@lunora/server 1.0.0-alpha.55 → 1.0.0-alpha.56

package/dist/index.d.mts

@@ -10,19 +10,21 @@ import { b as Permission, R as Role, T as TypedDefinePolicyInput, a as Policy, D
 export type { d as PolicyContext, e as PolicyDecision, f as PolicyDecisionOf, P as PolicyOperation } from "./packem_shared/types.d-C4CMJK8x.mjs";
 export { type CronJob, type CronJobsBuilder, type CronScheduleKind, type DailySchedule, type IntervalSchedule, type MonthlySchedule, type WeeklySchedule, cronJobs } from '@lunora/scheduler';
 /**
- * Make any `config.storage` result bucket-aware so `ctx.storage.bucket(name)`
+ * Make any resolved storage capability bucket-aware so `ctx.storage.bucket(name)`
  * always resolves. A `createBucketStorage(...)` result already carries
  * `.bucket` / `.bucketName` and is returned as-is; a single `createStorage(...)`
  * (or the no-storage stub) is tagged as the `"default"` bucket, where
  * `.bucket(name)` is the identity — single-bucket apps address one binding under
  * every name.
  *
- * This is the runtime counterpart the generated `_generated/shard.ts` imports to
- * wrap `ctx.storage`; it lives here (the single source) rather than being stamped
- * inline into every generated file, so the bucket-tagging behaviour has one home
- * alongside the storage ctx types. The input is genuinely heterogeneous (a thunk
- * result cast through `unknown`), so the signature is `unknown → unknown`; the
- * generated caller casts the result to its storage type.
+ * Lives here rather than in `@lunora/server` because two packages need it and
+ * neither may depend on the other: `@lunora/server` re-exports it as the runtime
+ * counterpart `_generated/shard.ts` imports, and `@lunora/runtime` uses it to
+ * build `ctx.storage` for an HTTP action from the worker's own R2 bindings.
+ * Inlined into each `dist` by the bundler, so no dependency edge is created.
+ *
+ * The input is genuinely heterogeneous (a thunk result cast through `unknown`),
+ * so the signature is `unknown → unknown`; callers cast the result.
  */
 declare const asBucketStorage: (raw: unknown) => unknown;
 /** Builder discriminator. Codegen reads this kind. */
@@ -583,18 +585,29 @@ type HttpMethod = "DELETE" | "GET" | "HEAD" | "OPTIONS" | "PATCH" | "POST" | "PU
 /**
  * Context handed to an HTTP action handler. A narrower view of {@link ActionContext}:
  * HTTP actions run in the worker (the "action runtime"), separate from the
- * transactional store, so there is no direct `db` / `vectors` / `storage`
- * surface — reach the data layer through `runQuery` / `runMutation` /
- * `runAction`, which forward to the owning shard.
+ * transactional store, so there is no direct `db` / `vectors` surface — reach the
+ * data layer through `runQuery` / `runMutation` / `runAction`, which forward to
+ * the owning shard. `db`'s absence is principled: an HTTP handler is not
+ * transactional.
+ *
+ * `scheduler` and `storage` ARE present, because neither needs the shard — the
+ * scheduler talks to the scheduler DO, and R2 is a worker binding an HTTP
+ * handler can reach where an action does. Both are optional: each exists only
+ * when the app declared the matching capability (`.scheduler(...)` /
+ * `.storage(...)`) on the generated app builder.
  *
- * `scheduler` IS present (it talks to the scheduler DO, not the shard) but is
- * optional: it exists only when the app declared `.scheduler(...)` on the
- * generated app builder. "Receive webhook → enqueue the real work → return 200"
- * is what HTTP actions are for, so omitting it forced every app to hand-roll a
- * hop through a mutation plus a closed allow-list of target strings.
+ * Omitting them was costly out of proportion to the gap. Without `scheduler`,
+ * "receive webhook → enqueue the real work → return 200" — the shape HTTP
+ * actions exist for — forced a hop through a mutation plus a closed allow-list
+ * of target strings, because a function reference cannot cross the RPC boundary
+ * and a free-form target on an unauthenticated endpoint is a "call any internal
+ * function" primitive. Without `storage`, any helper the ctx was threaded into
+ * had to be typed for its storage-touching branch, so a handler was barred from
+ * the helper even on the branches that never went near storage.
  */
 type HttpActionCtx = Pick<ActionCtx, "auth" | "cache" | "fetch" | "runAction" | "runMutation" | "runQuery"> & {
   readonly scheduler?: ActionCtx["scheduler"];
+  readonly storage?: ActionCtx["storage"];
 };
 /** A raw handler wrapped by {@link httpAction}. Receives the raw request, returns the raw response. */
 type HttpActionHandler = (context: HttpActionCtx, request: Request) => Promise<Response> | Response;
@@ -1166,13 +1179,47 @@ interface MaskContextIn {
 declare const mask: <Context extends MaskContextIn = MaskContextIn>(policies: MaskPolicies<Context>, options?: MaskOptions<Context>) => Middleware<Context, Context>;
 /** A document handed to a migration transform: the stored row including `_id`/`_creationTime`. */
 type MigrationDocument = Record<string, unknown>;
+/**
+ * The read surface a transform reaches through its `ctx`.
+ *
+ * Read-only by design: the runner accounts for exactly one rewrite per row read,
+ * and a transform writing directly would make that count describe something
+ * other than what happened. Scoped to the shard the runner is walking.
+ */
+interface MigrationReader {
+  count: (table: string, where?: Record<string, unknown>) => Promise<number>;
+  findFirst: (table: string, args?: Record<string, unknown>) => Promise<MigrationDocument | null>;
+  findMany: (table: string, args?: Record<string, unknown>) => Promise<{
+    isDone: boolean;
+    page: MigrationDocument[];
+  }>;
+  get: (id: string, expectedTable?: string) => Promise<MigrationDocument | null>;
+}
+/** The context handed to a transform alongside the row. */
+interface MigrationCtx {
+  db: MigrationReader;
+}
 /**
  * Transform applied to one document. Return a new document to rewrite the row,
  * or `undefined` to leave it untouched (skipped, not counted as changed). The
  * runner always preserves the original `_id` and `_creationTime`, so the
  * returned document neither needs to nor should change row identity.
+ *
+ * The second parameter carries a shard-scoped reader. Without it a transform
+ * could only rewrite the row it was handed — enough for a backfill whose new
+ * value is a pure function of the old row (`displayName = name ?? "Anonymous"`),
+ * but not for the shape people actually write: read the parent, copy a field
+ * down onto its children.
+ *
+ * May return a promise, since a cross-table read is asynchronous.
+ *
+ * **A shard key cannot be backfilled this way, even with a reader.** A row whose
+ * shard-key field is unset does not belong to any shard, so a shard-scoped query
+ * will not enumerate it; and writing the key would have to MOVE the row to a
+ * different Durable Object, which a per-shard runner cannot do. Re-keying is an
+ * export → transform → import, not a migration.
  */
-type MigrationTransform = (document: MigrationDocument) => MigrationDocument | undefined | void;
+type MigrationTransform = (document: MigrationDocument, ctx: MigrationCtx) => MigrationDocument | Promise<MigrationDocument | undefined | void> | undefined | void;
 interface MigrationDefinition {
   /** Rows fetched and rewritten per batch. Defaults to the runner's batch size when omitted. */
   readonly batchSize?: number;
@@ -2455,4 +2502,4 @@ interface StorageContextIn {
 }
 declare const storageRules: <Context extends StorageContextIn = StorageContextIn>(rules: ReadonlyArray<StorageRule<Context>>, options?: StorageRulesOptions) => Middleware<Context, Context>;
 declare const VERSION = "0.0.0";
-export { type ActionBuilder, type ActionCtx, type AggregateIndexDefinition, type AggregateIndexOptions, type AggregateOp, type ArgsValidator, type Component, type ComponentFunctions, type CreateOptions, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, type DataModelInit, type DefineComponentOptions, type DefineIdentityOptions, type DefineListArgsConfig, type DefinePluginOptions, type DefinePolicyInput, type DefinePresenceOptions, type DefineStorageRuleInput, type DurableObjectJurisdiction, type EmptyArgs, type EnvAccessor, type EnvKeyFailure, type EnvShape, type ExposeConfig, type ExtendableSchema, type FacadeEntry, type FacadeWriterLike, type FunctionKind, type HttpActionCtx, type HttpActionHandler, type HttpMethod, type HttpRoute, type HttpRouteBuilder, type HttpRouteFactory, type HttpRouteHandlerOptions, type HttpStreamHandlerOptions, type IdentityContract, type IdentityRejectMode, type IdentityValidation, type InferArgs, type InferEnv, type InferIdentity, type InlineAggregateIndexOptions, type InlineRankIndexOptions, type InternalActionBuilder, type InternalMutationBuilder, type InternalQueryBuilder, type LifecycleEvent, type LifecycleHandler, type ListArgsSpec, type ListArgsValidators, type ListArgsValue, type ListFilterOperators, type ListOrderByEntry, type ListWhere, type LunoraBuilders, LunoraEnvError, LunoraError, type LunoraHttpApp, type LunoraHttpEnv, type LunoraRouteHandler, type ManyRelation, type MaskColumns, type MaskContext, type MaskFn, type MaskOptions, type MaskPolicies, type MaskStrategy, type Middleware, type MiddlewareNext, type MigrationDefinition, type MigrationDocument, type MigrationTransform, type MutationBuilder, type MutationCtx, type MutatorDefinition, type OnDeleteAction, type OneRelation, type OrmLike, DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, type Permission, type Plugin, type Policy, type PrefixedTables, type PresenceComponent, type PresenceFunctions, type PresenceMember, type ProtectPublicOptions, type QueryBuilder, type QueryCtx, type RankIndexDefinition, type RankIndexOptions, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMigration, type RegisteredMutation, type RegisteredMutator, type RegisteredQuery, type RegisteredShape, type RegisteredStream, type RelationBuilder, type RelationDefinition, type RlsOptions, type RlsReadRegistry, type Role, type Schema, type SchemaExtension, type ShapeDefinition, type ShapeReadWhereRequest, type StorageOperation, type StorageRule, type StorageRuleContext, type StorageRuleDecision, type StorageRulesOptions, type TableBuilder, type TableDefinition, type TerminalKind, type TriggerBuilder, type TriggerDefinition, type TypedDefinePolicyInput, VERSION, type VectorEmbedder, type VectorIndexDefinition, type VectorIndexOptions, type VectorMetric, type VectorizeOptions, type WhereInput, allowAll, asBucketStorage, bindOrm, bindTableFacade, buildRlsReadRegistry, clampLimit, composePluginMiddleware, composeShapeReadWhere, createPolicyDsl, createSecrets, defineAggregateIndex, defineComponent, defineEnv, defineIdentity, defineListArgs, defineMigration, defineMutator, definePermission, definePlugin, definePolicies, definePolicy, definePresence, defineRankIndex, defineRole, defineSchema, defineSchemaExtension, defineShape, defineStorageRule, defineStorageRules, defineTable, defineVectorIndex, deny, httpAction, httpRoute, httpRouter, initLunora, installPlugins, isDeny, isSafeHeaderValue, mask, mergeSchemaExtension, onConnect, onDisconnect, presenceExtension, protectPublic, redactSecrets, rls, serveStorageObject, storageRules, toWhereInput };
+export { type ActionBuilder, type ActionCtx, type AggregateIndexDefinition, type AggregateIndexOptions, type AggregateOp, type ArgsValidator, type Component, type ComponentFunctions, type CreateOptions, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, type DataModelInit, type DefineComponentOptions, type DefineIdentityOptions, type DefineListArgsConfig, type DefinePluginOptions, type DefinePolicyInput, type DefinePresenceOptions, type DefineStorageRuleInput, type DurableObjectJurisdiction, type EmptyArgs, type EnvAccessor, type EnvKeyFailure, type EnvShape, type ExposeConfig, type ExtendableSchema, type FacadeEntry, type FacadeWriterLike, type FunctionKind, type HttpActionCtx, type HttpActionHandler, type HttpMethod, type HttpRoute, type HttpRouteBuilder, type HttpRouteFactory, type HttpRouteHandlerOptions, type HttpStreamHandlerOptions, type IdentityContract, type IdentityRejectMode, type IdentityValidation, type InferArgs, type InferEnv, type InferIdentity, type InlineAggregateIndexOptions, type InlineRankIndexOptions, type InternalActionBuilder, type InternalMutationBuilder, type InternalQueryBuilder, type LifecycleEvent, type LifecycleHandler, type ListArgsSpec, type ListArgsValidators, type ListArgsValue, type ListFilterOperators, type ListOrderByEntry, type ListWhere, type LunoraBuilders, LunoraEnvError, LunoraError, type LunoraHttpApp, type LunoraHttpEnv, type LunoraRouteHandler, type ManyRelation, type MaskColumns, type MaskContext, type MaskFn, type MaskOptions, type MaskPolicies, type MaskStrategy, type Middleware, type MiddlewareNext, type MigrationCtx, type MigrationDefinition, type MigrationDocument, type MigrationReader, type MigrationTransform, type MutationBuilder, type MutationCtx, type MutatorDefinition, type OnDeleteAction, type OneRelation, type OrmLike, DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, type Permission, type Plugin, type Policy, type PrefixedTables, type PresenceComponent, type PresenceFunctions, type PresenceMember, type ProtectPublicOptions, type QueryBuilder, type QueryCtx, type RankIndexDefinition, type RankIndexOptions, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMigration, type RegisteredMutation, type RegisteredMutator, type RegisteredQuery, type RegisteredShape, type RegisteredStream, type RelationBuilder, type RelationDefinition, type RlsOptions, type RlsReadRegistry, type Role, type Schema, type SchemaExtension, type ShapeDefinition, type ShapeReadWhereRequest, type StorageOperation, type StorageRule, type StorageRuleContext, type StorageRuleDecision, type StorageRulesOptions, type TableBuilder, type TableDefinition, type TerminalKind, type TriggerBuilder, type TriggerDefinition, type TypedDefinePolicyInput, VERSION, type VectorEmbedder, type VectorIndexDefinition, type VectorIndexOptions, type VectorMetric, type VectorizeOptions, type WhereInput, allowAll, asBucketStorage, bindOrm, bindTableFacade, buildRlsReadRegistry, clampLimit, composePluginMiddleware, composeShapeReadWhere, createPolicyDsl, createSecrets, defineAggregateIndex, defineComponent, defineEnv, defineIdentity, defineListArgs, defineMigration, defineMutator, definePermission, definePlugin, definePolicies, definePolicy, definePresence, defineRankIndex, defineRole, defineSchema, defineSchemaExtension, defineShape, defineStorageRule, defineStorageRules, defineTable, defineVectorIndex, deny, httpAction, httpRoute, httpRouter, initLunora, installPlugins, isDeny, isSafeHeaderValue, mask, mergeSchemaExtension, onConnect, onDisconnect, presenceExtension, protectPublic, redactSecrets, rls, serveStorageObject, storageRules, toWhereInput };

package/dist/index.d.ts

@@ -10,19 +10,21 @@ import { b as Permission, R as Role, T as TypedDefinePolicyInput, a as Policy, D
 export type { d as PolicyContext, e as PolicyDecision, f as PolicyDecisionOf, P as PolicyOperation } from "./packem_shared/types.d-DdYF8E18.js";
 export { type CronJob, type CronJobsBuilder, type CronScheduleKind, type DailySchedule, type IntervalSchedule, type MonthlySchedule, type WeeklySchedule, cronJobs } from '@lunora/scheduler';
 /**
- * Make any `config.storage` result bucket-aware so `ctx.storage.bucket(name)`
+ * Make any resolved storage capability bucket-aware so `ctx.storage.bucket(name)`
  * always resolves. A `createBucketStorage(...)` result already carries
  * `.bucket` / `.bucketName` and is returned as-is; a single `createStorage(...)`
  * (or the no-storage stub) is tagged as the `"default"` bucket, where
  * `.bucket(name)` is the identity — single-bucket apps address one binding under
  * every name.
  *
- * This is the runtime counterpart the generated `_generated/shard.ts` imports to
- * wrap `ctx.storage`; it lives here (the single source) rather than being stamped
- * inline into every generated file, so the bucket-tagging behaviour has one home
- * alongside the storage ctx types. The input is genuinely heterogeneous (a thunk
- * result cast through `unknown`), so the signature is `unknown → unknown`; the
- * generated caller casts the result to its storage type.
+ * Lives here rather than in `@lunora/server` because two packages need it and
+ * neither may depend on the other: `@lunora/server` re-exports it as the runtime
+ * counterpart `_generated/shard.ts` imports, and `@lunora/runtime` uses it to
+ * build `ctx.storage` for an HTTP action from the worker's own R2 bindings.
+ * Inlined into each `dist` by the bundler, so no dependency edge is created.
+ *
+ * The input is genuinely heterogeneous (a thunk result cast through `unknown`),
+ * so the signature is `unknown → unknown`; callers cast the result.
  */
 declare const asBucketStorage: (raw: unknown) => unknown;
 /** Builder discriminator. Codegen reads this kind. */
@@ -583,18 +585,29 @@ type HttpMethod = "DELETE" | "GET" | "HEAD" | "OPTIONS" | "PATCH" | "POST" | "PU
 /**
  * Context handed to an HTTP action handler. A narrower view of {@link ActionContext}:
  * HTTP actions run in the worker (the "action runtime"), separate from the
- * transactional store, so there is no direct `db` / `vectors` / `storage`
- * surface — reach the data layer through `runQuery` / `runMutation` /
- * `runAction`, which forward to the owning shard.
+ * transactional store, so there is no direct `db` / `vectors` surface — reach the
+ * data layer through `runQuery` / `runMutation` / `runAction`, which forward to
+ * the owning shard. `db`'s absence is principled: an HTTP handler is not
+ * transactional.
+ *
+ * `scheduler` and `storage` ARE present, because neither needs the shard — the
+ * scheduler talks to the scheduler DO, and R2 is a worker binding an HTTP
+ * handler can reach where an action does. Both are optional: each exists only
+ * when the app declared the matching capability (`.scheduler(...)` /
+ * `.storage(...)`) on the generated app builder.
  *
- * `scheduler` IS present (it talks to the scheduler DO, not the shard) but is
- * optional: it exists only when the app declared `.scheduler(...)` on the
- * generated app builder. "Receive webhook → enqueue the real work → return 200"
- * is what HTTP actions are for, so omitting it forced every app to hand-roll a
- * hop through a mutation plus a closed allow-list of target strings.
+ * Omitting them was costly out of proportion to the gap. Without `scheduler`,
+ * "receive webhook → enqueue the real work → return 200" — the shape HTTP
+ * actions exist for — forced a hop through a mutation plus a closed allow-list
+ * of target strings, because a function reference cannot cross the RPC boundary
+ * and a free-form target on an unauthenticated endpoint is a "call any internal
+ * function" primitive. Without `storage`, any helper the ctx was threaded into
+ * had to be typed for its storage-touching branch, so a handler was barred from
+ * the helper even on the branches that never went near storage.
  */
 type HttpActionCtx = Pick<ActionCtx, "auth" | "cache" | "fetch" | "runAction" | "runMutation" | "runQuery"> & {
   readonly scheduler?: ActionCtx["scheduler"];
+  readonly storage?: ActionCtx["storage"];
 };
 /** A raw handler wrapped by {@link httpAction}. Receives the raw request, returns the raw response. */
 type HttpActionHandler = (context: HttpActionCtx, request: Request) => Promise<Response> | Response;
@@ -1166,13 +1179,47 @@ interface MaskContextIn {
 declare const mask: <Context extends MaskContextIn = MaskContextIn>(policies: MaskPolicies<Context>, options?: MaskOptions<Context>) => Middleware<Context, Context>;
 /** A document handed to a migration transform: the stored row including `_id`/`_creationTime`. */
 type MigrationDocument = Record<string, unknown>;
+/**
+ * The read surface a transform reaches through its `ctx`.
+ *
+ * Read-only by design: the runner accounts for exactly one rewrite per row read,
+ * and a transform writing directly would make that count describe something
+ * other than what happened. Scoped to the shard the runner is walking.
+ */
+interface MigrationReader {
+  count: (table: string, where?: Record<string, unknown>) => Promise<number>;
+  findFirst: (table: string, args?: Record<string, unknown>) => Promise<MigrationDocument | null>;
+  findMany: (table: string, args?: Record<string, unknown>) => Promise<{
+    isDone: boolean;
+    page: MigrationDocument[];
+  }>;
+  get: (id: string, expectedTable?: string) => Promise<MigrationDocument | null>;
+}
+/** The context handed to a transform alongside the row. */
+interface MigrationCtx {
+  db: MigrationReader;
+}
 /**
  * Transform applied to one document. Return a new document to rewrite the row,
  * or `undefined` to leave it untouched (skipped, not counted as changed). The
  * runner always preserves the original `_id` and `_creationTime`, so the
  * returned document neither needs to nor should change row identity.
+ *
+ * The second parameter carries a shard-scoped reader. Without it a transform
+ * could only rewrite the row it was handed — enough for a backfill whose new
+ * value is a pure function of the old row (`displayName = name ?? "Anonymous"`),
+ * but not for the shape people actually write: read the parent, copy a field
+ * down onto its children.
+ *
+ * May return a promise, since a cross-table read is asynchronous.
+ *
+ * **A shard key cannot be backfilled this way, even with a reader.** A row whose
+ * shard-key field is unset does not belong to any shard, so a shard-scoped query
+ * will not enumerate it; and writing the key would have to MOVE the row to a
+ * different Durable Object, which a per-shard runner cannot do. Re-keying is an
+ * export → transform → import, not a migration.
  */
-type MigrationTransform = (document: MigrationDocument) => MigrationDocument | undefined | void;
+type MigrationTransform = (document: MigrationDocument, ctx: MigrationCtx) => MigrationDocument | Promise<MigrationDocument | undefined | void> | undefined | void;
 interface MigrationDefinition {
   /** Rows fetched and rewritten per batch. Defaults to the runner's batch size when omitted. */
   readonly batchSize?: number;
@@ -2455,4 +2502,4 @@ interface StorageContextIn {
 }
 declare const storageRules: <Context extends StorageContextIn = StorageContextIn>(rules: ReadonlyArray<StorageRule<Context>>, options?: StorageRulesOptions) => Middleware<Context, Context>;
 declare const VERSION = "0.0.0";
-export { type ActionBuilder, type ActionCtx, type AggregateIndexDefinition, type AggregateIndexOptions, type AggregateOp, type ArgsValidator, type Component, type ComponentFunctions, type CreateOptions, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, type DataModelInit, type DefineComponentOptions, type DefineIdentityOptions, type DefineListArgsConfig, type DefinePluginOptions, type DefinePolicyInput, type DefinePresenceOptions, type DefineStorageRuleInput, type DurableObjectJurisdiction, type EmptyArgs, type EnvAccessor, type EnvKeyFailure, type EnvShape, type ExposeConfig, type ExtendableSchema, type FacadeEntry, type FacadeWriterLike, type FunctionKind, type HttpActionCtx, type HttpActionHandler, type HttpMethod, type HttpRoute, type HttpRouteBuilder, type HttpRouteFactory, type HttpRouteHandlerOptions, type HttpStreamHandlerOptions, type IdentityContract, type IdentityRejectMode, type IdentityValidation, type InferArgs, type InferEnv, type InferIdentity, type InlineAggregateIndexOptions, type InlineRankIndexOptions, type InternalActionBuilder, type InternalMutationBuilder, type InternalQueryBuilder, type LifecycleEvent, type LifecycleHandler, type ListArgsSpec, type ListArgsValidators, type ListArgsValue, type ListFilterOperators, type ListOrderByEntry, type ListWhere, type LunoraBuilders, LunoraEnvError, LunoraError, type LunoraHttpApp, type LunoraHttpEnv, type LunoraRouteHandler, type ManyRelation, type MaskColumns, type MaskContext, type MaskFn, type MaskOptions, type MaskPolicies, type MaskStrategy, type Middleware, type MiddlewareNext, type MigrationDefinition, type MigrationDocument, type MigrationTransform, type MutationBuilder, type MutationCtx, type MutatorDefinition, type OnDeleteAction, type OneRelation, type OrmLike, DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, type Permission, type Plugin, type Policy, type PrefixedTables, type PresenceComponent, type PresenceFunctions, type PresenceMember, type ProtectPublicOptions, type QueryBuilder, type QueryCtx, type RankIndexDefinition, type RankIndexOptions, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMigration, type RegisteredMutation, type RegisteredMutator, type RegisteredQuery, type RegisteredShape, type RegisteredStream, type RelationBuilder, type RelationDefinition, type RlsOptions, type RlsReadRegistry, type Role, type Schema, type SchemaExtension, type ShapeDefinition, type ShapeReadWhereRequest, type StorageOperation, type StorageRule, type StorageRuleContext, type StorageRuleDecision, type StorageRulesOptions, type TableBuilder, type TableDefinition, type TerminalKind, type TriggerBuilder, type TriggerDefinition, type TypedDefinePolicyInput, VERSION, type VectorEmbedder, type VectorIndexDefinition, type VectorIndexOptions, type VectorMetric, type VectorizeOptions, type WhereInput, allowAll, asBucketStorage, bindOrm, bindTableFacade, buildRlsReadRegistry, clampLimit, composePluginMiddleware, composeShapeReadWhere, createPolicyDsl, createSecrets, defineAggregateIndex, defineComponent, defineEnv, defineIdentity, defineListArgs, defineMigration, defineMutator, definePermission, definePlugin, definePolicies, definePolicy, definePresence, defineRankIndex, defineRole, defineSchema, defineSchemaExtension, defineShape, defineStorageRule, defineStorageRules, defineTable, defineVectorIndex, deny, httpAction, httpRoute, httpRouter, initLunora, installPlugins, isDeny, isSafeHeaderValue, mask, mergeSchemaExtension, onConnect, onDisconnect, presenceExtension, protectPublic, redactSecrets, rls, serveStorageObject, storageRules, toWhereInput };
+export { type ActionBuilder, type ActionCtx, type AggregateIndexDefinition, type AggregateIndexOptions, type AggregateOp, type ArgsValidator, type Component, type ComponentFunctions, type CreateOptions, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, type DataModelInit, type DefineComponentOptions, type DefineIdentityOptions, type DefineListArgsConfig, type DefinePluginOptions, type DefinePolicyInput, type DefinePresenceOptions, type DefineStorageRuleInput, type DurableObjectJurisdiction, type EmptyArgs, type EnvAccessor, type EnvKeyFailure, type EnvShape, type ExposeConfig, type ExtendableSchema, type FacadeEntry, type FacadeWriterLike, type FunctionKind, type HttpActionCtx, type HttpActionHandler, type HttpMethod, type HttpRoute, type HttpRouteBuilder, type HttpRouteFactory, type HttpRouteHandlerOptions, type HttpStreamHandlerOptions, type IdentityContract, type IdentityRejectMode, type IdentityValidation, type InferArgs, type InferEnv, type InferIdentity, type InlineAggregateIndexOptions, type InlineRankIndexOptions, type InternalActionBuilder, type InternalMutationBuilder, type InternalQueryBuilder, type LifecycleEvent, type LifecycleHandler, type ListArgsSpec, type ListArgsValidators, type ListArgsValue, type ListFilterOperators, type ListOrderByEntry, type ListWhere, type LunoraBuilders, LunoraEnvError, LunoraError, type LunoraHttpApp, type LunoraHttpEnv, type LunoraRouteHandler, type ManyRelation, type MaskColumns, type MaskContext, type MaskFn, type MaskOptions, type MaskPolicies, type MaskStrategy, type Middleware, type MiddlewareNext, type MigrationCtx, type MigrationDefinition, type MigrationDocument, type MigrationReader, type MigrationTransform, type MutationBuilder, type MutationCtx, type MutatorDefinition, type OnDeleteAction, type OneRelation, type OrmLike, DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, type Permission, type Plugin, type Policy, type PrefixedTables, type PresenceComponent, type PresenceFunctions, type PresenceMember, type ProtectPublicOptions, type QueryBuilder, type QueryCtx, type RankIndexDefinition, type RankIndexOptions, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMigration, type RegisteredMutation, type RegisteredMutator, type RegisteredQuery, type RegisteredShape, type RegisteredStream, type RelationBuilder, type RelationDefinition, type RlsOptions, type RlsReadRegistry, type Role, type Schema, type SchemaExtension, type ShapeDefinition, type ShapeReadWhereRequest, type StorageOperation, type StorageRule, type StorageRuleContext, type StorageRuleDecision, type StorageRulesOptions, type TableBuilder, type TableDefinition, type TerminalKind, type TriggerBuilder, type TriggerDefinition, type TypedDefinePolicyInput, VERSION, type VectorEmbedder, type VectorIndexDefinition, type VectorIndexOptions, type VectorMetric, type VectorizeOptions, type WhereInput, allowAll, asBucketStorage, bindOrm, bindTableFacade, buildRlsReadRegistry, clampLimit, composePluginMiddleware, composeShapeReadWhere, createPolicyDsl, createSecrets, defineAggregateIndex, defineComponent, defineEnv, defineIdentity, defineListArgs, defineMigration, defineMutator, definePermission, definePlugin, definePolicies, definePolicy, definePresence, defineRankIndex, defineRole, defineSchema, defineSchemaExtension, defineShape, defineStorageRule, defineStorageRules, defineTable, defineVectorIndex, deny, httpAction, httpRoute, httpRouter, initLunora, installPlugins, isDeny, isSafeHeaderValue, mask, mergeSchemaExtension, onConnect, onDisconnect, presenceExtension, protectPublic, redactSecrets, rls, serveStorageObject, storageRules, toWhereInput };

package/dist/index.mjs

@@ -1 +1 @@
-import{default as t}from"./packem_shared/asBucketStorage-1pFfH-Tn.mjs";import{initLunora as i}from"./packem_shared/initLunora-QNqOuG0A.mjs";import{createSecrets as p}from"./packem_shared/createSecrets-CgVPiW2C.mjs";import{LunoraEnvError as m,defineEnv as d,redactSecrets as x}from"./packem_shared/LunoraEnvError-CgpI2Mm_.mjs";import{LunoraError as c}from"./packem_shared/LunoraError-LVhdU0Lo.mjs";import{bindOrm as E,bindTableFacade as u}from"./packem_shared/bindOrm-Bp9hsM2q.mjs";import{httpAction as g,httpRoute as R,httpRouter as L,isSafeHeaderValue as P,serveStorageObject as h}from"./packem_shared/httpAction-C14NuF3V.mjs";import{defineIdentity as I}from"./packem_shared/defineIdentity-B7gfAgxx.mjs";import{onConnect as b,onDisconnect as y}from"./packem_shared/onConnect-CEtRmUpJ.mjs";import{DEFAULT_LIMIT as _,DEFAULT_MAX_LIMIT as D,clampLimit as v,defineListArgs as C}from"./packem_shared/DEFAULT_LIMIT-yHJ5O96W.mjs";import{defineMigration as V}from"./packem_shared/defineMigration-Bfpwxv2f.mjs";import{defineMutator as N}from"./packem_shared/defineMutator-BgpQ-xUo.mjs";import{composePluginMiddleware as U,defineComponent as w,definePlugin as B,defineSchemaExtension as W,installPlugins as j,mergeSchemaExtension as H}from"./packem_shared/composePluginMiddleware-COr09CXA.mjs";import{PRESENCE_DEFAULT_TTL_MS as X,PRESENCE_TABLE as q,definePresence as z,presenceExtension as G}from"./packem_shared/PRESENCE_DEFAULT_TTL_MS-C9RX3Cl6.mjs";import{protectPublic as Q}from"./packem_shared/protectPublic-BhKewPqm.mjs";import{defineAggregateIndex as Z,defineRankIndex as $,defineSchema as ee,defineTable as oe,defineVectorIndex as re}from"./packem_shared/defineAggregateIndex-_gWNmkQZ.mjs";import{defineShape as ne}from"./packem_shared/defineShape-Ds8uNqzX.mjs";import{anyApi as fe}from"./types.mjs";import{cronJobs as ae}from"@lunora/scheduler";import{ValidationError as de,v as xe}from"@lunora/values";import{allowAll as ce,deny as le,isDeny as Ee,toWhereInput as ue}from"./packem_shared/allowAll-BnyNbJZT.mjs";import{buildRlsReadRegistry as ge,composeShapeReadWhere as Re}from"./packem_shared/buildRlsReadRegistry-WdiqSj87.mjs";import{createPolicyDsl as Pe,definePermission as he,definePolicies as Ae,definePolicy as Ie,defineRole as Te}from"./packem_shared/createPolicyDsl-sV1swpkD.mjs";import{defineStorageRule as ye,defineStorageRules as Me}from"./packem_shared/defineStorageRule-BDu01PUn.mjs";import{mask as De}from"./packem_shared/mask-C6Bi78qj.mjs";import{rls as Ce}from"./packem_shared/rls-_iVsPvhX.mjs";import{storageRules as Ve}from"./packem_shared/storageRules-BptPZbi8.mjs";const e="0.0.0";export{_ as DEFAULT_LIMIT,D as DEFAULT_MAX_LIMIT,m as LunoraEnvError,c as LunoraError,X as PRESENCE_DEFAULT_TTL_MS,q as PRESENCE_TABLE,e as VERSION,de as ValidationError,ce as allowAll,fe as anyApi,t as asBucketStorage,E as bindOrm,u as bindTableFacade,ge as buildRlsReadRegistry,v as clampLimit,U as composePluginMiddleware,Re as composeShapeReadWhere,Pe as createPolicyDsl,p as createSecrets,ae as cronJobs,Z as defineAggregateIndex,w as defineComponent,d as defineEnv,I as defineIdentity,C as defineListArgs,V as defineMigration,N as defineMutator,he as definePermission,B as definePlugin,Ae as definePolicies,Ie as definePolicy,z as definePresence,$ as defineRankIndex,Te as defineRole,ee as defineSchema,W as defineSchemaExtension,ne as defineShape,ye as defineStorageRule,Me as defineStorageRules,oe as defineTable,re as defineVectorIndex,le as deny,g as httpAction,R as httpRoute,L as httpRouter,i as initLunora,j as installPlugins,Ee as isDeny,P as isSafeHeaderValue,De as mask,H as mergeSchemaExtension,b as onConnect,y as onDisconnect,G as presenceExtension,Q as protectPublic,x as redactSecrets,Ce as rls,h as serveStorageObject,Ve as storageRules,ue as toWhereInput,xe as v};
+import{initLunora as t}from"./packem_shared/initLunora-QNqOuG0A.mjs";import{createSecrets as i}from"./packem_shared/createSecrets-CgVPiW2C.mjs";import{LunoraEnvError as p,defineEnv as m,redactSecrets as a}from"./packem_shared/LunoraEnvError-CgpI2Mm_.mjs";import{LunoraError as x}from"./packem_shared/LunoraError-LVhdU0Lo.mjs";import{bindOrm as c,bindTableFacade as l}from"./packem_shared/bindOrm-Bp9hsM2q.mjs";import{httpAction as u,httpRoute as S,httpRouter as g,isSafeHeaderValue as R,serveStorageObject as L}from"./packem_shared/httpAction-C14NuF3V.mjs";import{defineIdentity as h}from"./packem_shared/defineIdentity-B7gfAgxx.mjs";import{onConnect as I,onDisconnect as T}from"./packem_shared/onConnect-CEtRmUpJ.mjs";import{DEFAULT_LIMIT as y,DEFAULT_MAX_LIMIT as M,clampLimit as _,defineListArgs as D}from"./packem_shared/DEFAULT_LIMIT-yHJ5O96W.mjs";import{defineMigration as C}from"./packem_shared/defineMigration-Bfpwxv2f.mjs";import{defineMutator as V}from"./packem_shared/defineMutator-BgpQ-xUo.mjs";import{composePluginMiddleware as N,defineComponent as O,definePlugin as U,defineSchemaExtension as w,installPlugins as B,mergeSchemaExtension as W}from"./packem_shared/composePluginMiddleware-COr09CXA.mjs";import{PRESENCE_DEFAULT_TTL_MS as H,PRESENCE_TABLE as J,definePresence as X,presenceExtension as q}from"./packem_shared/PRESENCE_DEFAULT_TTL_MS-C9RX3Cl6.mjs";import{protectPublic as G}from"./packem_shared/protectPublic-BhKewPqm.mjs";import{defineAggregateIndex as Q,defineRankIndex as Y,defineSchema as Z,defineTable as $,defineVectorIndex as ee}from"./packem_shared/defineAggregateIndex-_gWNmkQZ.mjs";import{defineShape as re}from"./packem_shared/defineShape-Ds8uNqzX.mjs";import{anyApi as ne}from"./types.mjs";import{cronJobs as fe}from"@lunora/scheduler";import{ValidationError as me,v as ae}from"@lunora/values";import{allowAll as xe,deny as se,isDeny as ce,toWhereInput as le}from"./packem_shared/allowAll-BnyNbJZT.mjs";import{asBucketStorage as ue}from"./packem_shared/asBucketStorage-BthCnWop.mjs";import{buildRlsReadRegistry as ge,composeShapeReadWhere as Re}from"./packem_shared/buildRlsReadRegistry-WdiqSj87.mjs";import{createPolicyDsl as Pe,definePermission as he,definePolicies as Ae,definePolicy as Ie,defineRole as Te}from"./packem_shared/createPolicyDsl-sV1swpkD.mjs";import{defineStorageRule as ye,defineStorageRules as Me}from"./packem_shared/defineStorageRule-BDu01PUn.mjs";import{mask as De}from"./packem_shared/mask-C6Bi78qj.mjs";import{rls as Ce}from"./packem_shared/rls-_iVsPvhX.mjs";import{storageRules as Ve}from"./packem_shared/storageRules-BptPZbi8.mjs";const e="0.0.0";export{y as DEFAULT_LIMIT,M as DEFAULT_MAX_LIMIT,p as LunoraEnvError,x as LunoraError,H as PRESENCE_DEFAULT_TTL_MS,J as PRESENCE_TABLE,e as VERSION,me as ValidationError,xe as allowAll,ne as anyApi,ue as asBucketStorage,c as bindOrm,l as bindTableFacade,ge as buildRlsReadRegistry,_ as clampLimit,N as composePluginMiddleware,Re as composeShapeReadWhere,Pe as createPolicyDsl,i as createSecrets,fe as cronJobs,Q as defineAggregateIndex,O as defineComponent,m as defineEnv,h as defineIdentity,D as defineListArgs,C as defineMigration,V as defineMutator,he as definePermission,U as definePlugin,Ae as definePolicies,Ie as definePolicy,X as definePresence,Y as defineRankIndex,Te as defineRole,Z as defineSchema,w as defineSchemaExtension,re as defineShape,ye as defineStorageRule,Me as defineStorageRules,$ as defineTable,ee as defineVectorIndex,se as deny,u as httpAction,S as httpRoute,g as httpRouter,t as initLunora,B as installPlugins,ce as isDeny,R as isSafeHeaderValue,De as mask,W as mergeSchemaExtension,I as onConnect,T as onDisconnect,q as presenceExtension,G as protectPublic,a as redactSecrets,Ce as rls,L as serveStorageObject,Ve as storageRules,le as toWhereInput,ae as v};

package/dist/packem_shared/asBucketStorage-BthCnWop.mjs

@@ -0,0 +1 @@
+const n=c=>{const t=c??{};if(typeof t.bucket=="function")return t;const e={...t,bucketName:"default"};return e.bucket=()=>e,e};export{n as asBucketStorage};

package/dist/types.d.mts

@@ -795,11 +795,34 @@ interface PaginationResult<T = Record<string, unknown>> {
 /**
  * The fluent `ctx.db.query(table)` reader. Generic over the document type
  * `Row` so the generated `ctx.db` can bind it to `Doc&lt;table>` (the chain and
- * every terminal then resolve typed rows — no `as unknown as Doc&lt;...>` casts).
- * Defaults to the untyped `Record&lt;string, unknown>` shape for the base
- * (schema-agnostic) `@lunora/server` reader.
+ * every terminal then resolve typed rows — no `as unknown as Doc&lt;...>` casts),
+ * and over the table's declared index names so `.withIndex()` / `.withSearchIndex()`
+ * / `.withGeoIndex()` reject a name the table does not declare.
+ *
+ * All four default to the untyped shape for the base (schema-agnostic)
+ * `@lunora/server` reader, which is also the wide `(table: string) => TableReader`
+ * overload the generated `ctx.db` intersects in — so a caller holding a runtime
+ * string (e.g. `@lunora/ratelimit`'s `createDbStore`) is unaffected.
+ *
+ * The index-name parameters are what make a stale index name a compile error.
+ * They resolve to `never` for a table that declares none of that kind, so the
+ * only way to satisfy the call is to declare the index. Before this, a renamed
+ * or dropped index left its call sites typechecking, and the query either threw
+ * at runtime or silently degraded to a full table scan — the second being the
+ * worse outcome, since it stays green in tests and surfaces months later as a
+ * latency regression.
+ *
+ * **Why `with*` are method signatures and everything else is a property.**
+ * Narrowing a parameter makes the enclosing type contravariant in it, so as
+ * function properties these would make a BOUND reader
+ * (`TableReader&lt;Doc, "by_x">`, what `ctx.db.query(t)` returns) unassignable to
+ * the unbound `TableReader&lt;Doc>` — quietly breaking every helper factored as
+ * `(reader: TableReader&lt;Doc&lt;"users">>) => …`, which is the obvious way to share
+ * query logic. A method signature is bivariant in its parameters, which keeps
+ * that direction working while the narrow parameter still rejects an undeclared
+ * name at the call site. Both directions are pinned in `types.test-d.ts`.
  */
-interface TableReader<Row = Record<string, unknown>> {
+interface TableReader<Row = Record<string, unknown>, Indexes extends string = string, SearchIndexes extends string = string, GeoIndexes extends string = string> {
   /**
    * Iterate rows lazily: `for await (const row of ctx.db.query("t").withIndex(…))`.
    *
@@ -822,7 +845,7 @@ interface TableReader<Row = Record<string, unknown>> {
    */
   [Symbol.asyncIterator]: () => AsyncIterator<Row>;
   collect: () => Promise<Row[]>;
-  filter: (predicate: (document: Row) => boolean) => TableReader<Row>;
+  filter: (predicate: (document: Row) => boolean) => TableReader<Row, Indexes, SearchIndexes, GeoIndexes>;
   first: () => Promise<Row | null>;
   /**
    * Set the result order. Orders by the active `.withIndex()` (or by
@@ -831,7 +854,7 @@ interface TableReader<Row = Record<string, unknown>> {
    * terminal (`collect`/`first`/`take`/`paginate`/`unique`). Mirrors Convex's
    * `.order("asc" | "desc")`.
    */
-  order: (direction: "asc" | "desc") => TableReader<Row>;
+  order: (direction: "asc" | "desc") => TableReader<Row, Indexes, SearchIndexes, GeoIndexes>;
   paginate: (options: PaginationOptions) => Promise<PaginationResult<Row>>;
   take: (limit: number) => Promise<Row[]>;
   /**
@@ -847,8 +870,14 @@ interface TableReader<Row = Record<string, unknown>> {
    * scan over the index's companion followed by a Haversine refine. Pair with
    * `.take(n)` to cap results (`.paginate()` is not supported on a geo query).
    */
-  withGeoIndex: (indexName: string, build: (q: GeoFilterBuilder) => GeoFilterBuilder) => TableReader<Row>;
-  withIndex: (indexName: string, range?: (q: IndexRangeBuilder) => IndexRangeBuilder) => TableReader<Row>;
+  withGeoIndex(indexName: GeoIndexes, build: (q: GeoFilterBuilder) => GeoFilterBuilder): TableReader<Row, Indexes, SearchIndexes, GeoIndexes>;
+  /**
+   * Restrict the query to a declared `.index()`. `indexName` is constrained to
+   * this table's declared index names (`never` when it declares none), so a
+   * renamed, dropped, or mistyped index is a compile error rather than a
+   * runtime throw or a silent full-table scan.
+   */
+  withIndex(indexName: Indexes, range?: (q: IndexRangeBuilder) => IndexRangeBuilder): TableReader<Row, Indexes, SearchIndexes, GeoIndexes>;
   /**
    * Restrict the query to a declared `.searchIndex()`. The builder's
    * `.search(field, query)` runs a full-text match against the index's
@@ -856,7 +885,7 @@ interface TableReader<Row = Record<string, unknown>> {
    * field. Results come back ordered by relevance — pair with `.take(n)`
    * (`.paginate()` is not supported on a search query).
    */
-  withSearchIndex: (indexName: string, search: (q: SearchFilterBuilder) => SearchFilterBuilder) => TableReader<Row>;
+  withSearchIndex(indexName: SearchIndexes, search: (q: SearchFilterBuilder) => SearchFilterBuilder): TableReader<Row, Indexes, SearchIndexes, GeoIndexes>;
 }
 interface IndexRangeBuilder {
   eq: (field: string, value: unknown) => IndexRangeBuilder;

package/dist/types.d.ts

@@ -795,11 +795,34 @@ interface PaginationResult<T = Record<string, unknown>> {
 /**
  * The fluent `ctx.db.query(table)` reader. Generic over the document type
  * `Row` so the generated `ctx.db` can bind it to `Doc&lt;table>` (the chain and
- * every terminal then resolve typed rows — no `as unknown as Doc&lt;...>` casts).
- * Defaults to the untyped `Record&lt;string, unknown>` shape for the base
- * (schema-agnostic) `@lunora/server` reader.
+ * every terminal then resolve typed rows — no `as unknown as Doc&lt;...>` casts),
+ * and over the table's declared index names so `.withIndex()` / `.withSearchIndex()`
+ * / `.withGeoIndex()` reject a name the table does not declare.
+ *
+ * All four default to the untyped shape for the base (schema-agnostic)
+ * `@lunora/server` reader, which is also the wide `(table: string) => TableReader`
+ * overload the generated `ctx.db` intersects in — so a caller holding a runtime
+ * string (e.g. `@lunora/ratelimit`'s `createDbStore`) is unaffected.
+ *
+ * The index-name parameters are what make a stale index name a compile error.
+ * They resolve to `never` for a table that declares none of that kind, so the
+ * only way to satisfy the call is to declare the index. Before this, a renamed
+ * or dropped index left its call sites typechecking, and the query either threw
+ * at runtime or silently degraded to a full table scan — the second being the
+ * worse outcome, since it stays green in tests and surfaces months later as a
+ * latency regression.
+ *
+ * **Why `with*` are method signatures and everything else is a property.**
+ * Narrowing a parameter makes the enclosing type contravariant in it, so as
+ * function properties these would make a BOUND reader
+ * (`TableReader&lt;Doc, "by_x">`, what `ctx.db.query(t)` returns) unassignable to
+ * the unbound `TableReader&lt;Doc>` — quietly breaking every helper factored as
+ * `(reader: TableReader&lt;Doc&lt;"users">>) => …`, which is the obvious way to share
+ * query logic. A method signature is bivariant in its parameters, which keeps
+ * that direction working while the narrow parameter still rejects an undeclared
+ * name at the call site. Both directions are pinned in `types.test-d.ts`.
  */
-interface TableReader<Row = Record<string, unknown>> {
+interface TableReader<Row = Record<string, unknown>, Indexes extends string = string, SearchIndexes extends string = string, GeoIndexes extends string = string> {
   /**
    * Iterate rows lazily: `for await (const row of ctx.db.query("t").withIndex(…))`.
    *
@@ -822,7 +845,7 @@ interface TableReader<Row = Record<string, unknown>> {
    */
   [Symbol.asyncIterator]: () => AsyncIterator<Row>;
   collect: () => Promise<Row[]>;
-  filter: (predicate: (document: Row) => boolean) => TableReader<Row>;
+  filter: (predicate: (document: Row) => boolean) => TableReader<Row, Indexes, SearchIndexes, GeoIndexes>;
   first: () => Promise<Row | null>;
   /**
    * Set the result order. Orders by the active `.withIndex()` (or by
@@ -831,7 +854,7 @@ interface TableReader<Row = Record<string, unknown>> {
    * terminal (`collect`/`first`/`take`/`paginate`/`unique`). Mirrors Convex's
    * `.order("asc" | "desc")`.
    */
-  order: (direction: "asc" | "desc") => TableReader<Row>;
+  order: (direction: "asc" | "desc") => TableReader<Row, Indexes, SearchIndexes, GeoIndexes>;
   paginate: (options: PaginationOptions) => Promise<PaginationResult<Row>>;
   take: (limit: number) => Promise<Row[]>;
   /**
@@ -847,8 +870,14 @@ interface TableReader<Row = Record<string, unknown>> {
    * scan over the index's companion followed by a Haversine refine. Pair with
    * `.take(n)` to cap results (`.paginate()` is not supported on a geo query).
    */
-  withGeoIndex: (indexName: string, build: (q: GeoFilterBuilder) => GeoFilterBuilder) => TableReader<Row>;
-  withIndex: (indexName: string, range?: (q: IndexRangeBuilder) => IndexRangeBuilder) => TableReader<Row>;
+  withGeoIndex(indexName: GeoIndexes, build: (q: GeoFilterBuilder) => GeoFilterBuilder): TableReader<Row, Indexes, SearchIndexes, GeoIndexes>;
+  /**
+   * Restrict the query to a declared `.index()`. `indexName` is constrained to
+   * this table's declared index names (`never` when it declares none), so a
+   * renamed, dropped, or mistyped index is a compile error rather than a
+   * runtime throw or a silent full-table scan.
+   */
+  withIndex(indexName: Indexes, range?: (q: IndexRangeBuilder) => IndexRangeBuilder): TableReader<Row, Indexes, SearchIndexes, GeoIndexes>;
   /**
    * Restrict the query to a declared `.searchIndex()`. The builder's
    * `.search(field, query)` runs a full-text match against the index's
@@ -856,7 +885,7 @@ interface TableReader<Row = Record<string, unknown>> {
    * field. Results come back ordered by relevance — pair with `.take(n)`
    * (`.paginate()` is not supported on a search query).
    */
-  withSearchIndex: (indexName: string, search: (q: SearchFilterBuilder) => SearchFilterBuilder) => TableReader<Row>;
+  withSearchIndex(indexName: SearchIndexes, search: (q: SearchFilterBuilder) => SearchFilterBuilder): TableReader<Row, Indexes, SearchIndexes, GeoIndexes>;
 }
 interface IndexRangeBuilder {
   eq: (field: string, value: unknown) => IndexRangeBuilder;

package/dist/types.mjs

@@ -1 +1 @@
-const a=new Map,u=new Proxy({},{get(i,t){const e=a.get(t);if(e)return e;const r=new Map,o=new Proxy({},{get(c,n){const s=r.get(n);if(s)return s;const g={__lunoraRef:`${String(t)}:${String(n)}`};return r.set(n,g),g}});return a.set(t,o),o}});export{u as anyApi};
+const g=new Map,a=new Proxy({},{get(i,t){const e=g.get(t);if(e)return e;const r=new Map,o=new Proxy({},{get(u,n){const s=r.get(n);if(s)return s;const c={__lunoraRef:`${String(t)}:${String(n)}`};return r.set(n,c),c}});return g.set(t,o),o}}),p=a;export{p as anyApi};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/server",
-  "version": "1.0.0-alpha.55",
+  "version": "1.0.0-alpha.56",
   "description": "Server primitives for Lunora: defineSchema, defineTable, query, mutation, and action",
   "keywords": [
     "backend",

package/dist/packem_shared/asBucketStorage-1pFfH-Tn.mjs

@@ -1 +0,0 @@
-const n=u=>{const t=u??{};if(typeof t.bucket=="function")return t;const e={...t,bucketName:"default"};return e.bucket=()=>e,e};export{n as default};