@lunora/server 1.0.0-alpha.172 → 1.0.0-alpha.173

package/dist/index.d.mts

@@ -1,7 +1,7 @@
 import { Validator, Infer, v, Id, ValidatorMap, InferValidatorMap, ColumnValidator } from '@lunora/values';
 export { type ColumnValidator, type GeoPoint, type Id, type Infer, ValidationError, type Validator, type ValidatorKind, v } from '@lunora/values';
 import { ArgsValidator, InferArgs, RegisteredAction, ExposeConfig, X402ProcedureConfig, ActionCtx, MutationCtx, RegisteredMutation, QueryCtx, RegisteredQuery, DurableStreamOptions, RegisteredStream, FunctionKind, TableDefinition, RegisteredFunction, VectorIndexDefinition, Schema, AggregateOp, GlobalBackend, RelationDefinition, OnDeleteAction, SearchLanguage, SearchStrategy, ExternalSourceDefinition, TriggerBuilder, TriggerDefinition, VectorEmbedder, VectorMetric, DurableObjectJurisdiction, AggregateIndexDefinition, RankIndexDefinition, Secrets, LifecycleEvent, ShardInitEvent, RegisteredLifecycleHook, WhisperEvent } from "./types.mjs";
-export { type AnyApi, type AuthState, type CachePurge, type DatabaseReader, type DatabaseWriter, type FunctionVisibility, type GeoBoundingBox, type GeoFilterBuilder, type GeoIndexDefinition, type GeoPointInput, type IndexDefinition, type IndexRangeBuilder, type LifecycleEventKind, type LogFields, type LunoraLogMethod, type LunoraLogger, type LunoraMetrics, type LunoraTracer, type LunoraWideEvent, type MutationStorage, type PaginationOptions, type PaginationResult, type RankSortKey, type ReadOnlyStorage, type RelatedDirection, type RelatedNode, type RelatedOptions, type RelatedPage, type RelatedStart, type RelatedStartReference, type RestCacheConfig, type RetryPolicy, type RunQueryOptions, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type SearchFilterBuilder, type SearchIndexDefinition, type ShardMode, type SpanContextIds, type SpanEvaluation, type SpanHandle, type SpanIdentity, type SpanKind, type SpanLink, type SpanOptions, type Storage, type StorageMetadata, type StorageObjectBody, type StorageObjectHead, type StorageRange, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerCtx, type TriggerDatabase, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type TtlDefinition, type VectorMatch, type VectorMatches, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowEventDefinition, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceEvent, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, anyApi } from "./types.mjs";
+export { type AnyApi, type AuthState, type CachePurge, type DatabaseReader, type DatabaseWriter, type FunctionVisibility, type GeoBoundingBox, type GeoFilterBuilder, type GeoIndexDefinition, type GeoPointInput, type IndexDefinition, type IndexRangeBuilder, type LifecycleEventKind, type LogFields, type LunoraLogMethod, type LunoraLogger, type LunoraMetrics, type LunoraTracer, type LunoraWideEvent, type MutationStorage, type PaginationOptions, type PaginationResult, type RankSortKey, type ReadOnlyStorage, type RelatedDirection, type RelatedNode, type RelatedOptions, type RelatedPage, type RelatedStart, type RelatedStartReference, type RestCacheConfig, type RetryPolicy, type RunQueryOptions, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type SearchFilterBuilder, type SearchIndexDefinition, type ShardMode, type SpanContextIds, type SpanEvaluation, type SpanHandle, type SpanIdentity, type SpanKind, type SpanLink, type SpanOptions, type Storage, type StorageListOptions, type StorageListResult, type StorageMetadata, type StorageMultipartUpload, type StorageMultipartUploadOptions, type StorageObjectBody, type StorageObjectHead, type StorageRange, type StorageUploadBody, type StorageUploadOptions, type StorageUploadResult, type StorageUploadedPart, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerCtx, type TriggerDatabase, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type TtlDefinition, type VectorMatch, type VectorMatches, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowEventDefinition, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceEvent, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, anyApi } from "./types.mjs";
 import { LunoraError } from '@lunora/errors';
 export { LunoraError, type LunoraErrorCode } from '@lunora/errors';
 import { Context, Hono } from 'hono';
@@ -3659,14 +3659,17 @@ interface RegisteredShape<Args extends ValidatorMap = ValidatorMap, Context = Qu
 declare const defineShape: <Args extends ValidatorMap = ValidatorMap, Context = QueryCtx>(definition: ShapeDefinition<Args, Context>) => RegisteredShape<Args, Context>;
 /**
  * Operations a storage rule can gate. `read` covers `download` / `getMetadata` /
- * `head` / `getSignedUrl` / `getUrl`; `write` covers `store` /
- * `generateUploadUrl`; `delete` covers `delete` and the `deleteAfterCommit`
+ * `head` / `getSignedUrl` / `getUrl`; `write` covers `store` / `upload` /
+ * `generateUploadUrl` / `createMultipartUpload` / `resumeMultipartUpload`;
+ * `delete` covers `delete` and the `deleteAfterCommit`
  * enqueue; `list` is a prefix listing.
  *
  * `list` governs `ctx.db.system.query("_storage")` — the object enumeration
  * reachable from a handler — plus the file browser / admin path. It governs
- * nothing on `ctx.storage`, which exposes no `list` (and `storageRules` drops
- * any). Note the enumeration is additionally narrowed by the bucket's `read`
+ * nothing on `ctx.storage`: the action-only `ctx.storage.list` is not a gated
+ * method, so `storageRules` refuses it with `FORBIDDEN` rather than enforcing
+ * it. Note the
+ * enumeration is additionally narrowed by the bucket's `read`
  * rules, so a `read` prefix rule scopes what a handler can enumerate even with
  * no `list` rule declared.
  */

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { Validator, Infer, v, Id, ValidatorMap, InferValidatorMap, ColumnValidator } from '@lunora/values';
 export { type ColumnValidator, type GeoPoint, type Id, type Infer, ValidationError, type Validator, type ValidatorKind, v } from '@lunora/values';
 import { ArgsValidator, InferArgs, RegisteredAction, ExposeConfig, X402ProcedureConfig, ActionCtx, MutationCtx, RegisteredMutation, QueryCtx, RegisteredQuery, DurableStreamOptions, RegisteredStream, FunctionKind, TableDefinition, RegisteredFunction, VectorIndexDefinition, Schema, AggregateOp, GlobalBackend, RelationDefinition, OnDeleteAction, SearchLanguage, SearchStrategy, ExternalSourceDefinition, TriggerBuilder, TriggerDefinition, VectorEmbedder, VectorMetric, DurableObjectJurisdiction, AggregateIndexDefinition, RankIndexDefinition, Secrets, LifecycleEvent, ShardInitEvent, RegisteredLifecycleHook, WhisperEvent } from "./types.js";
-export { type AnyApi, type AuthState, type CachePurge, type DatabaseReader, type DatabaseWriter, type FunctionVisibility, type GeoBoundingBox, type GeoFilterBuilder, type GeoIndexDefinition, type GeoPointInput, type IndexDefinition, type IndexRangeBuilder, type LifecycleEventKind, type LogFields, type LunoraLogMethod, type LunoraLogger, type LunoraMetrics, type LunoraTracer, type LunoraWideEvent, type MutationStorage, type PaginationOptions, type PaginationResult, type RankSortKey, type ReadOnlyStorage, type RelatedDirection, type RelatedNode, type RelatedOptions, type RelatedPage, type RelatedStart, type RelatedStartReference, type RestCacheConfig, type RetryPolicy, type RunQueryOptions, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type SearchFilterBuilder, type SearchIndexDefinition, type ShardMode, type SpanContextIds, type SpanEvaluation, type SpanHandle, type SpanIdentity, type SpanKind, type SpanLink, type SpanOptions, type Storage, type StorageMetadata, type StorageObjectBody, type StorageObjectHead, type StorageRange, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerCtx, type TriggerDatabase, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type TtlDefinition, type VectorMatch, type VectorMatches, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowEventDefinition, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceEvent, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, anyApi } from "./types.js";
+export { type AnyApi, type AuthState, type CachePurge, type DatabaseReader, type DatabaseWriter, type FunctionVisibility, type GeoBoundingBox, type GeoFilterBuilder, type GeoIndexDefinition, type GeoPointInput, type IndexDefinition, type IndexRangeBuilder, type LifecycleEventKind, type LogFields, type LunoraLogMethod, type LunoraLogger, type LunoraMetrics, type LunoraTracer, type LunoraWideEvent, type MutationStorage, type PaginationOptions, type PaginationResult, type RankSortKey, type ReadOnlyStorage, type RelatedDirection, type RelatedNode, type RelatedOptions, type RelatedPage, type RelatedStart, type RelatedStartReference, type RestCacheConfig, type RetryPolicy, type RunQueryOptions, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type SearchFilterBuilder, type SearchIndexDefinition, type ShardMode, type SpanContextIds, type SpanEvaluation, type SpanHandle, type SpanIdentity, type SpanKind, type SpanLink, type SpanOptions, type Storage, type StorageListOptions, type StorageListResult, type StorageMetadata, type StorageMultipartUpload, type StorageMultipartUploadOptions, type StorageObjectBody, type StorageObjectHead, type StorageRange, type StorageUploadBody, type StorageUploadOptions, type StorageUploadResult, type StorageUploadedPart, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerCtx, type TriggerDatabase, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type TtlDefinition, type VectorMatch, type VectorMatches, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowEventDefinition, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceEvent, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, anyApi } from "./types.js";
 import { LunoraError } from '@lunora/errors';
 export { LunoraError, type LunoraErrorCode } from '@lunora/errors';
 import { Context, Hono } from 'hono';
@@ -3659,14 +3659,17 @@ interface RegisteredShape<Args extends ValidatorMap = ValidatorMap, Context = Qu
 declare const defineShape: <Args extends ValidatorMap = ValidatorMap, Context = QueryCtx>(definition: ShapeDefinition<Args, Context>) => RegisteredShape<Args, Context>;
 /**
  * Operations a storage rule can gate. `read` covers `download` / `getMetadata` /
- * `head` / `getSignedUrl` / `getUrl`; `write` covers `store` /
- * `generateUploadUrl`; `delete` covers `delete` and the `deleteAfterCommit`
+ * `head` / `getSignedUrl` / `getUrl`; `write` covers `store` / `upload` /
+ * `generateUploadUrl` / `createMultipartUpload` / `resumeMultipartUpload`;
+ * `delete` covers `delete` and the `deleteAfterCommit`
  * enqueue; `list` is a prefix listing.
  *
  * `list` governs `ctx.db.system.query("_storage")` — the object enumeration
  * reachable from a handler — plus the file browser / admin path. It governs
- * nothing on `ctx.storage`, which exposes no `list` (and `storageRules` drops
- * any). Note the enumeration is additionally narrowed by the bucket's `read`
+ * nothing on `ctx.storage`: the action-only `ctx.storage.list` is not a gated
+ * method, so `storageRules` refuses it with `FORBIDDEN` rather than enforcing
+ * it. Note the
+ * enumeration is additionally narrowed by the bucket's `read`
  * rules, so a `read` prefix rule scopes what a handler can enumerate even with
  * no `list` rule declared.
  */

package/dist/index.mjs

@@ -1 +1 @@
-import{ACTION_CACHE_DEFAULT_TTL_MS as t,ACTION_CACHE_TABLE as i,actionCacheExtension as n,cacheKeyFor as a,defineActionCache as f}from"./packem_shared/ACTION_CACHE_DEFAULT_TTL_MS-DHpfdhmu.mjs";import{initLunora as d}from"./packem_shared/initLunora-DAbEYdSo.mjs";import{isPerDispatchMiddleware as m,tagPerDispatchMiddleware as x}from"./packem_shared/isPerDispatchMiddleware-DDQPatSm.mjs";import{createSecrets as l}from"./packem_shared/createSecrets-D6rLB42U.mjs";import{beginDeferredDeletes as h,flushDeferredDeletes as S,withDeferredDeletes as u}from"./packem_shared/beginDeferredDeletes-DhwFBbvs.mjs";import{beginDeferredSchedules as T,withDeferredSchedules as g}from"./packem_shared/beginDeferredSchedules-DJ6U4iq5.mjs";import{DOCUMENT_HISTORY_REDACTED_FIELDS as R,DOCUMENT_HISTORY_TABLE as _,defineDocumentHistory as L,documentHistoryExtension as C}from"./packem_shared/DOCUMENT_HISTORY_REDACTED_FIELDS-DAfomt5Q.mjs";import{LunoraEnvError as M,defineEnv as P,redactSecrets as b}from"./packem_shared/LunoraEnvError-A5I-PzMh.mjs";import{bindOrm as F,bindTableFacade as O}from"./packem_shared/bindOrm-D_hFUjmr.mjs";import{httpAction as N,httpRoute as w,httpRouter as U,isSafeHeaderValue as k}from"./packem_shared/httpAction-DFVhrm8u.mjs";import{serveStorageObject as B}from"./packem_shared/serveStorageObject-9mdw0nyU.mjs";import{defineIdentity as W}from"./packem_shared/defineIdentity-DwkNKwYa.mjs";import{onConnect as Y,onDisconnect as J,onShardInit as K}from"./packem_shared/onConnect-BLRoOpv2.mjs";import{DEFAULT_LIMIT as X,DEFAULT_MAX_LIMIT as q,clampLimit as z,defineListArgs as G}from"./packem_shared/DEFAULT_LIMIT-pT_tV8R0.mjs";import{defineMigration as $}from"./packem_shared/defineMigration-CXOS0Bvq.mjs";import{defineModule as re}from"./packem_shared/defineModule-OecXWM3U.mjs";import{defineMutator as te}from"./packem_shared/defineMutator-DKy8UtbB.mjs";import{c as ne,d as ae,a as fe,b as se,e as de,f as pe,g as me,h as xe,i as ce,j as le,k as Ee,m as he}from"./packem_shared/plugin-DRIqze14.mjs";import{PRESENCE_DEFAULT_TTL_MS as ue,PRESENCE_TABLE as De,definePresence as Te,presenceExtension as ge}from"./packem_shared/PRESENCE_DEFAULT_TTL_MS-DObDBz6_.mjs";import{protectPublic as Re}from"./packem_shared/protectPublic-BUYCMZZB.mjs";import{onQueryChange as Le}from"./packem_shared/onQueryChange-CatdYnH5.mjs";import{createServices as Ie}from"./packem_shared/createServices-IJvoqi0e.mjs";import{defineShape as Pe}from"./packem_shared/defineShape-CbHQpfYD.mjs";import{anyApi as ye}from"./types.mjs";import{onWhisper as Oe}from"./packem_shared/onWhisper-CfDbFLQh.mjs";import{LunoraError as Ne}from"@lunora/errors";import{cronJobs as Ue}from"@lunora/scheduler";import{ValidationError as ve,v as Be}from"@lunora/values";import{allowAll as We,deny as je,isDeny as Ye,toWhereInput as Je}from"./packem_shared/allowAll-DkRAgItV.mjs";import{asBucketStorage as Qe}from"./packem_shared/asBucketStorage-DoGYOjq3.mjs";import{assertShapesDeclareReadPolicies as qe,buildRlsReadRegistry as ze,composeShapeReadWhere as Ge}from"./packem_shared/assertShapesDeclareReadPolicies-d9t7YZ7U.mjs";import{buildMaskRegistry as $e}from"./packem_shared/buildMaskRegistry-DpWMtalG.mjs";import{createPolicyDsl as rr,definePermission as or,definePolicies as tr,definePolicy as ir,defineRole as nr}from"./packem_shared/createPolicyDsl-BZa6SqLJ.mjs";import{defineStorageRule as fr,defineStorageRules as sr}from"./packem_shared/defineStorageRule-Dv4nJE0H.mjs";import{mask as pr}from"./packem_shared/mask-DrapWB_J.mjs";import{r as xr}from"./packem_shared/middleware-ChNz4wOv.mjs";import{storageRules as lr}from"./packem_shared/storageRules-DSmSbQqS.mjs";const e="0.0.0";export{t as ACTION_CACHE_DEFAULT_TTL_MS,i as ACTION_CACHE_TABLE,X as DEFAULT_LIMIT,q as DEFAULT_MAX_LIMIT,R as DOCUMENT_HISTORY_REDACTED_FIELDS,_ as DOCUMENT_HISTORY_TABLE,M as LunoraEnvError,Ne as LunoraError,ue as PRESENCE_DEFAULT_TTL_MS,De as PRESENCE_TABLE,e as VERSION,ve as ValidationError,n as actionCacheExtension,We as allowAll,ye as anyApi,Qe as asBucketStorage,qe as assertShapesDeclareReadPolicies,h as beginDeferredDeletes,T as beginDeferredSchedules,F as bindOrm,O as bindTableFacade,$e as buildMaskRegistry,ze as buildRlsReadRegistry,a as cacheKeyFor,z as clampLimit,ne as composePluginMiddleware,Ge as composeShapeReadWhere,rr as createPolicyDsl,l as createSecrets,Ie as createServices,Ue as cronJobs,f as defineActionCache,ae as defineAggregateIndex,fe as defineComponent,L as defineDocumentHistory,P as defineEnv,W as defineIdentity,G as defineListArgs,$ as defineMigration,re as defineModule,te as defineMutator,or as definePermission,se as definePlugin,tr as definePolicies,ir as definePolicy,Te as definePresence,de as defineRankIndex,nr as defineRole,pe as defineSchema,me as defineSchemaExtension,Pe as defineShape,fr as defineStorageRule,sr as defineStorageRules,xe as defineTable,ce as defineVectorIndex,je as deny,C as documentHistoryExtension,S as flushDeferredDeletes,N as httpAction,w as httpRoute,U as httpRouter,le as indexFieldsFromSchema,d as initLunora,Ee as installPlugins,Ye as isDeny,m as isPerDispatchMiddleware,k as isSafeHeaderValue,pr as mask,he as mergeSchemaExtension,Y as onConnect,J as onDisconnect,Le as onQueryChange,K as onShardInit,Oe as onWhisper,ge as presenceExtension,Re as protectPublic,b as redactSecrets,xr as rls,B as serveStorageObject,lr as storageRules,x as tagPerDispatchMiddleware,Je as toWhereInput,Be as v,u as withDeferredDeletes,g as withDeferredSchedules};
+import{ACTION_CACHE_DEFAULT_TTL_MS as t,ACTION_CACHE_TABLE as i,actionCacheExtension as n,cacheKeyFor as a,defineActionCache as f}from"./packem_shared/ACTION_CACHE_DEFAULT_TTL_MS-DHpfdhmu.mjs";import{initLunora as d}from"./packem_shared/initLunora-DAbEYdSo.mjs";import{isPerDispatchMiddleware as m,tagPerDispatchMiddleware as x}from"./packem_shared/isPerDispatchMiddleware-DDQPatSm.mjs";import{createSecrets as l}from"./packem_shared/createSecrets-D6rLB42U.mjs";import{beginDeferredDeletes as h,flushDeferredDeletes as S,withDeferredDeletes as u}from"./packem_shared/beginDeferredDeletes-DhwFBbvs.mjs";import{beginDeferredSchedules as T,withDeferredSchedules as g}from"./packem_shared/beginDeferredSchedules-DJ6U4iq5.mjs";import{DOCUMENT_HISTORY_REDACTED_FIELDS as R,DOCUMENT_HISTORY_TABLE as _,defineDocumentHistory as L,documentHistoryExtension as C}from"./packem_shared/DOCUMENT_HISTORY_REDACTED_FIELDS-DAfomt5Q.mjs";import{LunoraEnvError as M,defineEnv as P,redactSecrets as b}from"./packem_shared/LunoraEnvError-A5I-PzMh.mjs";import{bindOrm as F,bindTableFacade as O}from"./packem_shared/bindOrm-D_hFUjmr.mjs";import{httpAction as N,httpRoute as w,httpRouter as U,isSafeHeaderValue as k}from"./packem_shared/httpAction-DFVhrm8u.mjs";import{serveStorageObject as B}from"./packem_shared/serveStorageObject-9mdw0nyU.mjs";import{defineIdentity as W}from"./packem_shared/defineIdentity-DwkNKwYa.mjs";import{onConnect as Y,onDisconnect as J,onShardInit as K}from"./packem_shared/onConnect-BLRoOpv2.mjs";import{DEFAULT_LIMIT as X,DEFAULT_MAX_LIMIT as q,clampLimit as z,defineListArgs as G}from"./packem_shared/DEFAULT_LIMIT-pT_tV8R0.mjs";import{defineMigration as $}from"./packem_shared/defineMigration-CXOS0Bvq.mjs";import{defineModule as re}from"./packem_shared/defineModule-OecXWM3U.mjs";import{defineMutator as te}from"./packem_shared/defineMutator-DKy8UtbB.mjs";import{c as ne,d as ae,a as fe,b as se,e as de,f as pe,g as me,h as xe,i as ce,j as le,k as Ee,m as he}from"./packem_shared/plugin-DRIqze14.mjs";import{PRESENCE_DEFAULT_TTL_MS as ue,PRESENCE_TABLE as De,definePresence as Te,presenceExtension as ge}from"./packem_shared/PRESENCE_DEFAULT_TTL_MS-DObDBz6_.mjs";import{protectPublic as Re}from"./packem_shared/protectPublic-BUYCMZZB.mjs";import{onQueryChange as Le}from"./packem_shared/onQueryChange-CatdYnH5.mjs";import{createServices as Ie}from"./packem_shared/createServices-IJvoqi0e.mjs";import{defineShape as Pe}from"./packem_shared/defineShape-CbHQpfYD.mjs";import{anyApi as ye}from"./types.mjs";import{onWhisper as Oe}from"./packem_shared/onWhisper-CfDbFLQh.mjs";import{LunoraError as Ne}from"@lunora/errors";import{cronJobs as Ue}from"@lunora/scheduler";import{ValidationError as ve,v as Be}from"@lunora/values";import{allowAll as We,deny as je,isDeny as Ye,toWhereInput as Je}from"./packem_shared/allowAll-DkRAgItV.mjs";import{asBucketStorage as Qe}from"./packem_shared/asBucketStorage-DoGYOjq3.mjs";import{assertShapesDeclareReadPolicies as qe,buildRlsReadRegistry as ze,composeShapeReadWhere as Ge}from"./packem_shared/assertShapesDeclareReadPolicies-d9t7YZ7U.mjs";import{buildMaskRegistry as $e}from"./packem_shared/buildMaskRegistry-DpWMtalG.mjs";import{createPolicyDsl as rr,definePermission as or,definePolicies as tr,definePolicy as ir,defineRole as nr}from"./packem_shared/createPolicyDsl-BZa6SqLJ.mjs";import{defineStorageRule as fr,defineStorageRules as sr}from"./packem_shared/defineStorageRule-Dv4nJE0H.mjs";import{mask as pr}from"./packem_shared/mask-DrapWB_J.mjs";import{r as xr}from"./packem_shared/middleware-ChNz4wOv.mjs";import{storageRules as lr}from"./packem_shared/storageRules-1GWSFFnl.mjs";const e="0.0.0";export{t as ACTION_CACHE_DEFAULT_TTL_MS,i as ACTION_CACHE_TABLE,X as DEFAULT_LIMIT,q as DEFAULT_MAX_LIMIT,R as DOCUMENT_HISTORY_REDACTED_FIELDS,_ as DOCUMENT_HISTORY_TABLE,M as LunoraEnvError,Ne as LunoraError,ue as PRESENCE_DEFAULT_TTL_MS,De as PRESENCE_TABLE,e as VERSION,ve as ValidationError,n as actionCacheExtension,We as allowAll,ye as anyApi,Qe as asBucketStorage,qe as assertShapesDeclareReadPolicies,h as beginDeferredDeletes,T as beginDeferredSchedules,F as bindOrm,O as bindTableFacade,$e as buildMaskRegistry,ze as buildRlsReadRegistry,a as cacheKeyFor,z as clampLimit,ne as composePluginMiddleware,Ge as composeShapeReadWhere,rr as createPolicyDsl,l as createSecrets,Ie as createServices,Ue as cronJobs,f as defineActionCache,ae as defineAggregateIndex,fe as defineComponent,L as defineDocumentHistory,P as defineEnv,W as defineIdentity,G as defineListArgs,$ as defineMigration,re as defineModule,te as defineMutator,or as definePermission,se as definePlugin,tr as definePolicies,ir as definePolicy,Te as definePresence,de as defineRankIndex,nr as defineRole,pe as defineSchema,me as defineSchemaExtension,Pe as defineShape,fr as defineStorageRule,sr as defineStorageRules,xe as defineTable,ce as defineVectorIndex,je as deny,C as documentHistoryExtension,S as flushDeferredDeletes,N as httpAction,w as httpRoute,U as httpRouter,le as indexFieldsFromSchema,d as initLunora,Ee as installPlugins,Ye as isDeny,m as isPerDispatchMiddleware,k as isSafeHeaderValue,pr as mask,he as mergeSchemaExtension,Y as onConnect,J as onDisconnect,Le as onQueryChange,K as onShardInit,Oe as onWhisper,ge as presenceExtension,Re as protectPublic,b as redactSecrets,xr as rls,B as serveStorageObject,lr as storageRules,x as tagPerDispatchMiddleware,Je as toWhereInput,Be as v,u as withDeferredDeletes,g as withDeferredSchedules};

package/dist/packem_shared/storageRules-1GWSFFnl.mjs

@@ -0,0 +1 @@
+import{LunoraError as k}from"@lunora/errors";import{i as A,a as D}from"./middleware-ChNz4wOv.mjs";const E=(e,t,o)=>{const i=n=>o.isAllowed("list",n,t)&&o.isAllowed("read",n,t),{get:c,query:g}=e,f={...e},b=n=>n.filter(r=>typeof r.key=="string"&&i(r.key));return typeof c=="function"&&(f.get=async(n,r)=>(n==="_storage"&&o.assertAllowed("read",r,t),c(n,r))),typeof g=="function"&&(f.query=n=>{const r=g(n),{collect:p}=r;return n!=="_storage"||typeof p!="function"?r:{...r,collect:async()=>b(await p())}}),f},N=(e,t)=>{if(e===void 0)return!0;const o=e.endsWith("/")?e.slice(0,-1):e;return o===""||t===o||t.startsWith(`${o}/`)},S=e=>{const t=e[1],o=typeof t=="object"&&t!==null?t.method:void 0;return typeof o=="string"&&o.toUpperCase()==="PUT"?"write":"read"},M=[["createMultipartUpload","write"],["delete","delete"],["deleteAfterCommit","delete"],["download","read"],["generateUploadUrl","write"],["getMetadata","read"],["getSignedUrl",S],["getUrl","read"],["head","read"],["resumeMultipartUpload","write"],["store","write"],["upload","write"]],$=[["getPresignedUrl","ctx.storage.getPresignedUrl is not available under storageRules(...): a presigned URL reaches R2 directly, past every rule. Use getSignedUrl or generateUploadUrl, which route back through the Worker."],["list",'ctx.storage.list is not available under storageRules(...); enumerate via ctx.db.system.query("_storage"), which the rules filter.']],P=(e,t)=>{try{return e(t).bucketName===t}catch{return!1}},B=(e,t)=>{const o=e.bucketName??"default",{bucket:i}=e;for(const c of new Set(t))if(!(c===o||typeof i=="function"&&P(i,c)))throw new k("INTERNAL",`storageRules: rule for bucket "${c}" governs nothing — this request's storage cannot address that bucket (the accessor is "${o}", and selecting "${c}" does not reach a bucket of that name). A rule on an unaddressable bucket leaves the operation it was written to gate wide open. Match the rule's \`bucket\` to the name the binding is registered under in \`.storage({ bucket, buckets })\`.`)},_=(e,t={})=>{const o=A(t.roles);return async({ctx:i,next:c})=>{const g=await D(i.auth??{},o),f=(s,d,u)=>{const h=e.filter(a=>a.on===s&&a.bucket===u);if(h.length===0)return!0;const l={auth:g,ctx:i,key:d};return h.some(a=>N(a.prefix,d)&&a.when(l)===!0)},b=(s,d,u)=>{if(!f(s,d,u))throw new k("FORBIDDEN",`storage ${s} on "${d}" in bucket "${u}" denied by access rule`)},n=s=>{const d=s.bucketName??"default",u={bucketName:d};for(const[l,a]of M){const U=s[l];typeof U=="function"&&(u[l]=(...w)=>{const R=typeof w[0]=="string"?w[0]:"",v=typeof a=="function"?a(w):a;return b(v,R,d),U(...w)})}for(const[l,a]of $)typeof s[l]=="function"&&(u[l]=async()=>{throw new k("FORBIDDEN",a)});const{bucket:h}=s;return typeof h=="function"&&(u.bucket=l=>n(h(l))),u},r=i.storage;if(r===void 0)return c();B(r,e.map(s=>s.bucket));const p={storage:n(r)},y=i.db,m=y?.system;return y!==void 0&&m!==void 0&&typeof m=="object"&&(p.db={...y,system:E(m,r.bucketName??"default",{assertAllowed:b,isAllowed:f})}),c({ctx:p})}};export{_ as storageRules};

package/dist/types.d.mts

@@ -63,6 +63,344 @@ interface RestCachePolicy {
   readonly tag?: string;
   readonly vary?: string;
 }
+/**
+ * The `ctx.storage` surface, per function tier: {@link ReadOnlyStorage} for a
+ * query, {@link MutationStorage} for a mutation, {@link Storage} for an action.
+ *
+ * A structural mirror of `@lunora/storage`'s `Storage` — `@lunora/server` takes
+ * no dependency on that package. Re-exported through `../types`, so the public
+ * names are unchanged.
+ */
+/**
+ * Per-file metadata returned by {@link ReadOnlyStorage.getMetadata}. A clean
+ * public mirror of `@lunora/storage`'s `ObjectMetadata` — re-declared here so
+ * the ctx surface carries no dependency on the storage package's types. Matches
+ * the columns Convex surfaces for `ctx.storage.getMetadata` / `_storage`.
+ */
+interface StorageMetadata {
+  /** The object's `Content-Type`, when recorded. */
+  contentType?: string;
+  /** Custom metadata set at upload time, if any. */
+  customMetadata?: Record<string, string>;
+  /** The object's key. */
+  key: string;
+  /** Hex-encoded SHA-256 of the body, when R2 carries a checksum. */
+  sha256?: string;
+  /** Body length in bytes. */
+  size: number;
+  /** When the object was last written (epoch ms), when reported. */
+  uploaded?: number;
+}
+/**
+ * The body-free object shape returned by {@link ReadOnlyStorage.head} — a clean
+ * public mirror of `@lunora/storage`'s head projection, re-declared here for the
+ * same reason as {@link StorageMetadata}: the ctx surface carries no dependency
+ * on the storage package's types.
+ *
+ * Richer than {@link StorageMetadata} on purpose. `getMetadata` is the tidy
+ * Convex-shaped summary; `head` is what an HTTP layer needs, so it keeps the
+ * validator (`etag`) and the base64 digest RFC 9530 `Repr-Digest` requires, and
+ * leaves `uploaded` as the `Date` the binding reports rather than epoch ms.
+ */
+interface StorageObjectHead {
+  /** Custom metadata set at upload time, if any. */
+  customMetadata?: Record<string, string>;
+  /**
+   * R2's unquoted etag (the MD5 hex for a single-part upload). Required: R2
+   * reports one on every object, and an HTTP layer built on `head()` (the
+   * `serveStorageObject` helper) needs it to emit a validator.
+   */
+  etag: string;
+  /** The already-quoted form of {@link StorageObjectHead.etag}, when the binding reports one. */
+  httpEtag?: string;
+  /** Recorded HTTP metadata, notably the `Content-Type`. */
+  httpMetadata?: {
+    contentType?: string;
+  };
+  /** The object's key. */
+  key: string;
+  /** Hex-encoded SHA-256 of the body, when R2 carries a checksum. */
+  sha256?: string;
+  /** Base64-encoded SHA-256 of the same checksum — the encoding RFC 9530 digest headers require. */
+  sha256Base64?: string;
+  /** The FULL object size in bytes: R2 reports the object's size, not a returned window's, which is what makes a head enough to resolve a `Range` against. */
+  size: number;
+  /** When the object was last written. */
+  uploaded?: Date;
+}
+/**
+ * Byte window forwarded to {@link ReadOnlyStorage.download} so R2 resolves the
+ * slice server-side and streams only those bytes back. Mirrors R2's own `range`
+ * option (`@lunora/platform`'s `R2RangeLike`), restated structurally so
+ * `@lunora/server` takes no dependency on the bindings package.
+ */
+type StorageRange = {
+  length?: number;
+  offset: number;
+} | {
+  length: number;
+  offset?: number;
+} | {
+  suffix: number;
+};
+/**
+ * A downloaded object: the same metadata {@link StorageObjectHead} carries, plus
+ * the body stream. This is what `download()` resolves to — R2's object, NOT a
+ * bare stream.
+ */
+interface StorageObjectBody extends StorageObjectHead {
+  /** The object body stream. `null` for a zero-byte object. */
+  body: ReadableStream | null;
+}
+/**
+ * Read-only projection of `Storage` exposed on `QueryCtx` / `MutationCtx`.
+ *
+ * Queries are pure reads, and mutations run inside a transactional scope —
+ * neither is allowed to perform side-effectful R2 writes (`upload`) or
+ * deletes (`delete`). They can, however, **read** existing objects and
+ * resolve signed URLs (the URL signing itself is HMAC-only — no R2 round
+ * trip), so the read-only surface keeps `download` and `getSignedUrl`. The
+ * full {@link Storage} surface stays on `ActionCtx`.
+ */
+interface ReadOnlyStorage<Buckets extends string = string> {
+  /**
+   * Select a named bucket (declared via `v.storage("name")`). The returned
+   * accessor's operations target that bucket — `ctx.storage.bucket("avatars")
+   * .download(key)`. The bare `ctx.storage` targets the default bucket.
+   */
+  bucket: (name: Buckets) => ReadOnlyStorage<Buckets>;
+  /** The bucket this accessor's operations target (the default for the bare `ctx.storage`). */
+  readonly bucketName: string;
+  /**
+   * Fetch an existing object. Returns the R2 object — metadata plus a `body`
+   * stream — or `null` when absent.
+   *
+   * NOT a bare stream: `new Response(await ctx.storage.download(key))` would
+   * stringify the object and serve the literal text `[object Object]`. Reach
+   * for the body explicitly:
+   *
+   * ```ts
+   * const object = await ctx.storage.download(key);
+   *
+   * return object ? new Response(object.body) : new Response("Not found", { status: 404 });
+   * ```
+   *
+   * (`serveStorageObject` from `@lunora/server` does this, plus range/ETag
+   * handling, for the common "serve a stored file over HTTP" case.)
+   *
+   * Pass `range` to have R2 resolve the byte window server-side, so the
+   * unwanted bytes never reach the worker.
+   */
+  download: (key: string, options?: {
+    range?: StorageRange;
+  }) => Promise<StorageObjectBody | null>;
+  /**
+   * Read a file's metadata (size, content-type, sha256, upload time, custom
+   * metadata) without fetching its body. Returns `null` when the object is
+   * absent. Mirrors Convex's `ctx.storage.getMetadata`.
+   */
+  getMetadata: (key: string) => Promise<StorageMetadata | null>;
+  /** Resolve a short-lived signed URL for an existing object. */
+  getSignedUrl: (key: string, options?: {
+    expiresInSeconds?: number;
+  }) => Promise<string>;
+  /** Public URL pointing at the configured base for `key`. */
+  getUrl: (key: string) => string;
+  /**
+   * Read an object's metadata with NO body transfer, as the raw object shape —
+   * `etag` and the base64 digest included, which is what an HTTP layer needs to
+   * answer a `Range` request. Returns `null` when the object is absent.
+   *
+   * {@link ReadOnlyStorage.getMetadata} is the tidier summary over the same
+   * read; reach for this one when building a response.
+   */
+  head: (key: string) => Promise<StorageObjectHead | null>;
+}
+/**
+ * `ctx.storage` inside a **mutation**: the read surface, plus the one write a
+ * transactional context can safely express. See `@lunora/server`'s
+ * `deferred-deletes.ts` for why `delete` itself stays action-only.
+ */
+interface MutationStorage<Buckets extends string = string> extends ReadOnlyStorage<Buckets> {
+  /** Select a named bucket; deletes queued on it are flushed against that bucket. */
+  bucket: (name: Buckets) => MutationStorage<Buckets>;
+  /**
+   * Queue `key` for deletion once this mutation commits.
+   *
+   * Returns `void`, not a promise: nothing has been attempted yet, so the object
+   * is still there on the next line. A rolled-back mutation never flushes, so
+   * the row deletion and the object cleanup cannot disagree. A failed delete
+   * leaks the object rather than failing a mutation that already succeeded, and
+   * is logged with its key.
+   */
+  deleteAfterCommit: (key: string) => void;
+}
+/**
+ * The body shapes `store` / `upload` accept — what R2's `put` stores bytes from.
+ * Mirrors `@lunora/storage`'s `Storage.upload` parameter.
+ */
+type StorageUploadBody = ArrayBuffer | ArrayBufferView | Blob | ReadableStream | string;
+/**
+ * Options for `store` / `upload` — a structural mirror of `@lunora/storage`'s
+ * `UploadOptions`, so the `maxSize` / `allowedContentTypes` guards are reachable
+ * from `ctx.storage` without a type dependency on the storage package.
+ */
+interface StorageUploadOptions {
+  /** Content-type allowlist; the supplied `contentType` must match. */
+  allowedContentTypes?: ReadonlyArray<string>;
+  contentType?: string;
+  customMetadata?: Record<string, string>;
+  /**
+   * Maximum body size in bytes. A `ReadableStream` is buffered under the cap,
+   * so on the stream path `maxSize` is itself capped at 16 MiB — above that use
+   * {@link Storage.createMultipartUpload}.
+   */
+  maxSize?: number;
+  /** SHA-256 of the body (hex or a 32-byte buffer); R2 records and verifies it. */
+  sha256?: ArrayBuffer | string;
+}
+/** What `store` / `upload` resolve to: the stored key plus its etag (unquoted and quoted). */
+interface StorageUploadResult {
+  etag: string;
+  httpEtag: string;
+  key: string;
+}
+/** One uploaded multipart part — returned by `uploadPart`, required by `complete`. Mirrors R2's `R2UploadedPart`. */
+interface StorageUploadedPart {
+  etag: string;
+  partNumber: number;
+}
+/**
+ * An in-progress R2 multipart upload, as {@link Storage.createMultipartUpload} /
+ * {@link Storage.resumeMultipartUpload} return it. A structural mirror of
+ * R2's own multipart upload handle, as `@lunora/platform` declares it.
+ *
+ * Every part except the last must be the same size, and at least 5 MiB. The
+ * object does not guarantee the upload still exists — a parallel `complete` /
+ * `abort` invalidates it — so handle errors on each call.
+ */
+interface StorageMultipartUpload {
+  /** Abort the upload, discarding every uploaded part. */
+  abort: () => Promise<void>;
+  /** Finish the upload from the collected parts; resolves to the stored object's metadata. */
+  complete: (uploadedParts: StorageUploadedPart[]) => Promise<StorageObjectHead>;
+  /** The object key being assembled. */
+  readonly key: string;
+  /** The R2 upload id — persist it to resume the upload in a later request. */
+  readonly uploadId: string;
+  /** Upload one part (1-indexed); returns the `{ partNumber, etag }` to pass to `complete`. */
+  uploadPart: (partNumber: number, value: StorageUploadBody) => Promise<StorageUploadedPart>;
+}
+/** Options for {@link Storage.createMultipartUpload}: the metadata recorded on the assembled object. */
+interface StorageMultipartUploadOptions {
+  contentType?: string;
+  customMetadata?: Record<string, string>;
+}
+/** Options for {@link Storage.list}. Mirrors `@lunora/storage`'s `ListOptions`. */
+interface StorageListOptions {
+  /** The `cursor` of the previous page. */
+  cursor?: string;
+  /** R2 list delimiter — keys sharing a segment roll up into `delimitedPrefixes`. */
+  delimiter?: string;
+  /** Page-size ceiling: defaults to 100, capped at 1000. A positive integer; anything else throws. */
+  limit?: number;
+}
+/** One page of {@link Storage.list}. */
+interface StorageListResult {
+  /** Pass back as `options.cursor` for the next page, while `truncated` is `true`. */
+  cursor?: string;
+  /** The rolled-up "folders" when `options.delimiter` is set — these are NOT in `objects`. */
+  delimitedPrefixes?: string[];
+  /** The objects on this page, body-free and JSON-serializable. */
+  objects: StorageObjectHead[];
+  /** `true` while more pages remain. Paginate on this, never on `objects.length`. */
+  truncated?: boolean;
+}
+/**
+ * `ctx.storage` inside an **action**: the full `@lunora/storage` `Storage`
+ * surface, plus `bucket(name)`.
+ *
+ * Declared structurally rather than imported — `@lunora/server` takes no
+ * runtime or published-type dependency on `@lunora/storage` — so it tracks that
+ * surface by hand. A type test (`__tests__/storage-surface.test-d.ts`) fails
+ * `tsc` when the two drift —
+ * the member sets differ (a runtime member left untyped here, or a member typed
+ * here the runtime lacks — `bucket` aside, which the ctx wiring adds); the
+ * runtime object no longer satisfies a signature here (a return type widened,
+ * or a parameter narrowed, upstream); or a parameter list here differs from the
+ * runtime's (an option or body shape the runtime takes but this interface
+ * refuses). `getSignedUrl` is the one deliberate parameter exception: its PUT
+ * options would mint an upload URL from a query.
+ *
+ * Return types here may be NARROWER than the runtime's on purpose — `head`
+ * resolves to the {@link StorageObjectHead} mirror rather than R2's object.
+ *
+ * Every member here is action-only. Under a procedure guarded by
+ * `storageRules(...)`, the write paths (`store` / `upload` /
+ * `createMultipartUpload` / `resumeMultipartUpload`) are gated as `write`, and
+ * `getPresignedUrl` / `list`, which no rule can gate, reject with `FORBIDDEN`.
+ */
+interface Storage<Buckets extends string = string> extends ReadOnlyStorage<Buckets> {
+  /** Select a named bucket; the returned accessor exposes the full read/write surface. */
+  bucket: (name: Buckets) => Storage<Buckets>;
+  /**
+   * Begin a native R2 **multipart upload** — for objects above `store()`'s
+   * 16 MiB stream cap, streamed through the Worker without buffering. Upload
+   * the parts (each at least 5 MiB and uniform in size, except the last), then
+   * `complete` with the returned parts, or `abort`. Persist `uploadId` to
+   * continue in a later request via {@link Storage.resumeMultipartUpload}.
+   */
+  createMultipartUpload: (key: string, options?: StorageMultipartUploadOptions) => Promise<StorageMultipartUpload>;
+  delete: (key: string) => Promise<void>;
+  /**
+   * Mint a short-lived signed `PUT` URL a client can upload directly to,
+   * optionally pinning the `Content-Type` the uploader must send. Mirrors
+   * Convex's `storage.generateUploadUrl`.
+   */
+  generateUploadUrl: (key: string, options?: {
+    contentType?: string;
+    expiresInSeconds?: number;
+  }) => Promise<string>;
+  /**
+   * Mint a native S3 SigV4 URL that hits R2 **directly**, so the bytes never
+   * pass through the Worker — unlike {@link Storage.generateUploadUrl}, whose
+   * signed URL points back at this app so its storage rules still apply.
+   *
+   * Requires `s3` credentials on the `.storage({ s3 })` declaration; without
+   * them the call throws. That is the trade-off: no Worker in the path also
+   * means no rule enforcement in the path.
+   */
+  getPresignedUrl: (key: string, options?: {
+    expiresInSeconds?: number;
+    method?: "GET" | "PUT";
+  }) => Promise<string>;
+  /**
+   * List objects under `prefix` — e.g. to sweep abandoned staging uploads. With
+   * `options.delimiter` set, keys sharing a segment roll up into
+   * `delimitedPrefixes` and are NOT in `objects`, so an empty `objects` is not
+   * an empty directory. A page may hold fewer objects than `options.limit`:
+   * paginate on `truncated` / `cursor`.
+   *
+   * Not gated by storage access rules (and dropped under `storageRules(...)`);
+   * a rule-scoped enumeration goes through `ctx.db.system.query("_storage")`.
+   */
+  list: (prefix?: string, options?: StorageListOptions) => Promise<StorageListResult>;
+  /**
+   * Resume an in-progress multipart upload by its `uploadId` (e.g. across
+   * requests). Synchronous: R2 does not validate the id, so a stale one
+   * surfaces as an error on the first `uploadPart` / `complete`.
+   */
+  resumeMultipartUpload: (key: string, uploadId: string) => StorageMultipartUpload;
+  /**
+   * Upload `body` to `key` from the server, returning the stored object's key
+   * and etag. Mirrors Convex's `storage.store`; the same function as
+   * {@link Storage.upload}, so the `maxSize` / `allowedContentTypes` guards
+   * apply through the alias.
+   */
+  store: (key: string, body: StorageUploadBody, options?: StorageUploadOptions) => Promise<StorageUploadResult>;
+  /** Upload `body` to `key` — {@link Storage.store} under `@lunora/storage`'s own name, with one shared signature. */
+  upload: Storage<Buckets>["store"];
+}
 /** Map of validators describing a function's args record. Alias of `@lunora/values`' shared {@link ValidatorMap}. */
 type ArgsValidator = ValidatorMap;
 /** Infer the args object type from an {@link ArgsValidator}. Alias of `@lunora/values`' shared {@link InferValidatorMap}. */
@@ -1774,216 +2112,6 @@ interface TriggerBuilder<Shape extends Record<string, Validator> = Record<string
   beforeInsert: (handler: TriggerHandler<TriggerInsertEvent<Shape>>) => TriggerDefinition;
   beforeUpdate: (handler: TriggerHandler<TriggerUpdateEvent<Shape>>) => TriggerDefinition;
 }
-/**
- * Per-file metadata returned by {@link ReadOnlyStorage.getMetadata}. A clean
- * public mirror of `@lunora/storage`'s `ObjectMetadata` — re-declared here so
- * the ctx surface carries no dependency on the storage package's types. Matches
- * the columns Convex surfaces for `ctx.storage.getMetadata` / `_storage`.
- */
-interface StorageMetadata {
-  /** The object's `Content-Type`, when recorded. */
-  contentType?: string;
-  /** Custom metadata set at upload time, if any. */
-  customMetadata?: Record<string, string>;
-  /** The object's key. */
-  key: string;
-  /** Hex-encoded SHA-256 of the body, when R2 carries a checksum. */
-  sha256?: string;
-  /** Body length in bytes. */
-  size: number;
-  /** When the object was last written (epoch ms), when reported. */
-  uploaded?: number;
-}
-/**
- * The body-free object shape returned by {@link ReadOnlyStorage.head} — a clean
- * public mirror of `@lunora/storage`'s head projection, re-declared here for the
- * same reason as {@link StorageMetadata}: the ctx surface carries no dependency
- * on the storage package's types.
- *
- * Richer than {@link StorageMetadata} on purpose. `getMetadata` is the tidy
- * Convex-shaped summary; `head` is what an HTTP layer needs, so it keeps the
- * validator (`etag`) and the base64 digest RFC 9530 `Repr-Digest` requires, and
- * leaves `uploaded` as the `Date` the binding reports rather than epoch ms.
- */
-interface StorageObjectHead {
-  /** Custom metadata set at upload time, if any. */
-  customMetadata?: Record<string, string>;
-  /**
-   * R2's unquoted etag (the MD5 hex for a single-part upload). Required: R2
-   * reports one on every object, and an HTTP layer built on `head()` (the
-   * `serveStorageObject` helper) needs it to emit a validator.
-   */
-  etag: string;
-  /** The already-quoted form of {@link StorageObjectHead.etag}, when the binding reports one. */
-  httpEtag?: string;
-  /** Recorded HTTP metadata, notably the `Content-Type`. */
-  httpMetadata?: {
-    contentType?: string;
-  };
-  /** The object's key. */
-  key: string;
-  /** Hex-encoded SHA-256 of the body, when R2 carries a checksum. */
-  sha256?: string;
-  /** Base64-encoded SHA-256 of the same checksum — the encoding RFC 9530 digest headers require. */
-  sha256Base64?: string;
-  /** The FULL object size in bytes: R2 reports the object's size, not a returned window's, which is what makes a head enough to resolve a `Range` against. */
-  size: number;
-  /** When the object was last written. */
-  uploaded?: Date;
-}
-/**
- * Byte window forwarded to {@link ReadOnlyStorage.download} so R2 resolves the
- * slice server-side and streams only those bytes back. Mirrors R2's own `range`
- * option (`@lunora/platform`'s `R2RangeLike`), restated structurally so
- * `@lunora/server` takes no dependency on the bindings package.
- */
-type StorageRange = {
-  length?: number;
-  offset: number;
-} | {
-  length: number;
-  offset?: number;
-} | {
-  suffix: number;
-};
-/**
- * A downloaded object: the same metadata {@link StorageObjectHead} carries, plus
- * the body stream. This is what `download()` resolves to — R2's object, NOT a
- * bare stream.
- */
-interface StorageObjectBody extends StorageObjectHead {
-  /** The object body stream. `null` for a zero-byte object. */
-  body: ReadableStream | null;
-}
-/**
- * Read-only projection of `Storage` exposed on `QueryCtx` / `MutationCtx`.
- *
- * Queries are pure reads, and mutations run inside a transactional scope —
- * neither is allowed to perform side-effectful R2 writes (`upload`) or
- * deletes (`delete`). They can, however, **read** existing objects and
- * resolve signed URLs (the URL signing itself is HMAC-only — no R2 round
- * trip), so the read-only surface keeps `download` and `getSignedUrl`. The
- * full {@link Storage} surface stays on `ActionCtx`.
- */
-interface ReadOnlyStorage<Buckets extends string = string> {
-  /**
-   * Select a named bucket (declared via `v.storage("name")`). The returned
-   * accessor's operations target that bucket — `ctx.storage.bucket("avatars")
-   * .download(key)`. The bare `ctx.storage` targets the default bucket.
-   */
-  bucket: (name: Buckets) => ReadOnlyStorage<Buckets>;
-  /** The bucket this accessor's operations target (the default for the bare `ctx.storage`). */
-  readonly bucketName: string;
-  /**
-   * Fetch an existing object. Returns the R2 object — metadata plus a `body`
-   * stream — or `null` when absent.
-   *
-   * NOT a bare stream: `new Response(await ctx.storage.download(key))` would
-   * stringify the object and serve the literal text `[object Object]`. Reach
-   * for the body explicitly:
-   *
-   * ```ts
-   * const object = await ctx.storage.download(key);
-   *
-   * return object ? new Response(object.body) : new Response("Not found", { status: 404 });
-   * ```
-   *
-   * (`serveStorageObject` from `@lunora/server` does this, plus range/ETag
-   * handling, for the common "serve a stored file over HTTP" case.)
-   *
-   * Pass `range` to have R2 resolve the byte window server-side, so the
-   * unwanted bytes never reach the worker.
-   */
-  download: (key: string, options?: {
-    range?: StorageRange;
-  }) => Promise<StorageObjectBody | null>;
-  /**
-   * Read a file's metadata (size, content-type, sha256, upload time, custom
-   * metadata) without fetching its body. Returns `null` when the object is
-   * absent. Mirrors Convex's `ctx.storage.getMetadata`.
-   */
-  getMetadata: (key: string) => Promise<StorageMetadata | null>;
-  /** Resolve a short-lived signed URL for an existing object. */
-  getSignedUrl: (key: string, options?: {
-    expiresInSeconds?: number;
-  }) => Promise<string>;
-  /** Public URL pointing at the configured base for `key`. */
-  getUrl: (key: string) => string;
-  /**
-   * Read an object's metadata with NO body transfer, as the raw object shape —
-   * `etag` and the base64 digest included, which is what an HTTP layer needs to
-   * answer a `Range` request. Returns `null` when the object is absent.
-   *
-   * {@link ReadOnlyStorage.getMetadata} is the tidier summary over the same
-   * read; reach for this one when building a response.
-   */
-  head: (key: string) => Promise<StorageObjectHead | null>;
-}
-/**
- * `ctx.storage` inside a **mutation**: the read surface, plus the one write a
- * transactional context can safely express. See `@lunora/server`'s
- * `deferred-deletes.ts` for why `delete` itself stays action-only.
- */
-interface MutationStorage<Buckets extends string = string> extends ReadOnlyStorage<Buckets> {
-  /** Select a named bucket; deletes queued on it are flushed against that bucket. */
-  bucket: (name: Buckets) => MutationStorage<Buckets>;
-  /**
-   * Queue `key` for deletion once this mutation commits.
-   *
-   * Returns `void`, not a promise: nothing has been attempted yet, so the object
-   * is still there on the next line. A rolled-back mutation never flushes, so
-   * the row deletion and the object cleanup cannot disagree. A failed delete
-   * leaks the object rather than failing a mutation that already succeeded, and
-   * is logged with its key.
-   */
-  deleteAfterCommit: (key: string) => void;
-}
-interface Storage<Buckets extends string = string> extends ReadOnlyStorage<Buckets> {
-  /** Select a named bucket; the returned accessor exposes the full read/write surface. */
-  bucket: (name: Buckets) => Storage<Buckets>;
-  delete: (key: string) => Promise<void>;
-  /**
-   * Mint a short-lived signed `PUT` URL a client can upload directly to,
-   * optionally pinning the `Content-Type` the uploader must send. Mirrors
-   * Convex's `storage.generateUploadUrl`.
-   */
-  generateUploadUrl: (key: string, options?: {
-    contentType?: string;
-    expiresInSeconds?: number;
-  }) => Promise<string>;
-  /**
-   * Mint a native S3 SigV4 URL that hits R2 **directly**, so the bytes never
-   * pass through the Worker — unlike {@link Storage.generateUploadUrl}, whose
-   * signed URL points back at this app so its storage rules still apply.
-   *
-   * Requires `s3` credentials on the `.storage({ s3 })` declaration; without
-   * them the call throws. That is the trade-off: no Worker in the path also
-   * means no rule enforcement in the path.
-   *
-   * Declared structurally rather than imported — `@lunora/server` does not
-   * depend on `@lunora/storage`, and this file mirrors that surface the same
-   * way `head` and `download` do.
-   */
-  getPresignedUrl: (key: string, options?: {
-    expiresInSeconds?: number;
-    method?: "GET" | "PUT";
-  }) => Promise<string>;
-  /**
-   * Upload `body` to `key` from the server, returning the stored object's key
-   * and etag. Mirrors Convex's `storage.store`. Accepts the same guard fields
-   * as `@lunora/storage`'s `UploadOptions` so `maxSize` /
-   * `allowedContentTypes` enforcement isn't lost behind the Convex-style alias.
-   */
-  store: (key: string, body: ReadableStream | ArrayBuffer | Blob, options?: {
-    allowedContentTypes?: ReadonlyArray<string>;
-    contentType?: string;
-    customMetadata?: Record<string, string>;
-    maxSize?: number;
-  }) => Promise<{
-    etag: string;
-    key: string;
-  }>;
-}
 interface VectorMatch {
   id: string;
   metadata?: Record<string, unknown>;
@@ -2613,4 +2741,4 @@ interface ActionCtx {
  */
 type AnyApi = Record<string, Record<string, RegisteredFunction<ArgsValidator, unknown, FunctionKind>>>;
 declare const anyApi: AnyApi;
-export { type ActionCtx, type AggregateIndexDefinition, type AggregateOp, type AnyApi, type ArgsValidator, type AuthState, type CachePurge, type DatabaseReader, type DatabaseWriter, type DurableObjectJurisdiction, type DurableStreamOptions, type ExposeConfig, type ExternalSourceCursor, type ExternalSourceDefinition, type ExternalSourceMode, type ExternalSourceRefresh, type FunctionKind, type FunctionVisibility, type GeoBoundingBox, type GeoFilterBuilder, type GeoIndexDefinition, type GeoPointInput, type GlobalBackend, type IndexDefinition, type IndexRangeBuilder, type InferArgs, type LifecycleEvent, type LifecycleEventKind, type LogFields, type LunoraLogMethod, type LunoraLogger, type LunoraMetrics, type LunoraTracer, type LunoraWideEvent, type MutationCtx, type MutationStorage, type OnDeleteAction, type PaginationOptions, type PaginationResult, type QueryCtx, type RankIndexDefinition, type RankSortKey, type ReadOnlyStorage, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMutation, type RegisteredQuery, type RegisteredStream, type RelatedDirection, type RelatedNode, type RelatedOptions, type RelatedPage, type RelatedStart, type RelatedStartReference, type RelationDefinition, type RestCacheConfig, type RetryPolicy, type RunQueryOptions, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type Schema, type SearchFilterBuilder, type SearchIndexDefinition, type SearchLanguage, type SearchStrategy, type Secrets, type SecretsStoreSecretLike, type ShardInitEvent, type ShardMode, type SpanContextIds, type SpanEvaluation, type SpanHandle, type SpanIdentity, type SpanKind, type SpanLink, type SpanOptions, type Storage, type StorageMetadata, type StorageObjectBody, type StorageObjectHead, type StorageRange, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableDefinition, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerBuilder, type TriggerCtx, type TriggerDatabase, type TriggerDefinition, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type TtlDefinition, type VectorEmbedder, type VectorIndexDefinition, type VectorMatch, type VectorMatches, type VectorMetric, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WhisperEvent, type WorkflowCreateOptions, type WorkflowEventDefinition, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceEvent, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, type X402ProcedureConfig, anyApi };
+export { type ActionCtx, type AggregateIndexDefinition, type AggregateOp, type AnyApi, type ArgsValidator, type AuthState, type CachePurge, type DatabaseReader, type DatabaseWriter, type DurableObjectJurisdiction, type DurableStreamOptions, type ExposeConfig, type ExternalSourceCursor, type ExternalSourceDefinition, type ExternalSourceMode, type ExternalSourceRefresh, type FunctionKind, type FunctionVisibility, type GeoBoundingBox, type GeoFilterBuilder, type GeoIndexDefinition, type GeoPointInput, type GlobalBackend, type IndexDefinition, type IndexRangeBuilder, type InferArgs, type LifecycleEvent, type LifecycleEventKind, type LogFields, type LunoraLogMethod, type LunoraLogger, type LunoraMetrics, type LunoraTracer, type LunoraWideEvent, type MutationCtx, type MutationStorage, type OnDeleteAction, type PaginationOptions, type PaginationResult, type QueryCtx, type RankIndexDefinition, type RankSortKey, type ReadOnlyStorage, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMutation, type RegisteredQuery, type RegisteredStream, type RelatedDirection, type RelatedNode, type RelatedOptions, type RelatedPage, type RelatedStart, type RelatedStartReference, type RelationDefinition, type RestCacheConfig, type RetryPolicy, type RunQueryOptions, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type Schema, type SearchFilterBuilder, type SearchIndexDefinition, type SearchLanguage, type SearchStrategy, type Secrets, type SecretsStoreSecretLike, type ShardInitEvent, type ShardMode, type SpanContextIds, type SpanEvaluation, type SpanHandle, type SpanIdentity, type SpanKind, type SpanLink, type SpanOptions, type Storage, type StorageListOptions, type StorageListResult, type StorageMetadata, type StorageMultipartUpload, type StorageMultipartUploadOptions, type StorageObjectBody, type StorageObjectHead, type StorageRange, type StorageUploadBody, type StorageUploadOptions, type StorageUploadResult, type StorageUploadedPart, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableDefinition, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerBuilder, type TriggerCtx, type TriggerDatabase, type TriggerDefinition, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type TtlDefinition, type VectorEmbedder, type VectorIndexDefinition, type VectorMatch, type VectorMatches, type VectorMetric, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WhisperEvent, type WorkflowCreateOptions, type WorkflowEventDefinition, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceEvent, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, type X402ProcedureConfig, anyApi };

package/dist/types.d.ts

@@ -63,6 +63,344 @@ interface RestCachePolicy {
   readonly tag?: string;
   readonly vary?: string;
 }
+/**
+ * The `ctx.storage` surface, per function tier: {@link ReadOnlyStorage} for a
+ * query, {@link MutationStorage} for a mutation, {@link Storage} for an action.
+ *
+ * A structural mirror of `@lunora/storage`'s `Storage` — `@lunora/server` takes
+ * no dependency on that package. Re-exported through `../types`, so the public
+ * names are unchanged.
+ */
+/**
+ * Per-file metadata returned by {@link ReadOnlyStorage.getMetadata}. A clean
+ * public mirror of `@lunora/storage`'s `ObjectMetadata` — re-declared here so
+ * the ctx surface carries no dependency on the storage package's types. Matches
+ * the columns Convex surfaces for `ctx.storage.getMetadata` / `_storage`.
+ */
+interface StorageMetadata {
+  /** The object's `Content-Type`, when recorded. */
+  contentType?: string;
+  /** Custom metadata set at upload time, if any. */
+  customMetadata?: Record<string, string>;
+  /** The object's key. */
+  key: string;
+  /** Hex-encoded SHA-256 of the body, when R2 carries a checksum. */
+  sha256?: string;
+  /** Body length in bytes. */
+  size: number;
+  /** When the object was last written (epoch ms), when reported. */
+  uploaded?: number;
+}
+/**
+ * The body-free object shape returned by {@link ReadOnlyStorage.head} — a clean
+ * public mirror of `@lunora/storage`'s head projection, re-declared here for the
+ * same reason as {@link StorageMetadata}: the ctx surface carries no dependency
+ * on the storage package's types.
+ *
+ * Richer than {@link StorageMetadata} on purpose. `getMetadata` is the tidy
+ * Convex-shaped summary; `head` is what an HTTP layer needs, so it keeps the
+ * validator (`etag`) and the base64 digest RFC 9530 `Repr-Digest` requires, and
+ * leaves `uploaded` as the `Date` the binding reports rather than epoch ms.
+ */
+interface StorageObjectHead {
+  /** Custom metadata set at upload time, if any. */
+  customMetadata?: Record<string, string>;
+  /**
+   * R2's unquoted etag (the MD5 hex for a single-part upload). Required: R2
+   * reports one on every object, and an HTTP layer built on `head()` (the
+   * `serveStorageObject` helper) needs it to emit a validator.
+   */
+  etag: string;
+  /** The already-quoted form of {@link StorageObjectHead.etag}, when the binding reports one. */
+  httpEtag?: string;
+  /** Recorded HTTP metadata, notably the `Content-Type`. */
+  httpMetadata?: {
+    contentType?: string;
+  };
+  /** The object's key. */
+  key: string;
+  /** Hex-encoded SHA-256 of the body, when R2 carries a checksum. */
+  sha256?: string;
+  /** Base64-encoded SHA-256 of the same checksum — the encoding RFC 9530 digest headers require. */
+  sha256Base64?: string;
+  /** The FULL object size in bytes: R2 reports the object's size, not a returned window's, which is what makes a head enough to resolve a `Range` against. */
+  size: number;
+  /** When the object was last written. */
+  uploaded?: Date;
+}
+/**
+ * Byte window forwarded to {@link ReadOnlyStorage.download} so R2 resolves the
+ * slice server-side and streams only those bytes back. Mirrors R2's own `range`
+ * option (`@lunora/platform`'s `R2RangeLike`), restated structurally so
+ * `@lunora/server` takes no dependency on the bindings package.
+ */
+type StorageRange = {
+  length?: number;
+  offset: number;
+} | {
+  length: number;
+  offset?: number;
+} | {
+  suffix: number;
+};
+/**
+ * A downloaded object: the same metadata {@link StorageObjectHead} carries, plus
+ * the body stream. This is what `download()` resolves to — R2's object, NOT a
+ * bare stream.
+ */
+interface StorageObjectBody extends StorageObjectHead {
+  /** The object body stream. `null` for a zero-byte object. */
+  body: ReadableStream | null;
+}
+/**
+ * Read-only projection of `Storage` exposed on `QueryCtx` / `MutationCtx`.
+ *
+ * Queries are pure reads, and mutations run inside a transactional scope —
+ * neither is allowed to perform side-effectful R2 writes (`upload`) or
+ * deletes (`delete`). They can, however, **read** existing objects and
+ * resolve signed URLs (the URL signing itself is HMAC-only — no R2 round
+ * trip), so the read-only surface keeps `download` and `getSignedUrl`. The
+ * full {@link Storage} surface stays on `ActionCtx`.
+ */
+interface ReadOnlyStorage<Buckets extends string = string> {
+  /**
+   * Select a named bucket (declared via `v.storage("name")`). The returned
+   * accessor's operations target that bucket — `ctx.storage.bucket("avatars")
+   * .download(key)`. The bare `ctx.storage` targets the default bucket.
+   */
+  bucket: (name: Buckets) => ReadOnlyStorage<Buckets>;
+  /** The bucket this accessor's operations target (the default for the bare `ctx.storage`). */
+  readonly bucketName: string;
+  /**
+   * Fetch an existing object. Returns the R2 object — metadata plus a `body`
+   * stream — or `null` when absent.
+   *
+   * NOT a bare stream: `new Response(await ctx.storage.download(key))` would
+   * stringify the object and serve the literal text `[object Object]`. Reach
+   * for the body explicitly:
+   *
+   * ```ts
+   * const object = await ctx.storage.download(key);
+   *
+   * return object ? new Response(object.body) : new Response("Not found", { status: 404 });
+   * ```
+   *
+   * (`serveStorageObject` from `@lunora/server` does this, plus range/ETag
+   * handling, for the common "serve a stored file over HTTP" case.)
+   *
+   * Pass `range` to have R2 resolve the byte window server-side, so the
+   * unwanted bytes never reach the worker.
+   */
+  download: (key: string, options?: {
+    range?: StorageRange;
+  }) => Promise<StorageObjectBody | null>;
+  /**
+   * Read a file's metadata (size, content-type, sha256, upload time, custom
+   * metadata) without fetching its body. Returns `null` when the object is
+   * absent. Mirrors Convex's `ctx.storage.getMetadata`.
+   */
+  getMetadata: (key: string) => Promise<StorageMetadata | null>;
+  /** Resolve a short-lived signed URL for an existing object. */
+  getSignedUrl: (key: string, options?: {
+    expiresInSeconds?: number;
+  }) => Promise<string>;
+  /** Public URL pointing at the configured base for `key`. */
+  getUrl: (key: string) => string;
+  /**
+   * Read an object's metadata with NO body transfer, as the raw object shape —
+   * `etag` and the base64 digest included, which is what an HTTP layer needs to
+   * answer a `Range` request. Returns `null` when the object is absent.
+   *
+   * {@link ReadOnlyStorage.getMetadata} is the tidier summary over the same
+   * read; reach for this one when building a response.
+   */
+  head: (key: string) => Promise<StorageObjectHead | null>;
+}
+/**
+ * `ctx.storage` inside a **mutation**: the read surface, plus the one write a
+ * transactional context can safely express. See `@lunora/server`'s
+ * `deferred-deletes.ts` for why `delete` itself stays action-only.
+ */
+interface MutationStorage<Buckets extends string = string> extends ReadOnlyStorage<Buckets> {
+  /** Select a named bucket; deletes queued on it are flushed against that bucket. */
+  bucket: (name: Buckets) => MutationStorage<Buckets>;
+  /**
+   * Queue `key` for deletion once this mutation commits.
+   *
+   * Returns `void`, not a promise: nothing has been attempted yet, so the object
+   * is still there on the next line. A rolled-back mutation never flushes, so
+   * the row deletion and the object cleanup cannot disagree. A failed delete
+   * leaks the object rather than failing a mutation that already succeeded, and
+   * is logged with its key.
+   */
+  deleteAfterCommit: (key: string) => void;
+}
+/**
+ * The body shapes `store` / `upload` accept — what R2's `put` stores bytes from.
+ * Mirrors `@lunora/storage`'s `Storage.upload` parameter.
+ */
+type StorageUploadBody = ArrayBuffer | ArrayBufferView | Blob | ReadableStream | string;
+/**
+ * Options for `store` / `upload` — a structural mirror of `@lunora/storage`'s
+ * `UploadOptions`, so the `maxSize` / `allowedContentTypes` guards are reachable
+ * from `ctx.storage` without a type dependency on the storage package.
+ */
+interface StorageUploadOptions {
+  /** Content-type allowlist; the supplied `contentType` must match. */
+  allowedContentTypes?: ReadonlyArray<string>;
+  contentType?: string;
+  customMetadata?: Record<string, string>;
+  /**
+   * Maximum body size in bytes. A `ReadableStream` is buffered under the cap,
+   * so on the stream path `maxSize` is itself capped at 16 MiB — above that use
+   * {@link Storage.createMultipartUpload}.
+   */
+  maxSize?: number;
+  /** SHA-256 of the body (hex or a 32-byte buffer); R2 records and verifies it. */
+  sha256?: ArrayBuffer | string;
+}
+/** What `store` / `upload` resolve to: the stored key plus its etag (unquoted and quoted). */
+interface StorageUploadResult {
+  etag: string;
+  httpEtag: string;
+  key: string;
+}
+/** One uploaded multipart part — returned by `uploadPart`, required by `complete`. Mirrors R2's `R2UploadedPart`. */
+interface StorageUploadedPart {
+  etag: string;
+  partNumber: number;
+}
+/**
+ * An in-progress R2 multipart upload, as {@link Storage.createMultipartUpload} /
+ * {@link Storage.resumeMultipartUpload} return it. A structural mirror of
+ * R2's own multipart upload handle, as `@lunora/platform` declares it.
+ *
+ * Every part except the last must be the same size, and at least 5 MiB. The
+ * object does not guarantee the upload still exists — a parallel `complete` /
+ * `abort` invalidates it — so handle errors on each call.
+ */
+interface StorageMultipartUpload {
+  /** Abort the upload, discarding every uploaded part. */
+  abort: () => Promise<void>;
+  /** Finish the upload from the collected parts; resolves to the stored object's metadata. */
+  complete: (uploadedParts: StorageUploadedPart[]) => Promise<StorageObjectHead>;
+  /** The object key being assembled. */
+  readonly key: string;
+  /** The R2 upload id — persist it to resume the upload in a later request. */
+  readonly uploadId: string;
+  /** Upload one part (1-indexed); returns the `{ partNumber, etag }` to pass to `complete`. */
+  uploadPart: (partNumber: number, value: StorageUploadBody) => Promise<StorageUploadedPart>;
+}
+/** Options for {@link Storage.createMultipartUpload}: the metadata recorded on the assembled object. */
+interface StorageMultipartUploadOptions {
+  contentType?: string;
+  customMetadata?: Record<string, string>;
+}
+/** Options for {@link Storage.list}. Mirrors `@lunora/storage`'s `ListOptions`. */
+interface StorageListOptions {
+  /** The `cursor` of the previous page. */
+  cursor?: string;
+  /** R2 list delimiter — keys sharing a segment roll up into `delimitedPrefixes`. */
+  delimiter?: string;
+  /** Page-size ceiling: defaults to 100, capped at 1000. A positive integer; anything else throws. */
+  limit?: number;
+}
+/** One page of {@link Storage.list}. */
+interface StorageListResult {
+  /** Pass back as `options.cursor` for the next page, while `truncated` is `true`. */
+  cursor?: string;
+  /** The rolled-up "folders" when `options.delimiter` is set — these are NOT in `objects`. */
+  delimitedPrefixes?: string[];
+  /** The objects on this page, body-free and JSON-serializable. */
+  objects: StorageObjectHead[];
+  /** `true` while more pages remain. Paginate on this, never on `objects.length`. */
+  truncated?: boolean;
+}
+/**
+ * `ctx.storage` inside an **action**: the full `@lunora/storage` `Storage`
+ * surface, plus `bucket(name)`.
+ *
+ * Declared structurally rather than imported — `@lunora/server` takes no
+ * runtime or published-type dependency on `@lunora/storage` — so it tracks that
+ * surface by hand. A type test (`__tests__/storage-surface.test-d.ts`) fails
+ * `tsc` when the two drift —
+ * the member sets differ (a runtime member left untyped here, or a member typed
+ * here the runtime lacks — `bucket` aside, which the ctx wiring adds); the
+ * runtime object no longer satisfies a signature here (a return type widened,
+ * or a parameter narrowed, upstream); or a parameter list here differs from the
+ * runtime's (an option or body shape the runtime takes but this interface
+ * refuses). `getSignedUrl` is the one deliberate parameter exception: its PUT
+ * options would mint an upload URL from a query.
+ *
+ * Return types here may be NARROWER than the runtime's on purpose — `head`
+ * resolves to the {@link StorageObjectHead} mirror rather than R2's object.
+ *
+ * Every member here is action-only. Under a procedure guarded by
+ * `storageRules(...)`, the write paths (`store` / `upload` /
+ * `createMultipartUpload` / `resumeMultipartUpload`) are gated as `write`, and
+ * `getPresignedUrl` / `list`, which no rule can gate, reject with `FORBIDDEN`.
+ */
+interface Storage<Buckets extends string = string> extends ReadOnlyStorage<Buckets> {
+  /** Select a named bucket; the returned accessor exposes the full read/write surface. */
+  bucket: (name: Buckets) => Storage<Buckets>;
+  /**
+   * Begin a native R2 **multipart upload** — for objects above `store()`'s
+   * 16 MiB stream cap, streamed through the Worker without buffering. Upload
+   * the parts (each at least 5 MiB and uniform in size, except the last), then
+   * `complete` with the returned parts, or `abort`. Persist `uploadId` to
+   * continue in a later request via {@link Storage.resumeMultipartUpload}.
+   */
+  createMultipartUpload: (key: string, options?: StorageMultipartUploadOptions) => Promise<StorageMultipartUpload>;
+  delete: (key: string) => Promise<void>;
+  /**
+   * Mint a short-lived signed `PUT` URL a client can upload directly to,
+   * optionally pinning the `Content-Type` the uploader must send. Mirrors
+   * Convex's `storage.generateUploadUrl`.
+   */
+  generateUploadUrl: (key: string, options?: {
+    contentType?: string;
+    expiresInSeconds?: number;
+  }) => Promise<string>;
+  /**
+   * Mint a native S3 SigV4 URL that hits R2 **directly**, so the bytes never
+   * pass through the Worker — unlike {@link Storage.generateUploadUrl}, whose
+   * signed URL points back at this app so its storage rules still apply.
+   *
+   * Requires `s3` credentials on the `.storage({ s3 })` declaration; without
+   * them the call throws. That is the trade-off: no Worker in the path also
+   * means no rule enforcement in the path.
+   */
+  getPresignedUrl: (key: string, options?: {
+    expiresInSeconds?: number;
+    method?: "GET" | "PUT";
+  }) => Promise<string>;
+  /**
+   * List objects under `prefix` — e.g. to sweep abandoned staging uploads. With
+   * `options.delimiter` set, keys sharing a segment roll up into
+   * `delimitedPrefixes` and are NOT in `objects`, so an empty `objects` is not
+   * an empty directory. A page may hold fewer objects than `options.limit`:
+   * paginate on `truncated` / `cursor`.
+   *
+   * Not gated by storage access rules (and dropped under `storageRules(...)`);
+   * a rule-scoped enumeration goes through `ctx.db.system.query("_storage")`.
+   */
+  list: (prefix?: string, options?: StorageListOptions) => Promise<StorageListResult>;
+  /**
+   * Resume an in-progress multipart upload by its `uploadId` (e.g. across
+   * requests). Synchronous: R2 does not validate the id, so a stale one
+   * surfaces as an error on the first `uploadPart` / `complete`.
+   */
+  resumeMultipartUpload: (key: string, uploadId: string) => StorageMultipartUpload;
+  /**
+   * Upload `body` to `key` from the server, returning the stored object's key
+   * and etag. Mirrors Convex's `storage.store`; the same function as
+   * {@link Storage.upload}, so the `maxSize` / `allowedContentTypes` guards
+   * apply through the alias.
+   */
+  store: (key: string, body: StorageUploadBody, options?: StorageUploadOptions) => Promise<StorageUploadResult>;
+  /** Upload `body` to `key` — {@link Storage.store} under `@lunora/storage`'s own name, with one shared signature. */
+  upload: Storage<Buckets>["store"];
+}
 /** Map of validators describing a function's args record. Alias of `@lunora/values`' shared {@link ValidatorMap}. */
 type ArgsValidator = ValidatorMap;
 /** Infer the args object type from an {@link ArgsValidator}. Alias of `@lunora/values`' shared {@link InferValidatorMap}. */
@@ -1774,216 +2112,6 @@ interface TriggerBuilder<Shape extends Record<string, Validator> = Record<string
   beforeInsert: (handler: TriggerHandler<TriggerInsertEvent<Shape>>) => TriggerDefinition;
   beforeUpdate: (handler: TriggerHandler<TriggerUpdateEvent<Shape>>) => TriggerDefinition;
 }
-/**
- * Per-file metadata returned by {@link ReadOnlyStorage.getMetadata}. A clean
- * public mirror of `@lunora/storage`'s `ObjectMetadata` — re-declared here so
- * the ctx surface carries no dependency on the storage package's types. Matches
- * the columns Convex surfaces for `ctx.storage.getMetadata` / `_storage`.
- */
-interface StorageMetadata {
-  /** The object's `Content-Type`, when recorded. */
-  contentType?: string;
-  /** Custom metadata set at upload time, if any. */
-  customMetadata?: Record<string, string>;
-  /** The object's key. */
-  key: string;
-  /** Hex-encoded SHA-256 of the body, when R2 carries a checksum. */
-  sha256?: string;
-  /** Body length in bytes. */
-  size: number;
-  /** When the object was last written (epoch ms), when reported. */
-  uploaded?: number;
-}
-/**
- * The body-free object shape returned by {@link ReadOnlyStorage.head} — a clean
- * public mirror of `@lunora/storage`'s head projection, re-declared here for the
- * same reason as {@link StorageMetadata}: the ctx surface carries no dependency
- * on the storage package's types.
- *
- * Richer than {@link StorageMetadata} on purpose. `getMetadata` is the tidy
- * Convex-shaped summary; `head` is what an HTTP layer needs, so it keeps the
- * validator (`etag`) and the base64 digest RFC 9530 `Repr-Digest` requires, and
- * leaves `uploaded` as the `Date` the binding reports rather than epoch ms.
- */
-interface StorageObjectHead {
-  /** Custom metadata set at upload time, if any. */
-  customMetadata?: Record<string, string>;
-  /**
-   * R2's unquoted etag (the MD5 hex for a single-part upload). Required: R2
-   * reports one on every object, and an HTTP layer built on `head()` (the
-   * `serveStorageObject` helper) needs it to emit a validator.
-   */
-  etag: string;
-  /** The already-quoted form of {@link StorageObjectHead.etag}, when the binding reports one. */
-  httpEtag?: string;
-  /** Recorded HTTP metadata, notably the `Content-Type`. */
-  httpMetadata?: {
-    contentType?: string;
-  };
-  /** The object's key. */
-  key: string;
-  /** Hex-encoded SHA-256 of the body, when R2 carries a checksum. */
-  sha256?: string;
-  /** Base64-encoded SHA-256 of the same checksum — the encoding RFC 9530 digest headers require. */
-  sha256Base64?: string;
-  /** The FULL object size in bytes: R2 reports the object's size, not a returned window's, which is what makes a head enough to resolve a `Range` against. */
-  size: number;
-  /** When the object was last written. */
-  uploaded?: Date;
-}
-/**
- * Byte window forwarded to {@link ReadOnlyStorage.download} so R2 resolves the
- * slice server-side and streams only those bytes back. Mirrors R2's own `range`
- * option (`@lunora/platform`'s `R2RangeLike`), restated structurally so
- * `@lunora/server` takes no dependency on the bindings package.
- */
-type StorageRange = {
-  length?: number;
-  offset: number;
-} | {
-  length: number;
-  offset?: number;
-} | {
-  suffix: number;
-};
-/**
- * A downloaded object: the same metadata {@link StorageObjectHead} carries, plus
- * the body stream. This is what `download()` resolves to — R2's object, NOT a
- * bare stream.
- */
-interface StorageObjectBody extends StorageObjectHead {
-  /** The object body stream. `null` for a zero-byte object. */
-  body: ReadableStream | null;
-}
-/**
- * Read-only projection of `Storage` exposed on `QueryCtx` / `MutationCtx`.
- *
- * Queries are pure reads, and mutations run inside a transactional scope —
- * neither is allowed to perform side-effectful R2 writes (`upload`) or
- * deletes (`delete`). They can, however, **read** existing objects and
- * resolve signed URLs (the URL signing itself is HMAC-only — no R2 round
- * trip), so the read-only surface keeps `download` and `getSignedUrl`. The
- * full {@link Storage} surface stays on `ActionCtx`.
- */
-interface ReadOnlyStorage<Buckets extends string = string> {
-  /**
-   * Select a named bucket (declared via `v.storage("name")`). The returned
-   * accessor's operations target that bucket — `ctx.storage.bucket("avatars")
-   * .download(key)`. The bare `ctx.storage` targets the default bucket.
-   */
-  bucket: (name: Buckets) => ReadOnlyStorage<Buckets>;
-  /** The bucket this accessor's operations target (the default for the bare `ctx.storage`). */
-  readonly bucketName: string;
-  /**
-   * Fetch an existing object. Returns the R2 object — metadata plus a `body`
-   * stream — or `null` when absent.
-   *
-   * NOT a bare stream: `new Response(await ctx.storage.download(key))` would
-   * stringify the object and serve the literal text `[object Object]`. Reach
-   * for the body explicitly:
-   *
-   * ```ts
-   * const object = await ctx.storage.download(key);
-   *
-   * return object ? new Response(object.body) : new Response("Not found", { status: 404 });
-   * ```
-   *
-   * (`serveStorageObject` from `@lunora/server` does this, plus range/ETag
-   * handling, for the common "serve a stored file over HTTP" case.)
-   *
-   * Pass `range` to have R2 resolve the byte window server-side, so the
-   * unwanted bytes never reach the worker.
-   */
-  download: (key: string, options?: {
-    range?: StorageRange;
-  }) => Promise<StorageObjectBody | null>;
-  /**
-   * Read a file's metadata (size, content-type, sha256, upload time, custom
-   * metadata) without fetching its body. Returns `null` when the object is
-   * absent. Mirrors Convex's `ctx.storage.getMetadata`.
-   */
-  getMetadata: (key: string) => Promise<StorageMetadata | null>;
-  /** Resolve a short-lived signed URL for an existing object. */
-  getSignedUrl: (key: string, options?: {
-    expiresInSeconds?: number;
-  }) => Promise<string>;
-  /** Public URL pointing at the configured base for `key`. */
-  getUrl: (key: string) => string;
-  /**
-   * Read an object's metadata with NO body transfer, as the raw object shape —
-   * `etag` and the base64 digest included, which is what an HTTP layer needs to
-   * answer a `Range` request. Returns `null` when the object is absent.
-   *
-   * {@link ReadOnlyStorage.getMetadata} is the tidier summary over the same
-   * read; reach for this one when building a response.
-   */
-  head: (key: string) => Promise<StorageObjectHead | null>;
-}
-/**
- * `ctx.storage` inside a **mutation**: the read surface, plus the one write a
- * transactional context can safely express. See `@lunora/server`'s
- * `deferred-deletes.ts` for why `delete` itself stays action-only.
- */
-interface MutationStorage<Buckets extends string = string> extends ReadOnlyStorage<Buckets> {
-  /** Select a named bucket; deletes queued on it are flushed against that bucket. */
-  bucket: (name: Buckets) => MutationStorage<Buckets>;
-  /**
-   * Queue `key` for deletion once this mutation commits.
-   *
-   * Returns `void`, not a promise: nothing has been attempted yet, so the object
-   * is still there on the next line. A rolled-back mutation never flushes, so
-   * the row deletion and the object cleanup cannot disagree. A failed delete
-   * leaks the object rather than failing a mutation that already succeeded, and
-   * is logged with its key.
-   */
-  deleteAfterCommit: (key: string) => void;
-}
-interface Storage<Buckets extends string = string> extends ReadOnlyStorage<Buckets> {
-  /** Select a named bucket; the returned accessor exposes the full read/write surface. */
-  bucket: (name: Buckets) => Storage<Buckets>;
-  delete: (key: string) => Promise<void>;
-  /**
-   * Mint a short-lived signed `PUT` URL a client can upload directly to,
-   * optionally pinning the `Content-Type` the uploader must send. Mirrors
-   * Convex's `storage.generateUploadUrl`.
-   */
-  generateUploadUrl: (key: string, options?: {
-    contentType?: string;
-    expiresInSeconds?: number;
-  }) => Promise<string>;
-  /**
-   * Mint a native S3 SigV4 URL that hits R2 **directly**, so the bytes never
-   * pass through the Worker — unlike {@link Storage.generateUploadUrl}, whose
-   * signed URL points back at this app so its storage rules still apply.
-   *
-   * Requires `s3` credentials on the `.storage({ s3 })` declaration; without
-   * them the call throws. That is the trade-off: no Worker in the path also
-   * means no rule enforcement in the path.
-   *
-   * Declared structurally rather than imported — `@lunora/server` does not
-   * depend on `@lunora/storage`, and this file mirrors that surface the same
-   * way `head` and `download` do.
-   */
-  getPresignedUrl: (key: string, options?: {
-    expiresInSeconds?: number;
-    method?: "GET" | "PUT";
-  }) => Promise<string>;
-  /**
-   * Upload `body` to `key` from the server, returning the stored object's key
-   * and etag. Mirrors Convex's `storage.store`. Accepts the same guard fields
-   * as `@lunora/storage`'s `UploadOptions` so `maxSize` /
-   * `allowedContentTypes` enforcement isn't lost behind the Convex-style alias.
-   */
-  store: (key: string, body: ReadableStream | ArrayBuffer | Blob, options?: {
-    allowedContentTypes?: ReadonlyArray<string>;
-    contentType?: string;
-    customMetadata?: Record<string, string>;
-    maxSize?: number;
-  }) => Promise<{
-    etag: string;
-    key: string;
-  }>;
-}
 interface VectorMatch {
   id: string;
   metadata?: Record<string, unknown>;
@@ -2613,4 +2741,4 @@ interface ActionCtx {
  */
 type AnyApi = Record<string, Record<string, RegisteredFunction<ArgsValidator, unknown, FunctionKind>>>;
 declare const anyApi: AnyApi;
-export { type ActionCtx, type AggregateIndexDefinition, type AggregateOp, type AnyApi, type ArgsValidator, type AuthState, type CachePurge, type DatabaseReader, type DatabaseWriter, type DurableObjectJurisdiction, type DurableStreamOptions, type ExposeConfig, type ExternalSourceCursor, type ExternalSourceDefinition, type ExternalSourceMode, type ExternalSourceRefresh, type FunctionKind, type FunctionVisibility, type GeoBoundingBox, type GeoFilterBuilder, type GeoIndexDefinition, type GeoPointInput, type GlobalBackend, type IndexDefinition, type IndexRangeBuilder, type InferArgs, type LifecycleEvent, type LifecycleEventKind, type LogFields, type LunoraLogMethod, type LunoraLogger, type LunoraMetrics, type LunoraTracer, type LunoraWideEvent, type MutationCtx, type MutationStorage, type OnDeleteAction, type PaginationOptions, type PaginationResult, type QueryCtx, type RankIndexDefinition, type RankSortKey, type ReadOnlyStorage, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMutation, type RegisteredQuery, type RegisteredStream, type RelatedDirection, type RelatedNode, type RelatedOptions, type RelatedPage, type RelatedStart, type RelatedStartReference, type RelationDefinition, type RestCacheConfig, type RetryPolicy, type RunQueryOptions, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type Schema, type SearchFilterBuilder, type SearchIndexDefinition, type SearchLanguage, type SearchStrategy, type Secrets, type SecretsStoreSecretLike, type ShardInitEvent, type ShardMode, type SpanContextIds, type SpanEvaluation, type SpanHandle, type SpanIdentity, type SpanKind, type SpanLink, type SpanOptions, type Storage, type StorageMetadata, type StorageObjectBody, type StorageObjectHead, type StorageRange, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableDefinition, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerBuilder, type TriggerCtx, type TriggerDatabase, type TriggerDefinition, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type TtlDefinition, type VectorEmbedder, type VectorIndexDefinition, type VectorMatch, type VectorMatches, type VectorMetric, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WhisperEvent, type WorkflowCreateOptions, type WorkflowEventDefinition, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceEvent, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, type X402ProcedureConfig, anyApi };
+export { type ActionCtx, type AggregateIndexDefinition, type AggregateOp, type AnyApi, type ArgsValidator, type AuthState, type CachePurge, type DatabaseReader, type DatabaseWriter, type DurableObjectJurisdiction, type DurableStreamOptions, type ExposeConfig, type ExternalSourceCursor, type ExternalSourceDefinition, type ExternalSourceMode, type ExternalSourceRefresh, type FunctionKind, type FunctionVisibility, type GeoBoundingBox, type GeoFilterBuilder, type GeoIndexDefinition, type GeoPointInput, type GlobalBackend, type IndexDefinition, type IndexRangeBuilder, type InferArgs, type LifecycleEvent, type LifecycleEventKind, type LogFields, type LunoraLogMethod, type LunoraLogger, type LunoraMetrics, type LunoraTracer, type LunoraWideEvent, type MutationCtx, type MutationStorage, type OnDeleteAction, type PaginationOptions, type PaginationResult, type QueryCtx, type RankIndexDefinition, type RankSortKey, type ReadOnlyStorage, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMutation, type RegisteredQuery, type RegisteredStream, type RelatedDirection, type RelatedNode, type RelatedOptions, type RelatedPage, type RelatedStart, type RelatedStartReference, type RelationDefinition, type RestCacheConfig, type RetryPolicy, type RunQueryOptions, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type Schema, type SearchFilterBuilder, type SearchIndexDefinition, type SearchLanguage, type SearchStrategy, type Secrets, type SecretsStoreSecretLike, type ShardInitEvent, type ShardMode, type SpanContextIds, type SpanEvaluation, type SpanHandle, type SpanIdentity, type SpanKind, type SpanLink, type SpanOptions, type Storage, type StorageListOptions, type StorageListResult, type StorageMetadata, type StorageMultipartUpload, type StorageMultipartUploadOptions, type StorageObjectBody, type StorageObjectHead, type StorageRange, type StorageUploadBody, type StorageUploadOptions, type StorageUploadResult, type StorageUploadedPart, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableDefinition, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerBuilder, type TriggerCtx, type TriggerDatabase, type TriggerDefinition, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type TtlDefinition, type VectorEmbedder, type VectorIndexDefinition, type VectorMatch, type VectorMatches, type VectorMetric, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WhisperEvent, type WorkflowCreateOptions, type WorkflowEventDefinition, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceEvent, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, type X402ProcedureConfig, anyApi };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/server",
-  "version": "1.0.0-alpha.172",
+  "version": "1.0.0-alpha.173",
   "description": "Server primitives for Lunora: defineSchema, defineTable, query, mutation, and action",
   "keywords": [
     "backend",
@@ -67,8 +67,8 @@
   },
   "dependencies": {
     "@lunora/errors": "1.0.0-alpha.50",
-    "@lunora/scheduler": "1.0.0-alpha.106",
-    "@lunora/shard-engine": "1.0.0-alpha.108",
+    "@lunora/scheduler": "1.0.0-alpha.107",
+    "@lunora/shard-engine": "1.0.0-alpha.109",
     "@lunora/values": "1.0.0-alpha.60",
     "drizzle-orm": "^0.45.2",
     "hono": "^4.13.7"

package/dist/packem_shared/storageRules-DSmSbQqS.mjs

@@ -1 +0,0 @@
-import{LunoraError as A}from"@lunora/errors";import{i as U,a as $}from"./middleware-ChNz4wOv.mjs";const N=(e,t,o)=>{const a=s=>o.isAllowed("list",s,t)&&o.isAllowed("read",s,t),{get:r,query:b}=e,l={...e},w=s=>s.filter(n=>typeof n.key=="string"&&a(n.key));return typeof r=="function"&&(l.get=async(s,n)=>(s==="_storage"&&o.assertAllowed("read",n,t),r(s,n))),typeof b=="function"&&(l.query=s=>{const n=b(s),{collect:p}=n;return s!=="_storage"||typeof p!="function"?n:{...n,collect:async()=>w(await p())}}),l},S=(e,t)=>{if(e===void 0)return!0;const o=e.endsWith("/")?e.slice(0,-1):e;return o===""||t===o||t.startsWith(`${o}/`)},D=e=>{const t=e[1],o=typeof t=="object"&&t!==null?t.method:void 0;return typeof o=="string"&&o.toUpperCase()==="PUT"?"write":"read"},E=[["delete","delete"],["deleteAfterCommit","delete"],["download","read"],["generateUploadUrl","write"],["getMetadata","read"],["getSignedUrl",D],["getUrl","read"],["head","read"],["store","write"]],M=(e,t)=>{try{return e(t).bucketName===t}catch{return!1}},P=(e,t)=>{const o=e.bucketName??"default",{bucket:a}=e;for(const r of new Set(t))if(!(r===o||typeof a=="function"&&M(a,r)))throw new A("INTERNAL",`storageRules: rule for bucket "${r}" governs nothing — this request's storage cannot address that bucket (the accessor is "${o}", and selecting "${r}" does not reach a bucket of that name). A rule on an unaddressable bucket leaves the operation it was written to gate wide open. Match the rule's \`bucket\` to the name the binding is registered under in \`.storage({ bucket, buckets })\`.`)},C=(e,t={})=>{const o=U(t.roles);return async({ctx:a,next:r})=>{const b=await $(a.auth??{},o),l=(c,u,d)=>{const h=e.filter(i=>i.on===c&&i.bucket===d);if(h.length===0)return!0;const f={auth:b,ctx:a,key:u};return h.some(i=>S(i.prefix,u)&&i.when(f)===!0)},w=(c,u,d)=>{if(!l(c,u,d))throw new A("FORBIDDEN",`storage ${c} on "${u}" in bucket "${d}" denied by access rule`)},s=c=>{const u=c.bucketName??"default",d={bucketName:u};for(const[f,i]of E){const k=c[f];typeof k=="function"&&(d[f]=(...y)=>{const R=typeof y[0]=="string"?y[0]:"",v=typeof i=="function"?i(y):i;return w(v,R,u),k(...y)})}const{bucket:h}=c;return typeof h=="function"&&(d.bucket=f=>s(h(f))),d},n=a.storage;if(n===void 0)return r();P(n,e.map(c=>c.bucket));const p={storage:s(n)},g=a.db,m=g?.system;return g!==void 0&&m!==void 0&&typeof m=="object"&&(p.db={...g,system:N(m,n.bucketName??"default",{assertAllowed:w,isAllowed:l})}),r({ctx:p})}};export{C as storageRules};