@lunora/server 1.0.0-alpha.2 → 1.0.0-alpha.21

package/dist/index.d.mts

@@ -1,10 +1,12 @@
-import { Validator, Infer, v } from '@lunora/values';
+import { Validator, Infer, ValidatorMap, InferValidatorMap, v } from '@lunora/values';
 export { type ColumnValidator, type Id, type Infer, ValidationError, type Validator, type ValidatorKind, v } from '@lunora/values';
-import { ArgsValidator, InferArgs, RegisteredAction, ActionCtx, MutationCtx, RegisteredMutation, QueryCtx, RegisteredQuery, RegisteredStream, FunctionKind, LifecycleEvent, RegisteredLifecycleHook, TableDefinition, RegisteredFunction, VectorIndexDefinition, Schema, AggregateOp, RelationDefinition, GlobalBackend, OnDeleteAction, TriggerBuilder, TriggerDefinition, VectorEmbedder, VectorMetric, AggregateIndexDefinition, RankIndexDefinition } from "./types.mjs";
-export { type AnyApi, type AuthState, type DatabaseReader, type DatabaseWriter, type FunctionVisibility, type IndexDefinition, type IndexRangeBuilder, type LifecycleEventKind, type LunoraLogger, type PaginationOptions, type PaginationResult, type RankSortKey, type ReadOnlyStorage, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type SearchFilterBuilder, type SearchIndexDefinition, type ShardMode, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerCtx, type TriggerDatabase, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type VectorMatch, type VectorMatches, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, anyApi } from "./types.mjs";
+import { ArgsValidator, InferArgs, RegisteredAction, ActionCtx, MutationCtx, RegisteredMutation, QueryCtx, RegisteredQuery, RegisteredStream, FunctionKind, Secrets, LifecycleEvent, RegisteredLifecycleHook, TableDefinition, RegisteredFunction, VectorIndexDefinition, Schema, AggregateOp, DurableObjectJurisdiction, RelationDefinition, GlobalBackend, OnDeleteAction, ExternalSourceDefinition, TriggerBuilder, TriggerDefinition, VectorEmbedder, VectorMetric, AggregateIndexDefinition, RankIndexDefinition } from "./types.mjs";
+export { type AnyApi, type AuthState, type CachePurge, type DatabaseReader, type DatabaseWriter, type FunctionVisibility, type IndexDefinition, type IndexRangeBuilder, type LifecycleEventKind, type LunoraLogger, type PaginationOptions, type PaginationResult, type RankSortKey, type ReadOnlyStorage, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type SearchFilterBuilder, type SearchIndexDefinition, type ShardMode, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerCtx, type TriggerDatabase, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type VectorMatch, type VectorMatches, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, anyApi } from "./types.mjs";
+import { LunoraError as LunoraError$1, LunoraErrorCode } from '@lunora/errors';
+export type { LunoraErrorCode } from '@lunora/errors';
 import { Context, Hono } from 'hono';
-import { b as Permission, R as Role, T as TypedDefinePolicyInput, a as Policy, D as DefinePolicyInput, W as WhereInput, c as RlsOptions } from "./packem_shared/types.d-DmvyEMD6.mjs";
-export type { d as PolicyContext, e as PolicyDecision, f as PolicyDecisionOf, P as PolicyOperation } from "./packem_shared/types.d-DmvyEMD6.mjs";
+import { b as Permission, R as Role, T as TypedDefinePolicyInput, a as Policy, D as DefinePolicyInput, W as WhereInput, c as RlsOptions } from "./packem_shared/types.d-BB3pjV0m.mjs";
+export type { d as PolicyContext, e as PolicyDecision, f as PolicyDecisionOf, P as PolicyOperation } from "./packem_shared/types.d-BB3pjV0m.mjs";
 export { type CronJob, type CronJobsBuilder, type CronScheduleKind, type DailySchedule, type IntervalSchedule, type MonthlySchedule, type WeeklySchedule, cronJobs } from '@lunora/scheduler';
 import "./data-model.mjs";
 /**
@@ -187,6 +189,13 @@ declare const initLunora: {
   dataModel: <DataModel>() => DataModelInit<DataModel>;
 };
 /**
+* Build the `ctx.secrets` reader from the worker `env`. `get(name)` resolves
+* `env[name].get()` — the `secrets_store_secrets[]` binding of that name. An
+* absent or non-Secrets-Store binding throws a directed error pointing at the
+* wrangler config; the lookup is lazy, so an unused secret never resolves.
+*/
+declare const createSecrets: (env: Record<string, unknown>) => Secrets;
+/**
 * Redact secrets from a free-form message. Masks, in order: any quoted value
 * whose contents look like a credential (so a value surfaced as `received string
 * "sk_live_…"` is masked even though the surrounding text is not a token); a
@@ -219,8 +228,7 @@ interface EnvKeyFailure {
 *
 * Named export only (no default) per the repo export convention.
 */
-declare class LunoraEnvError extends Error {
-  override readonly name = "LunoraEnvError";
+declare class LunoraEnvError extends LunoraError$1 {
   readonly failures: ReadonlyArray<EnvKeyFailure>;
   constructor(failures: ReadonlyArray<EnvKeyFailure>);
 }
@@ -270,75 +278,9 @@ interface EnvAccessor<S extends EnvShape> {
 * invalid — lazily on first access of that key, or eagerly via `config.parse(env)`.
 */
 declare const defineEnv: <S extends EnvShape>(shape: S) => EnvAccessor<S>;
-/**
-* Canonical error type for Lunora procedures and middleware.
-*
-* The runtime's structural error mapper keys off `name === "LunoraError"` plus
-* the numeric `status`, so throwing one of these from a handler or middleware
-* yields the right RPC/HTTP status without any further wiring. `code` carries
-* the machine-readable reason for clients.
-*/
-declare const CODE_STATUS: {
-  readonly BAD_REQUEST: 400;
-  readonly CONFLICT: 409;
-  /**
-  * `count()` invoked against a table whose context carries an active RLS
-  * policy. The operation itself is unsupported in an RLS-restricted reader
-  * (kitcn's documented constraint) — the request is well-formed and the
-  * caller is authorized, so this is a 422 (semantic conflict) rather than a
-  * 403 (policy denial).
-  */
-  readonly COUNT_RLS_UNSUPPORTED: 422;
-  readonly FORBIDDEN: 403;
-  readonly INTERNAL_SERVER_ERROR: 500;
-  /**
-  * An analytical reduction (`aggregate` / `groupBy`) was invoked over a
-  * column that the procedure's `mask()` middleware redacts. A masked column
-  * can't be summed, averaged, or grouped without leaking the very values the
-  * mask hides (a group key *is* the raw value; an aggregate is computed from
-  * it), so the operation fails closed. The request is well-formed and the
-  * caller is authorized — this is a 422 (semantic conflict), mirroring
-  * `COUNT_RLS_UNSUPPORTED`.
-  */
-  readonly MASK_UNSUPPORTED: 422;
-  readonly NOT_FOUND: 404;
-  readonly NOT_IMPLEMENTED: 501;
-  /**
-  * A write policy's `when` returned a relation-crossing predicate
-  * (`some`/`none`/`every`/`is`/`isNot`). The in-memory write-policy evaluator
-  * has no child fetcher and cannot resolve a relation node, so the policy is
-  * unsupported as written. Relation predicates are valid in *read* policies
-  * and query `where` clauses (the pre-resolver handles them there). The
-  * request is well-formed; this is a 422 (semantic conflict), mirroring the
-  * sibling `*_UNSUPPORTED` codes.
-  */
-  readonly RELATION_PREDICATE_UNSUPPORTED: 422;
-  readonly TOO_MANY_REQUESTS: 429;
-  readonly UNAUTHORIZED: 401;
-  readonly UNPROCESSABLE: 422;
-};
-type LunoraErrorCode = keyof typeof CODE_STATUS;
-declare class LunoraError extends Error {
-  override readonly name = "LunoraError";
-  readonly code: LunoraErrorCode;
-  readonly status: number;
-  constructor(code: LunoraErrorCode, message?: string);
-}
-/**
-* The per-table `ctx.db` accessor (the `ctx.db.messages.findMany(...)` form) and
-* the kitcn-style `ctx.orm` namespace, as plain runtime helpers. This is the ONE
-* source of truth for the facade shape, shared by two callers so they can never
-* drift (a drift here is security-relevant — a facade accessor the RLS
-* middleware forgot to re-bind would read around policy). `@lunora/codegen`
-* emits `ctx.db`/`ctx.orm` by calling these over the raw shard writer (and the
-* D1 `globalDb` writer for `.global()` tables); the RLS middleware re-binds the
-* policy tables by calling them over the policy-enforcing wrapped writer.
-*
-* `bindTableFacade(writer, table)` pins `tableName` on the structural writer so
-* callers address rows by id (`get`/`delete`/`patch`/`replace`) or by the bound
-* table (everything else). The binding is identical regardless of which writer
-* is passed — that's the whole point.
-*/
+declare class LunoraError extends LunoraError$1 {
+  constructor(code: LunoraErrorCode, message?: string, data?: unknown);
+}
 /**
 * Minimal structural writer the facade binds over. Declared with **method**
 * syntax (not arrow properties) so a more-specifically-typed writer — both
@@ -349,12 +291,19 @@ declare class LunoraError extends Error {
 interface FacadeWriterLike {
   aggregate(tableName: string, options: unknown): Promise<unknown>;
   count(tableName: string, where?: unknown): Promise<number>;
-  delete(id: string, expectedTable?: string): Promise<void>;
+  delete(id: string, expectedTable?: string, options?: {
+    hard?: boolean;
+  }): Promise<void>;
   deleteMany?(ids: ReadonlyArray<string>, options?: {
     limit?: number;
   }, expectedTable?: string): Promise<{
     deleted: number;
   }>;
+  deleteWhere?(tableName: string, where: Record<string, unknown>, options?: {
+    limit?: number;
+  }): Promise<{
+    deleted: number;
+  }>;
   findFirst(tableName: string, args?: unknown): Promise<unknown>;
   findFirstOrThrow(tableName: string, args?: unknown): Promise<unknown>;
   findMany(tableName: string, args?: unknown): Promise<unknown>;
@@ -363,52 +312,133 @@ interface FacadeWriterLike {
   insert(tableName: string, document: Record<string, unknown>): Promise<string>;
   insertMany?(tableName: string, documents: ReadonlyArray<Record<string, unknown>>, options?: {
     limit?: number;
-  }): Promise<string[]>;
+    skipDuplicates?: boolean;
+  }): Promise<(string | null)[]>;
   patch(id: string, patch: Record<string, unknown>, expectedTable?: string): Promise<void>;
   patchMany?(patches: ReadonlyArray<{
     id: string;
     patch: Record<string, unknown>;
   }>, options?: {
     limit?: number;
-  }, expectedTable?: string): Promise<void>;
+  }, expectedTable?: string): Promise<{
+    patched: number;
+  }>;
+  patchWhere?(tableName: string, args: {
+    patch: Record<string, unknown>;
+    where: Record<string, unknown>;
+  }, options?: {
+    limit?: number;
+  }): Promise<{
+    patched: number;
+  }>;
   query(tableName: string): {
     withSearchIndex(indexName: string, search: (q: unknown) => unknown): unknown;
   };
   rank(tableName: string, indexName: string, options: unknown): Promise<unknown>;
   rankPage(tableName: string, indexName: string, options?: unknown): Promise<unknown>;
   replace(id: string, document: Record<string, unknown>, expectedTable?: string): Promise<void>;
+  restore?(id: string, expectedTable?: string): Promise<void>;
 }
 /** The per-table accessor object returned for the `ctx.db` table form. */
 interface FacadeEntry {
   aggregate: (options: unknown) => Promise<unknown>;
   count: (where?: unknown) => Promise<number>;
   delete: (id: string) => Promise<void>;
-  deleteMany: (ids: ReadonlyArray<string>, options?: {
-    limit?: number;
-  }) => Promise<{
-    deleted: number;
-  }>;
+  deleteMany: {
+    (ids: ReadonlyArray<string>, options?: {
+      limit?: number;
+    }): Promise<{
+      deleted: number;
+    }>;
+    (args: {
+      limit?: number;
+      where: Record<string, unknown>;
+    }): Promise<{
+      deleted: number;
+    }>;
+  };
+  /** `true` when at least one row matches `where` (or any row exists when omitted). Honors RLS like `findFirst`. */
+  exists: (where?: unknown) => Promise<boolean>;
   findFirst: (args?: unknown) => Promise<unknown>;
   findFirstOrThrow: (args?: unknown) => Promise<unknown>;
   findMany: (args?: unknown) => Promise<unknown>;
   get: (id: string) => Promise<unknown>;
   groupBy: (options: unknown) => Promise<unknown>;
-  insert: (document: Record<string, unknown>) => Promise<string>;
+  /** Physically remove a row (and physically cascade), bypassing `.softDelete()`. */
+  hardDelete: (id: string) => Promise<void>;
+  insert: (document: Record<string, unknown>, options?: FacadeInsertOptions) => Promise<null | string>;
+  /**
+  * Insert many documents into this table in one call. With
+  * `{ skipDuplicates: true }`, UNIQUE breaches resolve to `null` for that row
+  * instead of failing the batch. The typed facade narrows the return to
+  * `Id&lt;T>[]` when skipDuplicates is not requested.
+  */
   insertMany: (documents: ReadonlyArray<Record<string, unknown>>, options?: {
     limit?: number;
-  }) => Promise<string[]>;
+    skipDuplicates?: boolean;
+  }) => Promise<(string | null)[]>;
   patch: (id: string, patch: Record<string, unknown>) => Promise<void>;
-  patchMany: (patches: ReadonlyArray<{
-    id: string;
-    values: Record<string, unknown>;
-  }>, options?: {
-    limit?: number;
-  }) => Promise<void>;
+  patchMany: {
+    (patches: ReadonlyArray<{
+      id: string;
+      values: Record<string, unknown>;
+    }>, options?: {
+      limit?: number;
+    }): Promise<{
+      patched: number;
+    }>;
+    (args: {
+      limit?: number;
+      values: Record<string, unknown>;
+      where: Record<string, unknown>;
+    }): Promise<{
+      patched: number;
+    }>;
+  };
   rank: (indexName: string, options: unknown) => Promise<unknown>;
   rankPage: (indexName: string, options?: unknown) => Promise<unknown>;
   replace: (id: string, document: Record<string, unknown>) => Promise<void>;
+  /** Un-soft-delete a row: clears the `.softDelete()` marker (by-id, so it reaches a row list reads hide). */
+  restore: (id: string) => Promise<void>;
+  /** Insert when no row matches `target`, else patch the match. Composes `findFirst` + `insert`/`patch`, so RLS applies to each step. */
+  upsert: (args: UpsertArgs) => Promise<UpsertResult>;
+  /** Sequential `upsert` over many rows sharing one `target`; returns one result per input row in order. */
+  upsertMany: (args: UpsertManyArgs) => Promise<UpsertResult[]>;
   withSearchIndex: (indexName: string, search: (q: unknown) => unknown) => unknown;
 }
+/** Options accepted by the per-table `insert` accessor. */
+interface FacadeInsertOptions {
+  /**
+  * When `true`, a UNIQUE-constraint breach is swallowed: the insert becomes a
+  * silent no-op and resolves to `null` instead of throwing a `CONFLICT`. Any
+  * other error still propagates. Mirrors better-drizzle's `create({ skipDuplicates })`.
+  */
+  skipDuplicates?: boolean;
+}
+/** The conflict target for `upsert`/`upsertMany`: one field name or a tuple of them. */
+type UpsertTarget = ReadonlyArray<string> | string;
+/** Argument to the per-table `upsert` accessor. */
+interface UpsertArgs {
+  /** Document inserted when no existing row matches the `target`. */
+  create: Record<string, unknown>;
+  /** Field(s) — typically a `.unique()` column or unique index — used to look up an existing row. */
+  target: UpsertTarget;
+  /** Patch applied when an existing row matches the `target`. Defaults to `create`. */
+  update?: Record<string, unknown>;
+}
+/** Result of an `upsert`: the row's id and whether it was freshly inserted (`true`) or updated (`false`). */
+interface UpsertResult {
+  created: boolean;
+  id: string;
+}
+/** Argument to the per-table `upsertMany` accessor — a shared `target` plus per-row create/update payloads. */
+interface UpsertManyArgs {
+  rows: ReadonlyArray<{
+    create: Record<string, unknown>;
+    update?: Record<string, unknown>;
+  }>;
+  target: UpsertTarget;
+}
 /**
 * Bind a structural writer to one table, producing its `ctx.db` table accessor.
 *
@@ -426,7 +456,7 @@ declare const bindTableFacade: (writer: FacadeWriterLike, tableName: string) =>
 interface OrmLike {
   delete: (table: string, id: string) => Promise<void>;
   insert: (table: string) => {
-    values: (document: Record<string, unknown>) => Promise<string>;
+    values: (document: Record<string, unknown>) => Promise<null | string>;
   };
   query: Record<string, FacadeEntry>;
   replace: (table: string, id: string) => {
@@ -447,7 +477,7 @@ type HttpMethod = "DELETE" | "GET" | "HEAD" | "OPTIONS" | "PATCH" | "POST" | "PU
 * `storage` surface — reach the data layer through `runQuery` / `runMutation` /
 * `runAction`, which forward to the owning shard.
 */
-type HttpActionCtx = Pick<ActionCtx, "auth" | "fetch" | "runAction" | "runMutation" | "runQuery">;
+type HttpActionCtx = Pick<ActionCtx, "auth" | "cache" | "fetch" | "runAction" | "runMutation" | "runQuery">;
 /** A raw handler wrapped by {@link httpAction}. Receives the raw request, returns the raw response. */
 type HttpActionHandler = (context: HttpActionCtx, request: Request) => Promise<Response> | Response;
 /**
@@ -531,6 +561,16 @@ interface HttpStreamHandlerOptions<SearchParams extends ArgsValidator, Params ex
 */
 interface HttpRouteBuilder<SearchParams extends ArgsValidator, Body extends ArgsValidator, Params extends ArgsValidator, Output = undefined> {
   body: <B extends ArgsValidator>(validators: B) => HttpRouteBuilder<SearchParams, B & Body, Params, Output>;
+  /**
+  * Attach a `Cache-Control` header to the response. Only meaningful when
+  * Workers Cache is enabled in `wrangler.jsonc` (`"cache": { "enabled": true }`).
+  */
+  cacheControl: (value: string) => HttpRouteBuilder<SearchParams, Body, Params, Output>;
+  /**
+  * Attach a `Cache-Tag` header to the response for tag-based purging via
+  * `ctx.cache.purge({ tags: [...] })`.
+  */
+  cacheTag: (value: string) => HttpRouteBuilder<SearchParams, Body, Params, Output>;
   handler: [Output] extends [undefined] ? <R>(handler: (options: HttpRouteHandlerOptions<SearchParams, Body, Params>) => Promise<R> | R) => LunoraRouteHandler : (handler: (options: HttpRouteHandlerOptions<SearchParams, Body, Params>) => Output | Promise<Output>) => LunoraRouteHandler;
   output: <V extends Validator>(validator: V) => HttpRouteBuilder<SearchParams, Body, Params, Infer<V>>;
   params: <P extends ArgsValidator>(validators: P) => HttpRouteBuilder<SearchParams, Body, P & Params, Output>;
@@ -545,6 +585,11 @@ interface HttpRouteBuilder<SearchParams extends ArgsValidator, Body extends Args
   * handler's yielded type.
   */
   stream: <R>(handler: (options: HttpStreamHandlerOptions<SearchParams, Params>) => AsyncGenerator<R, void, void> | AsyncIterable<R>) => LunoraRouteHandler;
+  /**
+  * Attach a `Vary` header to the response so Cloudflare stores separate
+  * cached variants per distinct value of the listed request headers.
+  */
+  vary: (value: string) => HttpRouteBuilder<SearchParams, Body, Params, Output>;
 }
 /** Opens a fresh {@link HttpRouteBuilder}. The `path` documents intent; hono owns the actual routing at mount. */
 type HttpRouteFactory = (path: string) => HttpRouteBuilder<EmptyArgs, EmptyArgs, EmptyArgs>;
@@ -616,6 +661,15 @@ interface ContextWithStorage {
   storage: StorageDownloader;
 }
 /**
+* True when `value` is safe to use as an HTTP header field-value: no CR, LF, or
+* NUL. Guards against response-header injection / `Headers`-construction throws
+* when reflecting attacker-influenced object metadata (e.g. a stored
+* `Content-Type`). Exported (see the `export {}` at the file end) so an `httpAction`
+* handler can guard a request-derived header value before writing it — the fix the
+* `http_action_response_header_injection` advisor lint points to.
+*/
+declare const isSafeHeaderValue: (value: string) => boolean;
+/**
 * Stream a stored object as an HTTP {@link Response} from an `httpAction`
 * handler, with correct `Content-Type`, `ETag`, and `Accept-Ranges: bytes`.
 * Honors a single-range `Range` request → **206 Partial Content** with
@@ -631,6 +685,76 @@ interface ContextWithStorage {
 * client then ranges against R2/CDN directly with no Worker hop.
 */
 declare const serveStorageObject: (context: ContextWithStorage, key: string, request: Request) => Promise<Response>;
+/**
+* What the worker does with a resolver's identity when it fails contract
+* validation (a forged / malformed claim set arriving from an untrusted token).
+* `"anonymous"` (default, safe) treats the request as anonymous, so the bad
+* identity never reaches a policy as a valid identity (`ctx.auth.userId`
+* becomes `undefined`). `"reject"` fails the request closed (a `401`) — use
+* when a malformed credential should be a hard error, not a silent downgrade.
+*/
+type IdentityRejectMode = "anonymous" | "reject";
+/** Options for {@link defineIdentity}. */
+interface DefineIdentityOptions {
+  /**
+  * How to handle a resolver identity that violates the contract at the trust
+  * boundary. Defaults to `"anonymous"` (a forged claim set is downgraded to
+  * anonymous rather than flowing in as an unchecked cast).
+  */
+  readonly onInvalid?: IdentityRejectMode;
+}
+/** Result of validating a candidate identity against the contract. */
+type IdentityValidation = {
+  ok: true;
+} | {
+  error: string;
+  ok: false;
+};
+/**
+* A declared identity claim contract. Carries the codegen discovery brand, the
+* declared claim validators, the reject policy, and a runtime `validate`. The
+* `TClaims` type parameter is the inferred claim shape (always extending
+* `{ userId: string }`); it is phantom (no runtime field) and exists so
+* `@lunora/codegen` and {@link InferIdentity} can recover the type.
+*/
+interface IdentityContract<TClaims extends {
+  userId: string;
+} = {
+  userId: string;
+}> {
+  /**
+  * Phantom carrier for the inferred claim type. Never populated at runtime
+  * (`undefined`); present only so the type flows to codegen / {@link InferIdentity}.
+  */
+  readonly __claimType?: TClaims;
+  readonly __lunoraIdentity: true;
+  /** The declared claim validators (a `@lunora/values` validator map). */
+  readonly claims: ValidatorMap;
+  /** Reject policy applied at the trust boundary. See {@link IdentityRejectMode}. */
+  readonly onInvalid: IdentityRejectMode;
+  /**
+  * Validate a resolver's returned identity against the declared claims. On
+  * success the caller keeps the original identity untouched (so undeclared
+  * claims are forwarded verbatim, preserving today's behaviour); on failure
+  * the worker applies the `onInvalid` policy.
+  */
+  validate: (identity: Record<string, unknown>) => IdentityValidation;
+}
+/** Recover the declared claim type from a {@link defineIdentity} contract. */
+type InferIdentity<T> = T extends IdentityContract<infer TClaims> ? TClaims : never;
+/**
+* Declare the identity claim contract. `claims` is a `@lunora/values` validator
+* map whose inferred type must extend `{ userId: string }` — if it does not
+* (e.g. `userId` is missing or not a required string), the argument type
+* collapses to `never` and the call fails to typecheck.
+* @example
+* export const identity = defineIdentity({ userId: v.string(), tenantId: v.optional(v.string()), scopes: v.optional(v.array(v.string())) });
+*/
+declare const defineIdentity: <A extends ValidatorMap>(claims: InferValidatorMap<A> extends {
+  userId: string;
+} ? A : never, options?: DefineIdentityOptions) => IdentityContract<InferValidatorMap<A> & {
+  userId: string;
+}>;
 /** Handler for a connection-lifecycle hook. */
 type LifecycleHandler = (context: MutationCtx, event: LifecycleEvent) => Promise<void> | void;
 /** Register a hook that fires once when a client's WebSocket connects. */
@@ -761,6 +885,11 @@ interface MaskDatabase {
   }) => Promise<{
     deleted: number;
   }>;
+  deleteWhere?: (tableName: string, where: Record<string, unknown>, options?: {
+    limit?: number;
+  }) => Promise<{
+    deleted: number;
+  }>;
   findFirst: (tableName: string, args?: QueryArgs$1) => Promise<Record<string, unknown> | null>;
   findFirstOrThrow: (tableName: string, args?: QueryArgs$1) => Promise<Record<string, unknown>>;
   findMany: (tableName: string, args?: QueryArgs$1) => Promise<QueryPage$1>;
@@ -772,7 +901,8 @@ interface MaskDatabase {
   insert: (tableName: string, document: Record<string, unknown>) => Promise<string>;
   insertMany: (tableName: string, documents: ReadonlyArray<Record<string, unknown>>, options?: {
     limit?: number;
-  }) => Promise<string[]>;
+    skipDuplicates?: boolean;
+  }) => Promise<(string | null)[]>;
   lookupById?: (id: string, expectedTable?: string) => Promise<null | {
     row: Record<string, unknown>;
     tableName: string;
@@ -783,7 +913,17 @@ interface MaskDatabase {
     patch: Record<string, unknown>;
   }>, options?: {
     limit?: number;
-  }) => Promise<void>;
+  }) => Promise<{
+    patched: number;
+  }>;
+  patchWhere?: (tableName: string, args: {
+    patch: Record<string, unknown>;
+    where: Record<string, unknown>;
+  }, options?: {
+    limit?: number;
+  }) => Promise<{
+    patched: number;
+  }>;
   query: (tableName: string) => TableReaderLike$1;
   rank: (tableName: string, indexName: string, options: unknown) => Promise<null | {
     position: number;
@@ -815,21 +955,6 @@ interface MaskContextIn {
 * includes this middleware — opt-in, never global (the same invariant as RLS).
 */
 declare const mask: <Context extends MaskContextIn = MaskContextIn>(policies: MaskPolicies<Context>, options?: MaskOptions<Context>) => Middleware<Context, Context>;
-/**
-* Online data-migration authoring API.
-*
-* `defineMigration` declares a per-document backfill over one table: `up`
-* transforms every existing row, `down` (optional) reverses it. Unlike the D1
-* SQL schema migrations in `@lunora/d1`, these run *inside each shard's*
-* Durable Object against live documents, in keyset batches, and are resumable —
-* the per-shard runner in `@lunora/do` tracks progress in a reserved
-* `__lunora_migrations` table so an interrupted run picks up where it stopped.
-*
-* The returned object carries a `__lunoraMigration` brand so codegen can
-* discover declarations through the type checker (mirroring the procedure
-* builder's `__lunoraProcedure` brand) and emit them into a `LUNORA_MIGRATIONS`
-* registry the DO and CLI look migrations up by id.
-*/
 /** A document handed to a migration transform: the stored row including `_id`/`_creationTime`. */
 type MigrationDocument = Record<string, unknown>;
 /**
@@ -858,6 +983,55 @@ interface RegisteredMigration extends MigrationDefinition {
 /** Declare an online data migration. See the module docs for runtime semantics. */
 declare const defineMigration: (definition: MigrationDefinition) => RegisteredMigration;
 /**
+* A mutator declaration. `server` is authoritative; `client` is the optimistic
+* twin (optional — omit it to let the optimistic write fall through to the
+* server round-trip with no local preview). Both receive the same validated
+* `args`.
+*/
+interface MutatorDefinition<Args extends ValidatorMap = ValidatorMap, ServerContext = MutationCtx, ClientTx = unknown, R = unknown> {
+  /**
+  * Validator for the mutator's arguments. Validated on the DO before `server`
+  * runs and (when present) on the client before `client` runs, so both impls
+  * see the same parsed shape. Omit for a parameterless mutator.
+  */
+  readonly args?: Args;
+  /**
+  * Optimistic client implementation. Runs in a TanStack DB transaction
+  * against the local collections; its writes are applied immediately and
+  * automatically rolled back / rebased as the authoritative result syncs
+  * back. Pure and side-effect-free beyond the local store. Omit to skip the
+  * local preview.
+  */
+  readonly client?: (tx: ClientTx, args: InferValidatorMap<Args>) => Promise<void> | void;
+  /**
+  * Authoritative server implementation. Runs inside the shard DO with a full
+  * {@link MutationContext} (`ctx.db` writer); its writes append to `__cdc_log`
+  * and poke back to subscribers. This is the source of truth — the client
+  * impl is only a prediction of it.
+  */
+  readonly server: (context: ServerContext, args: InferValidatorMap<Args>) => Promise<R> | R;
+}
+/**
+* A {@link MutatorDefinition} plus the codegen discovery marker and a
+* dispatch-shaped `handler` (validates `args`, then runs `server`) so the DO
+* invokes a mutator exactly like a registered procedure.
+*/
+interface RegisteredMutator<Args extends ValidatorMap = ValidatorMap, ServerContext = MutationCtx, ClientTx = unknown, R = unknown> extends MutatorDefinition<Args, ServerContext, ClientTx, R> {
+  readonly __lunoraMutator: true;
+  /** Validate `rawArgs`, then run the authoritative `server` impl. Used by the DO push path. */
+  readonly handler: (context: ServerContext, rawArgs: Record<string, unknown>) => Promise<R>;
+  /**
+  * Marks the dispatch kind so codegen can register the mutator in the same
+  * `LUNORA_FUNCTIONS` table queries/mutations use — the DO's `handleRpc`
+  * reads `kind === "mutation"` to wrap the authoritative `server` impl in the
+  * shard's BEGIN/COMMIT span (all-or-nothing writes), exactly like an
+  * ordinary `mutation`.
+  */
+  readonly kind: "mutation";
+}
+/** Declare a custom mutator. See the module docs for runtime semantics. */
+declare const defineMutator: <Args extends ValidatorMap = ValidatorMap, ServerContext = MutationCtx, ClientTx = unknown, R = unknown>(definition: MutatorDefinition<Args, ServerContext, ClientTx, R>) => RegisteredMutator<Args, ServerContext, ClientTx, R>;
+/**
 * The prefixed tables a single plugin `P` contributes, or an empty map when it
 * ships no schema extension. Mirrors {@link PrefixedTables} at the plugin level
 * so {@link InstalledTables} can fold a tuple of plugins.
@@ -1168,6 +1342,35 @@ interface TableBuilder<Shape extends Record<string, Validator> = Record<string,
   }) => TableBuilder<Shape>;
   /** Route storage by the named field — one DO per distinct value. */
   shardBy: (field: keyof Shape & string) => TableBuilder<Shape>;
+  /**
+  * Turn on soft delete. Adds a nullable timestamp column (`options.field`,
+  * default `deletedAt`) and changes `ctx.db.&lt;table>.delete()` to **set** it
+  * instead of removing the row; `onDelete: "cascade"` children are recursively
+  * soft-deleted too. **List reads** (`findMany`/`findFirst`/`query()`/`count`/
+  * `aggregate`/relation loads) then hide soft-deleted rows unless they pass
+  * `includeDeleted: true`; by-id `get`/`patch`/`replace` and the new
+  * `restore()` still address the row directly. `hardDelete()` physically
+  * removes it (cascading as a real delete). Note: `includeDeleted` is a read
+  * scope, not access control — anyone who can run the read can set it; a unique
+  * index still rejects a new row that collides with a soft-deleted one (the row
+  * physically persists).
+  */
+  softDelete: (options?: {
+    field?: string;
+  }) => TableBuilder<Shape>;
+  /**
+  * Materialize this table from an external Postgres/MySQL behind Cloudflare
+  * Hyperdrive (plan 077). A system-driven poll loop reads the tenant slice
+  * (`query`, with params bound from `tenantBy`) and lands it in the DO's SQLite,
+  * after which `defineShape` carries it to clients unchanged. Implies
+  * `.externallyManaged()` (rows come from the ingest loop, not user mutations).
+  *
+  * Orthogonal to `.shardBy()` — combine them for per-tenant DOs. **Under
+  * `.shardBy()` `tenantBy` is mandatory** (the tenant-isolation boundary); the
+  * `external_source_unscoped` advisor lint fails the build when it is absent, and
+  * `external_source_on_global` rejects combining `.source()` with `.global()`.
+  */
+  source: (definition: ExternalSourceDefinition) => TableBuilder<Shape>;
   /** Declare named lifecycle triggers fired inline within the write path. */
   triggers: (build: (t: TriggerBuilder<Shape>) => Record<string, TriggerDefinition>) => TableBuilder<Shape>;
   /** Declare a vector index over a single text field on this table. */
@@ -1190,7 +1393,7 @@ interface VectorIndexOptions {
 * Build a table definition. Returned object is both the table definition (for
 * `defineSchema`) and a fluent builder for indexes + sharding metadata.
 */
-declare const defineTable: <Shape extends Record<string, Validator>>(shape: Shape) => TableBuilder<Shape>;
+declare const defineTable: <Shape extends Record<string, Validator>>(inputShape: Shape) => TableBuilder<Shape>;
 /**
 * Declare a standalone vector index (DSL Shape B). Pass the returned value in
 * the `vectorIndexes` map of {@link defineSchema} when the source is derived
@@ -1262,6 +1465,28 @@ type ExtendableSchema<T extends Record<string, TableDefinition>> = {
     readonly key: Key;
   }) => ExtendableSchema<PrefixedTables<X, Key> & T>;
   /**
+  * Pin every Durable Object the app reaches — shards, fan-out, subscriptions,
+  * the scheduler, and `ctx.containers` — to a Cloudflare data-residency
+  * jurisdiction (`"eu"`, `"us"`, `"fedramp"`). Codegen reads this off the
+  * schema and emits it into the generated worker's `createWorker({ jurisdiction })`
+  * (and `ctx.scheduler` / `ctx.containers`). Non-mutating: returns a fresh
+  * `ExtendableSchema`, so it composes with `.rls(...)` / `.extend(...)` in any order.
+  *
+  * ⚠️ **Set this once, before your first deploy — changing or removing it
+  * strands data.** A Durable Object name maps to a *different* ID in each
+  * jurisdiction, so toggling this on an existing app makes every shard, scheduler
+  * job, and session DO resolve to a NEW, empty DO; the previous data stays in the
+  * old jurisdiction's DOs and is no longer reachable. There is no in-place
+  * migration — you would have to export from the old jurisdiction and import
+  * into the new one.
+  *
+  * Note: this pins **DO-backed** state only. D1-backed state — `.global()`
+  * tables and `@lunora/auth` sessions alike — is governed by D1's own location
+  * settings, not this option.
+  * @see https://developers.cloudflare.com/durable-objects/reference/data-location/
+  */
+  jurisdiction: (jurisdiction: DurableObjectJurisdiction) => ExtendableSchema<T>;
+  /**
   * Turn on secure-by-default RLS for the whole schema. Every table is then
   * protected — the DO/D1 write path denies raw, non-RLS `ctx.db` access, so a
   * procedure that forgets `.use(rls(...))` fails closed. Opt a table out with
@@ -1433,7 +1658,7 @@ declare const definePolicy: <Context = unknown>(input: DefinePolicyInput<Context
 * the compile-time surface narrows, so a policy authored either way is
 * discovered identically by the `rls()` chain.
 */
-declare const createPolicyDsl: <DM, REL extends Record<keyof DM, object>>() => <T extends keyof DM, Context = unknown>(input: TypedDefinePolicyInput<DM, REL, T, Context>) => Policy<Context>;
+declare const createPolicyDsl: <DM, REL extends Record<keyof DM, object>, Identity = Record<string, unknown>>() => <T extends keyof DM, Context = unknown>(input: TypedDefinePolicyInput<DM, REL, T, Context, Identity>) => Policy<Context>;
 /**
 * Declare a named permission a policy can check with `ctx.auth.can(...)`. Grant
 * it to a role through `defineRole`'s `permissions`, register those roles with
@@ -1562,12 +1787,19 @@ interface DatabaseWriterLike {
   */
   aggregate: (tableName: string, options: AggregateArgs) => Promise<null | number>;
   count: (tableName: string, whereOrArgs?: CountArgs | WhereInput) => Promise<number>;
-  delete: (id: string, expectedTable?: string) => Promise<void>;
+  delete: (id: string, expectedTable?: string, options?: {
+    hard?: boolean;
+  }) => Promise<void>;
   deleteMany: (ids: ReadonlyArray<string>, options?: {
     limit?: number;
   }, expectedTable?: string) => Promise<{
     deleted: number;
   }>;
+  deleteWhere?: (tableName: string, where: WhereInput, options?: {
+    limit?: number;
+  }) => Promise<{
+    deleted: number;
+  }>;
   findFirst: (tableName: string, args?: QueryArgs) => Promise<Record<string, unknown> | null>;
   findFirstOrThrow: (tableName: string, args?: QueryArgs) => Promise<Record<string, unknown>>;
   findMany: (tableName: string, args?: QueryArgs) => Promise<QueryPage>;
@@ -1584,7 +1816,8 @@ interface DatabaseWriterLike {
   insert: (tableName: string, document: Record<string, unknown>) => Promise<string>;
   insertMany: (tableName: string, documents: ReadonlyArray<Record<string, unknown>>, options?: {
     limit?: number;
-  }) => Promise<string[]>;
+    skipDuplicates?: boolean;
+  }) => Promise<(string | null)[]>;
   insertManyUnsafe: (tableName: string, documents: ReadonlyArray<Record<string, unknown>>, options?: {
     allowExplicitId?: boolean;
     limit?: number;
@@ -1607,7 +1840,17 @@ interface DatabaseWriterLike {
     patch: Record<string, unknown>;
   }>, options?: {
     limit?: number;
-  }, expectedTable?: string) => Promise<void>;
+  }, expectedTable?: string) => Promise<{
+    patched: number;
+  }>;
+  patchWhere?: (tableName: string, args: {
+    patch: Record<string, unknown>;
+    where: WhereInput;
+  }, options?: {
+    limit?: number;
+  }) => Promise<{
+    patched: number;
+  }>;
   query: (tableName: string) => TableReaderLike;
   /**
   * Rank a row within its partition. A position is a count-of-rows-before, so
@@ -1633,6 +1876,7 @@ interface DatabaseWriterLike {
   */
   rankPage: (tableName: string, indexName: string, options?: RankPageArgs) => Promise<QueryPage>;
   replace: (id: string, document: Record<string, unknown>, expectedTable?: string) => Promise<void>;
+  restore?: (id: string, expectedTable?: string) => Promise<void>;
 }
 /**
 * What a procedure's `ctx.db` must structurally satisfy for the middleware
@@ -1656,6 +1900,104 @@ interface RlsContextIn {
 }
 declare const rls: <Context extends RlsContextIn = RlsContextIn>(policies: ReadonlyArray<Policy<Context>>, options?: RlsOptions) => Middleware<Context, Context>;
 /**
+* One `rls()` tag's read policies for a table, paired with the role→permission
+* grants of that SAME middleware. Keeping the role map per-group is what lets a
+* policy's `auth.can(...)` resolve against its own middleware's roles — never a
+* permission registered on a different `rls()` step.
+*/
+interface ScopedReadPolicies {
+  readonly policies: ReadonlyArray<Policy>;
+  readonly rolePermissions: ReadonlyMap<string, ReadonlySet<string>>;
+}
+/** Table-indexed read-policy groups, each scoped to the roles of the rls() middleware that declared it. */
+interface RlsReadRegistry {
+  readonly byTable: ReadonlyMap<string, ReadonlyArray<ScopedReadPolicies>>;
+}
+/** The trusted, server-resolved facts a shape's RLS evaluation runs under. */
+interface ShapeReadWhereRequest {
+  /** The shape ctx (the procedure context a policy `when` reads as `ctx`). */
+  readonly ctx: unknown;
+  /** Resolved identity claims (the socket's verified identity), or `null` when anonymous. */
+  readonly identity: Record<string, unknown> | null;
+  /** `true` when the schema is `.rls("required")` — gates the fail-closed branch. */
+  readonly rlsRequired: boolean;
+  /** Role labels the request carries (drives `auth.can(...)`). */
+  readonly roles: ReadonlyArray<string>;
+  /** The shape's own predicate (`where(ctx, args)`). */
+  readonly shapeWhere: WhereInput;
+  /** Logical table the shape replicates. */
+  readonly table: string;
+  /** `true` when the table is `.public()` (exempt from `.rls("required")` denial). */
+  readonly tablePublic: boolean;
+  /** Verified user id, or `null` when anonymous. */
+  readonly userId: null | string;
+}
+/**
+* Build the read-policy registry from the registered functions (pass
+* `Object.values(LUNORA_FUNCTIONS)`). Only `on: "read"` policies are collected,
+* grouped per `rls()` middleware so each group keeps its own role→permission map
+* (a `(table, when)` pair is de-duplicated within a tag). A tag reused across
+* several procedures (a shared `const guard = rls(...)`) is folded once. This
+* mirrors the request-time `rls()` path exactly: a policy's `auth.can(...)`
+* resolves against the roles of the middleware that declared it, never a union.
+*/
+declare const buildRlsReadRegistry: (functions: Iterable<unknown>) => RlsReadRegistry;
+/**
+* Compute the effective `where` a shape replicates: the table's RLS read
+* base-where AND the shape's own predicate. Returns the shape predicate
+* unchanged for a table with no read policy (a `.public()` or non-RLS table),
+* and the FALSE sentinel (replicate nothing) when a `.rls("required")` schema
+* exposes a protected, policy-less table.
+*/
+declare const composeShapeReadWhere: (registry: RlsReadRegistry, request: ShapeReadWhereRequest) => WhereInput;
+/**
+* A shape declaration. `where` receives the trusted procedure context and the
+* validated client args and returns the same {@link WhereInput} shape the RLS
+* DSL uses, so the DO can AND-merge it with the table's read base-where via the
+* existing where-compiler (zero second predicate implementation).
+*/
+interface ShapeDefinition<Args extends ValidatorMap = ValidatorMap, Context = QueryCtx> {
+  /**
+  * Validator for the client-supplied shape parameters. Validated on the DO
+  * before `where` runs, so a malformed `args` envelope is rejected at the
+  * subscription boundary rather than silently widening the partition. Omit
+  * for a parameterless shape.
+  */
+  readonly args?: Args;
+  /**
+  * Project the replicated rows to these columns (the system columns `_id` and
+  * `_creationTime` are always included). Omit to replicate every column. An
+  * empty array is rejected — it would replicate no data, which is never the
+  * intent.
+  */
+  readonly columns?: ReadonlyArray<string>;
+  /** Logical table this shape replicates a partition of. */
+  readonly table: string;
+  /**
+  * Predicate selecting the rows this shape replicates. AND-composed with the
+  * table's RLS read base-where on the DO. Runs server-side with a trusted
+  * `ctx` (identity/auth the client can't forge) and the validated client
+  * `args`; returns a {@link WhereInput} using the same operator set as the
+  * SQL compiler (`eq`/`in`/`lt`/… + `AND`/`OR`/`NOT`).
+  */
+  readonly where: (context: Context, args: InferValidatorMap<Args>) => WhereInput;
+}
+/** A {@link ShapeDefinition} plus the codegen discovery marker and a dispatch-shaped `compileWhere`. */
+interface RegisteredShape<Args extends ValidatorMap = ValidatorMap, Context = QueryCtx> extends ShapeDefinition<Args, Context> {
+  readonly __lunoraShape: true;
+  /**
+  * Validate `rawArgs`, then evaluate `where` under the trusted `ctx` and
+  * return its {@link WhereInput}. Used by the generated DO's `resolveShape`
+  * override: `ctx` is erased to `unknown` at this dispatch boundary (the DO
+  * builds it from the socket's verified identity and hands it back as the
+  * concrete {@link QueryContext} the predicate expects), exactly like
+  * `RegisteredLunoraFunction.handler` erases its context.
+  */
+  readonly compileWhere: (context: unknown, rawArgs: Record<string, unknown>) => WhereInput;
+}
+/** Declare a replication shape. See the module docs for runtime semantics. */
+declare const defineShape: <Args extends ValidatorMap = ValidatorMap, Context = QueryCtx>(definition: ShapeDefinition<Args, Context>) => RegisteredShape<Args, Context>;
+/**
 * Operations a storage rule can gate. `read` covers `download` / `getMetadata`
 * / `getSignedUrl` / `getUrl`; `write` covers `store` / `generateUploadUrl`;
 * `delete` is `delete`; `list` is a prefix listing (governed via the file
@@ -1738,4 +2080,4 @@ interface StorageContextIn {
 }
 declare const storageRules: <Context extends StorageContextIn = StorageContextIn>(rules: ReadonlyArray<StorageRule<Context>>, options?: StorageRulesOptions) => Middleware<Context, Context>;
 declare const VERSION = "0.0.0";
-export { type ActionBuilder, type ActionCtx, type AggregateIndexDefinition, type AggregateIndexOptions, type AggregateOp, type ArgsValidator, type Component, type ComponentFunctions, type CreateOptions, type DataModelInit, type DefineComponentOptions, type DefinePluginOptions, type DefinePolicyInput, type DefinePresenceOptions, type DefineStorageRuleInput, type EmptyArgs, type EnvAccessor, type EnvKeyFailure, type EnvShape, type ExtendableSchema, type FacadeEntry, type FacadeWriterLike, type FunctionKind, type HttpActionCtx, type HttpActionHandler, type HttpMethod, type HttpRoute, type HttpRouteBuilder, type HttpRouteFactory, type HttpRouteHandlerOptions, type HttpStreamHandlerOptions, type InferArgs, type InferEnv, type InlineAggregateIndexOptions, type InlineRankIndexOptions, type InternalActionBuilder, type InternalMutationBuilder, type InternalQueryBuilder, type LifecycleEvent, type LifecycleHandler, type LunoraBuilders, LunoraEnvError, LunoraError, type LunoraErrorCode, type LunoraHttpApp, type LunoraHttpEnv, type LunoraRouteHandler, type ManyRelation, type MaskColumns, type MaskContext, type MaskFn, type MaskOptions, type MaskPolicies, type MaskStrategy, type Middleware, type MiddlewareNext, type MigrationDefinition, type MigrationDocument, type MigrationTransform, type MutationBuilder, type MutationCtx, type OnDeleteAction, type OneRelation, type OrmLike, DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, type Permission, type Plugin, type Policy, type PrefixedTables, type PresenceComponent, type PresenceFunctions, type PresenceMember, type ProtectPublicOptions, type QueryBuilder, type QueryCtx, type RankIndexDefinition, type RankIndexOptions, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMigration, type RegisteredMutation, type RegisteredQuery, type RegisteredStream, type RelationBuilder, type RelationDefinition, type RlsOptions, type Role, type Schema, type SchemaExtension, type StorageOperation, type StorageRule, type StorageRuleContext, type StorageRuleDecision, type StorageRulesOptions, type TableBuilder, type TableDefinition, type TerminalKind, type TriggerBuilder, type TriggerDefinition, type TypedDefinePolicyInput, VERSION, type VectorEmbedder, type VectorIndexDefinition, type VectorIndexOptions, type VectorMetric, type VectorizeOptions, type WhereInput, asBucketStorage, bindOrm, bindTableFacade, composePluginMiddleware, createPolicyDsl, defineAggregateIndex, defineComponent, defineEnv, defineMigration, definePermission, definePlugin, definePolicies, definePolicy, definePresence, defineRankIndex, defineRole, defineSchema, defineSchemaExtension, defineStorageRule, defineStorageRules, defineTable, defineVectorIndex, httpAction, httpRoute, httpRouter, initLunora, installPlugins, mask, mergeSchemaExtension, onConnect, onDisconnect, presenceExtension, protectPublic, redactSecrets, rls, serveStorageObject, storageRules };
+export { type ActionBuilder, type ActionCtx, type AggregateIndexDefinition, type AggregateIndexOptions, type AggregateOp, type ArgsValidator, type Component, type ComponentFunctions, type CreateOptions, type DataModelInit, type DefineComponentOptions, type DefineIdentityOptions, type DefinePluginOptions, type DefinePolicyInput, type DefinePresenceOptions, type DefineStorageRuleInput, type DurableObjectJurisdiction, type EmptyArgs, type EnvAccessor, type EnvKeyFailure, type EnvShape, type ExtendableSchema, type FacadeEntry, type FacadeWriterLike, type FunctionKind, type HttpActionCtx, type HttpActionHandler, type HttpMethod, type HttpRoute, type HttpRouteBuilder, type HttpRouteFactory, type HttpRouteHandlerOptions, type HttpStreamHandlerOptions, type IdentityContract, type IdentityRejectMode, type IdentityValidation, type InferArgs, type InferEnv, type InferIdentity, type InlineAggregateIndexOptions, type InlineRankIndexOptions, type InternalActionBuilder, type InternalMutationBuilder, type InternalQueryBuilder, type LifecycleEvent, type LifecycleHandler, type LunoraBuilders, LunoraEnvError, LunoraError, type LunoraHttpApp, type LunoraHttpEnv, type LunoraRouteHandler, type ManyRelation, type MaskColumns, type MaskContext, type MaskFn, type MaskOptions, type MaskPolicies, type MaskStrategy, type Middleware, type MiddlewareNext, type MigrationDefinition, type MigrationDocument, type MigrationTransform, type MutationBuilder, type MutationCtx, type MutatorDefinition, type OnDeleteAction, type OneRelation, type OrmLike, DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, type Permission, type Plugin, type Policy, type PrefixedTables, type PresenceComponent, type PresenceFunctions, type PresenceMember, type ProtectPublicOptions, type QueryBuilder, type QueryCtx, type RankIndexDefinition, type RankIndexOptions, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMigration, type RegisteredMutation, type RegisteredMutator, type RegisteredQuery, type RegisteredShape, type RegisteredStream, type RelationBuilder, type RelationDefinition, type RlsOptions, type RlsReadRegistry, type Role, type Schema, type SchemaExtension, type ShapeDefinition, type ShapeReadWhereRequest, type StorageOperation, type StorageRule, type StorageRuleContext, type StorageRuleDecision, type StorageRulesOptions, type TableBuilder, type TableDefinition, type TerminalKind, type TriggerBuilder, type TriggerDefinition, type TypedDefinePolicyInput, VERSION, type VectorEmbedder, type VectorIndexDefinition, type VectorIndexOptions, type VectorMetric, type VectorizeOptions, type WhereInput, asBucketStorage, bindOrm, bindTableFacade, buildRlsReadRegistry, composePluginMiddleware, composeShapeReadWhere, createPolicyDsl, createSecrets, defineAggregateIndex, defineComponent, defineEnv, defineIdentity, defineMigration, defineMutator, definePermission, definePlugin, definePolicies, definePolicy, definePresence, defineRankIndex, defineRole, defineSchema, defineSchemaExtension, defineShape, defineStorageRule, defineStorageRules, defineTable, defineVectorIndex, httpAction, httpRoute, httpRouter, initLunora, installPlugins, isSafeHeaderValue, mask, mergeSchemaExtension, onConnect, onDisconnect, presenceExtension, protectPublic, redactSecrets, rls, serveStorageObject, storageRules };