary (enforced by the `external_source_unscoped` advisor lint).
+*/
+interface ExternalSourceDefinition {
+  /** The wrangler Hyperdrive binding name the poll loop reads from. */
+  binding: string;
+  /** Project the materialized rows to these columns (passed to the membership diff). Omit ⇒ the full mapped document. */
+  columns?: ReadonlyArray<string>;
+  /** Column whose value becomes the Lunora `_id`. Defaults to `"id"`. */
+  idColumn?: string;
+  /** Transform an external row into the stored document body. Omit ⇒ every selected column except `idColumn` is copied. */
+  map?: (row: Record<string, unknown>) => Record<string, unknown>;
+  /** Delete-detection mode. Defaults to `"full-pull"`. */
+  mode?: ExternalSourceMode;
+  /** The full tenant-membership query, with driver-native placeholders (`$1` / `?`). `tenantBy` binds its params. */
+  query: string;
+  /** `"incremental"` only: run a full-pull reconcile this often to garbage-collect tombstones the incremental path can't see. */
+  reconcileEveryMs?: number;
+  /** Poll cadence, or `"manual"`. Omit ⇒ the runtime's size-scaled default. */
+  refresh?: ExternalSourceRefresh;
+  /**
+  * **Mandatory under `.shardBy()`**: map this DO's shard key → the query's bound
+  * params, so a tenant DO can only ever pull its own rows. An unscoped sourced +
+  * sharded table replicates the whole multitenant table into every shard — the
+  * `external_source_unscoped` advisor lint fails the build when this is absent.
+  */
+  tenantBy?: (shardKey: string) => ReadonlyArray<unknown>;
+}
 interface IndexDefinition {
   fields: ReadonlyArray<string>;
   name: string;
@@ -130,6 +183,14 @@ interface TableDefinition<Shape extends Record<string, Validator> = Record<strin
   * without scanning the underlying table.
   */
   aggregateIndexes: ReadonlyArray<AggregateIndexDefinition>;
+  /**
+  * Set by `.source(...)` (named `externalSource`, not `source`, so the data
+  * field doesn't collide with the fluent `.source()` builder method — same
+  * convention as `shardBy()`/`shardMode`). When present, the table is
+  * materialized from an external Hyperdrive-backed database by a system poll
+  * loop rather than user mutations. Implies `isExternallyManaged`.
+  */
+  externalSource?: ExternalSourceDefinition;
   indexes: ReadonlyArray<IndexDefinition>;
   /**
   * `true` when `.externallyManaged()` was called — the table's rows are
@@ -165,6 +226,20 @@ interface TableDefinition<Shape extends Record<string, Validator> = Record<strin
   shape: Shape;
   shardMode: ShardMode;
   /**
+  * Set by `.softDelete()` (named `softDeleteMode`, not `softDelete`, so the
+  * data field doesn't collide with the fluent `.softDelete()` builder method —
+  * same convention as `shardBy()`/`shardMode`). When present, the table carries
+  * a nullable timestamp column (`field`, default `deletedAt`):
+  * `ctx.db.&lt;table>.delete()` flips it instead of physically removing the row,
+  * and **list reads** (`findMany`/`findFirst`/`query()`/`count`/`aggregate`/
+  * relation loads) hide rows whose `field` is set unless
+  * `includeDeleted: true` is passed. By-id `get`/`patch`/`replace` and
+  * `restore` are unaffected. Absent ⇒ deletes are physical, as before.
+  */
+  softDeleteMode?: {
+    field: string;
+  };
+  /**
   * Declared lifecycle triggers keyed by accessor name; empty unless
   * `.triggers()` was called. Named `triggerMap` (not `triggers`) so the
   * fluent `.triggers((t) => …)` builder method doesn't collide with this
@@ -614,6 +689,31 @@ interface Workflows {
   /** Resolve the handle for a declared workflow by export name. */
   get: <Params = Record<string, unknown>>(name: string) => WorkflowHandle<Params>;
 }
+/**
+* Structural projection of workers-types' `SecretsStoreSecret` binding — the
+* per-secret `secrets_store_secrets[]` binding whose `.get()` resolves the
+* secret value (or throws if it does not exist). Mirrored structurally so the
+* runtime resolves it without a workerd type dependency.
+*/
+interface SecretsStoreSecretLike {
+  get: () => Promise<string>;
+}
+/**
+* `ctx.secrets` — read account-level secrets bound via Cloudflare Secrets Store.
+* A core built-in (always present on every context, like `ctx.log`): a binding
+* named in wrangler's `secrets_store_secrets[]` is read by its binding name.
+*
+* ```ts
+* const apiKey = await ctx.secrets.get("STRIPE_KEY");
+* ```
+*
+* The lookup is async (the platform fetches and decrypts on first read);
+* reading an undeclared name throws a directed error naming the bound secrets.
+*/
+interface Secrets {
+  /** Resolve a Secrets Store secret by its wrangler binding name. */
+  get: (name: string) => Promise<string>;
+}
 /** Lifecycle phase relative to the SQL write. */
 type TriggerTiming = "after" | "before";
 /** The CRUD operation a trigger reacts to. `patch` and `replace` both map to `update`. */
@@ -899,7 +999,7 @@ interface VectorRecord {
 }
 /**
 * Read-only vector surface exposed on {@link QueryCtx}. Mirrors the read half
-* of `@lunora/vectors`' `LunoraVectors` so the live adapter is assignable.
+* of `@lunora/bindings/vectors`' `LunoraVectors` so the live adapter is assignable.
 */
 interface VectorSearchReader {
   getByIds: (indexName: string, ids: ReadonlyArray<string>) => Promise<ReadonlyArray<VectorRecord>>;
@@ -953,6 +1053,14 @@ interface QueryCtx {
   /** Structured, function-attributed logger; see {@link LunoraLogger}. */
   readonly log: LunoraLogger;
   /**
+  * Wall-clock time (epoch ms) the function began, captured once so the whole
+  * handler sees a single stable value. Query/mutation handlers must be
+  * deterministic — they may be re-run on OCC retry / subscription re-eval — so
+  * read time through `ctx.now` instead of `Date.now()` (the latter is flagged
+  * by the `nondeterministic_query_mutation` advisor). Actions may use `Date.now()`.
+  */
+  readonly now: number;
+  /**
   * Compose a read-only subquery in-process, reusing this query's read
   * context (same transaction, same `db`). Executes the referenced query's
   * handler directly — no fresh DO RPC round-trip — so it observes the exact
@@ -961,6 +1069,8 @@ interface QueryCtx {
   * Mirrors Convex's `ctx.runQuery`.
   */
   readonly runQuery: <A extends ArgsValidator, R>(reference: RegisteredQuery<A, R>, args: InferArgs<A>) => Promise<R>;
+  /** Read account-level secrets from Cloudflare Secrets Store; see {@link Secrets}. */
+  readonly secrets: Secrets;
   readonly storage: ReadOnlyStorage;
   readonly vectors: VectorSearchReader;
 }
@@ -977,6 +1087,14 @@ interface MutationCtx {
   /** Structured, function-attributed logger; see {@link LunoraLogger}. */
   readonly log: LunoraLogger;
   /**
+  * Wall-clock time (epoch ms) the function began, captured once so the whole
+  * handler sees a single stable value. Mutation handlers must be deterministic
+  * — they may be re-run on OCC retry — so read time through `ctx.now` instead
+  * of `Date.now()` (the latter is flagged by the `nondeterministic_query_mutation`
+  * advisor). Actions may use `Date.now()`.
+  */
+  readonly now: number;
+  /**
   * Compose a submutation in-process, reusing this mutation's `db` writer.
   * Executes the referenced mutation's handler directly — no fresh DO RPC —
   * so its writes apply through the same shard invocation as the enclosing
@@ -993,6 +1111,8 @@ interface MutationCtx {
   */
   readonly runQuery: <A extends ArgsValidator, R>(reference: RegisteredQuery<A, R>, args: InferArgs<A>) => Promise<R>;
   readonly scheduler: Scheduler;
+  /** Read account-level secrets from Cloudflare Secrets Store; see {@link Secrets}. */
+  readonly secrets: Secrets;
   readonly storage: ReadOnlyStorage;
   readonly vectors: VectorSearch;
   /** Start / resume / inspect durable workflows; see {@link Workflows}. */
@@ -1011,10 +1131,18 @@ interface ActionCtx {
   readonly ip?: string;
   /** Structured, function-attributed logger; see {@link LunoraLogger}. */
   readonly log: LunoraLogger;
+  /**
+  * Wall-clock time (epoch ms) the action began, captured once for convenience
+  * and parity with query/mutation `ctx.now`. Actions run exactly once, so they
+  * may also use ambient `Date.now()` freely.
+  */
+  readonly now: number;
   readonly runAction: <A extends ArgsValidator, R>(reference: RegisteredAction<A, R>, args: InferArgs<A>) => Promise<R>;
   readonly runMutation: <A extends ArgsValidator, R>(reference: RegisteredMutation<A, R>, args: InferArgs<A>) => Promise<R>;
   readonly runQuery: <A extends ArgsValidator, R>(reference: RegisteredQuery<A, R>, args: InferArgs<A>) => Promise<R>;
   readonly scheduler: Scheduler;
+  /** Read account-level secrets from Cloudflare Secrets Store; see {@link Secrets}. */
+  readonly secrets: Secrets;
   readonly storage: Storage;
   readonly vectors: VectorSearch;
   /** Start / resume / inspect durable workflows; see {@link Workflows}. */
@@ -1026,4 +1154,4 @@ interface ActionCtx {
 */
 type AnyApi = Record<string, Record<string, RegisteredFunction<ArgsValidator, unknown, FunctionKind>>>;
 declare const anyApi: AnyApi;
-export { type ActionCtx, type AggregateIndexDefinition, type AggregateOp, type AnyApi, type ArgsValidator, type AuthState, type DatabaseReader, type DatabaseWriter, type FunctionKind, type FunctionVisibility, type GlobalBackend, type IndexDefinition, type IndexRangeBuilder, type InferArgs, type LifecycleEvent, type LifecycleEventKind, type LunoraLogger, type MutationCtx, type OnDeleteAction, type PaginationOptions, type PaginationResult, type QueryCtx, type RankIndexDefinition, type RankSortKey, type ReadOnlyStorage, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMutation, type RegisteredQuery, type RegisteredStream, type RelationDefinition, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type Schema, type SearchFilterBuilder, type SearchIndexDefinition, type ShardMode, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableDefinition, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerBuilder, type TriggerCtx, type TriggerDatabase, type TriggerDefinition, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type VectorEmbedder, type VectorIndexDefinition, type VectorMatch, type VectorMatches, type VectorMetric, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, anyApi };
+export { type ActionCtx, type AggregateIndexDefinition, type AggregateOp, type AnyApi, type ArgsValidator, type AuthState, type DatabaseReader, type DatabaseWriter, type DurableObjectJurisdiction, type ExternalSourceDefinition, type ExternalSourceMode, type ExternalSourceRefresh, type FunctionKind, type FunctionVisibility, type GlobalBackend, type IndexDefinition, type IndexRangeBuilder, type InferArgs, type LifecycleEvent, type LifecycleEventKind, type LunoraLogger, type MutationCtx, type OnDeleteAction, type PaginationOptions, type PaginationResult, type QueryCtx, type RankIndexDefinition, type RankSortKey, type ReadOnlyStorage, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMutation, type RegisteredQuery, type RegisteredStream, type RelationDefinition, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type Schema, type SearchFilterBuilder, type SearchIndexDefinition, type Secrets, type SecretsStoreSecretLike, type ShardMode, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableDefinition, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerBuilder, type TriggerCtx, type TriggerDatabase, type TriggerDefinition, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type VectorEmbedder, type VectorIndexDefinition, type VectorMatch, type VectorMatches, type VectorMetric, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, anyApi };

package/dist/types.d.ts

@@ -5,6 +5,14 @@ type ArgsValidator = ValidatorMap;
 type InferArgs<A extends ArgsValidator> = InferValidatorMap<A>;
 /** Storage backend for a `.global()` table: D1 (default) or a Postgres/MySQL database via Cloudflare Hyperdrive (PlanetScale, Neon, …). */
 type GlobalBackend = "d1" | "hyperdrive";
+/**
+* Cloudflare Durable Object data-residency jurisdiction declared via
+* `defineSchema(...).jurisdiction("…")`. Restricts where every DO the app
+* reaches runs and persists data (GDPR, FedRAMP, US data residency). Widening
+* union — Cloudflare adds values over time.
+* @see https://developers.cloudflare.com/durable-objects/reference/data-location/
+*/
+type DurableObjectJurisdiction = "eu" | "fedramp" | "us";
 /** How a table is routed at runtime. */
 type ShardMode = {
   backend?: GlobalBackend;
@@ -15,6 +23,51 @@ type ShardMode = {
 } | {
   kind: "root";
 };
+/** Poll cadence for a sourced table — `"manual"` (pull only on an explicit trigger) or a fixed interval. */
+type ExternalSourceRefresh = "manual" | {
+  everyMs: number;
+};
+/**
+* Delete-detection mode for external-source ingest. `"full-pull"` (default) reads
+* the whole tenant membership each tick and diffs it, so it observes upstream
+* deletes; `"incremental"` pulls only changed rows (cheap) and is blind to deletes
+* unless paired with a soft-delete column or a `reconcileEveryMs` full-pull sweep.
+*/
+type ExternalSourceMode = "full-pull" | "incremental";
+/**
+* Config for `.source(...)` (plan 077): declares a table as **materialized from an
+* external Postgres/MySQL behind Cloudflare Hyperdrive**, not written by user
+* mutations. A system-driven poll loop reads the tenant slice and lands it in the
+* DO's SQLite (via the validated CDC writer), after which `defineShape` carries it
+* to clients unchanged. Orthogonal to `shardMode` — a sourced table almost always
+* also `.shardBy()`s, in which case `tenantBy` is the mandatory tenant-isolation
+* boundary (enforced by the `external_source_unscoped` advisor lint).
+*/
+interface ExternalSourceDefinition {
+  /** The wrangler Hyperdrive binding name the poll loop reads from. */
+  binding: string;
+  /** Project the materialized rows to these columns (passed to the membership diff). Omit ⇒ the full mapped document. */
+  columns?: ReadonlyArray<string>;
+  /** Column whose value becomes the Lunora `_id`. Defaults to `"id"`. */
+  idColumn?: string;
+  /** Transform an external row into the stored document body. Omit ⇒ every selected column except `idColumn` is copied. */
+  map?: (row: Record<string, unknown>) => Record<string, unknown>;
+  /** Delete-detection mode. Defaults to `"full-pull"`. */
+  mode?: ExternalSourceMode;
+  /** The full tenant-membership query, with driver-native placeholders (`$1` / `?`). `tenantBy` binds its params. */
+  query: string;
+  /** `"incremental"` only: run a full-pull reconcile this often to garbage-collect tombstones the incremental path can't see. */
+  reconcileEveryMs?: number;
+  /** Poll cadence, or `"manual"`. Omit ⇒ the runtime's size-scaled default. */
+  refresh?: ExternalSourceRefresh;
+  /**
+  * **Mandatory under `.shardBy()`**: map this DO's shard key → the query's bound
+  * params, so a tenant DO can only ever pull its own rows. An unscoped sourced +
+  * sharded table replicates the whole multitenant table into every shard — the
+  * `external_source_unscoped` advisor lint fails the build when this is absent.
+  */
+  tenantBy?: (shardKey: string) => ReadonlyArray<unknown>;
+}
 interface IndexDefinition {
   fields: ReadonlyArray<string>;
   name: string;
@@ -130,6 +183,14 @@ interface TableDefinition<Shape extends Record<string, Validator> = Record<strin
   * without scanning the underlying table.
   */
   aggregateIndexes: ReadonlyArray<AggregateIndexDefinition>;
+  /**
+  * Set by `.source(...)` (named `externalSource`, not `source`, so the data
+  * field doesn't collide with the fluent `.source()` builder method — same
+  * convention as `shardBy()`/`shardMode`). When present, the table is
+  * materialized from an external Hyperdrive-backed database by a system poll
+  * loop rather than user mutations. Implies `isExternallyManaged`.
+  */
+  externalSource?: ExternalSourceDefinition;
   indexes: ReadonlyArray<IndexDefinition>;
   /**
   * `true` when `.externallyManaged()` was called — the table's rows are
@@ -165,6 +226,20 @@ interface TableDefinition<Shape extends Record<string, Validator> = Record<strin
   shape: Shape;
   shardMode: ShardMode;
   /**
+  * Set by `.softDelete()` (named `softDeleteMode`, not `softDelete`, so the
+  * data field doesn't collide with the fluent `.softDelete()` builder method —
+  * same convention as `shardBy()`/`shardMode`). When present, the table carries
+  * a nullable timestamp column (`field`, default `deletedAt`):
+  * `ctx.db.&lt;table>.delete()` flips it instead of physically removing the row,
+  * and **list reads** (`findMany`/`findFirst`/`query()`/`count`/`aggregate`/
+  * relation loads) hide rows whose `field` is set unless
+  * `includeDeleted: true` is passed. By-id `get`/`patch`/`replace` and
+  * `restore` are unaffected. Absent ⇒ deletes are physical, as before.
+  */
+  softDeleteMode?: {
+    field: string;
+  };
+  /**
   * Declared lifecycle triggers keyed by accessor name; empty unless
   * `.triggers()` was called. Named `triggerMap` (not `triggers`) so the
   * fluent `.triggers((t) => …)` builder method doesn't collide with this
@@ -614,6 +689,31 @@ interface Workflows {
   /** Resolve the handle for a declared workflow by export name. */
   get: <Params = Record<string, unknown>>(name: string) => WorkflowHandle<Params>;
 }
+/**
+* Structural projection of workers-types' `SecretsStoreSecret` binding — the
+* per-secret `secrets_store_secrets[]` binding whose `.get()` resolves the
+* secret value (or throws if it does not exist). Mirrored structurally so the
+* runtime resolves it without a workerd type dependency.
+*/
+interface SecretsStoreSecretLike {
+  get: () => Promise<string>;
+}
+/**
+* `ctx.secrets` — read account-level secrets bound via Cloudflare Secrets Store.
+* A core built-in (always present on every context, like `ctx.log`): a binding
+* named in wrangler's `secrets_store_secrets[]` is read by its binding name.
+*
+* ```ts
+* const apiKey = await ctx.secrets.get("STRIPE_KEY");
+* ```
+*
+* The lookup is async (the platform fetches and decrypts on first read);
+* reading an undeclared name throws a directed error naming the bound secrets.
+*/
+interface Secrets {
+  /** Resolve a Secrets Store secret by its wrangler binding name. */
+  get: (name: string) => Promise<string>;
+}
 /** Lifecycle phase relative to the SQL write. */
 type TriggerTiming = "after" | "before";
 /** The CRUD operation a trigger reacts to. `patch` and `replace` both map to `update`. */
@@ -899,7 +999,7 @@ interface VectorRecord {
 }
 /**
 * Read-only vector surface exposed on {@link QueryCtx}. Mirrors the read half
-* of `@lunora/vectors`' `LunoraVectors` so the live adapter is assignable.
+* of `@lunora/bindings/vectors`' `LunoraVectors` so the live adapter is assignable.
 */
 interface VectorSearchReader {
   getByIds: (indexName: string, ids: ReadonlyArray<string>) => Promise<ReadonlyArray<VectorRecord>>;
@@ -953,6 +1053,14 @@ interface QueryCtx {
   /** Structured, function-attributed logger; see {@link LunoraLogger}. */
   readonly log: LunoraLogger;
   /**
+  * Wall-clock time (epoch ms) the function began, captured once so the whole
+  * handler sees a single stable value. Query/mutation handlers must be
+  * deterministic — they may be re-run on OCC retry / subscription re-eval — so
+  * read time through `ctx.now` instead of `Date.now()` (the latter is flagged
+  * by the `nondeterministic_query_mutation` advisor). Actions may use `Date.now()`.
+  */
+  readonly now: number;
+  /**
   * Compose a read-only subquery in-process, reusing this query's read
   * context (same transaction, same `db`). Executes the referenced query's
   * handler directly — no fresh DO RPC round-trip — so it observes the exact
@@ -961,6 +1069,8 @@ interface QueryCtx {
   * Mirrors Convex's `ctx.runQuery`.
   */
   readonly runQuery: <A extends ArgsValidator, R>(reference: RegisteredQuery<A, R>, args: InferArgs<A>) => Promise<R>;
+  /** Read account-level secrets from Cloudflare Secrets Store; see {@link Secrets}. */
+  readonly secrets: Secrets;
   readonly storage: ReadOnlyStorage;
   readonly vectors: VectorSearchReader;
 }
@@ -977,6 +1087,14 @@ interface MutationCtx {
   /** Structured, function-attributed logger; see {@link LunoraLogger}. */
   readonly log: LunoraLogger;
   /**
+  * Wall-clock time (epoch ms) the function began, captured once so the whole
+  * handler sees a single stable value. Mutation handlers must be deterministic
+  * — they may be re-run on OCC retry — so read time through `ctx.now` instead
+  * of `Date.now()` (the latter is flagged by the `nondeterministic_query_mutation`
+  * advisor). Actions may use `Date.now()`.
+  */
+  readonly now: number;
+  /**
   * Compose a submutation in-process, reusing this mutation's `db` writer.
   * Executes the referenced mutation's handler directly — no fresh DO RPC —
   * so its writes apply through the same shard invocation as the enclosing
@@ -993,6 +1111,8 @@ interface MutationCtx {
   */
   readonly runQuery: <A extends ArgsValidator, R>(reference: RegisteredQuery<A, R>, args: InferArgs<A>) => Promise<R>;
   readonly scheduler: Scheduler;
+  /** Read account-level secrets from Cloudflare Secrets Store; see {@link Secrets}. */
+  readonly secrets: Secrets;
   readonly storage: ReadOnlyStorage;
   readonly vectors: VectorSearch;
   /** Start / resume / inspect durable workflows; see {@link Workflows}. */
@@ -1011,10 +1131,18 @@ interface ActionCtx {
   readonly ip?: string;
   /** Structured, function-attributed logger; see {@link LunoraLogger}. */
   readonly log: LunoraLogger;
+  /**
+  * Wall-clock time (epoch ms) the action began, captured once for convenience
+  * and parity with query/mutation `ctx.now`. Actions run exactly once, so they
+  * may also use ambient `Date.now()` freely.
+  */
+  readonly now: number;
   readonly runAction: <A extends ArgsValidator, R>(reference: RegisteredAction<A, R>, args: InferArgs<A>) => Promise<R>;
   readonly runMutation: <A extends ArgsValidator, R>(reference: RegisteredMutation<A, R>, args: InferArgs<A>) => Promise<R>;
   readonly runQuery: <A extends ArgsValidator, R>(reference: RegisteredQuery<A, R>, args: InferArgs<A>) => Promise<R>;
   readonly scheduler: Scheduler;
+  /** Read account-level secrets from Cloudflare Secrets Store; see {@link Secrets}. */
+  readonly secrets: Secrets;
   readonly storage: Storage;
   readonly vectors: VectorSearch;
   /** Start / resume / inspect durable workflows; see {@link Workflows}. */
@@ -1026,4 +1154,4 @@ interface ActionCtx {
 */
 type AnyApi = Record<string, Record<string, RegisteredFunction<ArgsValidator, unknown, FunctionKind>>>;
 declare const anyApi: AnyApi;
-export { type ActionCtx, type AggregateIndexDefinition, type AggregateOp, type AnyApi, type ArgsValidator, type AuthState, type DatabaseReader, type DatabaseWriter, type FunctionKind, type FunctionVisibility, type GlobalBackend, type IndexDefinition, type IndexRangeBuilder, type InferArgs, type LifecycleEvent, type LifecycleEventKind, type LunoraLogger, type MutationCtx, type OnDeleteAction, type PaginationOptions, type PaginationResult, type QueryCtx, type RankIndexDefinition, type RankSortKey, type ReadOnlyStorage, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMutation, type RegisteredQuery, type RegisteredStream, type RelationDefinition, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type Schema, type SearchFilterBuilder, type SearchIndexDefinition, type ShardMode, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableDefinition, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerBuilder, type TriggerCtx, type TriggerDatabase, type TriggerDefinition, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type VectorEmbedder, type VectorIndexDefinition, type VectorMatch, type VectorMatches, type VectorMetric, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, anyApi };
+export { type ActionCtx, type AggregateIndexDefinition, type AggregateOp, type AnyApi, type ArgsValidator, type AuthState, type DatabaseReader, type DatabaseWriter, type DurableObjectJurisdiction, type ExternalSourceDefinition, type ExternalSourceMode, type ExternalSourceRefresh, type FunctionKind, type FunctionVisibility, type GlobalBackend, type IndexDefinition, type IndexRangeBuilder, type InferArgs, type LifecycleEvent, type LifecycleEventKind, type LunoraLogger, type MutationCtx, type OnDeleteAction, type PaginationOptions, type PaginationResult, type QueryCtx, type RankIndexDefinition, type RankSortKey, type ReadOnlyStorage, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMutation, type RegisteredQuery, type RegisteredStream, type RelationDefinition, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type Schema, type SearchFilterBuilder, type SearchIndexDefinition, type Secrets, type SecretsStoreSecretLike, type ShardMode, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableDefinition, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerBuilder, type TriggerCtx, type TriggerDatabase, type TriggerDefinition, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type VectorEmbedder, type VectorIndexDefinition, type VectorMatch, type VectorMatches, type VectorMetric, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, anyApi };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/server",
-  "version": "1.0.0-alpha.1",
+  "version": "1.0.0-alpha.11",
   "description": "Server primitives for Lunora: defineSchema, defineTable, query, mutation, and action",
   "keywords": [
     "backend",
@@ -25,7 +25,7 @@
     "directory": "packages/server"
   },
   "files": [
-    "dist",
+    "./dist",
     "README.md",
     "LICENSE.md",
     "__assets__"
@@ -62,10 +62,10 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/scheduler": "1.0.0-alpha.1",
-    "@lunora/values": "1.0.0-alpha.1",
+    "@lunora/scheduler": "1.0.0-alpha.4",
+    "@lunora/values": "1.0.0-alpha.3",
     "drizzle-orm": "^0.45.2",
-    "hono": "^4.12.26"
+    "hono": "^4.12.27"
   },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"