@lunora/server 1.0.0-alpha.26 → 1.0.0-alpha.28

package/dist/types.d.ts

@@ -6,12 +6,12 @@ type InferArgs<A extends ArgsValidator> = InferValidatorMap<A>;
 /** Storage backend for a `.global()` table: D1 (default) or a Postgres/MySQL database via Cloudflare Hyperdrive (PlanetScale, Neon, …). */
 type GlobalBackend = "d1" | "hyperdrive";
 /**
-* Cloudflare Durable Object data-residency jurisdiction declared via
-* `defineSchema(...).jurisdiction("…")`. Restricts where every DO the app
-* reaches runs and persists data (GDPR, FedRAMP, US data residency). Widening
-* union — Cloudflare adds values over time.
-* @see https://developers.cloudflare.com/durable-objects/reference/data-location/
-*/
+ * Cloudflare Durable Object data-residency jurisdiction declared via
+ * `defineSchema(...).jurisdiction("…")`. Restricts where every DO the app
+ * reaches runs and persists data (GDPR, FedRAMP, US data residency). Widening
+ * union — Cloudflare adds values over time.
+ * @see https://developers.cloudflare.com/durable-objects/reference/data-location/
+ */
 type DurableObjectJurisdiction = "eu" | "fedramp" | "us";
 /** How a table is routed at runtime. */
 type ShardMode = {
@@ -28,31 +28,31 @@ type ExternalSourceRefresh = "manual" | {
   everyMs: number;
 };
 /**
-* Delete-detection mode for external-source ingest (plan 077 / 136).
-*
-* `"full-pull"` (the default) reads the **whole** tenant membership each tick and
-* diffs it, so it observes upstream deletes for free — but costs a full read per tick
-* (the Phase-0 bench put the ceiling at ~10k rows).
-*
-* `"incremental"` pulls **only rows past a durable watermark** (`cursor`), cheap for
-* large low-churn tables above the full-pull cap. Because an absent row then means
-* "unchanged", not "deleted", incremental requires a delete-visibility path: either a
-* `reconcileEveryMs` periodic full-pull sweep, or a `softDeleteColumn` whose
-* tombstones the pull returns. `defineSchema` throws (and the
-* `external_source_incremental_no_delete_path` advisor lint fails the build) when an
-* incremental source declares neither.
-*/
+ * Delete-detection mode for external-source ingest (plan 077 / 136).
+ *
+ * `"full-pull"` (the default) reads the **whole** tenant membership each tick and
+ * diffs it, so it observes upstream deletes for free — but costs a full read per tick
+ * (the Phase-0 bench put the ceiling at ~10k rows).
+ *
+ * `"incremental"` pulls **only rows past a durable watermark** (`cursor`), cheap for
+ * large low-churn tables above the full-pull cap. Because an absent row then means
+ * "unchanged", not "deleted", incremental requires a delete-visibility path: either a
+ * `reconcileEveryMs` periodic full-pull sweep, or a `softDeleteColumn` whose
+ * tombstones the pull returns. `defineSchema` throws (and the
+ * `external_source_incremental_no_delete_path` advisor lint fails the build) when an
+ * incremental source declares neither.
+ */
 type ExternalSourceMode = "full-pull" | "incremental";
 /**
-* Incremental-ingest cursor (plan 136): the monotonic watermark column plus the
-* watermark-parameterized pull query. `column` names the field in the pulled rows
-* whose max becomes the next watermark (e.g. `"updated_at"`). `query` is a second
-* SQL that returns only rows changed since the watermark — the watermark binds as
-* the parameter AFTER `tenantBy`'s params (e.g. Postgres
-* `... WHERE tenant_id = $1 AND updated_at >= $2 ORDER BY updated_at`). Prefer `>=`
-* with the idempotent upsert apply so rows sharing the boundary timestamp are never
-* skipped (re-pulling them is a no-op).
-*/
+ * Incremental-ingest cursor (plan 136): the monotonic watermark column plus the
+ * watermark-parameterized pull query. `column` names the field in the pulled rows
+ * whose max becomes the next watermark (e.g. `"updated_at"`). `query` is a second
+ * SQL that returns only rows changed since the watermark — the watermark binds as
+ * the parameter AFTER `tenantBy`'s params (e.g. Postgres
+ * `... WHERE tenant_id = $1 AND updated_at >= $2 ORDER BY updated_at`). Prefer `>=`
+ * with the idempotent upsert apply so rows sharing the boundary timestamp are never
+ * skipped (re-pulling them is a no-op).
+ */
 interface ExternalSourceCursor {
   /** The monotonic watermark column in the pulled rows; its max advances the stored watermark. */
   column: string;
@@ -60,14 +60,14 @@ interface ExternalSourceCursor {
   query: string;
 }
 /**
-* Config for `.source(...)` (plan 077): declares a table as **materialized from an
-* external Postgres/MySQL behind Cloudflare Hyperdrive**, not written by user
-* mutations. A system-driven poll loop reads the tenant slice and lands it in the
-* DO's SQLite (via the validated CDC writer), after which `defineShape` carries it
-* to clients unchanged. Orthogonal to `shardMode` — a sourced table almost always
-* also `.shardBy()`s, in which case `tenantBy` is the mandatory tenant-isolation
-* boundary (enforced by the `external_source_unscoped` advisor lint).
-*/
+ * Config for `.source(...)` (plan 077): declares a table as **materialized from an
+ * external Postgres/MySQL behind Cloudflare Hyperdrive**, not written by user
+ * mutations. A system-driven poll loop reads the tenant slice and lands it in the
+ * DO's SQLite (via the validated CDC writer), after which `defineShape` carries it
+ * to clients unchanged. Orthogonal to `shardMode` — a sourced table almost always
+ * also `.shardBy()`s, in which case `tenantBy` is the mandatory tenant-isolation
+ * boundary (enforced by the `external_source_unscoped` advisor lint).
+ */
 interface ExternalSourceDefinition {
   /** The wrangler Hyperdrive binding name the poll loop reads from. */
   binding: string;
@@ -84,27 +84,27 @@ interface ExternalSourceDefinition {
   /** The full tenant-membership query, with driver-native placeholders (`$1` / `?`). `tenantBy` binds its params. */
   query: string;
   /**
-  * **Incremental delete-visibility (plan 136)**: run a full-pull sweep at most
-  * this often (millis) to GC upstream deletes an incremental slice can't see.
-  * One of `reconcileEveryMs` / `softDeleteColumn` is required for incremental;
-  * rejected on a `"full-pull"` source.
-  */
+   * **Incremental delete-visibility (plan 136)**: run a full-pull sweep at most
+   * this often (millis) to GC upstream deletes an incremental slice can't see.
+   * One of `reconcileEveryMs` / `softDeleteColumn` is required for incremental;
+   * rejected on a `"full-pull"` source.
+   */
   reconcileEveryMs?: number;
   /** Poll cadence, or `"manual"`. Omit ⇒ the runtime's size-scaled default. */
   refresh?: ExternalSourceRefresh;
   /**
-  * **Incremental delete-visibility (plan 136)**: the upstream soft-delete
-  * tombstone column (e.g. `"deleted_at"`). When set, the incremental pull must
-  * return tombstoned rows and the ingest turns each into a local delete — an
-  * alternative to `reconcileEveryMs`. Rejected on a `"full-pull"` source.
-  */
+   * **Incremental delete-visibility (plan 136)**: the upstream soft-delete
+   * tombstone column (e.g. `"deleted_at"`). When set, the incremental pull must
+   * return tombstoned rows and the ingest turns each into a local delete — an
+   * alternative to `reconcileEveryMs`. Rejected on a `"full-pull"` source.
+   */
   softDeleteColumn?: string;
   /**
-  * **Mandatory under `.shardBy()`**: map this DO's shard key → the query's bound
-  * params, so a tenant DO can only ever pull its own rows. An unscoped sourced +
-  * sharded table replicates the whole multitenant table into every shard — the
-  * `external_source_unscoped` advisor lint fails the build when this is absent.
-  */
+   * **Mandatory under `.shardBy()`**: map this DO's shard key → the query's bound
+   * params, so a tenant DO can only ever pull its own rows. An unscoped sourced +
+   * sharded table replicates the whole multitenant table into every shard — the
+   * `external_source_unscoped` advisor lint fails the build when this is absent.
+   */
   tenantBy?: (shardKey: string) => ReadonlyArray<unknown>;
 }
 interface IndexDefinition {
@@ -120,18 +120,18 @@ interface SearchIndexDefinition {
 /** Reducer applied by an aggregate index. */
 type AggregateOp = "avg" | "count" | "max" | "min" | "sum";
 /**
-* Declared aggregate index — the schema-level seam that lets the runtime keep
-* O(1) counters/sums in step with row writes (via the trigger runner) and
-* route matching reads through them.
-*
-* - `on` — the table whose rows feed the aggregate.
-* - `op` — the reducer. `count` is field-less; the others take `field`.
-* - `field` — the column the reducer applies to (required for non-count ops).
-* - `by` — group keys. When all `where` keys in a read participate in `by`, the
-* reader can answer from the counter table without scanning rows.
-* - `where` — optional static predicate baked into the counter (only the rows
-* matching it ever land in the counter).
-*/
+ * Declared aggregate index — the schema-level seam that lets the runtime keep
+ * O(1) counters/sums in step with row writes (via the trigger runner) and
+ * route matching reads through them.
+ *
+ * - `on` — the table whose rows feed the aggregate.
+ * - `op` — the reducer. `count` is field-less; the others take `field`.
+ * - `field` — the column the reducer applies to (required for non-count ops).
+ * - `by` — group keys. When all `where` keys in a read participate in `by`, the
+ * reader can answer from the counter table without scanning rows.
+ * - `where` — optional static predicate baked into the counter (only the rows
+ * matching it ever land in the counter).
+ */
 interface AggregateIndexDefinition {
   by?: ReadonlyArray<string>;
   field?: string;
@@ -141,32 +141,32 @@ interface AggregateIndexDefinition {
   where?: Record<string, unknown>;
 }
 /**
-* One ordering key on a `rankIndex.sortBy`: which column to sort by, and the
-* direction. The runtime breaks ties on the row's `_id` ASC so the order is
-* total and `rank()` always returns a deterministic 1-based position.
-*/
+ * One ordering key on a `rankIndex.sortBy`: which column to sort by, and the
+ * direction. The runtime breaks ties on the row's `_id` ASC so the order is
+ * total and `rank()` always returns a deterministic 1-based position.
+ */
 interface RankSortKey {
   direction: "asc" | "desc";
   field: string;
 }
 /**
-* Declared rank index — a sorted companion table per `(partition tuple, sortBy)`
-* maintained by triggers, so:
-*
-* - `rank(row)` returns the row's 1-based position within its partition under
-* the declared `sortBy` order, plus the partition's total row count, in
-* O(log n) lookups against the SQLite btree on the companion table.
-* - `rankPage({ where, take, from })` walks the same companion table to return
-* rows in the declared order — a sorted-pagination accelerator.
-*
-* Fields mirror `AggregateIndexDefinition`:
-*
-* - `on` — the source table whose rows feed the rank.
-* - `sortBy` — ordered keys driving the rank. Required.
-* - `partitionBy` — columns that scope each rank context (e.g. `["channelId"]`
-* to rank within a channel). Omitted ⇒ one global rank across the table.
-* - `where` — static predicate baked into the index; only matching rows enter.
-*/
+ * Declared rank index — a sorted companion table per `(partition tuple, sortBy)`
+ * maintained by triggers, so:
+ *
+ * - `rank(row)` returns the row's 1-based position within its partition under
+ * the declared `sortBy` order, plus the partition's total row count, in
+ * O(log n) lookups against the SQLite btree on the companion table.
+ * - `rankPage({ where, take, from })` walks the same companion table to return
+ * rows in the declared order — a sorted-pagination accelerator.
+ *
+ * Fields mirror `AggregateIndexDefinition`:
+ *
+ * - `on` — the source table whose rows feed the rank.
+ * - `sortBy` — ordered keys driving the rank. Required.
+ * - `partitionBy` — columns that scope each rank context (e.g. `["channelId"]`
+ * to rank within a channel). Omitted ⇒ one global rank across the table.
+ * - `where` — static predicate baked into the index; only matching rows enter.
+ */
 interface RankIndexDefinition {
   name: string;
   on: string;
@@ -177,16 +177,16 @@ interface RankIndexDefinition {
 /** FK behavior when a referenced parent row is deleted (mirrors SQL `ON DELETE`). */
 type OnDeleteAction = "cascade" | "restrict" | "set null";
 /**
-* A declared relation between two tables, recorded by `.relations((r) => …)`.
-*
-* - `one` (many-to-one): the FK column `field` lives on **this** table and
-* points at `table`.`references` (default `_id`). Loads a single doc.
-* - `many` (one-to-many): the FK column `field` lives on the **target** table
-* and points back at this table's `references` (default `_id`). Loads an array.
-*
-* `onDelete` is meaningful only on `one`: it is the action applied to the
-* holder rows when the referenced parent row is deleted.
-*/
+ * A declared relation between two tables, recorded by `.relations((r) => …)`.
+ *
+ * - `one` (many-to-one): the FK column `field` lives on **this** table and
+ * points at `table`.`references` (default `_id`). Loads a single doc.
+ * - `many` (one-to-many): the FK column `field` lives on the **target** table
+ * and points back at this table's `references` (default `_id`). Loads an array.
+ *
+ * `onDelete` is meaningful only on `one`: it is the action applied to the
+ * holder rows when the referenced parent row is deleted.
+ */
 interface RelationDefinition {
   field: string;
   kind: "many" | "one";
@@ -197,15 +197,15 @@ interface RelationDefinition {
 /** Distance metric used by a Vectorize index. */
 type VectorMetric = "cosine" | "dot-product" | "euclidean";
 /**
-* Bring-your-own-embedder: a user-supplied fn turning a source string into a
-* numeric vector. The runtime calls it at upsert/query time so the framework
-* never couples to a single embedding provider.
-*/
+ * Bring-your-own-embedder: a user-supplied fn turning a source string into a
+ * numeric vector. The runtime calls it at upsert/query time so the framework
+ * never couples to a single embedding provider.
+ */
 type VectorEmbedder = (input: string) => Promise<ReadonlyArray<number>> | ReadonlyArray<number>;
 /**
-* Vector index declared inline on a table via `.vectorize(field, opts)`
-* (DSL Shape A). The source is always a single column on the owning table.
-*/
+ * Vector index declared inline on a table via `.vectorize(field, opts)`
+ * (DSL Shape A). The source is always a single column on the owning table.
+ */
 interface TableVectorIndex {
   dimensions: number;
   embed: VectorEmbedder;
@@ -216,82 +216,82 @@ interface TableVectorIndex {
 }
 interface TableDefinition<Shape extends Record<string, Validator> = Record<string, Validator>> {
   /**
-  * Aggregate indexes declared via `.aggregateIndex(name, opts)`. The runtime
-  * maintains a counter row per `by` group via the trigger seam, so reads
-  * whose `where` keys all participate in the index's `by` set are answered
-  * without scanning the underlying table.
-  */
+   * Aggregate indexes declared via `.aggregateIndex(name, opts)`. The runtime
+   * maintains a counter row per `by` group via the trigger seam, so reads
+   * whose `where` keys all participate in the index's `by` set are answered
+   * without scanning the underlying table.
+   */
   aggregateIndexes: ReadonlyArray<AggregateIndexDefinition>;
   /**
-  * Set by `.source(...)` (named `externalSource`, not `source`, so the data
-  * field doesn't collide with the fluent `.source()` builder method — same
-  * convention as `shardBy()`/`shardMode`). When present, the table is
-  * materialized from an external Hyperdrive-backed database by a system poll
-  * loop rather than user mutations. Implies `isExternallyManaged`.
-  */
+   * Set by `.source(...)` (named `externalSource`, not `source`, so the data
+   * field doesn't collide with the fluent `.source()` builder method — same
+   * convention as `shardBy()`/`shardMode`). When present, the table is
+   * materialized from an external Hyperdrive-backed database by a system poll
+   * loop rather than user mutations. Implies `isExternallyManaged`.
+   */
   externalSource?: ExternalSourceDefinition;
   indexes: ReadonlyArray<IndexDefinition>;
   /**
-  * `true` when `.externallyManaged()` was called — the table's rows are
-  * written outside Lunora's discoverable insert path (an adapter, a
-  * migration, or framework middleware), e.g. `@lunora/auth`'s better-auth
-  * tables or `@lunora/ratelimit`'s store. Advisor insert-path lints
-  * (`table_without_insert`) skip such tables instead of flagging the absent
-  * `ctx.db.insert(...)`.
-  */
+   * `true` when `.externallyManaged()` was called — the table's rows are
+   * written outside Lunora's discoverable insert path (an adapter, a
+   * migration, or framework middleware), e.g. `@lunora/auth`'s better-auth
+   * tables or `@lunora/ratelimit`'s store. Advisor insert-path lints
+   * (`table_without_insert`) skip such tables instead of flagging the absent
+   * `ctx.db.insert(...)`.
+   */
   isExternallyManaged?: boolean;
   /**
-  * `true` when `.public()` was called — the table opts OUT of secure-by-default
-  * RLS. Under a schema marked `.rls("required")`, every table is protected (the
-  * DO/D1 write path denies raw, non-RLS `ctx.db` access) UNLESS it is `isPublic`.
-  * Has no effect when the schema does not require RLS.
-  */
+   * `true` when `.public()` was called — the table opts OUT of secure-by-default
+   * RLS. Under a schema marked `.rls("required")`, every table is protected (the
+   * DO/D1 write path denies raw, non-RLS `ctx.db` access) UNLESS it is `isPublic`.
+   * Has no effect when the schema does not require RLS.
+   */
   isPublic?: boolean;
   /**
-  * Rank indexes declared via `.rankIndex(name, opts)`. The runtime maintains
-  * a sorted companion table per declared rank with a btree on
-  * `(partition, sortBy)` so `rank(row)` returns the row's 1-based position
-  * within its partition in O(log n), and `rankPage()` walks the index for
-  * sorted pagination.
-  */
+   * Rank indexes declared via `.rankIndex(name, opts)`. The runtime maintains
+   * a sorted companion table per declared rank with a btree on
+   * `(partition, sortBy)` so `rank(row)` returns the row's 1-based position
+   * within its partition in O(log n), and `rankPage()` walks the index for
+   * sorted pagination.
+   */
   rankIndexes: ReadonlyArray<RankIndexDefinition>;
   /**
-  * Declared relations keyed by accessor name; empty unless `.relations()`
-  * was called. Named `relationMap` (not `relations`) so the fluent
-  * `.relations((r) => …)` builder method doesn't collide with this field.
-  */
+   * Declared relations keyed by accessor name; empty unless `.relations()`
+   * was called. Named `relationMap` (not `relations`) so the fluent
+   * `.relations((r) => …)` builder method doesn't collide with this field.
+   */
   relationMap: Record<string, RelationDefinition>;
   searchIndexes: ReadonlyArray<SearchIndexDefinition>;
   shape: Shape;
   shardMode: ShardMode;
   /**
-  * Set by `.softDelete()` (named `softDeleteMode`, not `softDelete`, so the
-  * data field doesn't collide with the fluent `.softDelete()` builder method —
-  * same convention as `shardBy()`/`shardMode`). When present, the table carries
-  * a nullable timestamp column (`field`, default `deletedAt`):
-  * `ctx.db.&lt;table>.delete()` flips it instead of physically removing the row,
-  * and **list reads** (`findMany`/`findFirst`/`query()`/`count`/`aggregate`/
-  * relation loads) hide rows whose `field` is set unless
-  * `includeDeleted: true` is passed. By-id `get`/`patch`/`replace` and
-  * `restore` are unaffected. Absent ⇒ deletes are physical, as before.
-  */
+   * Set by `.softDelete()` (named `softDeleteMode`, not `softDelete`, so the
+   * data field doesn't collide with the fluent `.softDelete()` builder method —
+   * same convention as `shardBy()`/`shardMode`). When present, the table carries
+   * a nullable timestamp column (`field`, default `deletedAt`):
+   * `ctx.db.&lt;table>.delete()` flips it instead of physically removing the row,
+   * and **list reads** (`findMany`/`findFirst`/`query()`/`count`/`aggregate`/
+   * relation loads) hide rows whose `field` is set unless
+   * `includeDeleted: true` is passed. By-id `get`/`patch`/`replace` and
+   * `restore` are unaffected. Absent ⇒ deletes are physical, as before.
+   */
   softDeleteMode?: {
     field: string;
   };
   /**
-  * Declared lifecycle triggers keyed by accessor name; empty unless
-  * `.triggers()` was called. Named `triggerMap` (not `triggers`) so the
-  * fluent `.triggers((t) => …)` builder method doesn't collide with this
-  * field — same reasoning as {@link TableDefinition.relationMap}.
-  */
+   * Declared lifecycle triggers keyed by accessor name; empty unless
+   * `.triggers()` was called. Named `triggerMap` (not `triggers`) so the
+   * fluent `.triggers((t) => …)` builder method doesn't collide with this
+   * field — same reasoning as {@link TableDefinition.relationMap}.
+   */
   triggerMap: Record<string, TriggerDefinition>;
   vectorIndexes: ReadonlyArray<TableVectorIndex>;
 }
 /**
-* Standalone vector index declared via `defineVectorIndex(...)` (DSL Shape B).
-* Unlike {@link TableVectorIndex}, the source is a `select` function so it can
-* derive the embedded text from any computation (e.g. `title + body`).
-*/
+ * Standalone vector index declared via `defineVectorIndex(...)` (DSL Shape B).
+ * Unlike {@link TableVectorIndex}, the source is a `select` function so it can
+ * derive the embedded text from any computation (e.g. `title + body`).
+ */
 interface VectorIndexDefinition {
   readonly dimensions: number;
   readonly embed: VectorEmbedder;
@@ -303,40 +303,40 @@ interface VectorIndexDefinition {
 }
 interface Schema<T extends Record<string, TableDefinition> = Record<string, TableDefinition>> {
   /**
-  * Secure-by-default RLS mode declared via `.rls("required")`. When
-  * `"required"`, every table is protected: the DO/D1 write path denies raw
-  * (non-RLS-wrapped) `ctx.db` access at runtime, so a procedure that forgets
-  * `.use(rls(...))` fails closed instead of silently exposing the table. A
-  * table opts out with `.public()` (→ {@link TableDefinition.isPublic}).
-  * Absent ⇒ legacy opt-in behavior (RLS only where a policy is applied).
-  */
+   * Secure-by-default RLS mode declared via `.rls("required")`. When
+   * `"required"`, every table is protected: the DO/D1 write path denies raw
+   * (non-RLS-wrapped) `ctx.db` access at runtime, so a procedure that forgets
+   * `.use(rls(...))` fails closed instead of silently exposing the table. A
+   * table opts out with `.public()` (→ {@link TableDefinition.isPublic}).
+   * Absent ⇒ legacy opt-in behavior (RLS only where a policy is applied).
+   */
   readonly rlsMode?: "required";
   readonly tables: T;
   readonly vectorIndexes: Record<string, VectorIndexDefinition>;
 }
 type FunctionKind = "action" | "mutation" | "query" | "stream";
 /**
-* Call surface a function is exposed on. `public` functions are reachable from
-* clients via the generated `api`; `internal` functions are reachable only
-* server-to-server (`ctx.runQuery`/`runMutation`/`runAction`) and are rejected
-* by the DO's external RPC path. Absence is treated as `public` for
-* back-compat with functions registered before visibility existed.
-*/
+ * Call surface a function is exposed on. `public` functions are reachable from
+ * clients via the generated `api`; `internal` functions are reachable only
+ * server-to-server (`ctx.runQuery`/`runMutation`/`runAction`) and are rejected
+ * by the DO's external RPC path. Absence is treated as `public` for
+ * back-compat with functions registered before visibility existed.
+ */
 type FunctionVisibility = "internal" | "public";
 /**
-* x402 payment tag attached by the `.x402({ price })` builder modifier. Marks a
-* public procedure as paid: the origin worker answers an unpaid client RPC with
-* HTTP 402, verifies + settles the payment, and only then dispatches to the
-* shard. The runtime reads only `price` from here — the network, recipient, and
-* facilitator live in the worker-level x402 charge config, so `@lunora/runtime`
-* never has to import `@lunora/x402` (and its viem/solana deps).
-*/
+ * x402 payment tag attached by the `.x402({ price })` builder modifier. Marks a
+ * public procedure as paid: the origin worker answers an unpaid client RPC with
+ * HTTP 402, verifies + settles the payment, and only then dispatches to the
+ * shard. The runtime reads only `price` from here — the network, recipient, and
+ * facilitator live in the worker-level x402 charge config, so `@lunora/runtime`
+ * never has to import `@lunora/x402` (and its viem/solana deps).
+ */
 interface X402ProcedureConfig {
   /**
-  * USD-denominated price: a number of dollars (`0.01`) or a decimal string
-  * (`"0.01"`, or the `"$0.01"` shorthand). Resolved to the network
-  * stablecoin's base units (USDC has 6 decimals) at challenge time.
-  */
+   * USD-denominated price: a number of dollars (`0.01`) or a decimal string
+   * (`"0.01"`, or the `"$0.01"` shorthand). Resolved to the network
+   * stablecoin's base units (USDC has 6 decimals) at challenge time.
+   */
   readonly price: number | string;
 }
 interface RegisteredFunction<A extends ArgsValidator, R, Kind extends FunctionKind> {
@@ -344,18 +344,18 @@ interface RegisteredFunction<A extends ArgsValidator, R, Kind extends FunctionKi
   readonly handler: (context: unknown, args: InferArgs<A>) => Promise<R> | R;
   readonly kind: Kind;
   /**
-  * Set on connection-lifecycle hooks (`onConnect` / `onDisconnect`).
-  * Marks the function for the generated `LUNORA_LIFECYCLE_HOOKS` manifest so the
-  * DO dispatches it on socket connect/disconnect rather than via a client RPC.
-  * Absent on ordinary registrations.
-  */
+   * Set on connection-lifecycle hooks (`onConnect` / `onDisconnect`).
+   * Marks the function for the generated `LUNORA_LIFECYCLE_HOOKS` manifest so the
+   * DO dispatches it on socket connect/disconnect rather than via a client RPC.
+   * Absent on ordinary registrations.
+   */
   readonly lifecycle?: LifecycleEventKind;
   readonly visibility?: FunctionVisibility;
   /**
-  * Set by the `.x402({ price })` builder modifier. Marks the procedure as paid
-  * so the origin worker gates it behind an x402 402-challenge before dispatch.
-  * Absent on unpaid functions.
-  */
+   * Set by the `.x402({ price })` builder modifier. Marks the procedure as paid
+   * so the origin worker gates it behind an x402 402-challenge before dispatch.
+   * Absent on unpaid functions.
+   */
   readonly x402?: X402ProcedureConfig;
 }
 type RegisteredQuery<A extends ArgsValidator, R> = RegisteredFunction<A, R, "query">;
@@ -364,11 +364,11 @@ type RegisteredAction<A extends ArgsValidator, R> = RegisteredFunction<A, R, "ac
 /** Which side of the WebSocket lifecycle a hook fires on. */
 type LifecycleEventKind = "connect" | "disconnect";
 /**
-* The event a connection-lifecycle hook receives as its second argument. It is
-* the JSON-serializable payload the DO forwards on socket connect/disconnect;
-* the verified caller identity is also reflected on `ctx.auth` (the hook runs
-* under the connecting user via `resolveIdentity`).
-*/
+ * The event a connection-lifecycle hook receives as its second argument. It is
+ * the JSON-serializable payload the DO forwards on socket connect/disconnect;
+ * the verified caller identity is also reflected on `ctx.auth` (the hook runs
+ * under the connecting user via `resolveIdentity`).
+ */
 interface LifecycleEvent {
   /** Stable per-socket id, minted at upgrade and replayed verbatim on disconnect. */
   readonly connectionId: string;
@@ -380,20 +380,20 @@ interface LifecycleEvent {
   readonly userId: string | null;
 }
 /**
-* A registered connection-lifecycle hook — an internal mutation tagged with the
-* lifecycle side it fires on. Produced by `onConnect` / `onDisconnect`.
-*/
+ * A registered connection-lifecycle hook — an internal mutation tagged with the
+ * lifecycle side it fires on. Produced by `onConnect` / `onDisconnect`.
+ */
 type RegisteredLifecycleHook = RegisteredFunction<Record<string, never>, void, "mutation"> & {
   readonly lifecycle: LifecycleEventKind;
 };
 /**
-* A streaming query registration. Unlike {@link RegisteredFunction} the handler
-* returns an `AsyncIterable&lt;R>` synchronously (it does NOT `Promise&lt;R>`); the
-* runtime drives it frame by frame and forwards each chunk to the caller. The
-* third `signal` argument is wired to the caller's cancel signal so the handler
-* can stop early — break out of the loop or check `signal.aborted` between
-* yields.
-*/
+ * A streaming query registration. Unlike {@link RegisteredFunction} the handler
+ * returns an `AsyncIterable&lt;R>` synchronously (it does NOT `Promise&lt;R>`); the
+ * runtime drives it frame by frame and forwards each chunk to the caller. The
+ * third `signal` argument is wired to the caller's cancel signal so the handler
+ * can stop early — break out of the loop or check `signal.aborted` between
+ * yields.
+ */
 interface RegisteredStream<A extends ArgsValidator, R> {
   readonly args: A;
   readonly handler: (context: unknown, args: InferArgs<A>, signal: AbortSignal) => AsyncIterable<R>;
@@ -403,10 +403,10 @@ interface RegisteredStream<A extends ArgsValidator, R> {
 /** The system tables `ctx.db.system` can read. */
 type SystemTableName = "_scheduled_functions" | "_storage";
 /**
-* A pending scheduled invocation as surfaced by the `_scheduled_functions`
-* system table. Mirrors {@link ScheduledJob} (the `ctx.scheduler` view); the
-* separate name keeps the system-table read surface self-describing.
-*/
+ * A pending scheduled invocation as surfaced by the `_scheduled_functions`
+ * system table. Mirrors {@link ScheduledJob} (the `ctx.scheduler` view); the
+ * separate name keeps the system-table read surface self-describing.
+ */
 interface ScheduledFunctionDoc {
   /** Function arguments the job will be dispatched with. */
   args: Record<string, unknown>;
@@ -436,55 +436,55 @@ interface SystemQuery<T extends SystemTableName> {
   collect: () => Promise<SystemDoc<T>[]>;
 }
 /**
-* Read-only reader over Lunora's system tables (`_scheduled_functions`,
-* `_storage`), exposed as `ctx.db.system`. Mirrors Convex's `ctx.db.system`.
-*
-* **Best-effort and eventually consistent.** Unlike `ctx.db.&lt;table>` — which
-* reads the shard's transactional SQLite snapshot — the data behind these tables
-* lives OUTSIDE the shard (scheduled functions in the `SchedulerDO`, storage
-* objects in R2). Every `collect()` / `get()` reaches across to that source.
-*
-* It is **not part of the mutation transaction snapshot** (no OCC guard, no
-* subscription dependency recorded — reading it inside a mutation does not pin
-* it), and results are **eventually consistent** with writes a mutation just
-* made (e.g. a freshly scheduled job may not appear yet).
-*
-* Read-only by design: mutate scheduled jobs via `ctx.scheduler`, storage
-* objects via `ctx.storage`.
-*/
+ * Read-only reader over Lunora's system tables (`_scheduled_functions`,
+ * `_storage`), exposed as `ctx.db.system`. Mirrors Convex's `ctx.db.system`.
+ *
+ * **Best-effort and eventually consistent.** Unlike `ctx.db.&lt;table>` — which
+ * reads the shard's transactional SQLite snapshot — the data behind these tables
+ * lives OUTSIDE the shard (scheduled functions in the `SchedulerDO`, storage
+ * objects in R2). Every `collect()` / `get()` reaches across to that source.
+ *
+ * It is **not part of the mutation transaction snapshot** (no OCC guard, no
+ * subscription dependency recorded — reading it inside a mutation does not pin
+ * it), and results are **eventually consistent** with writes a mutation just
+ * made (e.g. a freshly scheduled job may not appear yet).
+ *
+ * Read-only by design: mutate scheduled jobs via `ctx.scheduler`, storage
+ * objects via `ctx.storage`.
+ */
 interface SystemDatabaseReader {
   /**
-  * Resolve a single system-table row by id, or `null` when absent.
-  * (`_scheduled_functions` → job id; `_storage` → object key.)
-  */
+   * Resolve a single system-table row by id, or `null` when absent.
+   * (`_scheduled_functions` → job id; `_storage` → object key.)
+   */
   get: <T extends SystemTableName>(table: T, id: string) => Promise<SystemDoc<T> | null>;
   /**
-  * Begin a read over a system table; call `.collect()` to resolve the full
-  * list. No filtering, indexing, or pagination — the backing source is remote
-  * and the surface stays deliberately minimal.
-  */
+   * Begin a read over a system table; call `.collect()` to resolve the full
+   * list. No filtering, indexing, or pagination — the backing source is remote
+   * and the surface stays deliberately minimal.
+   */
   query: <T extends SystemTableName>(table: T) => SystemQuery<T>;
 }
 /**
-* Read-only handle bound to a table. Used by `query`/`mutation`/`action`. The
-* actual SQL implementation lives in `@lunora/do`; these are signatures only.
-*/
+ * Read-only handle bound to a table. Used by `query`/`mutation`/`action`. The
+ * actual SQL implementation lives in `@lunora/do`; these are signatures only.
+ */
 interface DatabaseReader {
   get: <T extends string>(id: Id<T>) => Promise<Record<string, unknown> | null>;
   /**
-  * Validate an untrusted `id` string against the structural shape of an id
-  * for `tableName`, returning the branded {@link Id} when it is well-formed
-  * and `null` otherwise. Pure structural validation — it never reads the
-  * database, so a structurally valid id for a row that doesn't exist still
-  * returns the branded id (mirrors Convex's `db.normalizeId`).
-  */
+   * Validate an untrusted `id` string against the structural shape of an id
+   * for `tableName`, returning the branded {@link Id} when it is well-formed
+   * and `null` otherwise. Pure structural validation — it never reads the
+   * database, so a structurally valid id for a row that doesn't exist still
+   * returns the branded id (mirrors Convex's `db.normalizeId`).
+   */
   normalizeId: <T extends string>(tableName: T, id: string) => Id<T> | null;
   query: (tableName: string) => TableReader;
   /**
-  * Best-effort, read-only reader over Lunora's system tables
-  * (`_scheduled_functions`, `_storage`). Eventually consistent and **not**
-  * part of the transaction snapshot — see {@link SystemDatabaseReader}.
-  */
+   * Best-effort, read-only reader over Lunora's system tables
+   * (`_scheduled_functions`, `_storage`). Eventually consistent and **not**
+   * part of the transaction snapshot — see {@link SystemDatabaseReader}.
+   */
   readonly system: SystemDatabaseReader;
 }
 /** Options for {@link TableReader.paginate} — Convex-compatible page request. */
@@ -492,14 +492,14 @@ interface PaginationOptions {
   /** Opaque cursor from the prior page's `continueCursor`; `null`/omitted starts at the first page. */
   cursor?: null | string;
   /**
-  * Optional inclusive upper bound for reactive pagination. When supplied the
-  * page covers the fixed half-open range `(cursor, endCursor]` (ignoring
-  * `numItems`): every row strictly after `cursor` up to and including the
-  * boundary row `endCursor` encodes. The page's `isDone` is `true` and its
-  * `continueCursor` echoes `endCursor`, so the next page keeps starting where
-  * this one ends even as rows are inserted/deleted inside the range. Omit (or
-  * pass `null`) for the legacy "first `numItems` after `cursor`" behaviour.
-  */
+   * Optional inclusive upper bound for reactive pagination. When supplied the
+   * page covers the fixed half-open range `(cursor, endCursor]` (ignoring
+   * `numItems`): every row strictly after `cursor` up to and including the
+   * boundary row `endCursor` encodes. The page's `isDone` is `true` and its
+   * `continueCursor` echoes `endCursor`, so the next page keeps starting where
+   * this one ends even as rows are inserted/deleted inside the range. Omit (or
+   * pass `null`) for the legacy "first `numItems` after `cursor`" behaviour.
+   */
   endCursor?: null | string;
   /** Maximum rows to return for this page. */
   numItems: number;
@@ -512,46 +512,46 @@ interface PaginationResult<T = Record<string, unknown>> {
   isDone: boolean;
   page: T[];
   /**
-  * Reactive-pagination only: the midpoint cursor of a bounded
-  * `(cursor, endCursor]` page, used by the client to split an over-grown page
-  * into two adjacent ranges. Absent on legacy (open-ended) pages.
-  */
+   * Reactive-pagination only: the midpoint cursor of a bounded
+   * `(cursor, endCursor]` page, used by the client to split an over-grown page
+   * into two adjacent ranges. Absent on legacy (open-ended) pages.
+   */
   splitCursor?: null | string;
 }
 /**
-* The fluent `ctx.db.query(table)` reader. Generic over the document type
-* `Row` so the generated `ctx.db` can bind it to `Doc&lt;table>` (the chain and
-* every terminal then resolve typed rows — no `as unknown as Doc&lt;...>` casts).
-* Defaults to the untyped `Record&lt;string, unknown>` shape for the base
-* (schema-agnostic) `@lunora/server` reader.
-*/
+ * The fluent `ctx.db.query(table)` reader. Generic over the document type
+ * `Row` so the generated `ctx.db` can bind it to `Doc&lt;table>` (the chain and
+ * every terminal then resolve typed rows — no `as unknown as Doc&lt;...>` casts).
+ * Defaults to the untyped `Record&lt;string, unknown>` shape for the base
+ * (schema-agnostic) `@lunora/server` reader.
+ */
 interface TableReader<Row = Record<string, unknown>> {
   collect: () => Promise<Row[]>;
   filter: (predicate: (document: Row) => boolean) => TableReader<Row>;
   first: () => Promise<Row | null>;
   /**
-  * Set the result order. Orders by the active `.withIndex()` (or by
-  * `_creationTime` when none is staged), `"asc"` by default; `"desc"`
-  * reverses it. Composes with `.withIndex()`, `.filter()`, and every
-  * terminal (`collect`/`first`/`take`/`paginate`/`unique`). Mirrors Convex's
-  * `.order("asc" | "desc")`.
-  */
+   * Set the result order. Orders by the active `.withIndex()` (or by
+   * `_creationTime` when none is staged), `"asc"` by default; `"desc"`
+   * reverses it. Composes with `.withIndex()`, `.filter()`, and every
+   * terminal (`collect`/`first`/`take`/`paginate`/`unique`). Mirrors Convex's
+   * `.order("asc" | "desc")`.
+   */
   order: (direction: "asc" | "desc") => TableReader<Row>;
   paginate: (options: PaginationOptions) => Promise<PaginationResult<Row>>;
   take: (limit: number) => Promise<Row[]>;
   /**
-  * Return the single matching document. Returns `null` when nothing matches
-  * and throws when more than one row matches. Mirrors Convex's `.unique()`.
-  */
+   * Return the single matching document. Returns `null` when nothing matches
+   * and throws when more than one row matches. Mirrors Convex's `.unique()`.
+   */
   unique: () => Promise<Row | null>;
   withIndex: (indexName: string, range?: (q: IndexRangeBuilder) => IndexRangeBuilder) => TableReader<Row>;
   /**
-  * Restrict the query to a declared `.searchIndex()`. The builder's
-  * `.search(field, query)` runs a full-text match against the index's
-  * searchable field; `.eq(field, value)` narrows by a declared filter
-  * field. Results come back ordered by relevance — pair with `.take(n)`
-  * (`.paginate()` is not supported on a search query).
-  */
+   * Restrict the query to a declared `.searchIndex()`. The builder's
+   * `.search(field, query)` runs a full-text match against the index's
+   * searchable field; `.eq(field, value)` narrows by a declared filter
+   * field. Results come back ordered by relevance — pair with `.take(n)`
+   * (`.paginate()` is not supported on a search query).
+   */
   withSearchIndex: (indexName: string, search: (q: SearchFilterBuilder) => SearchFilterBuilder) => TableReader<Row>;
 }
 interface IndexRangeBuilder {
@@ -569,12 +569,12 @@ interface SearchFilterBuilder {
   search: (field: string, query: string) => SearchFilterBuilder;
 }
 /**
-* Options shared by the batch-write methods (`insertMany`/`deleteMany`/
-* `patchMany`) — a per-call payload cap. The default cap (500) rejects an
-* oversized call up front so an accidental O(n²) or a payload past the Durable
-* Object request limit fails loudly instead of degrading the mutation. Callers
-* with larger sets should chunk their own loop or raise `limit`.
-*/
+ * Options shared by the batch-write methods (`insertMany`/`deleteMany`/
+ * `patchMany`) — a per-call payload cap. The default cap (500) rejects an
+ * oversized call up front so an accidental O(n²) or a payload past the Durable
+ * Object request limit fails loudly instead of degrading the mutation. Callers
+ * with larger sets should chunk their own loop or raise `limit`.
+ */
 interface BatchWriteOptions {
   /** Reject the call when the batch size exceeds this value (default 500). */
   limit?: number;
@@ -582,67 +582,67 @@ interface BatchWriteOptions {
 /** Options accepted by {@link DatabaseWriter.insertMany} and the per-table facade. */
 interface InsertManyOptions extends BatchWriteOptions {
   /**
-  * When `true`, a UNIQUE-constraint breach for a row resolves to `null`
-  * instead of throwing — the rest of the batch is still inserted. Skipped rows
-  * keep their input-order slot with `null` in the returned array. Mirrors
-  * better-drizzle's `createMany({ skipDuplicates: true })`.
-  */
+   * When `true`, a UNIQUE-constraint breach for a row resolves to `null`
+   * instead of throwing — the rest of the batch is still inserted. Skipped rows
+   * keep their input-order slot with `null` in the returned array. Mirrors
+   * better-drizzle's `createMany({ skipDuplicates: true })`.
+   */
   skipDuplicates?: boolean;
 }
 interface DatabaseWriter extends DatabaseReader {
   delete: <T extends string>(id: Id<T>) => Promise<void>;
   /**
-  * Delete many rows by id in one call. Each id is deleted through the full
-  * single-row pipeline (triggers + per-row RLS). The returned `deleted` is the
-  * number of ids **requested**, not the rows actually removed — an unknown or
-  * duplicated id is a silent no-op.
-  *
-  * **Atomic within a mutation:** the DO wraps a mutation's dispatch in a
-  * BEGIN/COMMIT span, so a mid-batch failure (a later RLS denial or handler
-  * error) rolls back the whole mutation. (In an action there is no transaction
-  * span, so the prior deletes persist; the in-memory test harness mirrors the span.)
-  */
+   * Delete many rows by id in one call. Each id is deleted through the full
+   * single-row pipeline (triggers + per-row RLS). The returned `deleted` is the
+   * number of ids **requested**, not the rows actually removed — an unknown or
+   * duplicated id is a silent no-op.
+   *
+   * **Atomic within a mutation:** the DO wraps a mutation's dispatch in a
+   * BEGIN/COMMIT span, so a mid-batch failure (a later RLS denial or handler
+   * error) rolls back the whole mutation. (In an action there is no transaction
+   * span, so the prior deletes persist; the in-memory test harness mirrors the span.)
+   */
   deleteMany: <T extends string>(ids: ReadonlyArray<Id<T>>, options?: BatchWriteOptions) => Promise<{
     deleted: number;
   }>;
   /**
-  * Delete every row matching `where` in one call. Matching rows are resolved
-  * first, then each row is deleted through the single-row delete pipeline
-  * (triggers, companion sync, CDC, broadcast) so reactive subscriptions and
-  * search/aggregate companions stay correct.
-  *
-  * **Atomic within a mutation:** the DO wraps a mutation's dispatch in a
-  * BEGIN/COMMIT span, so a mid-batch failure rolls back the whole mutation.
-  */
+   * Delete every row matching `where` in one call. Matching rows are resolved
+   * first, then each row is deleted through the single-row delete pipeline
+   * (triggers, companion sync, CDC, broadcast) so reactive subscriptions and
+   * search/aggregate companions stay correct.
+   *
+   * **Atomic within a mutation:** the DO wraps a mutation's dispatch in a
+   * BEGIN/COMMIT span, so a mid-batch failure rolls back the whole mutation.
+   */
   deleteWhere: (tableName: string, where: Record<string, unknown>, options?: BatchWriteOptions) => Promise<{
     deleted: number;
   }>;
   /**
-  * Insert a document, returning its server id.
-  *
-  * Pass `options.clientId` (a UUID) to key the row yourself — for an
-  * optimistic client that needs the persisted row to match the key it
-  * already rendered. It's validated for shape and still subject to the
-  * primary-key uniqueness constraint; omit it and the server mints the id.
-  */
+   * Insert a document, returning its server id.
+   *
+   * Pass `options.clientId` (a UUID) to key the row yourself — for an
+   * optimistic client that needs the persisted row to match the key it
+   * already rendered. It's validated for shape and still subject to the
+   * primary-key uniqueness constraint; omit it and the server mints the id.
+   */
   insert: <T extends string>(tableName: T, document: Record<string, unknown>, options?: {
     clientId?: string;
   }) => Promise<Id<T>>;
   /**
-  * Insert many documents into one table in a single call, returning the
-  * minted ids in input order. Equivalent to a per-row `insert()` loop — each
-  * row gets defaults, validators, triggers, and a per-row RLS check — but the
-  * caller pays one round-trip instead of N.
-  *
-  * Pass `{ skipDuplicates: true }` to turn UNIQUE-constraint breaches into
-  * `null` results for that row instead of failing the whole batch; the rest of
-  * the batch is still inserted and order is preserved.
-  *
-  * **Atomic within a mutation:** the DO wraps a mutation's dispatch in a
-  * BEGIN/COMMIT span, so a mid-batch failure (an invalid or RLS-denied row)
-  * rolls back the whole mutation. (In an action there is no transaction span,
-  * so the prior inserts persist; the in-memory test harness mirrors the span.)
-  */
+   * Insert many documents into one table in a single call, returning the
+   * minted ids in input order. Equivalent to a per-row `insert()` loop — each
+   * row gets defaults, validators, triggers, and a per-row RLS check — but the
+   * caller pays one round-trip instead of N.
+   *
+   * Pass `{ skipDuplicates: true }` to turn UNIQUE-constraint breaches into
+   * `null` results for that row instead of failing the whole batch; the rest of
+   * the batch is still inserted and order is preserved.
+   *
+   * **Atomic within a mutation:** the DO wraps a mutation's dispatch in a
+   * BEGIN/COMMIT span, so a mid-batch failure (an invalid or RLS-denied row)
+   * rolls back the whole mutation. (In an action there is no transaction span,
+   * so the prior inserts persist; the in-memory test harness mirrors the span.)
+   */
   insertMany: {
     <T extends string>(tableName: T, documents: ReadonlyArray<Record<string, unknown>>, options: BatchWriteOptions & {
       skipDuplicates: true;
@@ -650,32 +650,32 @@ interface DatabaseWriter extends DatabaseReader {
     <T extends string>(tableName: T, documents: ReadonlyArray<Record<string, unknown>>, options?: InsertManyOptions): Promise<Id<T>[]>;
   };
   /**
-  * **Trusted** bulk insert: one multi-row `INSERT` that **skips per-row
-  * `.check()` validators and before/after triggers** for throughput on data you
-  * control (seed, migration, admin import). Defaults, ids, and every companion
-  * (search/aggregate/rank/CDC + live subscriptions) are still applied, so reads
-  * stay correct.
-  *
-  * It is **"unsafe" only in that it bypasses the validation/trigger pipeline** —
-  * RLS is **not** bypassed: secure-by-default and the table's insert policy still
-  * apply (the framework ships no RLS-bypassing writer). Pass `allowExplicitId` to
-  * preserve a supplied `_id` (import). Use only for data you trust; prefer
-  * `insertMany` for anything user-supplied.
-  */
+   * **Trusted** bulk insert: one multi-row `INSERT` that **skips per-row
+   * `.check()` validators and before/after triggers** for throughput on data you
+   * control (seed, migration, admin import). Defaults, ids, and every companion
+   * (search/aggregate/rank/CDC + live subscriptions) are still applied, so reads
+   * stay correct.
+   *
+   * It is **"unsafe" only in that it bypasses the validation/trigger pipeline** —
+   * RLS is **not** bypassed: secure-by-default and the table's insert policy still
+   * apply (the framework ships no RLS-bypassing writer). Pass `allowExplicitId` to
+   * preserve a supplied `_id` (import). Use only for data you trust; prefer
+   * `insertMany` for anything user-supplied.
+   */
   insertManyUnsafe: <T extends string>(tableName: T, documents: ReadonlyArray<Record<string, unknown>>, options?: BatchWriteOptions & {
     allowExplicitId?: boolean;
   }) => Promise<Id<T>[]>;
   patch: <T extends string>(id: Id<T>, patch: Record<string, unknown>) => Promise<void>;
   /**
-  * Patch many rows by id in one call. Each `{ id, patch }` is applied like a
-  * single `patch()` (per-row triggers + RLS). Returns the number of rows
-  * actually patched.
-  *
-  * **Atomic within a mutation:** the DO wraps a mutation's dispatch in a
-  * BEGIN/COMMIT span, so a mid-batch failure rolls back the whole mutation.
-  * (In an action there is no transaction span, so the prior patches persist;
-  * the in-memory test harness mirrors the span.)
-  */
+   * Patch many rows by id in one call. Each `{ id, patch }` is applied like a
+   * single `patch()` (per-row triggers + RLS). Returns the number of rows
+   * actually patched.
+   *
+   * **Atomic within a mutation:** the DO wraps a mutation's dispatch in a
+   * BEGIN/COMMIT span, so a mid-batch failure rolls back the whole mutation.
+   * (In an action there is no transaction span, so the prior patches persist;
+   * the in-memory test harness mirrors the span.)
+   */
   patchMany: <T extends string>(patches: ReadonlyArray<{
     id: Id<T>;
     patch: Record<string, unknown>;
@@ -683,14 +683,14 @@ interface DatabaseWriter extends DatabaseReader {
     patched: number;
   }>;
   /**
-  * Patch every row matching `where` with the same `patch` in one call. The
-  * matching rows are resolved first, then each row is updated through the
-  * single-row patch pipeline (OCC, triggers, companion sync, CDC, broadcast)
-  * so reactive subscriptions and search/aggregate companions stay correct.
-  *
-  * **Atomic within a mutation:** the DO wraps a mutation's dispatch in a
-  * BEGIN/COMMIT span, so a mid-batch failure rolls back the whole mutation.
-  */
+   * Patch every row matching `where` with the same `patch` in one call. The
+   * matching rows are resolved first, then each row is updated through the
+   * single-row patch pipeline (OCC, triggers, companion sync, CDC, broadcast)
+   * so reactive subscriptions and search/aggregate companions stay correct.
+   *
+   * **Atomic within a mutation:** the DO wraps a mutation's dispatch in a
+   * BEGIN/COMMIT span, so a mid-batch failure rolls back the whole mutation.
+   */
   patchWhere: (tableName: string, args: {
     patch: Record<string, unknown>;
     where: Record<string, unknown>;
@@ -705,11 +705,11 @@ interface AuthState {
   readonly userId: string | null;
 }
 /**
-* A pending scheduled invocation as surfaced by {@link Scheduler.list} /
-* {@link Scheduler.get}. A clean public mirror of `@lunora/scheduler`'s internal
-* `ScheduleRecord` — re-declared here so the public ctx surface carries no
-* dependency on the scheduler package's internal types.
-*/
+ * A pending scheduled invocation as surfaced by {@link Scheduler.list} /
+ * {@link Scheduler.get}. A clean public mirror of `@lunora/scheduler`'s internal
+ * `ScheduleRecord` — re-declared here so the public ctx surface carries no
+ * dependency on the scheduler package's internal types.
+ */
 interface ScheduledJob {
   args: Record<string, unknown>;
   /** Number of dispatch attempts already made (absent until the first retry). */
@@ -724,13 +724,13 @@ interface ScheduledJob {
   shardKey?: string;
 }
 /**
-* A schedulable durable-workflow reference — the generated `workflows.&lt;name>` /
-* `agents.&lt;name>` object, which carries its `WORKFLOW_*`/`AGENT_*` binding and
-* stable name. Structural mirror of `@lunora/scheduler`'s `WorkflowReference` so
-* `ctx.scheduler` can target a workflow/agent without a dependency on
-* `@lunora/scheduler` / `@lunora/workflow`. A scheduled workflow target starts a
-* fresh instance on fire (the args become its `params`).
-*/
+ * A schedulable durable-workflow reference — the generated `workflows.&lt;name>` /
+ * `agents.&lt;name>` object, which carries its `WORKFLOW_*`/`AGENT_*` binding and
+ * stable name. Structural mirror of `@lunora/scheduler`'s `WorkflowReference` so
+ * `ctx.scheduler` can target a workflow/agent without a dependency on
+ * `@lunora/scheduler` / `@lunora/workflow`. A scheduled workflow target starts a
+ * fresh instance on fire (the args become its `params`).
+ */
 interface SchedulableWorkflowReference {
   /** The `WORKFLOW_*`/`AGENT_*` binding name (present on a generated ref). */
   readonly binding?: string;
@@ -748,22 +748,22 @@ interface Scheduler {
   /** List all pending scheduled jobs. */
   list: () => Promise<ScheduledJob[]>;
   /**
-  * Schedule a one-shot run `delayMs` from now. `target` is a function path
-  * (`"ns:fn"`) dispatched as a one-shot, or a generated `workflows.&lt;name>` /
-  * `agents.&lt;name>` reference which starts a fresh durable instance on fire
-  * (the args become its `params`).
-  */
+   * Schedule a one-shot run `delayMs` from now. `target` is a function path
+   * (`"ns:fn"`) dispatched as a one-shot, or a generated `workflows.&lt;name>` /
+   * `agents.&lt;name>` reference which starts a fresh durable instance on fire
+   * (the args become its `params`).
+   */
   runAfter: (delayMs: number, target: SchedulableWorkflowReference | string, args?: Record<string, unknown>) => Promise<string>;
   /** Like {@link Scheduler.runAfter} but fires at an absolute epoch-ms timestamp. */
   runAt: (timestampMs: number, target: SchedulableWorkflowReference | string, args?: Record<string, unknown>) => Promise<string>;
 }
 /**
-* A workflow instance's lifecycle status. Clean public mirror of
-* `@lunora/workflow`'s `WorkflowInstanceStatus` (itself a mirror of Cloudflare's
-* `WorkflowInstanceStatus`) — re-declared here so the ctx surface carries no
-* dependency on the workflow package, exactly as {@link Scheduler} avoids a
-* dependency on `@lunora/scheduler`.
-*/
+ * A workflow instance's lifecycle status. Clean public mirror of
+ * `@lunora/workflow`'s `WorkflowInstanceStatus` (itself a mirror of Cloudflare's
+ * `WorkflowInstanceStatus`) — re-declared here so the ctx surface carries no
+ * dependency on the workflow package, exactly as {@link Scheduler} avoids a
+ * dependency on `@lunora/scheduler`.
+ */
 type WorkflowInstanceStatus = "complete" | "errored" | "paused" | "queued" | "running" | "terminated" | "unknown" | "waiting" | "waitingForPause";
 /** Result of {@link WorkflowInstance.status}. Mirrors `@lunora/workflow`'s `WorkflowStatusResult`. */
 interface WorkflowStatusResult {
@@ -800,9 +800,9 @@ interface WorkflowInstance {
   terminate: () => Promise<void>;
 }
 /**
-* A typed handle to one declared workflow, addressable from `ctx.workflows`.
-* Mirrors `@lunora/workflow`'s `WorkflowHandle`.
-*/
+ * A typed handle to one declared workflow, addressable from `ctx.workflows`.
+ * Mirrors `@lunora/workflow`'s `WorkflowHandle`.
+ */
 interface WorkflowHandle<Params = Record<string, unknown>> {
   /** Start a new instance (optionally with an id + params). */
   create: (options?: WorkflowCreateOptions<Params>) => Promise<WorkflowInstance>;
@@ -812,51 +812,51 @@ interface WorkflowHandle<Params = Record<string, unknown>> {
   get: (id: string) => Promise<WorkflowInstance>;
 }
 /**
-* The `ctx.workflows` surface on {@link MutationCtx} / {@link ActionCtx}. Each
-* workflow declared in `lunora/workflows.ts` is reachable by its export name;
-* codegen narrows the `get(name)` overloads to the known workflow names + their
-* inferred param types. Mirrors `@lunora/workflow`'s `Workflows`.
-*/
+ * The `ctx.workflows` surface on {@link MutationCtx} / {@link ActionCtx}. Each
+ * workflow declared in `lunora/workflows.ts` is reachable by its export name;
+ * codegen narrows the `get(name)` overloads to the known workflow names + their
+ * inferred param types. Mirrors `@lunora/workflow`'s `Workflows`.
+ */
 interface Workflows {
   /** Resolve the handle for a declared workflow by export name. */
   get: <Params = Record<string, unknown>>(name: string) => WorkflowHandle<Params>;
 }
 /**
-* Programmatic cache purge surface exposed on {@link ActionCtx}. Actions run
-* in the Worker (not the DO), so they can reach the Worker's `ctx.cache.purge`.
-* Queries and mutations do not expose this — they run inside the Durable Object.
-*/
+ * Programmatic cache purge surface exposed on {@link ActionCtx}. Actions run
+ * in the Worker (not the DO), so they can reach the Worker's `ctx.cache.purge`.
+ * Queries and mutations do not expose this — they run inside the Durable Object.
+ */
 interface CachePurge {
   /**
-  * Purge cached responses matching the given tags, or everything when
-  * `purgeEverything` is true. Only available in action handlers.
-  */
+   * Purge cached responses matching the given tags, or everything when
+   * `purgeEverything` is true. Only available in action handlers.
+   */
   purge: (options: {
     purgeEverything?: boolean;
     tags?: string[];
   }) => Promise<unknown>;
 }
 /**
-* Structural projection of workers-types' `SecretsStoreSecret` binding — the
-* per-secret `secrets_store_secrets[]` binding whose `.get()` resolves the
-* secret value (or throws if it does not exist). Mirrored structurally so the
-* runtime resolves it without a workerd type dependency.
-*/
+ * Structural projection of workers-types' `SecretsStoreSecret` binding — the
+ * per-secret `secrets_store_secrets[]` binding whose `.get()` resolves the
+ * secret value (or throws if it does not exist). Mirrored structurally so the
+ * runtime resolves it without a workerd type dependency.
+ */
 interface SecretsStoreSecretLike {
   get: () => Promise<string>;
 }
 /**
-* `ctx.secrets` — read account-level secrets bound via Cloudflare Secrets Store.
-* A core built-in (always present on every context, like `ctx.log`): a binding
-* named in wrangler's `secrets_store_secrets[]` is read by its binding name.
-*
-* ```ts
-* const apiKey = await ctx.secrets.get("STRIPE_KEY");
-* ```
-*
-* The lookup is async (the platform fetches and decrypts on first read);
-* reading an undeclared name throws a directed error naming the bound secrets.
-*/
+ * `ctx.secrets` — read account-level secrets bound via Cloudflare Secrets Store.
+ * A core built-in (always present on every context, like `ctx.log`): a binding
+ * named in wrangler's `secrets_store_secrets[]` is read by its binding name.
+ *
+ * ```ts
+ * const apiKey = await ctx.secrets.get("STRIPE_KEY");
+ * ```
+ *
+ * The lookup is async (the platform fetches and decrypts on first read);
+ * reading an undeclared name throws a directed error naming the bound secrets.
+ */
 interface Secrets {
   /** Resolve a Secrets Store secret by its wrangler binding name. */
   get: (name: string) => Promise<string>;
@@ -866,11 +866,11 @@ type TriggerTiming = "after" | "before";
 /** The CRUD operation a trigger reacts to. `patch` and `replace` both map to `update`. */
 type TriggerOp = "delete" | "insert" | "update";
 /**
-* A row as observed by a trigger handler: the table's `Shape` (with the same
-* optionality rules as {@link InferArgs}) plus the system columns every stored
-* doc carries.
-*/
-type TriggerRow<Shape extends Record<string, Validator>> = { [K in keyof Shape as undefined extends Infer<Shape[K]> ? K : never]?: Infer<Shape[K]> } & { [K in keyof Shape as undefined extends Infer<Shape[K]> ? never : K]: Infer<Shape[K]> } & {
+ * A row as observed by a trigger handler: the table's `Shape` (with the same
+ * optionality rules as {@link InferArgs}) plus the system columns every stored
+ * doc carries.
+ */
+type TriggerRow<Shape extends Record<string, Validator>> = { [K in keyof Shape as undefined extends Infer<Shape[K]> ? K : never]?: Infer<Shape[K]>; } & { [K in keyof Shape as undefined extends Infer<Shape[K]> ? never : K]: Infer<Shape[K]>; } & {
   readonly _creationTime: number;
   readonly _id: string;
 };
@@ -882,11 +882,11 @@ interface TriggerInsertEvent<Shape extends Record<string, Validator> = Record<st
   readonly table: string;
 }
 /**
-* What an `update` trigger observes: the merged row plus the pre-write row.
-* `previous` is typed as always present (the row must exist to be updated); the
-* runtime supplies it best-effort and only omits it in the unreachable
-* row-vanished-mid-write case.
-*/
+ * What an `update` trigger observes: the merged row plus the pre-write row.
+ * `previous` is typed as always present (the row must exist to be updated); the
+ * runtime supplies it best-effort and only omits it in the unreachable
+ * row-vanished-mid-write case.
+ */
 interface TriggerUpdateEvent<Shape extends Record<string, Validator> = Record<string, Validator>> {
   readonly doc: TriggerRow<Shape>;
   readonly id: string;
@@ -895,10 +895,10 @@ interface TriggerUpdateEvent<Shape extends Record<string, Validator> = Record<st
   readonly table: string;
 }
 /**
-* What a `delete` trigger observes: the row about to be (or just) removed.
-* `previous` is typed as always present; the runtime supplies it best-effort
-* and only omits it in the unreachable row-vanished-mid-write case.
-*/
+ * What a `delete` trigger observes: the row about to be (or just) removed.
+ * `previous` is typed as always present; the runtime supplies it best-effort
+ * and only omits it in the unreachable row-vanished-mid-write case.
+ */
 interface TriggerDeleteEvent<Shape extends Record<string, Validator> = Record<string, Validator>> {
   readonly id: string;
   readonly op: "delete";
@@ -922,10 +922,10 @@ interface TriggerQueryArgs {
   with?: Record<string, unknown>;
 }
 /**
-* Args accepted by {@link TriggerDatabase.aggregate} — structural mirror of
-* `@lunora/do`'s `AggregateOptions`, kept local so trigger handlers in
-* `@lunora/server` don't take a hard dep on the DO runtime.
-*/
+ * Args accepted by {@link TriggerDatabase.aggregate} — structural mirror of
+ * `@lunora/do`'s `AggregateOptions`, kept local so trigger handlers in
+ * `@lunora/server` don't take a hard dep on the DO runtime.
+ */
 interface TriggerAggregateOptions {
   baseWhere?: Record<string, unknown>;
   field?: string;
@@ -970,17 +970,17 @@ interface TriggerRankPageOptions {
   where?: Record<string, unknown>;
 }
 /**
-* Portable, table/id-addressed ORM writer handed to trigger handlers via
-* `ctx.db`. Mirrors `@lunora/do`'s runtime `DatabaseWriterLike` surface — it is
-* **not** the generated per-table `ctx.db.&lt;table>` facade (which can't be typed
-* from inside `defineTable`, where the full schema isn't known).
-*
-* `aggregate`/`groupBy`/`count`/`rank`/`rankPage` route through the same
-* trigger-maintained counter and rank tables the user-facing reader uses, so
-* a handler's `ctx.db.&lt;table>.aggregate(...)` observes the just-staged write
-* within the same DO transaction (the counter step happens before the trigger
-* fires).
-*/
+ * Portable, table/id-addressed ORM writer handed to trigger handlers via
+ * `ctx.db`. Mirrors `@lunora/do`'s runtime `DatabaseWriterLike` surface — it is
+ * **not** the generated per-table `ctx.db.&lt;table>` facade (which can't be typed
+ * from inside `defineTable`, where the full schema isn't known).
+ *
+ * `aggregate`/`groupBy`/`count`/`rank`/`rankPage` route through the same
+ * trigger-maintained counter and rank tables the user-facing reader uses, so
+ * a handler's `ctx.db.&lt;table>.aggregate(...)` observes the just-staged write
+ * within the same DO transaction (the counter step happens before the trigger
+ * fires).
+ */
 interface TriggerDatabase {
   aggregate: (tableName: string, options: TriggerAggregateOptions) => Promise<null | number>;
   count: (tableName: string, where?: Record<string, unknown>) => Promise<number>;
@@ -996,10 +996,10 @@ interface TriggerDatabase {
   replace: (id: string, document: Record<string, unknown>) => Promise<void>;
 }
 /**
-* Handle injected into every trigger handler. `db` is the portable ORM writer;
-* `scheduler` enqueues async / cross-shard follow-up work (cross-shard work is
-* **not** transactional with the firing write).
-*/
+ * Handle injected into every trigger handler. `db` is the portable ORM writer;
+ * `scheduler` enqueues async / cross-shard follow-up work (cross-shard work is
+ * **not** transactional with the firing write).
+ */
 interface TriggerCtx {
   readonly db: TriggerDatabase;
   readonly scheduler: Scheduler;
@@ -1007,20 +1007,20 @@ interface TriggerCtx {
 /** A user-declared trigger handler. Throwing from a `before*` handler aborts the write. */
 type TriggerHandler<Event> = (context: TriggerCtx, event: Event) => Promise<void> | void;
 /**
-* A single declared trigger, as stored in {@link TableDefinition.triggerMap}.
-* The handler's event type is erased to the {@link TriggerEvent} union here; the
-* per-op {@link TriggerBuilder} methods recover the precise event type for
-* authors.
-*/
+ * A single declared trigger, as stored in {@link TableDefinition.triggerMap}.
+ * The handler's event type is erased to the {@link TriggerEvent} union here; the
+ * per-op {@link TriggerBuilder} methods recover the precise event type for
+ * authors.
+ */
 interface TriggerDefinition {
   readonly handler: TriggerHandler<TriggerEvent>;
   readonly op: TriggerOp;
   readonly timing: TriggerTiming;
 }
 /**
-* The `t` argument passed to `.triggers((t) => …)`. Each method binds a handler
-* to one `timing`+`op` pair, typing the event against the table's `Shape`.
-*/
+ * The `t` argument passed to `.triggers((t) => …)`. Each method binds a handler
+ * to one `timing`+`op` pair, typing the event against the table's `Shape`.
+ */
 interface TriggerBuilder<Shape extends Record<string, Validator> = Record<string, Validator>> {
   afterDelete: (handler: TriggerHandler<TriggerDeleteEvent<Shape>>) => TriggerDefinition;
   afterInsert: (handler: TriggerHandler<TriggerInsertEvent<Shape>>) => TriggerDefinition;
@@ -1030,11 +1030,11 @@ interface TriggerBuilder<Shape extends Record<string, Validator> = Record<string
   beforeUpdate: (handler: TriggerHandler<TriggerUpdateEvent<Shape>>) => TriggerDefinition;
 }
 /**
-* Per-file metadata returned by {@link ReadOnlyStorage.getMetadata}. A clean
-* public mirror of `@lunora/storage`'s `ObjectMetadata` — re-declared here so
-* the ctx surface carries no dependency on the storage package's types. Matches
-* the columns Convex surfaces for `ctx.storage.getMetadata` / `_storage`.
-*/
+ * Per-file metadata returned by {@link ReadOnlyStorage.getMetadata}. A clean
+ * public mirror of `@lunora/storage`'s `ObjectMetadata` — re-declared here so
+ * the ctx surface carries no dependency on the storage package's types. Matches
+ * the columns Convex surfaces for `ctx.storage.getMetadata` / `_storage`.
+ */
 interface StorageMetadata {
   /** The object's `Content-Type`, when recorded. */
   contentType?: string;
@@ -1050,31 +1050,31 @@ interface StorageMetadata {
   uploaded?: number;
 }
 /**
-* Read-only projection of `Storage` exposed on `QueryCtx` / `MutationCtx`.
-*
-* Queries are pure reads, and mutations run inside a transactional scope —
-* neither is allowed to perform side-effectful R2 writes (`upload`) or
-* deletes (`delete`). They can, however, **read** existing objects and
-* resolve signed URLs (the URL signing itself is HMAC-only — no R2 round
-* trip), so the read-only surface keeps `download` and `getSignedUrl`. The
-* full {@link Storage} surface stays on `ActionCtx`.
-*/
+ * Read-only projection of `Storage` exposed on `QueryCtx` / `MutationCtx`.
+ *
+ * Queries are pure reads, and mutations run inside a transactional scope —
+ * neither is allowed to perform side-effectful R2 writes (`upload`) or
+ * deletes (`delete`). They can, however, **read** existing objects and
+ * resolve signed URLs (the URL signing itself is HMAC-only — no R2 round
+ * trip), so the read-only surface keeps `download` and `getSignedUrl`. The
+ * full {@link Storage} surface stays on `ActionCtx`.
+ */
 interface ReadOnlyStorage<Buckets extends string = string> {
   /**
-  * Select a named bucket (declared via `v.storage("name")`). The returned
-  * accessor's operations target that bucket — `ctx.storage.bucket("avatars")
-  * .download(key)`. The bare `ctx.storage` targets the default bucket.
-  */
+   * Select a named bucket (declared via `v.storage("name")`). The returned
+   * accessor's operations target that bucket — `ctx.storage.bucket("avatars")
+   * .download(key)`. The bare `ctx.storage` targets the default bucket.
+   */
   bucket: (name: Buckets) => ReadOnlyStorage<Buckets>;
   /** The bucket this accessor's operations target (the default for the bare `ctx.storage`). */
   readonly bucketName: string;
   /** Fetch the body of an existing object. Returns `null` when absent. */
   download: (key: string) => Promise<ReadableStream | null>;
   /**
-  * Read a file's metadata (size, content-type, sha256, upload time, custom
-  * metadata) without fetching its body. Returns `null` when the object is
-  * absent. Mirrors Convex's `ctx.storage.getMetadata`.
-  */
+   * Read a file's metadata (size, content-type, sha256, upload time, custom
+   * metadata) without fetching its body. Returns `null` when the object is
+   * absent. Mirrors Convex's `ctx.storage.getMetadata`.
+   */
   getMetadata: (key: string) => Promise<StorageMetadata | null>;
   /** Resolve a short-lived signed URL for an existing object. */
   getSignedUrl: (key: string, options?: {
@@ -1088,20 +1088,20 @@ interface Storage<Buckets extends string = string> extends ReadOnlyStorage<Bucke
   bucket: (name: Buckets) => Storage<Buckets>;
   delete: (key: string) => Promise<void>;
   /**
-  * Mint a short-lived signed `PUT` URL a client can upload directly to,
-  * optionally pinning the `Content-Type` the uploader must send. Mirrors
-  * Convex's `storage.generateUploadUrl`.
-  */
+   * Mint a short-lived signed `PUT` URL a client can upload directly to,
+   * optionally pinning the `Content-Type` the uploader must send. Mirrors
+   * Convex's `storage.generateUploadUrl`.
+   */
   generateUploadUrl: (key: string, options?: {
     contentType?: string;
     expiresInSeconds?: number;
   }) => Promise<string>;
   /**
-  * Upload `body` to `key` from the server, returning the stored object's key
-  * and etag. Mirrors Convex's `storage.store`. Accepts the same guard fields
-  * as `@lunora/storage`'s `UploadOptions` so `maxSize` /
-  * `allowedContentTypes` enforcement isn't lost behind the Convex-style alias.
-  */
+   * Upload `body` to `key` from the server, returning the stored object's key
+   * and etag. Mirrors Convex's `storage.store`. Accepts the same guard fields
+   * as `@lunora/storage`'s `UploadOptions` so `maxSize` /
+   * `allowedContentTypes` enforcement isn't lost behind the Convex-style alias.
+   */
   store: (key: string, body: ReadableStream | ArrayBuffer | Blob, options?: {
     allowedContentTypes?: ReadonlyArray<string>;
     contentType?: string;
@@ -1145,84 +1145,122 @@ interface VectorRecord {
   values: ReadonlyArray<number>;
 }
 /**
-* Read-only vector surface exposed on {@link QueryCtx}. Mirrors the read half
-* of `@lunora/bindings/vectors`' `LunoraVectors` so the live adapter is assignable.
-*/
+ * Read-only vector surface exposed on {@link QueryCtx}. Mirrors the read half
+ * of `@lunora/bindings/vectors`' `LunoraVectors` so the live adapter is assignable.
+ */
 interface VectorSearchReader {
   getByIds: (indexName: string, ids: ReadonlyArray<string>) => Promise<ReadonlyArray<VectorRecord>>;
   query: (indexName: string, input: VectorQueryInput) => Promise<VectorMatches>;
 }
 /**
-* Mutating vector surface on {@link MutationCtx} / {@link ActionCtx}. `upsert`
-* is queued post-commit by default; `upsertNow` forces a synchronous write.
-* `db.delete` on a vectorized table auto-propagates the matching `deleteByIds`.
-*/
+ * Mutating vector surface on {@link MutationCtx} / {@link ActionCtx}. `upsert`
+ * is queued post-commit by default; `upsertNow` forces a synchronous write.
+ * `db.delete` on a vectorized table auto-propagates the matching `deleteByIds`.
+ */
 interface VectorSearch extends VectorSearchReader {
   deleteByIds: (indexName: string, ids: ReadonlyArray<string>) => Promise<void>;
   upsert: (indexName: string, input: VectorUpsertInput) => Promise<void>;
   upsertNow: (indexName: string, input: VectorUpsertInput) => Promise<void>;
 }
 /**
-* Structured logger on every function `ctx`. Each call emits one attributed log
-* line — tagged with the function path on the server — that flows to an
-* `ObservabilitySink`'s `onLog` (where you route it in production) and, in
-* development, to the dev server terminal via the CLI / Vite plugin formatter.
-* Mirrors the `console` method names so it's a drop-in for `console.log` inside a
-* handler, but with attribution and a routable transport.
-*
-* Accepts any number of values per call, exactly like `console`; objects are
-* rendered into the human-readable message. The raw, un-rendered arguments are
-* preserved ONLY on the in-process `onLog` sink (which you opt into and control);
-* the rendered message — not the structured args — is what reaches the dev
-* terminal and the platform's Workers Logs.
-*
-* Attribution follows the dispatched function: a log emitted inside an internal
-* function invoked via `ctx.runQuery`/`runMutation`/`runAction` is attributed to
-* the outer request entrypoint, since the composed call reuses its context.
-*/
+ * Structured, filterable key/value fields attached to a log line — the second
+ * argument of a `ctx.log.<level>(message, fields)` call, or the fields bound by
+ * `ctx.log.with(fields)`. They travel to an `ObservabilitySink`'s `onLog` and,
+ * for a network sink, become OTLP log-record attributes a log pipeline (or the
+ * Cloud log viewer) can filter and index on. Primitive values pass through;
+ * objects/arrays are JSON-encoded at the sink boundary.
+ */
+type LogFields = Record<string, unknown>;
+/**
+ * One `ctx.log` severity method. Two call forms:
+ *
+ * - **Structured** — `ctx.log.info("order placed", { orderId, total })`: a
+ *   message string plus a `fields` object. The fields are indexed as attributes.
+ * - **Console-style** — `ctx.log.info("state", value, other)`: any number of
+ *   values, joined into the display message exactly like `console.log`.
+ *
+ * The structured form is matched when the second argument is a plain object;
+ * otherwise the call is treated as console-style, so existing `console`-shaped
+ * calls keep working unchanged.
+ */
+interface LunoraLogMethod {
+  (message: string, fields?: LogFields): void;
+  (...args: unknown[]): void;
+}
+/**
+ * Structured logger on every function `ctx`. Each call emits one attributed log
+ * line — tagged with the function path on the server — that flows to an
+ * `ObservabilitySink`'s `onLog` (where you route it in production) and, in
+ * development, to the dev server terminal via the CLI / Vite plugin formatter.
+ * Mirrors the `console` method names so it's a drop-in for `console.log` inside a
+ * handler, but with attribution, structured fields, and a routable transport.
+ *
+ * Six severities spanning the OpenTelemetry ramp: `trace`, `debug`, `info` (and
+ * its `log` alias), `warn`, `error`, `fatal`.
+ *
+ * Two ways to attach structured {@link LogFields}: pass them per call
+ * (`ctx.log.info(message, fields)`) or bind them once with {@link with} for a
+ * child logger that stamps every line. The rendered `message` and the structured
+ * `fields` reach the dev terminal and the platform's Workers Logs; the raw,
+ * un-rendered console-style arguments are preserved ONLY on the in-process
+ * `onLog` sink (which you opt into and control).
+ *
+ * Attribution follows the dispatched function: a log emitted inside an internal
+ * function invoked via `ctx.runQuery`/`runMutation`/`runAction` is attributed to
+ * the outer request entrypoint, since the composed call reuses its context.
+ */
 interface LunoraLogger {
-  readonly debug: (...args: unknown[]) => void;
-  readonly error: (...args: unknown[]) => void;
-  readonly info: (...args: unknown[]) => void;
-  readonly log: (...args: unknown[]) => void;
-  readonly warn: (...args: unknown[]) => void;
+  readonly debug: LunoraLogMethod;
+  readonly error: LunoraLogMethod;
+  readonly fatal: LunoraLogMethod;
+  readonly info: LunoraLogMethod;
+  readonly log: LunoraLogMethod;
+  readonly trace: LunoraLogMethod;
+  readonly warn: LunoraLogMethod;
+  /**
+   * Return a child logger that stamps `fields` onto every line it emits,
+   * merged under any per-call fields (per-call wins on a key clash). Chainable
+   * — `ctx.log.with({ requestId }).with({ step })` accumulates both. Use it to
+   * bind request-scoped context once instead of repeating it per call.
+   */
+  readonly with: (fields: LogFields) => LunoraLogger;
 }
 interface QueryCtx {
   readonly auth: AuthState;
   readonly db: DatabaseReader;
   /**
-  * The validated, typed environment. Populated only when the project declares
-  * a `defineEnv(...)` contract in `lunora/env.ts`; codegen then narrows this to
-  * the validated `InferEnv` shape so `ctx.env.STRIPE_KEY` is parsed and
-  * coercion-aware. Absent (optional) without a contract — declare
-  * `lunora/env.ts` to populate and type it.
-  */
+   * The validated, typed environment. Populated only when the project declares
+   * a `defineEnv(...)` contract in `lunora/env.ts`; codegen then narrows this to
+   * the validated `InferEnv` shape so `ctx.env.STRIPE_KEY` is parsed and
+   * coercion-aware. Absent (optional) without a contract — declare
+   * `lunora/env.ts` to populate and type it.
+   */
   readonly env?: Record<string, unknown>;
   /**
-  * The caller's IP for this request — Cloudflare's trusted `CF-Connecting-IP`,
-  * forwarded server-side (never read from a client header). `undefined` when
-  * unknown: a live-subscription re-run, a server-initiated dispatch, or
-  * non-Cloudflare hosting. A convenient rate-limit key for anonymous traffic.
-  */
+   * The caller's IP for this request — Cloudflare's trusted `CF-Connecting-IP`,
+   * forwarded server-side (never read from a client header). `undefined` when
+   * unknown: a live-subscription re-run, a server-initiated dispatch, or
+   * non-Cloudflare hosting. A convenient rate-limit key for anonymous traffic.
+   */
   readonly ip?: string;
   /** Structured, function-attributed logger; see {@link LunoraLogger}. */
   readonly log: LunoraLogger;
   /**
-  * Wall-clock time (epoch ms) the function began, captured once so the whole
-  * handler sees a single stable value. Query/mutation handlers must be
-  * deterministic — they may be re-run on OCC retry / subscription re-eval — so
-  * read time through `ctx.now` instead of `Date.now()` (the latter is flagged
-  * by the `nondeterministic_query_mutation` advisor). Actions may use `Date.now()`.
-  */
+   * Wall-clock time (epoch ms) the function began, captured once so the whole
+   * handler sees a single stable value. Query/mutation handlers must be
+   * deterministic — they may be re-run on OCC retry / subscription re-eval — so
+   * read time through `ctx.now` instead of `Date.now()` (the latter is flagged
+   * by the `nondeterministic_query_mutation` advisor). Actions may use `Date.now()`.
+   */
   readonly now: number;
   /**
-  * Compose a read-only subquery in-process, reusing this query's read
-  * context (same transaction, same `db`). Executes the referenced query's
-  * handler directly — no fresh DO RPC round-trip — so it observes the exact
-  * same snapshot. A query may only call other queries; there is no
-  * `runMutation` on a `QueryCtx` (writes are not allowed from a query).
-  * Mirrors Convex's `ctx.runQuery`.
-  */
+   * Compose a read-only subquery in-process, reusing this query's read
+   * context (same transaction, same `db`). Executes the referenced query's
+   * handler directly — no fresh DO RPC round-trip — so it observes the exact
+   * same snapshot. A query may only call other queries; there is no
+   * `runMutation` on a `QueryCtx` (writes are not allowed from a query).
+   * Mirrors Convex's `ctx.runQuery`.
+   */
   readonly runQuery: <A extends ArgsValidator, R>(reference: RegisteredQuery<A, R>, args: InferArgs<A>) => Promise<R>;
   /** Read account-level secrets from Cloudflare Secrets Store; see {@link Secrets}. */
   readonly secrets: Secrets;
@@ -1233,45 +1271,45 @@ interface MutationCtx {
   readonly auth: AuthState;
   readonly db: DatabaseWriter;
   /**
-  * The validated, typed environment. Populated only when the project declares
-  * a `defineEnv(...)` contract in `lunora/env.ts`; codegen then narrows this to
-  * the validated `InferEnv` shape so `ctx.env.STRIPE_KEY` is parsed and
-  * coercion-aware. Absent (optional) without a contract — declare
-  * `lunora/env.ts` to populate and type it.
-  */
+   * The validated, typed environment. Populated only when the project declares
+   * a `defineEnv(...)` contract in `lunora/env.ts`; codegen then narrows this to
+   * the validated `InferEnv` shape so `ctx.env.STRIPE_KEY` is parsed and
+   * coercion-aware. Absent (optional) without a contract — declare
+   * `lunora/env.ts` to populate and type it.
+   */
   readonly env?: Record<string, unknown>;
   /**
-  * The caller's IP for this request — Cloudflare's trusted `CF-Connecting-IP`,
-  * forwarded server-side (never read from a client header). `undefined` when
-  * unknown: a live-subscription re-run, a server-initiated dispatch, or
-  * non-Cloudflare hosting. A convenient rate-limit key for anonymous traffic.
-  */
+   * The caller's IP for this request — Cloudflare's trusted `CF-Connecting-IP`,
+   * forwarded server-side (never read from a client header). `undefined` when
+   * unknown: a live-subscription re-run, a server-initiated dispatch, or
+   * non-Cloudflare hosting. A convenient rate-limit key for anonymous traffic.
+   */
   readonly ip?: string;
   /** Structured, function-attributed logger; see {@link LunoraLogger}. */
   readonly log: LunoraLogger;
   /**
-  * Wall-clock time (epoch ms) the function began, captured once so the whole
-  * handler sees a single stable value. Mutation handlers must be deterministic
-  * — they may be re-run on OCC retry — so read time through `ctx.now` instead
-  * of `Date.now()` (the latter is flagged by the `nondeterministic_query_mutation`
-  * advisor). Actions may use `Date.now()`.
-  */
+   * Wall-clock time (epoch ms) the function began, captured once so the whole
+   * handler sees a single stable value. Mutation handlers must be deterministic
+   * — they may be re-run on OCC retry — so read time through `ctx.now` instead
+   * of `Date.now()` (the latter is flagged by the `nondeterministic_query_mutation`
+   * advisor). Actions may use `Date.now()`.
+   */
   readonly now: number;
   /**
-  * Compose a submutation in-process, reusing this mutation's `db` writer.
-  * Executes the referenced mutation's handler directly — no fresh DO RPC —
-  * so its writes apply through the same shard invocation as the enclosing
-  * mutation. Note: writes are not wrapped in a SQL transaction, so a partial
-  * failure does not roll back earlier writes (the same as a top-level
-  * mutation). Mirrors Convex's `ctx.runMutation`.
-  */
+   * Compose a submutation in-process, reusing this mutation's `db` writer.
+   * Executes the referenced mutation's handler directly — no fresh DO RPC —
+   * so its writes apply through the same shard invocation as the enclosing
+   * mutation. Note: writes are not wrapped in a SQL transaction, so a partial
+   * failure does not roll back earlier writes (the same as a top-level
+   * mutation). Mirrors Convex's `ctx.runMutation`.
+   */
   readonly runMutation: <A extends ArgsValidator, R>(reference: RegisteredMutation<A, R>, args: InferArgs<A>) => Promise<R>;
   /**
-  * Compose a read-only subquery in-process, reusing this mutation's `db`.
-  * Executes the referenced query's handler directly — no fresh DO RPC — so
-  * it observes this mutation's in-flight writes. Mirrors Convex's
-  * `ctx.runQuery`.
-  */
+   * Compose a read-only subquery in-process, reusing this mutation's `db`.
+   * Executes the referenced query's handler directly — no fresh DO RPC — so
+   * it observes this mutation's in-flight writes. Mirrors Convex's
+   * `ctx.runQuery`.
+   */
   readonly runQuery: <A extends ArgsValidator, R>(reference: RegisteredQuery<A, R>, args: InferArgs<A>) => Promise<R>;
   readonly scheduler: Scheduler;
   /** Read account-level secrets from Cloudflare Secrets Store; see {@link Secrets}. */
@@ -1284,36 +1322,36 @@ interface MutationCtx {
 interface ActionCtx {
   readonly auth: AuthState;
   /**
-  * Programmatic Workers Cache purge; see {@link CachePurge}.
-  * **Action-only** — actions run in the Worker, which has a `cache` binding.
-  * Queries and mutations run inside the Durable Object and do not expose this.
-  * Optional at runtime because Workers Cache is only present when enabled.
-  */
+   * Programmatic Workers Cache purge; see {@link CachePurge}.
+   * **Action-only** — actions run in the Worker, which has a `cache` binding.
+   * Queries and mutations run inside the Durable Object and do not expose this.
+   * Optional at runtime because Workers Cache is only present when enabled.
+   */
   readonly cache?: CachePurge;
   readonly db: DatabaseWriter;
   /**
-  * The validated, typed environment. Populated only when the project declares
-  * a `defineEnv(...)` contract in `lunora/env.ts`; codegen then narrows this to
-  * the validated `InferEnv` shape so `ctx.env.STRIPE_KEY` is parsed and
-  * coercion-aware. Absent (optional) without a contract — declare
-  * `lunora/env.ts` to populate and type it.
-  */
+   * The validated, typed environment. Populated only when the project declares
+   * a `defineEnv(...)` contract in `lunora/env.ts`; codegen then narrows this to
+   * the validated `InferEnv` shape so `ctx.env.STRIPE_KEY` is parsed and
+   * coercion-aware. Absent (optional) without a contract — declare
+   * `lunora/env.ts` to populate and type it.
+   */
   readonly env?: Record<string, unknown>;
   readonly fetch: typeof globalThis.fetch;
   /**
-  * The caller's IP for this request — Cloudflare's trusted `CF-Connecting-IP`,
-  * forwarded server-side (never read from a client header). `undefined` when
-  * unknown: a live-subscription re-run, a server-initiated dispatch, or
-  * non-Cloudflare hosting. A convenient rate-limit key for anonymous traffic.
-  */
+   * The caller's IP for this request — Cloudflare's trusted `CF-Connecting-IP`,
+   * forwarded server-side (never read from a client header). `undefined` when
+   * unknown: a live-subscription re-run, a server-initiated dispatch, or
+   * non-Cloudflare hosting. A convenient rate-limit key for anonymous traffic.
+   */
   readonly ip?: string;
   /** Structured, function-attributed logger; see {@link LunoraLogger}. */
   readonly log: LunoraLogger;
   /**
-  * Wall-clock time (epoch ms) the action began, captured once for convenience
-  * and parity with query/mutation `ctx.now`. Actions run exactly once, so they
-  * may also use ambient `Date.now()` freely.
-  */
+   * Wall-clock time (epoch ms) the action began, captured once for convenience
+   * and parity with query/mutation `ctx.now`. Actions run exactly once, so they
+   * may also use ambient `Date.now()` freely.
+   */
   readonly now: number;
   readonly runAction: <A extends ArgsValidator, R>(reference: RegisteredAction<A, R>, args: InferArgs<A>) => Promise<R>;
   readonly runMutation: <A extends ArgsValidator, R>(reference: RegisteredMutation<A, R>, args: InferArgs<A>) => Promise<R>;
@@ -1327,9 +1365,9 @@ interface ActionCtx {
   readonly workflows: Workflows;
 }
 /**
-* Stand-in returned by codegen so projects can `import { api } from "./_generated/api"`.
-* The runtime value is opaque; the types are filled in by generated declarations.
-*/
+ * Stand-in returned by codegen so projects can `import { api } from "./_generated/api"`.
+ * The runtime value is opaque; the types are filled in by generated declarations.
+ */
 type AnyApi = Record<string, Record<string, RegisteredFunction<ArgsValidator, unknown, FunctionKind>>>;
 declare const anyApi: AnyApi;
-export { type ActionCtx, type AggregateIndexDefinition, type AggregateOp, type AnyApi, type ArgsValidator, type AuthState, type CachePurge, type DatabaseReader, type DatabaseWriter, type DurableObjectJurisdiction, type ExternalSourceCursor, type ExternalSourceDefinition, type ExternalSourceMode, type ExternalSourceRefresh, type FunctionKind, type FunctionVisibility, type GlobalBackend, type IndexDefinition, type IndexRangeBuilder, type InferArgs, type LifecycleEvent, type LifecycleEventKind, type LunoraLogger, type MutationCtx, type OnDeleteAction, type PaginationOptions, type PaginationResult, type QueryCtx, type RankIndexDefinition, type RankSortKey, type ReadOnlyStorage, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMutation, type RegisteredQuery, type RegisteredStream, type RelationDefinition, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type Schema, type SearchFilterBuilder, type SearchIndexDefinition, type Secrets, type SecretsStoreSecretLike, type ShardMode, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableDefinition, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerBuilder, type TriggerCtx, type TriggerDatabase, type TriggerDefinition, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type VectorEmbedder, type VectorIndexDefinition, type VectorMatch, type VectorMatches, type VectorMetric, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, type X402ProcedureConfig, anyApi };
+export { type ActionCtx, type AggregateIndexDefinition, type AggregateOp, type AnyApi, type ArgsValidator, type AuthState, type CachePurge, type DatabaseReader, type DatabaseWriter, type DurableObjectJurisdiction, type ExternalSourceCursor, type ExternalSourceDefinition, type ExternalSourceMode, type ExternalSourceRefresh, type FunctionKind, type FunctionVisibility, type GlobalBackend, type IndexDefinition, type IndexRangeBuilder, type InferArgs, type LifecycleEvent, type LifecycleEventKind, type LogFields, type LunoraLogMethod, type LunoraLogger, type MutationCtx, type OnDeleteAction, type PaginationOptions, type PaginationResult, type QueryCtx, type RankIndexDefinition, type RankSortKey, type ReadOnlyStorage, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMutation, type RegisteredQuery, type RegisteredStream, type RelationDefinition, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type Schema, type SearchFilterBuilder, type SearchIndexDefinition, type Secrets, type SecretsStoreSecretLike, type ShardMode, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableDefinition, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerBuilder, type TriggerCtx, type TriggerDatabase, type TriggerDefinition, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type VectorEmbedder, type VectorIndexDefinition, type VectorMatch, type VectorMatches, type VectorMetric, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, type X402ProcedureConfig, anyApi };