@lunora/server 1.0.0-alpha.55 → 1.0.0-alpha.57

package/dist/index.d.mts

@@ -10,19 +10,21 @@ import { b as Permission, R as Role, T as TypedDefinePolicyInput, a as Policy, D
 export type { d as PolicyContext, e as PolicyDecision, f as PolicyDecisionOf, P as PolicyOperation } from "./packem_shared/types.d-C4CMJK8x.mjs";
 export { type CronJob, type CronJobsBuilder, type CronScheduleKind, type DailySchedule, type IntervalSchedule, type MonthlySchedule, type WeeklySchedule, cronJobs } from '@lunora/scheduler';
 /**
- * Make any `config.storage` result bucket-aware so `ctx.storage.bucket(name)`
+ * Make any resolved storage capability bucket-aware so `ctx.storage.bucket(name)`
  * always resolves. A `createBucketStorage(...)` result already carries
  * `.bucket` / `.bucketName` and is returned as-is; a single `createStorage(...)`
  * (or the no-storage stub) is tagged as the `"default"` bucket, where
  * `.bucket(name)` is the identity — single-bucket apps address one binding under
  * every name.
  *
- * This is the runtime counterpart the generated `_generated/shard.ts` imports to
- * wrap `ctx.storage`; it lives here (the single source) rather than being stamped
- * inline into every generated file, so the bucket-tagging behaviour has one home
- * alongside the storage ctx types. The input is genuinely heterogeneous (a thunk
- * result cast through `unknown`), so the signature is `unknown → unknown`; the
- * generated caller casts the result to its storage type.
+ * Lives here rather than in `@lunora/server` because two packages need it and
+ * neither may depend on the other: `@lunora/server` re-exports it as the runtime
+ * counterpart `_generated/shard.ts` imports, and `@lunora/runtime` uses it to
+ * build `ctx.storage` for an HTTP action from the worker's own R2 bindings.
+ * Inlined into each `dist` by the bundler, so no dependency edge is created.
+ *
+ * The input is genuinely heterogeneous (a thunk result cast through `unknown`),
+ * so the signature is `unknown → unknown`; callers cast the result.
  */
 declare const asBucketStorage: (raw: unknown) => unknown;
 /** Builder discriminator. Codegen reads this kind. */
@@ -583,18 +585,29 @@ type HttpMethod = "DELETE" | "GET" | "HEAD" | "OPTIONS" | "PATCH" | "POST" | "PU
 /**
  * Context handed to an HTTP action handler. A narrower view of {@link ActionContext}:
  * HTTP actions run in the worker (the "action runtime"), separate from the
- * transactional store, so there is no direct `db` / `vectors` / `storage`
- * surface — reach the data layer through `runQuery` / `runMutation` /
- * `runAction`, which forward to the owning shard.
+ * transactional store, so there is no direct `db` / `vectors` surface — reach the
+ * data layer through `runQuery` / `runMutation` / `runAction`, which forward to
+ * the owning shard. `db`'s absence is principled: an HTTP handler is not
+ * transactional.
+ *
+ * `scheduler` and `storage` ARE present, because neither needs the shard — the
+ * scheduler talks to the scheduler DO, and R2 is a worker binding an HTTP
+ * handler can reach where an action does. Both are optional: each exists only
+ * when the app declared the matching capability (`.scheduler(...)` /
+ * `.storage(...)`) on the generated app builder.
  *
- * `scheduler` IS present (it talks to the scheduler DO, not the shard) but is
- * optional: it exists only when the app declared `.scheduler(...)` on the
- * generated app builder. "Receive webhook → enqueue the real work → return 200"
- * is what HTTP actions are for, so omitting it forced every app to hand-roll a
- * hop through a mutation plus a closed allow-list of target strings.
+ * Omitting them was costly out of proportion to the gap. Without `scheduler`,
+ * "receive webhook → enqueue the real work → return 200" — the shape HTTP
+ * actions exist for — forced a hop through a mutation plus a closed allow-list
+ * of target strings, because a function reference cannot cross the RPC boundary
+ * and a free-form target on an unauthenticated endpoint is a "call any internal
+ * function" primitive. Without `storage`, any helper the ctx was threaded into
+ * had to be typed for its storage-touching branch, so a handler was barred from
+ * the helper even on the branches that never went near storage.
  */
 type HttpActionCtx = Pick<ActionCtx, "auth" | "cache" | "fetch" | "runAction" | "runMutation" | "runQuery"> & {
   readonly scheduler?: ActionCtx["scheduler"];
+  readonly storage?: ActionCtx["storage"];
 };
 /** A raw handler wrapped by {@link httpAction}. Receives the raw request, returns the raw response. */
 type HttpActionHandler = (context: HttpActionCtx, request: Request) => Promise<Response> | Response;
@@ -967,456 +980,197 @@ declare const clampLimit: (limit: number | undefined, fallback: number, maxLimit
  */
 declare const defineListArgs: <TDocument>() => <F extends ListFilterShape<TDocument>, O extends keyof TDocument & string>(config: DefineListArgsConfig<F, O>) => ListArgsSpec<TDocument, F, O>;
 /**
- * Context handed to a {@link MaskFn} (and to {@link MaskOptions.bypass}). The
- * `auth` shape mirrors RLS's `PolicyContext.auth` one-for-one — same identity
- * resolver, same `can(...)` permission check — so an author can branch a mask
- * on the caller's role/permission. `row` is the full pre-mask row the column
- * belongs to; `column` is the column currently being masked. Both are absent
- * when the context is used for the procedure-wide `bypass` check (no specific
- * cell is in play yet).
- */
-interface MaskContext<Context = unknown> {
-  readonly auth: {
-    /** `true` when any of the request's `roles` grants `permission` (see {@link MaskOptions.roles}). Fails closed for unregistered roles. */
-    readonly can: (permission: Permission | string) => boolean;
-    readonly identity?: Record<string, unknown> | null;
-    readonly roles: ReadonlyArray<string>;
-    readonly userId: null | string;
-  };
-  /** The column currently being masked. Present only inside a per-cell {@link MaskFn}. */
-  readonly column?: string;
-  readonly ctx: Context;
-  /** The full pre-mask row the masked cell belongs to. Present only inside a per-cell {@link MaskFn}. */
-  readonly row?: Record<string, unknown>;
+ * Structural mirrors of `@lunora/shard-engine`'s rank-page-row shapes
+ * (`RankPageRowKey` / `RankPageRow` / `ShardRankPageResult`) — the return type
+ * of the writer's `rankPageRows` seam, the cross-shard companion to
+ * `rankPage`.
+ *
+ * Shared by `../rls/middleware` and `../mask/middleware`: both wrap
+ * `rankPageRows` structurally (no `@lunora/shard-engine` import, mirroring how
+ * every other method on their `DatabaseWriterLike`/`MaskDatabase` projections
+ * is hand-mirrored rather than imported) and both need the exact same result
+ * shape to type their overrides. A single copy here means the two wrappers
+ * can't drift out of lockstep with each other — see AGENTS.md's platform
+ * parity note on `ShardSqlExec` and the canonical binding `*Like` projections
+ * shipping wrong for exactly this reason (two hand-maintained mirrors of one
+ * upstream type).
+ */
+/** Structural mirror of `@lunora/shard-engine`'s `RankPageRowKey`. */
+interface RankPageRowKeyLike {
+  partitionKey: string;
+  rowId: string;
+  sortValues: ReadonlyArray<unknown>;
+}
+/** Structural mirror of `@lunora/shard-engine`'s `RankPageRow`. */
+interface RankPageRowLike {
+  doc: Record<string, unknown>;
+  key: RankPageRowKeyLike;
+}
+/** Structural mirror of `@lunora/shard-engine`'s `ShardRankPageResult` — the `rankPageRows` return shape. */
+interface ShardRankPageResultLike {
+  directions: ReadonlyArray<"asc" | "desc">;
+  hasMore: boolean;
+  rows: ReadonlyArray<RankPageRowLike>;
 }
 /**
- * A custom masking function. Receives the raw cell value and the
- * {@link MaskContext}, returns the value to surface. Use it for partial masks
- * (`maskMiddle(phone)`), role-aware reveals (`ctx.auth.can(...) ? value : null`),
- * or format-preserving tokens. A function that **throws** fails closed — the
- * cell is redacted to `null`, never leaked raw.
+ * The prefixed tables a single plugin `P` contributes, or an empty map when it
+ * ships no schema extension. Mirrors {@link PrefixedTables} at the plugin level
+ * so {@link InstalledTables} can fold a tuple of plugins.
  */
-type MaskFn<Context = unknown> = (value: unknown, context: MaskContext<Context>) => unknown;
+type ExtensionTablesOf<P> = P extends {
+  readonly extension: SchemaExtension<infer X> & {
+    readonly key: infer K;
+  };
+} ? K extends string ? PrefixedTables<X, K> : Record<never, never> : Record<never, never>;
 /**
- * How a column is masked:
- *
- * - `"redact"` — drop the value to `null`. The simplest, safest strategy, and
- * the right choice for any value that must actually be kept secret.
- * - `"hash"` — replace with a stable token (unsalted 32-bit FNV-1a hex) so the
- * same input always yields the same token (joinable/groupable client-side).
- * **This is NOT a confidentiality control.** It is a non-cryptographic,
- * unsalted, deterministic, narrow (~2^32) digest: low-entropy values (emails,
- * phone numbers, SSNs) are brute-force-recoverable by the very caller you are
- * masking from, and identical values always produce identical tokens across
- * rows/columns/tenants (enabling correlation). Use `"hash"` ONLY when you want a
- * stable pseudonym for grouping/joining and leaking the value is acceptable —
- * never to hide sensitive PII. For PII that must stay hidden, use `"redact"`.
- * - a {@link MaskFn} — author-defined transform (partial mask, role-aware reveal).
+ * Fold a tuple of plugins onto a base table map `T`, accumulating each plugin's
+ * auto-prefixed extension tables left-to-right — the type-level mirror of
+ * {@link installPlugins} applying `mergeSchemaExtension` for each plugin in turn.
  */
-type MaskStrategy<Context = unknown> = "hash" | "redact" | MaskFn<Context>;
-/** Per-column strategy map for one table: `{ email: "redact", phone: maskMiddle }`. */
-type MaskColumns<Context = unknown> = Record<string, MaskStrategy<Context>>;
+type InstalledTables<T extends Record<string, TableDefinition>, Plugins extends ReadonlyArray<unknown>> = Plugins extends readonly [infer Head, ...infer Rest] ? InstalledTables<ExtensionTablesOf<Head> & T, Rest> : T;
 /**
- * The mask declaration passed to `mask(...)`: a table → column → strategy map.
- * Deliberately a plain object literal so the codegen feeder can statically read
- * which columns a procedure masks (powering the `mask_uncovered_pii_column`
- * advisor lint), exactly as the RLS feeder reads policy tables.
+ * Union every plugin's `ContextOut` in a tuple — the type-level mirror of the
+ * `ctx.api.&lt;key>` additions {@link composePluginMiddleware} accumulates as each
+ * plugin middleware runs. Independent of the incoming context, which the builder
+ * infers at the `.use(...)` site.
  */
-type MaskPolicies<Context = unknown> = Record<string, MaskColumns<Context>>;
+type ComposedOut<Plugins extends ReadonlyArray<unknown>> = Plugins extends readonly [infer Head, ...infer Rest] ? ComposedOut<Rest> & (Head extends Plugin<any, any, infer Out> ? Out : unknown) : unknown;
 /**
- * Options for `mask(policies, options)`.
- *
- * - `roles` registers the role→permission grants that back `ctx.auth.can(...)`
- * inside a {@link MaskFn} — identical to `rls(policies, { roles })`. A role
- * not listed grants no permissions (fails closed for unknown roles).
- * - `bypass` is a procedure-wide escape hatch: when it returns `true` the whole
- * mask is skipped (the caller sees raw values). Use it for a privileged
- * viewer — `bypass: ({ auth }) => auth.can("pii:view")`. Prefer this over
- * branching every column when an entire class of caller should see clear data.
+ * Schema fragment a plugin contributes. Same shape as the `tables` map
+ * passed to `defineSchema`. Optional `vectorIndexes` mirror the top-level
+ * `defineSchema` argument so a plugin can ship vector decls alongside its
+ * tables.
  */
-interface MaskOptions<Context = unknown> {
-  readonly bypass?: (context: MaskContext<Context>) => boolean;
-  readonly roles?: ReadonlyArray<Role>;
-}
-interface QueryPage$1 {
-  continueCursor: null | string;
-  isDone: boolean;
-  page: Record<string, unknown>[];
+interface SchemaExtension<T extends Record<string, TableDefinition> = Record<string, TableDefinition>> {
+  /** Stable key identifying the plugin that owns this extension. */
+  readonly key: string;
+  /**
+   * Extension tables, keyed by **bare** name (e.g. `buckets`). At merge time
+   * each is auto-prefixed with `key` (`ratelimit_buckets`) so it can't
+   * collide with an app table; do **not** namespace manually.
+   */
+  readonly tables: T;
+  /**
+   * Optional standalone vector indexes the plugin ships, keyed by index
+   * name. Merged into the host schema's `vectorIndexes`; a key collision
+   * with the base schema is a hard error (same policy as tables).
+   */
+  readonly vectorIndexes?: Record<string, VectorIndexDefinition>;
 }
-interface QueryArgs$1 {
-  baseWhere?: unknown;
-  cursor?: null | string;
-  limit?: number;
-  orderBy?: ReadonlyArray<Record<string, unknown>>;
-  where?: unknown;
-  with?: Record<string, unknown>;
+/**
+ * Build a {@link SchemaExtension}. The `key` is a runtime tag (used for
+ * error messages on collision) and a type-level brand.
+ */
+declare const defineSchemaExtension: <T extends Record<string, TableDefinition>>(key: string, options: {
+  tables: T;
+  vectorIndexes?: Record<string, VectorIndexDefinition>;
+}) => SchemaExtension<T>;
+/**
+ * A plugin packages an optional schema extension and optional middleware.
+ * Both are independently usable: an app can install only the schema (e.g.
+ * for plugins that ship background workers but no per-request behavior)
+ * or only the middleware (plugins that augment ctx without persistent
+ * state).
+ */
+interface Plugin<TExtension extends Record<string, TableDefinition> = Record<string, TableDefinition>, TContextIn = unknown, TContextOut = TContextIn> {
+  /**
+   * Optional schema extension. Apps install via
+   * `defineSchema(...).extend(plugin.extension)`.
+   */
+  readonly extension?: SchemaExtension<TExtension>;
+  /** Stable key identifying the plugin. Matches `extension.key` when set. */
+  readonly key: string;
+  /**
+   * Optional middleware. Users attach with `c.query.use(plugin.middleware)`.
+   * The middleware can extend `ctx`; convention is to attach helpers under
+   * `ctx.api.&lt;key>`, e.g.
+   *
+   * ```ts
+   * middleware: ({ ctx, next }) =>
+   *     next({ ctx: { api: { ...ctx.api, ratelimit: api } } })
+   * ```
+   */
+  readonly middleware?: Middleware<TContextIn, TContextOut>;
 }
-interface AggregateArgs$1 {
-  field?: string;
-  op: string;
-  where?: unknown;
+/** Options to {@link definePlugin}. */
+interface DefinePluginOptions<TExtension extends Record<string, TableDefinition>, TContextIn, TContextOut> {
+  extension?: SchemaExtension<TExtension>;
+  middleware?: Middleware<TContextIn, TContextOut>;
 }
-interface GroupByArgs$1 {
-  agg?: {
-    field?: string;
-    op: string;
+/**
+ * Call signatures for {@link definePlugin}. When `extension` is supplied the
+ * returned plugin's `extension` is typed as PRESENT (not `?`), so the
+ * canonical install pattern `defineSchema(...).extend(plugin.extension)`
+ * typechecks without a non-null assertion — the shape every scaffold template
+ * ships. The bare-options signature keeps `extension` optional for plugins
+ * that carry only middleware.
+ */
+interface DefinePluginFunction {
+  <TExtension extends Record<string, TableDefinition>, TContextIn = unknown, TContextOut = TContextIn>(key: string, options: DefinePluginOptions<TExtension, TContextIn, TContextOut> & {
+    extension: SchemaExtension<TExtension>;
+  }): Plugin<TExtension, TContextIn, TContextOut> & {
+    readonly extension: SchemaExtension<TExtension>;
   };
-  by: ReadonlyArray<string>;
-  where?: unknown;
+  <TExtension extends Record<string, TableDefinition>, TContextIn = unknown, TContextOut = TContextIn>(key: string, options: DefinePluginOptions<TExtension, TContextIn, TContextOut>): Plugin<TExtension, TContextIn, TContextOut>;
 }
-interface TableReaderLike$1 {
-  collect: () => Promise<Record<string, unknown>[]>;
-  filter: (predicate: (document: Record<string, unknown>) => boolean) => TableReaderLike$1;
-  first: () => Promise<Record<string, unknown> | null>;
-  order: (direction: "asc" | "desc") => TableReaderLike$1;
-  paginate: (options: {
-    cursor?: null | string;
-    numItems: number;
-  }) => Promise<QueryPage$1>;
-  take: (limit: number) => Promise<Record<string, unknown>[]>;
-  unique: () => Promise<Record<string, unknown> | null>;
-  withGeoIndex: (indexName: string, build: (q: unknown) => unknown) => TableReaderLike$1;
-  withIndex: (indexName: string, range?: (q: unknown) => unknown) => TableReaderLike$1;
-  withSearchIndex: (indexName: string, search: (q: unknown) => unknown) => TableReaderLike$1;
+/**
+ * Package a schema extension + middleware as a reusable plugin. Either
+ * field is optional — `definePlugin("foo", {})` is valid but degenerate.
+ */
+declare const definePlugin: DefinePluginFunction;
+/**
+ * Bundle of registered functions a {@link Component} ships. Keys are the
+ * function's local name (e.g. `check`, `reset`); the registered function
+ * value carries its own kind / args / handler.
+ *
+ * Users re-export from their own lunora module so codegen picks them up:
+ *
+ * ```ts
+ * // lunora/ratelimit.ts
+ * import { ratelimit } from "@vendor/ratelimit-component";
+ * export const { check, reset } = ratelimit.functions;
+ * // Emits as `ratelimit:check` / `ratelimit:reset` in the generated `api`.
+ * ```
+ *
+ * Codegen follows the re-export back to the bundled `query/mutation/action`
+ * call (property access or destructuring both work), so the functions land in
+ * the generated `api` under the re-exporting file's namespace.
+ */
+type ComponentFunctions = Readonly<Record<string, RegisteredFunction<any, any, FunctionKind>>>;
+/**
+ * Component = {@link Plugin} with a bundle of registered functions. The
+ * extension + middleware + functions are independent: a component can ship
+ * functions without a schema (e.g. a stateless utility), or a schema
+ * without functions (e.g. shared table definitions), and any combination.
+ */
+interface Component<TExtension extends Record<string, TableDefinition> = Record<string, TableDefinition>, TContextIn = unknown, TContextOut = TContextIn, F extends ComponentFunctions = ComponentFunctions> extends Plugin<TExtension, TContextIn, TContextOut> {
+  readonly functions: F;
+}
+interface DefineComponentOptions<TExtension extends Record<string, TableDefinition>, TContextIn, TContextOut, F extends ComponentFunctions> extends DefinePluginOptions<TExtension, TContextIn, TContextOut> {
+  /** Registered functions the component ships. Keys are the function's local name. */
+  functions?: F;
 }
 /**
- * Structural projection of the runtime ORM writer — the same subset
- * `../rls/middleware` mirrors, so the wrapper is interchangeable between
- * `@lunora/do`'s and `@lunora/d1`'s `DatabaseWriterLike` without an
- * inter-package dependency. `rankBefore` is optional (the D1 twin omits it).
- */
-interface MaskDatabase {
-  aggregate: (tableName: string, options: AggregateArgs$1) => Promise<null | number>;
-  count: (tableName: string, whereOrArgs?: unknown) => Promise<number>;
-  delete: (id: string, expectedTable?: string) => Promise<void>;
-  deleteMany: (ids: ReadonlyArray<string>, options?: {
-    limit?: number;
-  }) => Promise<{
-    deleted: number;
-  }>;
-  deleteWhere?: (tableName: string, where: Record<string, unknown>, options?: {
-    limit?: number;
-  }) => Promise<{
-    deleted: number;
-  }>;
-  findFirst: (tableName: string, args?: QueryArgs$1) => Promise<Record<string, unknown> | null>;
-  findFirstOrThrow: (tableName: string, args?: QueryArgs$1) => Promise<Record<string, unknown>>;
-  findMany: (tableName: string, args?: QueryArgs$1) => Promise<QueryPage$1>;
-  get: (id: string, expectedTable?: string) => Promise<Record<string, unknown> | null>;
-  groupBy: (tableName: string, options: GroupByArgs$1) => Promise<ReadonlyArray<{
-    key: Record<string, unknown>;
-    value: null | number;
-  }>>;
-  insert: (tableName: string, document: Record<string, unknown>) => Promise<string>;
-  insertMany: (tableName: string, documents: ReadonlyArray<Record<string, unknown>>, options?: {
-    limit?: number;
-    skipDuplicates?: boolean;
-  }) => Promise<(string | null)[]>;
-  lookupById?: (id: string, expectedTable?: string) => Promise<null | {
-    row: Record<string, unknown>;
-    tableName: string;
-  }>;
-  patch: (id: string, patch: Record<string, unknown>, expectedTable?: string) => Promise<void>;
-  patchMany: (patches: ReadonlyArray<{
-    id: string;
-    patch: Record<string, unknown>;
-  }>, options?: {
-    limit?: number;
-  }) => Promise<{
-    patched: number;
-  }>;
-  patchWhere?: (tableName: string, args: {
-    patch: Record<string, unknown>;
-    where: Record<string, unknown>;
-  }, options?: {
-    limit?: number;
-  }) => Promise<{
-    patched: number;
-  }>;
-  query: (tableName: string) => TableReaderLike$1;
-  rank: (tableName: string, indexName: string, options: unknown) => Promise<null | {
-    position: number;
-    total: number;
-  }>;
-  rankBefore?: (tableName: string, indexName: string, options: unknown) => Promise<{
-    before: number;
-    total: number;
-  }>;
-  rankPage: (tableName: string, indexName: string, options?: unknown) => Promise<QueryPage$1>;
-  replace: (id: string, document: Record<string, unknown>, expectedTable?: string) => Promise<void>;
-}
-/** Roles list source on the context. Tolerant of older auth states (mirrors RLS's `AuthLike`). */
-type AuthLike$1 = {
-  getIdentity?: () => Promise<Record<string, unknown> | null>;
-  roles?: ReadonlyArray<string>;
-  userId?: null | string;
-};
-interface MaskContextIn {
-  auth?: AuthLike$1;
-  db: MaskDatabase;
-}
-/**
- * Procedure-builder middleware. Apply per-request via `.use(mask(policies))`.
- * Closes over the policy map at builder-construction time; resolves identity +
- * the `bypass` decision per call against the live ctx.
- *
- * IMPORTANT: a mask is in scope only for procedures whose builder chain
- * includes this middleware — opt-in, never global (the same invariant as RLS).
- */
-declare const mask: <Context extends MaskContextIn = MaskContextIn>(policies: MaskPolicies<Context>, options?: MaskOptions<Context>) => Middleware<Context, Context>;
-/** A document handed to a migration transform: the stored row including `_id`/`_creationTime`. */
-type MigrationDocument = Record<string, unknown>;
-/**
- * Transform applied to one document. Return a new document to rewrite the row,
- * or `undefined` to leave it untouched (skipped, not counted as changed). The
- * runner always preserves the original `_id` and `_creationTime`, so the
- * returned document neither needs to nor should change row identity.
- */
-type MigrationTransform = (document: MigrationDocument) => MigrationDocument | undefined | void;
-interface MigrationDefinition {
-  /** Rows fetched and rewritten per batch. Defaults to the runner's batch size when omitted. */
-  readonly batchSize?: number;
-  /** Optional reverse transform, applied by `migrate down`. */
-  readonly down?: MigrationTransform;
-  /** Stable, unique identifier — the key per-shard run-state is tracked under. */
-  readonly id: string;
-  /** Table whose documents this migration iterates. */
-  readonly table: string;
-  /** Forward transform, applied to every row by `migrate up`. */
-  readonly up: MigrationTransform;
-}
-/** A {@link MigrationDefinition} plus the codegen discovery marker. */
-interface RegisteredMigration extends MigrationDefinition {
-  readonly __lunoraMigration: true;
-}
-/** Declare an online data migration. See the module docs for runtime semantics. */
-declare const defineMigration: (definition: MigrationDefinition) => RegisteredMigration;
-/**
- * A mutator declaration. `server` is authoritative; `client` is the optimistic
- * twin (optional — omit it to let the optimistic write fall through to the
- * server round-trip with no local preview). Both receive the same validated
- * `args`.
- */
-interface MutatorDefinition<Args extends ValidatorMap = ValidatorMap, ServerContext = MutationCtx, ClientTx = unknown, R = unknown> {
-  /**
-   * Validator for the mutator's arguments. Validated on the DO before `server`
-   * runs and (when present) on the client before `client` runs, so both impls
-   * see the same parsed shape. Omit for a parameterless mutator.
-   */
-  readonly args?: Args;
-  /**
-   * Optimistic client implementation. Runs in a TanStack DB transaction
-   * against the local collections; its writes are applied immediately and
-   * automatically rolled back / rebased as the authoritative result syncs
-   * back. Pure and side-effect-free beyond the local store. Omit to skip the
-   * local preview.
-   */
-  readonly client?: (tx: ClientTx, args: InferValidatorMap<Args>) => Promise<void> | void;
-  /**
-   * Owner-scope the write: names the column carrying the row owner (e.g.
-   * `owner: "userId"`). Before `server` runs, the mutator requires a verified
-   * identity, rejects a client-supplied owner that disagrees with it, and sets
-   * the column to the verified value — so the impl reads `args[owner]` without
-   * trusting the client and never repeats the check by hand.
-   *
-   * This replaces the "every mutator opens with `assertOwner(ctx, args.userId)`"
-   * pattern, and is the write-side counterpart to an `owner`-scoped
-   * {@link import("./shapes").ShapeDefinition}. Unlike a shape it takes the column
-   * NAME rather than `true`: a shape is bound to one `table`, so the table's
-   * `.ownedBy(field)` resolves unambiguously, whereas one mutator may write
-   * several tables and has no single owning table to read it from.
-   *
-   * Declare the column `v.optional(...)` to leave it off the wire entirely; it is
-   * injected either way.
-   */
-  readonly owner?: string;
-  /**
-   * Authoritative server implementation. Runs inside the shard DO with a full
-   * {@link MutationContext} (`ctx.db` writer); its writes append to `__cdc_log`
-   * and poke back to subscribers. This is the source of truth — the client
-   * impl is only a prediction of it.
-   */
-  readonly server: (context: ServerContext, args: InferValidatorMap<Args>) => Promise<R> | R;
-}
-/**
- * A {@link MutatorDefinition} plus the codegen discovery marker and a
- * dispatch-shaped `handler` (validates `args`, then runs `server`) so the DO
- * invokes a mutator exactly like a registered procedure.
- */
-interface RegisteredMutator<Args extends ValidatorMap = ValidatorMap, ServerContext = MutationCtx, ClientTx = unknown, R = unknown> extends MutatorDefinition<Args, ServerContext, ClientTx, R> {
-  readonly __lunoraMutator: true;
-  /** Validate `rawArgs`, then run the authoritative `server` impl. Used by the DO push path. */
-  readonly handler: (context: ServerContext, rawArgs: Record<string, unknown>) => Promise<R>;
-  /**
-   * Marks the dispatch kind so codegen can register the mutator in the same
-   * `LUNORA_FUNCTIONS` table queries/mutations use — the DO's `handleRpc`
-   * reads `kind === "mutation"` to wrap the authoritative `server` impl in the
-   * shard's BEGIN/COMMIT span (all-or-nothing writes), exactly like an
-   * ordinary `mutation`.
-   */
-  readonly kind: "mutation";
-}
-/** Declare a custom mutator. See the module docs for runtime semantics. */
-declare const defineMutator: <Args extends ValidatorMap = ValidatorMap, ServerContext = MutationCtx, ClientTx = unknown, R = unknown>(definition: MutatorDefinition<Args, ServerContext, ClientTx, R>) => RegisteredMutator<Args, ServerContext, ClientTx, R>;
-/**
- * The prefixed tables a single plugin `P` contributes, or an empty map when it
- * ships no schema extension. Mirrors {@link PrefixedTables} at the plugin level
- * so {@link InstalledTables} can fold a tuple of plugins.
- */
-type ExtensionTablesOf<P> = P extends {
-  readonly extension: SchemaExtension<infer X> & {
-    readonly key: infer K;
-  };
-} ? K extends string ? PrefixedTables<X, K> : Record<never, never> : Record<never, never>;
-/**
- * Fold a tuple of plugins onto a base table map `T`, accumulating each plugin's
- * auto-prefixed extension tables left-to-right — the type-level mirror of
- * {@link installPlugins} applying `mergeSchemaExtension` for each plugin in turn.
- */
-type InstalledTables<T extends Record<string, TableDefinition>, Plugins extends ReadonlyArray<unknown>> = Plugins extends readonly [infer Head, ...infer Rest] ? InstalledTables<ExtensionTablesOf<Head> & T, Rest> : T;
-/**
- * Union every plugin's `ContextOut` in a tuple — the type-level mirror of the
- * `ctx.api.&lt;key>` additions {@link composePluginMiddleware} accumulates as each
- * plugin middleware runs. Independent of the incoming context, which the builder
- * infers at the `.use(...)` site.
- */
-type ComposedOut<Plugins extends ReadonlyArray<unknown>> = Plugins extends readonly [infer Head, ...infer Rest] ? ComposedOut<Rest> & (Head extends Plugin<any, any, infer Out> ? Out : unknown) : unknown;
-/**
- * Schema fragment a plugin contributes. Same shape as the `tables` map
- * passed to `defineSchema`. Optional `vectorIndexes` mirror the top-level
- * `defineSchema` argument so a plugin can ship vector decls alongside its
- * tables.
- */
-interface SchemaExtension<T extends Record<string, TableDefinition> = Record<string, TableDefinition>> {
-  /** Stable key identifying the plugin that owns this extension. */
-  readonly key: string;
-  /**
-   * Extension tables, keyed by **bare** name (e.g. `buckets`). At merge time
-   * each is auto-prefixed with `key` (`ratelimit_buckets`) so it can't
-   * collide with an app table; do **not** namespace manually.
-   */
-  readonly tables: T;
-  /**
-   * Optional standalone vector indexes the plugin ships, keyed by index
-   * name. Merged into the host schema's `vectorIndexes`; a key collision
-   * with the base schema is a hard error (same policy as tables).
-   */
-  readonly vectorIndexes?: Record<string, VectorIndexDefinition>;
-}
-/**
- * Build a {@link SchemaExtension}. The `key` is a runtime tag (used for
- * error messages on collision) and a type-level brand.
- */
-declare const defineSchemaExtension: <T extends Record<string, TableDefinition>>(key: string, options: {
-  tables: T;
-  vectorIndexes?: Record<string, VectorIndexDefinition>;
-}) => SchemaExtension<T>;
-/**
- * A plugin packages an optional schema extension and optional middleware.
- * Both are independently usable: an app can install only the schema (e.g.
- * for plugins that ship background workers but no per-request behavior)
- * or only the middleware (plugins that augment ctx without persistent
- * state).
- */
-interface Plugin<TExtension extends Record<string, TableDefinition> = Record<string, TableDefinition>, TContextIn = unknown, TContextOut = TContextIn> {
-  /**
-   * Optional schema extension. Apps install via
-   * `defineSchema(...).extend(plugin.extension)`.
-   */
-  readonly extension?: SchemaExtension<TExtension>;
-  /** Stable key identifying the plugin. Matches `extension.key` when set. */
-  readonly key: string;
-  /**
-   * Optional middleware. Users attach with `c.query.use(plugin.middleware)`.
-   * The middleware can extend `ctx`; convention is to attach helpers under
-   * `ctx.api.&lt;key>`, e.g.
-   *
-   * ```ts
-   * middleware: ({ ctx, next }) =>
-   *     next({ ctx: { api: { ...ctx.api, ratelimit: api } } })
-   * ```
-   */
-  readonly middleware?: Middleware<TContextIn, TContextOut>;
-}
-/** Options to {@link definePlugin}. */
-interface DefinePluginOptions<TExtension extends Record<string, TableDefinition>, TContextIn, TContextOut> {
-  extension?: SchemaExtension<TExtension>;
-  middleware?: Middleware<TContextIn, TContextOut>;
-}
-/**
- * Call signatures for {@link definePlugin}. When `extension` is supplied the
- * returned plugin's `extension` is typed as PRESENT (not `?`), so the
- * canonical install pattern `defineSchema(...).extend(plugin.extension)`
- * typechecks without a non-null assertion — the shape every scaffold template
- * ships. The bare-options signature keeps `extension` optional for plugins
- * that carry only middleware.
- */
-interface DefinePluginFunction {
-  <TExtension extends Record<string, TableDefinition>, TContextIn = unknown, TContextOut = TContextIn>(key: string, options: DefinePluginOptions<TExtension, TContextIn, TContextOut> & {
-    extension: SchemaExtension<TExtension>;
-  }): Plugin<TExtension, TContextIn, TContextOut> & {
-    readonly extension: SchemaExtension<TExtension>;
-  };
-  <TExtension extends Record<string, TableDefinition>, TContextIn = unknown, TContextOut = TContextIn>(key: string, options: DefinePluginOptions<TExtension, TContextIn, TContextOut>): Plugin<TExtension, TContextIn, TContextOut>;
-}
-/**
- * Package a schema extension + middleware as a reusable plugin. Either
- * field is optional — `definePlugin("foo", {})` is valid but degenerate.
- */
-declare const definePlugin: DefinePluginFunction;
-/**
- * Bundle of registered functions a {@link Component} ships. Keys are the
- * function's local name (e.g. `check`, `reset`); the registered function
- * value carries its own kind / args / handler.
- *
- * Users re-export from their own lunora module so codegen picks them up:
- *
- * ```ts
- * // lunora/ratelimit.ts
- * import { ratelimit } from "@vendor/ratelimit-component";
- * export const { check, reset } = ratelimit.functions;
- * // Emits as `ratelimit:check` / `ratelimit:reset` in the generated `api`.
- * ```
- *
- * Codegen follows the re-export back to the bundled `query/mutation/action`
- * call (property access or destructuring both work), so the functions land in
- * the generated `api` under the re-exporting file's namespace.
- */
-type ComponentFunctions = Readonly<Record<string, RegisteredFunction<any, any, FunctionKind>>>;
-/**
- * Component = {@link Plugin} with a bundle of registered functions. The
- * extension + middleware + functions are independent: a component can ship
- * functions without a schema (e.g. a stateless utility), or a schema
- * without functions (e.g. shared table definitions), and any combination.
- */
-interface Component<TExtension extends Record<string, TableDefinition> = Record<string, TableDefinition>, TContextIn = unknown, TContextOut = TContextIn, F extends ComponentFunctions = ComponentFunctions> extends Plugin<TExtension, TContextIn, TContextOut> {
-  readonly functions: F;
-}
-interface DefineComponentOptions<TExtension extends Record<string, TableDefinition>, TContextIn, TContextOut, F extends ComponentFunctions> extends DefinePluginOptions<TExtension, TContextIn, TContextOut> {
-  /** Registered functions the component ships. Keys are the function's local name. */
-  functions?: F;
-}
-/**
- * Convenience wrapper around {@link definePlugin} that also bundles a set
- * of registered functions. The resulting `component.functions` object is a
- * record of `name → registered query/mutation/action`; consumers
- * re-export entries so codegen discovers them as user functions:
- *
- * ```ts
- * export const ratelimit = defineComponent("ratelimit", {
- *     // Bare `buckets` merges in as `ratelimit_buckets`.
- *     extension: defineSchemaExtension("ratelimit", { tables: { buckets } }),
- *     middleware: ({ ctx, next }) => next({ ctx: { ...ctx, ratelimit: api(ctx) } }),
- *     functions: {
- *         check: query.input({ key: v.string() }).query(async ({ ctx, args }) => ...),
- *         reset: mutation.input({ key: v.string() }).mutation(async ({ ctx, args }) => ...),
- *     },
- * });
- * ```
- *
- * Re-exporting an entry (by property access or destructuring) is enough for
- * codegen to discover it in the host app's namespace — the discovery resolver
- * chases the re-export back to the bundled registration call.
+ * Convenience wrapper around {@link definePlugin} that also bundles a set
+ * of registered functions. The resulting `component.functions` object is a
+ * record of `name → registered query/mutation/action`; consumers
+ * re-export entries so codegen discovers them as user functions:
+ *
+ * ```ts
+ * export const ratelimit = defineComponent("ratelimit", {
+ *     // Bare `buckets` merges in as `ratelimit_buckets`.
+ *     extension: defineSchemaExtension("ratelimit", { tables: { buckets } }),
+ *     middleware: ({ ctx, next }) => next({ ctx: { ...ctx, ratelimit: api(ctx) } }),
+ *     functions: {
+ *         check: query.input({ key: v.string() }).query(async ({ ctx, args }) => ...),
+ *         reset: mutation.input({ key: v.string() }).mutation(async ({ ctx, args }) => ...),
+ *     },
+ * });
+ * ```
+ *
+ * Re-exporting an entry (by property access or destructuring) is enough for
+ * codegen to discover it in the host app's namespace — the discovery resolver
+ * chases the re-export back to the bundled registration call.
  */
 declare const defineComponent: <TExtension extends Record<string, TableDefinition>, TContextIn = unknown, TContextOut = TContextIn, F extends ComponentFunctions = ComponentFunctions>(key: string, options: DefineComponentOptions<TExtension, TContextIn, TContextOut, F>) => Component<TExtension, TContextIn, TContextOut, F>;
 /**
@@ -1439,6 +1193,16 @@ type PrefixedTables<X extends Record<string, TableDefinition>, Key extends strin
  * collisions are impossible. The only remaining hard error is two extensions
  * sharing the same `key` and producing the same prefixed table (or vector
  * index) name — silent shadow would let one plugin hijack another's data.
+ *
+ * Re-runs {@link validateIndexFields} against the merged table set before
+ * returning: `defineSchema` only validates the tables it was called with, so
+ * without this an extension-contributed index with a typo'd/out-of-shape
+ * field (or a duplicate name within one kind) would never be checked at all.
+ * Re-validating the whole merged set (base + prefixed extension tables) is
+ * cheap and idempotent for the base tables, which already passed this same
+ * check when the base schema was built. Both callers of this function —
+ * `withExtend.extend()` (`./schema`) and `installPlugins` (below) — get the
+ * re-validation for free from this single call site (plan 258 §4/§9 Q3).
  */
 declare const mergeSchemaExtension: <T extends Record<string, TableDefinition>, X extends Record<string, TableDefinition>, Key extends string = string>(base: Schema<T>, extension: SchemaExtension<X> & {
   readonly key: Key;
@@ -1570,7 +1334,7 @@ interface TableBuilder<Shape extends Record<string, Validator> = Record<string,
     backend?: GlobalBackend;
   }) => TableBuilder<Shape>;
   /** Add a secondary index. */
-  index: (name: string, fields: ReadonlyArray<string>, options?: {
+  index: (name: string, fields: ReadonlyArray<(keyof Shape & string) | (typeof SYSTEM_INDEX_FIELDS)[number]>, options?: {
     unique?: boolean;
   }) => TableBuilder<Shape>;
   /**
@@ -1692,101 +1456,510 @@ declare const defineTable: <Shape extends Record<string, Validator>>(inputShape:
  */
 declare const defineVectorIndex: (options: VectorIndexOptions) => VectorIndexDefinition;
 /**
- * Options for the standalone `defineAggregateIndex(name, opts)` helper (DSL
- * Shape B). Unlike the inline `.aggregateIndex(...)` builder, this form takes
- * the owning table explicitly via `on` — handy when a single counter wants to
- * live next to the schema map rather than inside a table chain.
+ * Options for the standalone `defineAggregateIndex(name, opts)` helper (DSL
+ * Shape B). Unlike the inline `.aggregateIndex(...)` builder, this form takes
+ * the owning table explicitly via `on` — handy when a single counter wants to
+ * live next to the schema map rather than inside a table chain.
+ */
+interface AggregateIndexOptions {
+  by?: ReadonlyArray<string>;
+  field?: string;
+  on: string;
+  op?: AggregateOp;
+  where?: Record<string, unknown>;
+}
+/**
+ * Declare a standalone aggregate index. Pass the returned value to
+ * `defineSchema(tables, vectorIndexes, aggregateIndexes)` keyed by index name —
+ * the schema attaches it to `tables[on].aggregateIndexes` so runtime consumers
+ * (DO + D1) read every index uniformly off the table definition.
+ */
+declare const defineAggregateIndex: (name: string, options: AggregateIndexOptions) => AggregateIndexDefinition;
+/**
+ * Options for the standalone `defineRankIndex(name, opts)` helper (DSL Shape B).
+ * Mirrors the inline `.rankIndex(...)` builder but takes the owning table via
+ * `table` so it can sit next to the schema map.
+ */
+interface RankIndexOptions {
+  partitionBy?: ReadonlyArray<string>;
+  sortBy: ReadonlyArray<{
+    direction?: "asc" | "desc";
+    field: string;
+  }>;
+  table: string;
+  where?: Record<string, unknown>;
+}
+/**
+ * Declare a standalone rank index. Pass the returned value to
+ * `defineSchema(tables, vectorIndexes, aggregateIndexes, rankIndexes)` keyed
+ * by index name — the schema attaches it to `tables[on].rankIndexes`.
+ */
+declare const defineRankIndex: (name: string, options: RankIndexOptions) => RankIndexDefinition;
+/**
+ * Build the application schema. The first argument is the table map; the
+ * optional second argument registers standalone `defineVectorIndex(...)`
+ * declarations (DSL Shape B) keyed by index name. The optional third argument
+ * registers standalone `defineAggregateIndex(...)` declarations (DSL Shape B);
+ * the optional fourth argument registers standalone `defineRankIndex(...)`
+ * declarations. Both are folded into the matching `tables[on].*Indexes` array
+ * so runtime backends read every index uniformly off the table definition.
+ */
+/**
+ * Schema with an in-place `.extend(plugin.extension)` method. Used so apps
+ * can compose plugin schemas: `defineSchema({...}).extend(authPlugin.extension)`.
+ *
+ * `extend` is non-mutating — returns a fresh `ExtendableSchema` containing
+ * the merged tables. Extension tables are auto-namespaced by the extension
+ * `key` (`buckets` → `ratelimit_buckets`), so the merged type carries the
+ * prefixed names via {@link PrefixedTables}. Chains:
+ * `defineSchema(...).extend(a).extend(b)` is the typed equivalent of merging
+ * `a`'s prefixed tables then `b`'s.
+ */
+type ExtendableSchema<T extends Record<string, TableDefinition>> = {
+  extend: <X extends Record<string, TableDefinition>, Key extends string>(extension: SchemaExtension<X> & {
+    readonly key: Key;
+  }) => ExtendableSchema<PrefixedTables<X, Key> & T>;
+  /**
+   * Pin every Durable Object the app reaches — shards, fan-out, subscriptions,
+   * the scheduler, and `ctx.containers` — to a Cloudflare data-residency
+   * jurisdiction (`"eu"`, `"us"`, `"fedramp"`). Codegen reads this off the
+   * schema and emits it into the generated worker's `createWorker({ jurisdiction })`
+   * (and `ctx.scheduler` / `ctx.containers`). Non-mutating: returns a fresh
+   * `ExtendableSchema`, so it composes with `.rls(...)` / `.extend(...)` in any order.
+   *
+   * ⚠️ **Set this once, before your first deploy — changing or removing it
+   * strands data.** A Durable Object name maps to a *different* ID in each
+   * jurisdiction, so toggling this on an existing app makes every shard, scheduler
+   * job, and session DO resolve to a NEW, empty DO; the previous data stays in the
+   * old jurisdiction's DOs and is no longer reachable. There is no in-place
+   * migration — you would have to export from the old jurisdiction and import
+   * into the new one.
+   *
+   * Note: this pins **DO-backed** state only. D1-backed state — `.global()`
+   * tables and `@lunora/auth` sessions alike — is governed by D1's own location
+   * settings, not this option.
+   * @see https://developers.cloudflare.com/durable-objects/reference/data-location/
+   */
+  jurisdiction: (jurisdiction: DurableObjectJurisdiction) => ExtendableSchema<T>;
+  /**
+   * Turn on secure-by-default RLS for the whole schema. Every table is then
+   * protected — the DO/D1 write path denies raw, non-RLS `ctx.db` access, so a
+   * procedure that forgets `.use(rls(...))` fails closed. Opt a table out with
+   * `.public()`. Non-mutating: returns a fresh `ExtendableSchema` carrying the
+   * mode, so `.rls("required")` composes with `.extend(...)` either order.
+   */
+  rls: (mode: "required") => ExtendableSchema<T>;
+} & Schema<T>;
+/**
+ * Columns every row carries implicitly (never part of a table's declared
+ * `shape`), so `.index()` may legitimately name them. The single source for
+ * both the compile-time allow-list (`TableBuilder["index"]`'s `fields` type,
+ * via `(typeof SYSTEM_INDEX_FIELDS)[number]`) and the runtime cross-check
+ * below (via `SYSTEM_INDEX_FIELDS_SET`) — declared once so the two can't
+ * drift apart.
+ */
+declare const SYSTEM_INDEX_FIELDS: readonly ["_creationTime", "_id"];
+/**
+ * Per-table, per-KIND index→declared-fields map: for each table, each index
+ * KIND (`index` | `rank` | `geo`) that has at least one declared index maps
+ * to a name→fields record for that kind only. Distilled by
+ * {@link indexFieldsFromSchema}; this is the shape `mask()`'s
+ * `MaskOptions.indexFields` expects (see `./mask/types`), so a table not
+ * present here (no declared indexes of any kind) is simply absent from the
+ * map rather than mapped to `{}`, and a kind with no declared indexes on a
+ * table that HAS other kinds is simply absent from that table's entry.
+ *
+ * Kept per kind (rather than one flat name→fields record) because the engine
+ * resolves `withIndex`/`withGeoIndex`/rank reads in THREE separate
+ * namespaces (`tableDefinition.indexes` / `.geoIndexes` / `.rankIndexes` —
+ * see `@lunora/shard-engine`'s `ctx-db.ts`), so the same name can legally and
+ * unambiguously denote a different index per kind. A flat map would let one
+ * kind's fields silently shadow another's for a colliding name, producing a
+ * wrong-namespace answer from the mask guard (checking the wrong index's
+ * fields) instead of the documented fail-open (missing lookup) — see plan 258.
+ */
+type IndexFieldsByTable = Readonly<Record<string, {
+  readonly geo?: Readonly<Record<string, ReadonlyArray<string>>>;
+  readonly index?: Readonly<Record<string, ReadonlyArray<string>>>;
+  readonly rank?: Readonly<Record<string, ReadonlyArray<string>>>;
+}>>;
+declare const indexFieldsFromSchema: (schema: Schema) => IndexFieldsByTable;
+declare const defineSchema: <T extends Record<string, TableDefinition>>(tables: T, vectorIndexes?: Record<string, VectorIndexDefinition>, aggregateIndexes?: Record<string, AggregateIndexDefinition>, rankIndexes?: Record<string, RankIndexDefinition>) => ExtendableSchema<T>;
+/**
+ * Context handed to a {@link MaskFn} (and to {@link MaskOptions.bypass}). The
+ * `auth` shape mirrors RLS's `PolicyContext.auth` one-for-one — same identity
+ * resolver, same `can(...)` permission check — so an author can branch a mask
+ * on the caller's role/permission. `row` is the full pre-mask row the column
+ * belongs to; `column` is the column currently being masked. Both are absent
+ * when the context is used for the procedure-wide `bypass` check (no specific
+ * cell is in play yet).
+ */
+interface MaskContext<Context = unknown> {
+  readonly auth: {
+    /** `true` when any of the request's `roles` grants `permission` (see {@link MaskOptions.roles}). Fails closed for unregistered roles. */
+    readonly can: (permission: Permission | string) => boolean;
+    readonly identity?: Record<string, unknown> | null;
+    readonly roles: ReadonlyArray<string>;
+    readonly userId: null | string;
+  };
+  /** The column currently being masked. Present only inside a per-cell {@link MaskFn}. */
+  readonly column?: string;
+  readonly ctx: Context;
+  /** The full pre-mask row the masked cell belongs to. Present only inside a per-cell {@link MaskFn}. */
+  readonly row?: Record<string, unknown>;
+}
+/**
+ * A custom masking function. Receives the raw cell value and the
+ * {@link MaskContext}, returns the value to surface. Use it for partial masks
+ * (`maskMiddle(phone)`), role-aware reveals (`ctx.auth.can(...) ? value : null`),
+ * or format-preserving tokens. A function that **throws** fails closed — the
+ * cell is redacted to `null`, never leaked raw.
+ */
+type MaskFn<Context = unknown> = (value: unknown, context: MaskContext<Context>) => unknown;
+/**
+ * How a column is masked:
+ *
+ * - `"redact"` — drop the value to `null`. The simplest, safest strategy, and
+ * the right choice for any value that must actually be kept secret.
+ * - `"hash"` — replace with a stable token (unsalted 32-bit FNV-1a hex) so the
+ * same input always yields the same token (joinable/groupable client-side).
+ * **This is NOT a confidentiality control.** It is a non-cryptographic,
+ * unsalted, deterministic, narrow (~2^32) digest: low-entropy values (emails,
+ * phone numbers, SSNs) are brute-force-recoverable by the very caller you are
+ * masking from, and identical values always produce identical tokens across
+ * rows/columns/tenants (enabling correlation). Use `"hash"` ONLY when you want a
+ * stable pseudonym for grouping/joining and leaking the value is acceptable —
+ * never to hide sensitive PII. For PII that must stay hidden, use `"redact"`.
+ * - a {@link MaskFn} — author-defined transform (partial mask, role-aware reveal).
+ */
+type MaskStrategy<Context = unknown> = "hash" | "redact" | MaskFn<Context>;
+/** Per-column strategy map for one table: `{ email: "redact", phone: maskMiddle }`. */
+type MaskColumns<Context = unknown> = Record<string, MaskStrategy<Context>>;
+/**
+ * The mask declaration passed to `mask(...)`: a table → column → strategy map.
+ * Deliberately a plain object literal so the codegen feeder can statically read
+ * which columns a procedure masks (powering the `mask_uncovered_pii_column`
+ * advisor lint), exactly as the RLS feeder reads policy tables.
+ */
+type MaskPolicies<Context = unknown> = Record<string, MaskColumns<Context>>;
+/**
+ * Options for `mask(policies, options)`.
+ *
+ * - `roles` registers the role→permission grants that back `ctx.auth.can(...)`
+ * inside a {@link MaskFn} — identical to `rls(policies, { roles })`. A role
+ * not listed grants no permissions (fails closed for unknown roles).
+ * - `bypass` is a procedure-wide escape hatch: when it returns `true` the whole
+ * mask is skipped (the caller sees raw values). Use it for a privileged
+ * viewer — `bypass: ({ auth }) => auth.can("pii:view")`. Prefer this over
+ * branching every column when an entire class of caller should see clear data.
+ * - `indexFields` closes the bare-index-scan / rank / geo position oracle (see
+ * the `mask/middleware` module docblock's "Residual read-position oracles" section).
+ */
+interface MaskOptions<Context = unknown> {
+  readonly bypass?: (context: MaskContext<Context>) => boolean;
+  /**
+   * Per-table, per-KIND index→declared-fields map (regular index `fields`
+   * under `index`; rank index `sortBy` ∪ `partitionBy` under `rank`; geo
+   * index `field` under `geo`). Supplied to close the bare-index-scan /
+   * rank / geo position oracle: a `withIndex(name)` with no range callback,
+   * a `rank`/`rankPage`/`rankBefore` read, or a `withGeoIndex` read, over an
+   * index whose DECLARED fields (for that read's own kind) intersect a
+   * masked column, is rejected. Kept per kind — rather than one flat
+   * name→fields map — because the engine resolves `withIndex` /
+   * `withGeoIndex` / rank reads in three separate namespaces, so the same
+   * index name can legally denote a different index per kind; a flat map
+   * would let one kind's fields shadow another's for a colliding name.
+   * OPTIONAL and additive — omit it and behaviour is unchanged (the oracle
+   * stays open, exactly as before this option existed). Build it with
+   * `indexFieldsFromSchema` (exported from `@lunora/server`):
+   * `mask(policies, { indexFields: indexFieldsFromSchema(schema) })`.
+   */
+  readonly indexFields?: IndexFieldsByTable;
+  readonly roles?: ReadonlyArray<Role>;
+}
+interface QueryPage$1 {
+  continueCursor: null | string;
+  isDone: boolean;
+  page: Record<string, unknown>[];
+}
+interface QueryArgs$1 {
+  baseWhere?: unknown;
+  cursor?: null | string;
+  limit?: number;
+  orderBy?: ReadonlyArray<Record<string, unknown>>;
+  where?: unknown;
+  with?: Record<string, unknown>;
+}
+interface AggregateArgs$1 {
+  field?: string;
+  op: string;
+  where?: unknown;
+}
+interface GroupByArgs$1 {
+  agg?: {
+    field?: string;
+    op: string;
+  };
+  by: ReadonlyArray<string>;
+  where?: unknown;
+}
+/** One row of a `.collectWithScores()` result — mirrors `@lunora/shard-engine`'s `ScoredDocument`. */
+type ScoredDocument = GeoScoredDocument | SearchScoredDocument;
+/** A `.withGeoIndex()` row — mirrors `@lunora/shard-engine`'s `GeoScoredDocument`. */
+interface GeoScoredDocument {
+  distanceMeters: null | number;
+  document: Record<string, unknown>;
+  score?: never;
+}
+/** A `.withSearchIndex()` row — mirrors `@lunora/shard-engine`'s `SearchScoredDocument`. */
+interface SearchScoredDocument {
+  distanceMeters?: never;
+  document: Record<string, unknown>;
+  score: number;
+}
+interface TableReaderLike$1 {
+  [Symbol.asyncIterator]: () => AsyncIterator<Record<string, unknown>>;
+  collect: () => Promise<Record<string, unknown>[]>;
+  collectWithScores: () => Promise<ScoredDocument[]>;
+  filter: (predicate: (document: Record<string, unknown>) => boolean) => TableReaderLike$1;
+  first: () => Promise<Record<string, unknown> | null>;
+  order: (direction: "asc" | "desc") => TableReaderLike$1;
+  paginate: (options: {
+    cursor?: null | string;
+    numItems: number;
+  }) => Promise<QueryPage$1>;
+  take: (limit: number) => Promise<Record<string, unknown>[]>;
+  unique: () => Promise<Record<string, unknown> | null>;
+  withGeoIndex: (indexName: string, build: (q: unknown) => unknown) => TableReaderLike$1;
+  withIndex: (indexName: string, range?: (q: unknown) => unknown) => TableReaderLike$1;
+  withSearchIndex: (indexName: string, search: (q: unknown) => unknown) => TableReaderLike$1;
+}
+/**
+ * Structural projection of the runtime ORM writer — the same subset
+ * `../rls/middleware` mirrors, so the wrapper is interchangeable between
+ * `@lunora/do`'s and `@lunora/d1`'s `DatabaseWriterLike` without an
+ * inter-package dependency. `rankBefore` is optional (the D1 twin omits it).
  */
-interface AggregateIndexOptions {
-  by?: ReadonlyArray<string>;
-  field?: string;
-  on: string;
-  op?: AggregateOp;
-  where?: Record<string, unknown>;
+interface MaskDatabase {
+  aggregate: (tableName: string, options: AggregateArgs$1) => Promise<null | number>;
+  count: (tableName: string, whereOrArgs?: unknown) => Promise<number>;
+  delete: (id: string, expectedTable?: string) => Promise<void>;
+  deleteMany: (ids: ReadonlyArray<string>, options?: {
+    limit?: number;
+  }) => Promise<{
+    deleted: number;
+  }>;
+  deleteWhere?: (tableName: string, where: Record<string, unknown>, options?: {
+    limit?: number;
+  }) => Promise<{
+    deleted: number;
+  }>;
+  findFirst: (tableName: string, args?: QueryArgs$1) => Promise<Record<string, unknown> | null>;
+  findFirstOrThrow: (tableName: string, args?: QueryArgs$1) => Promise<Record<string, unknown>>;
+  findMany: (tableName: string, args?: QueryArgs$1) => Promise<QueryPage$1>;
+  get: (id: string, expectedTable?: string) => Promise<Record<string, unknown> | null>;
+  groupBy: (tableName: string, options: GroupByArgs$1) => Promise<ReadonlyArray<{
+    key: Record<string, unknown>;
+    value: null | number;
+  }>>;
+  insert: (tableName: string, document: Record<string, unknown>) => Promise<string>;
+  insertMany: (tableName: string, documents: ReadonlyArray<Record<string, unknown>>, options?: {
+    limit?: number;
+    skipDuplicates?: boolean;
+  }) => Promise<(string | null)[]>;
+  lookupById?: (id: string, expectedTable?: string) => Promise<null | {
+    row: Record<string, unknown>;
+    tableName: string;
+  }>;
+  patch: (id: string, patch: Record<string, unknown>, expectedTable?: string) => Promise<void>;
+  patchMany: (patches: ReadonlyArray<{
+    id: string;
+    patch: Record<string, unknown>;
+  }>, options?: {
+    limit?: number;
+  }) => Promise<{
+    patched: number;
+  }>;
+  patchWhere?: (tableName: string, args: {
+    patch: Record<string, unknown>;
+    where: Record<string, unknown>;
+  }, options?: {
+    limit?: number;
+  }) => Promise<{
+    patched: number;
+  }>;
+  query: (tableName: string) => TableReaderLike$1;
+  rank: (tableName: string, indexName: string, options: unknown) => Promise<null | {
+    position: number;
+    total: number;
+  }>;
+  rankBefore?: (tableName: string, indexName: string, options: unknown) => Promise<{
+    before: number;
+    total: number;
+  }>;
+  rankPage: (tableName: string, indexName: string, options?: unknown) => Promise<QueryPage$1>;
+  /** Cross-shard companion to `rankPage`, gated the same way `rankPage` is masked below. */
+  rankPageRows?: (tableName: string, indexName: string, options?: unknown) => Promise<ShardRankPageResultLike>;
+  replace: (id: string, document: Record<string, unknown>, expectedTable?: string) => Promise<void>;
+}
+/** Roles list source on the context. Tolerant of older auth states (mirrors RLS's `AuthLike`). */
+type AuthLike$1 = {
+  getIdentity?: () => Promise<Record<string, unknown> | null>;
+  roles?: ReadonlyArray<string>;
+  userId?: null | string;
+};
+interface MaskContextIn {
+  auth?: AuthLike$1;
+  db: MaskDatabase;
 }
 /**
- * Declare a standalone aggregate index. Pass the returned value to
- * `defineSchema(tables, vectorIndexes, aggregateIndexes)` keyed by index name —
- * the schema attaches it to `tables[on].aggregateIndexes` so runtime consumers
- * (DO + D1) read every index uniformly off the table definition.
+ * Procedure-builder middleware. Apply per-request via `.use(mask(policies))`.
+ * Closes over the policy map at builder-construction time; resolves identity +
+ * the `bypass` decision per call against the live ctx.
+ *
+ * IMPORTANT: a mask is in scope only for procedures whose builder chain
+ * includes this middleware — opt-in, never global (the same invariant as RLS).
  */
-declare const defineAggregateIndex: (name: string, options: AggregateIndexOptions) => AggregateIndexDefinition;
+declare const mask: <Context extends MaskContextIn = MaskContextIn>(policies: MaskPolicies<Context>, options?: MaskOptions<Context>) => Middleware<Context, Context>;
+/** Project-wide masked-column registry: every table any registered function masks, unioned. */
+type MaskRegistry = ReadonlyMap<string, ReadonlySet<string>>;
 /**
- * Options for the standalone `defineRankIndex(name, opts)` helper (DSL Shape B).
- * Mirrors the inline `.rankIndex(...)` builder but takes the owning table via
- * `table` so it can sit next to the schema map.
+ * Build the project-wide masked-column registry from the registered functions
+ * (pass `Object.values(LUNORA_FUNCTIONS)`) — the mask-column twin of
+ * `buildRlsReadRegistry`. Unions every function's `.use(mask(...))` columns
+ * per table: a column masked by ANY registered function counts as masked in
+ * the registry — there is no "which procedure would this shape have gone
+ * through" question to narrow by, so the union is the only safe answer.
  */
-interface RankIndexOptions {
-  partitionBy?: ReadonlyArray<string>;
-  sortBy: ReadonlyArray<{
-    direction?: "asc" | "desc";
-    field: string;
+declare const buildMaskRegistry: (functions: Iterable<unknown>) => MaskRegistry;
+/** A document handed to a migration transform: the stored row including `_id`/`_creationTime`. */
+type MigrationDocument = Record<string, unknown>;
+/**
+ * The read surface a transform reaches through its `ctx`.
+ *
+ * Read-only by design: the runner accounts for exactly one rewrite per row read,
+ * and a transform writing directly would make that count describe something
+ * other than what happened. Scoped to the shard the runner is walking.
+ */
+interface MigrationReader {
+  count: (table: string, where?: Record<string, unknown>) => Promise<number>;
+  findFirst: (table: string, args?: Record<string, unknown>) => Promise<MigrationDocument | null>;
+  findMany: (table: string, args?: Record<string, unknown>) => Promise<{
+    isDone: boolean;
+    page: MigrationDocument[];
   }>;
-  table: string;
-  where?: Record<string, unknown>;
+  get: (id: string, expectedTable?: string) => Promise<MigrationDocument | null>;
+}
+/** The context handed to a transform alongside the row. */
+interface MigrationCtx {
+  db: MigrationReader;
 }
 /**
- * Declare a standalone rank index. Pass the returned value to
- * `defineSchema(tables, vectorIndexes, aggregateIndexes, rankIndexes)` keyed
- * by index name — the schema attaches it to `tables[on].rankIndexes`.
- */
-declare const defineRankIndex: (name: string, options: RankIndexOptions) => RankIndexDefinition;
-/**
- * Build the application schema. The first argument is the table map; the
- * optional second argument registers standalone `defineVectorIndex(...)`
- * declarations (DSL Shape B) keyed by index name. The optional third argument
- * registers standalone `defineAggregateIndex(...)` declarations (DSL Shape B);
- * the optional fourth argument registers standalone `defineRankIndex(...)`
- * declarations. Both are folded into the matching `tables[on].*Indexes` array
- * so runtime backends read every index uniformly off the table definition.
+ * Transform applied to one document. Return a new document to rewrite the row,
+ * or `undefined` to leave it untouched (skipped, not counted as changed). The
+ * runner always preserves the original `_id` and `_creationTime`, so the
+ * returned document neither needs to nor should change row identity.
+ *
+ * The second parameter carries a shard-scoped reader. Without it a transform
+ * could only rewrite the row it was handed — enough for a backfill whose new
+ * value is a pure function of the old row (`displayName = name ?? "Anonymous"`),
+ * but not for the shape people actually write: read the parent, copy a field
+ * down onto its children.
+ *
+ * May return a promise, since a cross-table read is asynchronous.
+ *
+ * **A shard key cannot be backfilled this way, even with a reader.** A row whose
+ * shard-key field is unset does not belong to any shard, so a shard-scoped query
+ * will not enumerate it; and writing the key would have to MOVE the row to a
+ * different Durable Object, which a per-shard runner cannot do. Re-keying is an
+ * export → transform → import, not a migration.
  */
+type MigrationTransform = (document: MigrationDocument, ctx: MigrationCtx) => MigrationDocument | Promise<MigrationDocument | undefined | void> | undefined | void;
+interface MigrationDefinition {
+  /** Rows fetched and rewritten per batch. Defaults to the runner's batch size when omitted. */
+  readonly batchSize?: number;
+  /** Optional reverse transform, applied by `migrate down`. */
+  readonly down?: MigrationTransform;
+  /** Stable, unique identifier — the key per-shard run-state is tracked under. */
+  readonly id: string;
+  /** Table whose documents this migration iterates. */
+  readonly table: string;
+  /** Forward transform, applied to every row by `migrate up`. */
+  readonly up: MigrationTransform;
+}
+/** A {@link MigrationDefinition} plus the codegen discovery marker. */
+interface RegisteredMigration extends MigrationDefinition {
+  readonly __lunoraMigration: true;
+}
+/** Declare an online data migration. See the module docs for runtime semantics. */
+declare const defineMigration: (definition: MigrationDefinition) => RegisteredMigration;
 /**
- * Schema with an in-place `.extend(plugin.extension)` method. Used so apps
- * can compose plugin schemas: `defineSchema({...}).extend(authPlugin.extension)`.
- *
- * `extend` is non-mutating — returns a fresh `ExtendableSchema` containing
- * the merged tables. Extension tables are auto-namespaced by the extension
- * `key` (`buckets` → `ratelimit_buckets`), so the merged type carries the
- * prefixed names via {@link PrefixedTables}. Chains:
- * `defineSchema(...).extend(a).extend(b)` is the typed equivalent of merging
- * `a`'s prefixed tables then `b`'s.
+ * A mutator declaration. `server` is authoritative; `client` is the optimistic
+ * twin (optional — omit it to let the optimistic write fall through to the
+ * server round-trip with no local preview). Both receive the same validated
+ * `args`.
  */
-type ExtendableSchema<T extends Record<string, TableDefinition>> = {
-  extend: <X extends Record<string, TableDefinition>, Key extends string>(extension: SchemaExtension<X> & {
-    readonly key: Key;
-  }) => ExtendableSchema<PrefixedTables<X, Key> & T>;
+interface MutatorDefinition<Args extends ValidatorMap = ValidatorMap, ServerContext = MutationCtx, ClientTx = unknown, R = unknown> {
   /**
-   * Pin every Durable Object the app reaches — shards, fan-out, subscriptions,
-   * the scheduler, and `ctx.containers` — to a Cloudflare data-residency
-   * jurisdiction (`"eu"`, `"us"`, `"fedramp"`). Codegen reads this off the
-   * schema and emits it into the generated worker's `createWorker({ jurisdiction })`
-   * (and `ctx.scheduler` / `ctx.containers`). Non-mutating: returns a fresh
-   * `ExtendableSchema`, so it composes with `.rls(...)` / `.extend(...)` in any order.
+   * Validator for the mutator's arguments. Validated on the DO before `server`
+   * runs and (when present) on the client before `client` runs, so both impls
+   * see the same parsed shape. Omit for a parameterless mutator.
+   */
+  readonly args?: Args;
+  /**
+   * Optimistic client implementation. Runs in a TanStack DB transaction
+   * against the local collections; its writes are applied immediately and
+   * automatically rolled back / rebased as the authoritative result syncs
+   * back. Pure and side-effect-free beyond the local store. Omit to skip the
+   * local preview.
+   */
+  readonly client?: (tx: ClientTx, args: InferValidatorMap<Args>) => Promise<void> | void;
+  /**
+   * Owner-scope the write: names the column carrying the row owner (e.g.
+   * `owner: "userId"`). Before `server` runs, the mutator requires a verified
+   * identity, rejects a client-supplied owner that disagrees with it, and sets
+   * the column to the verified value — so the impl reads `args[owner]` without
+   * trusting the client and never repeats the check by hand.
    *
-   * ⚠️ **Set this once, before your first deploy — changing or removing it
-   * strands data.** A Durable Object name maps to a *different* ID in each
-   * jurisdiction, so toggling this on an existing app makes every shard, scheduler
-   * job, and session DO resolve to a NEW, empty DO; the previous data stays in the
-   * old jurisdiction's DOs and is no longer reachable. There is no in-place
-   * migration — you would have to export from the old jurisdiction and import
-   * into the new one.
+   * This replaces the "every mutator opens with `assertOwner(ctx, args.userId)`"
+   * pattern, and is the write-side counterpart to an `owner`-scoped
+   * {@link import("./shapes").ShapeDefinition}. Unlike a shape it takes the column
+   * NAME rather than `true`: a shape is bound to one `table`, so the table's
+   * `.ownedBy(field)` resolves unambiguously, whereas one mutator may write
+   * several tables and has no single owning table to read it from.
    *
-   * Note: this pins **DO-backed** state only. D1-backed state — `.global()`
-   * tables and `@lunora/auth` sessions alike — is governed by D1's own location
-   * settings, not this option.
-   * @see https://developers.cloudflare.com/durable-objects/reference/data-location/
+   * Declare the column `v.optional(...)` to leave it off the wire entirely; it is
+   * injected either way.
    */
-  jurisdiction: (jurisdiction: DurableObjectJurisdiction) => ExtendableSchema<T>;
+  readonly owner?: string;
   /**
-   * Turn on secure-by-default RLS for the whole schema. Every table is then
-   * protected — the DO/D1 write path denies raw, non-RLS `ctx.db` access, so a
-   * procedure that forgets `.use(rls(...))` fails closed. Opt a table out with
-   * `.public()`. Non-mutating: returns a fresh `ExtendableSchema` carrying the
-   * mode, so `.rls("required")` composes with `.extend(...)` either order.
+   * Authoritative server implementation. Runs inside the shard DO with a full
+   * {@link MutationContext} (`ctx.db` writer); its writes append to `__cdc_log`
+   * and poke back to subscribers. This is the source of truth — the client
+   * impl is only a prediction of it.
    */
-  rls: (mode: "required") => ExtendableSchema<T>;
-} & Schema<T>;
-declare const defineSchema: <T extends Record<string, TableDefinition>>(tables: T, vectorIndexes?: Record<string, VectorIndexDefinition>, aggregateIndexes?: Record<string, AggregateIndexDefinition>, rankIndexes?: Record<string, RankIndexDefinition>) => ExtendableSchema<T>;
+  readonly server: (context: ServerContext, args: InferValidatorMap<Args>) => Promise<R> | R;
+}
+/**
+ * A {@link MutatorDefinition} plus the codegen discovery marker and a
+ * dispatch-shaped `handler` (validates `args`, then runs `server`) so the DO
+ * invokes a mutator exactly like a registered procedure.
+ */
+interface RegisteredMutator<Args extends ValidatorMap = ValidatorMap, ServerContext = MutationCtx, ClientTx = unknown, R = unknown> extends MutatorDefinition<Args, ServerContext, ClientTx, R> {
+  readonly __lunoraMutator: true;
+  /** Validate `rawArgs`, then run the authoritative `server` impl. Used by the DO push path. */
+  readonly handler: (context: ServerContext, rawArgs: Record<string, unknown>) => Promise<R>;
+  /**
+   * Marks the dispatch kind so codegen can register the mutator in the same
+   * `LUNORA_FUNCTIONS` table queries/mutations use — the DO's `handleRpc`
+   * reads `kind === "mutation"` to wrap the authoritative `server` impl in the
+   * shard's BEGIN/COMMIT span (all-or-nothing writes), exactly like an
+   * ordinary `mutation`.
+   */
+  readonly kind: "mutation";
+}
+/** Declare a custom mutator. See the module docs for runtime semantics. */
+declare const defineMutator: <Args extends ValidatorMap = ValidatorMap, ServerContext = MutationCtx, ClientTx = unknown, R = unknown>(definition: MutatorDefinition<Args, ServerContext, ClientTx, R>) => RegisteredMutator<Args, ServerContext, ClientTx, R>;
 /** Default time-to-live for a presence row: a heartbeat keeps a member "present" for this long. */
 declare const DEFAULT_TTL_MS = 3e4;
 declare const PRESENCE_BARE_TABLE = "present";
@@ -2174,6 +2347,13 @@ interface DatabaseWriterLike {
    * Required for the same reason as `aggregate`.
    */
   rankPage: (tableName: string, indexName: string, options?: RankPageArgs) => Promise<QueryPage>;
+  /**
+   * Cross-shard companion to `rankPage`: same ranked slice, but each row
+   * keeps its rank-key tuple for the query coordinator's k-way merge. Same
+   * count-of-partition RLS hazard as `rankPage` — failed closed under a read
+   * policy for the identical reason (see `rankPage` above).
+   */
+  rankPageRows?: (tableName: string, indexName: string, options?: RankPageArgs) => Promise<ShardRankPageResultLike>;
   replace: (id: string, document: Record<string, unknown>, expectedTable?: string) => Promise<void>;
   restore?: (id: string, expectedTable?: string) => Promise<void>;
   /**
@@ -2455,4 +2635,4 @@ interface StorageContextIn {
 }
 declare const storageRules: <Context extends StorageContextIn = StorageContextIn>(rules: ReadonlyArray<StorageRule<Context>>, options?: StorageRulesOptions) => Middleware<Context, Context>;
 declare const VERSION = "0.0.0";
-export { type ActionBuilder, type ActionCtx, type AggregateIndexDefinition, type AggregateIndexOptions, type AggregateOp, type ArgsValidator, type Component, type ComponentFunctions, type CreateOptions, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, type DataModelInit, type DefineComponentOptions, type DefineIdentityOptions, type DefineListArgsConfig, type DefinePluginOptions, type DefinePolicyInput, type DefinePresenceOptions, type DefineStorageRuleInput, type DurableObjectJurisdiction, type EmptyArgs, type EnvAccessor, type EnvKeyFailure, type EnvShape, type ExposeConfig, type ExtendableSchema, type FacadeEntry, type FacadeWriterLike, type FunctionKind, type HttpActionCtx, type HttpActionHandler, type HttpMethod, type HttpRoute, type HttpRouteBuilder, type HttpRouteFactory, type HttpRouteHandlerOptions, type HttpStreamHandlerOptions, type IdentityContract, type IdentityRejectMode, type IdentityValidation, type InferArgs, type InferEnv, type InferIdentity, type InlineAggregateIndexOptions, type InlineRankIndexOptions, type InternalActionBuilder, type InternalMutationBuilder, type InternalQueryBuilder, type LifecycleEvent, type LifecycleHandler, type ListArgsSpec, type ListArgsValidators, type ListArgsValue, type ListFilterOperators, type ListOrderByEntry, type ListWhere, type LunoraBuilders, LunoraEnvError, LunoraError, type LunoraHttpApp, type LunoraHttpEnv, type LunoraRouteHandler, type ManyRelation, type MaskColumns, type MaskContext, type MaskFn, type MaskOptions, type MaskPolicies, type MaskStrategy, type Middleware, type MiddlewareNext, type MigrationDefinition, type MigrationDocument, type MigrationTransform, type MutationBuilder, type MutationCtx, type MutatorDefinition, type OnDeleteAction, type OneRelation, type OrmLike, DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, type Permission, type Plugin, type Policy, type PrefixedTables, type PresenceComponent, type PresenceFunctions, type PresenceMember, type ProtectPublicOptions, type QueryBuilder, type QueryCtx, type RankIndexDefinition, type RankIndexOptions, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMigration, type RegisteredMutation, type RegisteredMutator, type RegisteredQuery, type RegisteredShape, type RegisteredStream, type RelationBuilder, type RelationDefinition, type RlsOptions, type RlsReadRegistry, type Role, type Schema, type SchemaExtension, type ShapeDefinition, type ShapeReadWhereRequest, type StorageOperation, type StorageRule, type StorageRuleContext, type StorageRuleDecision, type StorageRulesOptions, type TableBuilder, type TableDefinition, type TerminalKind, type TriggerBuilder, type TriggerDefinition, type TypedDefinePolicyInput, VERSION, type VectorEmbedder, type VectorIndexDefinition, type VectorIndexOptions, type VectorMetric, type VectorizeOptions, type WhereInput, allowAll, asBucketStorage, bindOrm, bindTableFacade, buildRlsReadRegistry, clampLimit, composePluginMiddleware, composeShapeReadWhere, createPolicyDsl, createSecrets, defineAggregateIndex, defineComponent, defineEnv, defineIdentity, defineListArgs, defineMigration, defineMutator, definePermission, definePlugin, definePolicies, definePolicy, definePresence, defineRankIndex, defineRole, defineSchema, defineSchemaExtension, defineShape, defineStorageRule, defineStorageRules, defineTable, defineVectorIndex, deny, httpAction, httpRoute, httpRouter, initLunora, installPlugins, isDeny, isSafeHeaderValue, mask, mergeSchemaExtension, onConnect, onDisconnect, presenceExtension, protectPublic, redactSecrets, rls, serveStorageObject, storageRules, toWhereInput };
+export { type ActionBuilder, type ActionCtx, type AggregateIndexDefinition, type AggregateIndexOptions, type AggregateOp, type ArgsValidator, type Component, type ComponentFunctions, type CreateOptions, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, type DataModelInit, type DefineComponentOptions, type DefineIdentityOptions, type DefineListArgsConfig, type DefinePluginOptions, type DefinePolicyInput, type DefinePresenceOptions, type DefineStorageRuleInput, type DurableObjectJurisdiction, type EmptyArgs, type EnvAccessor, type EnvKeyFailure, type EnvShape, type ExposeConfig, type ExtendableSchema, type FacadeEntry, type FacadeWriterLike, type FunctionKind, type HttpActionCtx, type HttpActionHandler, type HttpMethod, type HttpRoute, type HttpRouteBuilder, type HttpRouteFactory, type HttpRouteHandlerOptions, type HttpStreamHandlerOptions, type IdentityContract, type IdentityRejectMode, type IdentityValidation, type IndexFieldsByTable, type InferArgs, type InferEnv, type InferIdentity, type InlineAggregateIndexOptions, type InlineRankIndexOptions, type InternalActionBuilder, type InternalMutationBuilder, type InternalQueryBuilder, type LifecycleEvent, type LifecycleHandler, type ListArgsSpec, type ListArgsValidators, type ListArgsValue, type ListFilterOperators, type ListOrderByEntry, type ListWhere, type LunoraBuilders, LunoraEnvError, LunoraError, type LunoraHttpApp, type LunoraHttpEnv, type LunoraRouteHandler, type ManyRelation, type MaskColumns, type MaskContext, type MaskFn, type MaskOptions, type MaskPolicies, type MaskRegistry, type MaskStrategy, type Middleware, type MiddlewareNext, type MigrationCtx, type MigrationDefinition, type MigrationDocument, type MigrationReader, type MigrationTransform, type MutationBuilder, type MutationCtx, type MutatorDefinition, type OnDeleteAction, type OneRelation, type OrmLike, DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, type Permission, type Plugin, type Policy, type PrefixedTables, type PresenceComponent, type PresenceFunctions, type PresenceMember, type ProtectPublicOptions, type QueryBuilder, type QueryCtx, type RankIndexDefinition, type RankIndexOptions, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMigration, type RegisteredMutation, type RegisteredMutator, type RegisteredQuery, type RegisteredShape, type RegisteredStream, type RelationBuilder, type RelationDefinition, type RlsOptions, type RlsReadRegistry, type Role, type Schema, type SchemaExtension, type ShapeDefinition, type ShapeReadWhereRequest, type StorageOperation, type StorageRule, type StorageRuleContext, type StorageRuleDecision, type StorageRulesOptions, type TableBuilder, type TableDefinition, type TerminalKind, type TriggerBuilder, type TriggerDefinition, type TypedDefinePolicyInput, VERSION, type VectorEmbedder, type VectorIndexDefinition, type VectorIndexOptions, type VectorMetric, type VectorizeOptions, type WhereInput, allowAll, asBucketStorage, bindOrm, bindTableFacade, buildMaskRegistry, buildRlsReadRegistry, clampLimit, composePluginMiddleware, composeShapeReadWhere, createPolicyDsl, createSecrets, defineAggregateIndex, defineComponent, defineEnv, defineIdentity, defineListArgs, defineMigration, defineMutator, definePermission, definePlugin, definePolicies, definePolicy, definePresence, defineRankIndex, defineRole, defineSchema, defineSchemaExtension, defineShape, defineStorageRule, defineStorageRules, defineTable, defineVectorIndex, deny, httpAction, httpRoute, httpRouter, indexFieldsFromSchema, initLunora, installPlugins, isDeny, isSafeHeaderValue, mask, mergeSchemaExtension, onConnect, onDisconnect, presenceExtension, protectPublic, redactSecrets, rls, serveStorageObject, storageRules, toWhereInput };