@lunora/server 1.0.0-alpha.56 → 1.0.0-alpha.57

package/dist/index.d.mts

@@ -980,860 +980,986 @@ declare const clampLimit: (limit: number | undefined, fallback: number, maxLimit
  */
 declare const defineListArgs: <TDocument>() => <F extends ListFilterShape<TDocument>, O extends keyof TDocument & string>(config: DefineListArgsConfig<F, O>) => ListArgsSpec<TDocument, F, O>;
 /**
- * Context handed to a {@link MaskFn} (and to {@link MaskOptions.bypass}). The
- * `auth` shape mirrors RLS's `PolicyContext.auth` one-for-one — same identity
- * resolver, same `can(...)` permission check — so an author can branch a mask
- * on the caller's role/permission. `row` is the full pre-mask row the column
- * belongs to; `column` is the column currently being masked. Both are absent
- * when the context is used for the procedure-wide `bypass` check (no specific
- * cell is in play yet).
- */
-interface MaskContext<Context = unknown> {
-  readonly auth: {
-    /** `true` when any of the request's `roles` grants `permission` (see {@link MaskOptions.roles}). Fails closed for unregistered roles. */
-    readonly can: (permission: Permission | string) => boolean;
-    readonly identity?: Record<string, unknown> | null;
-    readonly roles: ReadonlyArray<string>;
-    readonly userId: null | string;
-  };
-  /** The column currently being masked. Present only inside a per-cell {@link MaskFn}. */
-  readonly column?: string;
-  readonly ctx: Context;
-  /** The full pre-mask row the masked cell belongs to. Present only inside a per-cell {@link MaskFn}. */
-  readonly row?: Record<string, unknown>;
+ * Structural mirrors of `@lunora/shard-engine`'s rank-page-row shapes
+ * (`RankPageRowKey` / `RankPageRow` / `ShardRankPageResult`) — the return type
+ * of the writer's `rankPageRows` seam, the cross-shard companion to
+ * `rankPage`.
+ *
+ * Shared by `../rls/middleware` and `../mask/middleware`: both wrap
+ * `rankPageRows` structurally (no `@lunora/shard-engine` import, mirroring how
+ * every other method on their `DatabaseWriterLike`/`MaskDatabase` projections
+ * is hand-mirrored rather than imported) and both need the exact same result
+ * shape to type their overrides. A single copy here means the two wrappers
+ * can't drift out of lockstep with each other — see AGENTS.md's platform
+ * parity note on `ShardSqlExec` and the canonical binding `*Like` projections
+ * shipping wrong for exactly this reason (two hand-maintained mirrors of one
+ * upstream type).
+ */
+/** Structural mirror of `@lunora/shard-engine`'s `RankPageRowKey`. */
+interface RankPageRowKeyLike {
+  partitionKey: string;
+  rowId: string;
+  sortValues: ReadonlyArray<unknown>;
+}
+/** Structural mirror of `@lunora/shard-engine`'s `RankPageRow`. */
+interface RankPageRowLike {
+  doc: Record<string, unknown>;
+  key: RankPageRowKeyLike;
+}
+/** Structural mirror of `@lunora/shard-engine`'s `ShardRankPageResult` — the `rankPageRows` return shape. */
+interface ShardRankPageResultLike {
+  directions: ReadonlyArray<"asc" | "desc">;
+  hasMore: boolean;
+  rows: ReadonlyArray<RankPageRowLike>;
 }
 /**
- * A custom masking function. Receives the raw cell value and the
- * {@link MaskContext}, returns the value to surface. Use it for partial masks
- * (`maskMiddle(phone)`), role-aware reveals (`ctx.auth.can(...) ? value : null`),
- * or format-preserving tokens. A function that **throws** fails closed — the
- * cell is redacted to `null`, never leaked raw.
+ * The prefixed tables a single plugin `P` contributes, or an empty map when it
+ * ships no schema extension. Mirrors {@link PrefixedTables} at the plugin level
+ * so {@link InstalledTables} can fold a tuple of plugins.
  */
-type MaskFn<Context = unknown> = (value: unknown, context: MaskContext<Context>) => unknown;
+type ExtensionTablesOf<P> = P extends {
+  readonly extension: SchemaExtension<infer X> & {
+    readonly key: infer K;
+  };
+} ? K extends string ? PrefixedTables<X, K> : Record<never, never> : Record<never, never>;
 /**
- * How a column is masked:
- *
- * - `"redact"` — drop the value to `null`. The simplest, safest strategy, and
- * the right choice for any value that must actually be kept secret.
- * - `"hash"` — replace with a stable token (unsalted 32-bit FNV-1a hex) so the
- * same input always yields the same token (joinable/groupable client-side).
- * **This is NOT a confidentiality control.** It is a non-cryptographic,
- * unsalted, deterministic, narrow (~2^32) digest: low-entropy values (emails,
- * phone numbers, SSNs) are brute-force-recoverable by the very caller you are
- * masking from, and identical values always produce identical tokens across
- * rows/columns/tenants (enabling correlation). Use `"hash"` ONLY when you want a
- * stable pseudonym for grouping/joining and leaking the value is acceptable —
- * never to hide sensitive PII. For PII that must stay hidden, use `"redact"`.
- * - a {@link MaskFn} — author-defined transform (partial mask, role-aware reveal).
+ * Fold a tuple of plugins onto a base table map `T`, accumulating each plugin's
+ * auto-prefixed extension tables left-to-right — the type-level mirror of
+ * {@link installPlugins} applying `mergeSchemaExtension` for each plugin in turn.
  */
-type MaskStrategy<Context = unknown> = "hash" | "redact" | MaskFn<Context>;
-/** Per-column strategy map for one table: `{ email: "redact", phone: maskMiddle }`. */
-type MaskColumns<Context = unknown> = Record<string, MaskStrategy<Context>>;
+type InstalledTables<T extends Record<string, TableDefinition>, Plugins extends ReadonlyArray<unknown>> = Plugins extends readonly [infer Head, ...infer Rest] ? InstalledTables<ExtensionTablesOf<Head> & T, Rest> : T;
 /**
- * The mask declaration passed to `mask(...)`: a table → column → strategy map.
- * Deliberately a plain object literal so the codegen feeder can statically read
- * which columns a procedure masks (powering the `mask_uncovered_pii_column`
- * advisor lint), exactly as the RLS feeder reads policy tables.
+ * Union every plugin's `ContextOut` in a tuple — the type-level mirror of the
+ * `ctx.api.&lt;key>` additions {@link composePluginMiddleware} accumulates as each
+ * plugin middleware runs. Independent of the incoming context, which the builder
+ * infers at the `.use(...)` site.
  */
-type MaskPolicies<Context = unknown> = Record<string, MaskColumns<Context>>;
+type ComposedOut<Plugins extends ReadonlyArray<unknown>> = Plugins extends readonly [infer Head, ...infer Rest] ? ComposedOut<Rest> & (Head extends Plugin<any, any, infer Out> ? Out : unknown) : unknown;
 /**
- * Options for `mask(policies, options)`.
- *
- * - `roles` registers the role→permission grants that back `ctx.auth.can(...)`
- * inside a {@link MaskFn} — identical to `rls(policies, { roles })`. A role
- * not listed grants no permissions (fails closed for unknown roles).
- * - `bypass` is a procedure-wide escape hatch: when it returns `true` the whole
- * mask is skipped (the caller sees raw values). Use it for a privileged
- * viewer — `bypass: ({ auth }) => auth.can("pii:view")`. Prefer this over
- * branching every column when an entire class of caller should see clear data.
+ * Schema fragment a plugin contributes. Same shape as the `tables` map
+ * passed to `defineSchema`. Optional `vectorIndexes` mirror the top-level
+ * `defineSchema` argument so a plugin can ship vector decls alongside its
+ * tables.
  */
-interface MaskOptions<Context = unknown> {
-  readonly bypass?: (context: MaskContext<Context>) => boolean;
-  readonly roles?: ReadonlyArray<Role>;
-}
-interface QueryPage$1 {
-  continueCursor: null | string;
-  isDone: boolean;
-  page: Record<string, unknown>[];
+interface SchemaExtension<T extends Record<string, TableDefinition> = Record<string, TableDefinition>> {
+  /** Stable key identifying the plugin that owns this extension. */
+  readonly key: string;
+  /**
+   * Extension tables, keyed by **bare** name (e.g. `buckets`). At merge time
+   * each is auto-prefixed with `key` (`ratelimit_buckets`) so it can't
+   * collide with an app table; do **not** namespace manually.
+   */
+  readonly tables: T;
+  /**
+   * Optional standalone vector indexes the plugin ships, keyed by index
+   * name. Merged into the host schema's `vectorIndexes`; a key collision
+   * with the base schema is a hard error (same policy as tables).
+   */
+  readonly vectorIndexes?: Record<string, VectorIndexDefinition>;
 }
-interface QueryArgs$1 {
-  baseWhere?: unknown;
-  cursor?: null | string;
-  limit?: number;
-  orderBy?: ReadonlyArray<Record<string, unknown>>;
-  where?: unknown;
-  with?: Record<string, unknown>;
+/**
+ * Build a {@link SchemaExtension}. The `key` is a runtime tag (used for
+ * error messages on collision) and a type-level brand.
+ */
+declare const defineSchemaExtension: <T extends Record<string, TableDefinition>>(key: string, options: {
+  tables: T;
+  vectorIndexes?: Record<string, VectorIndexDefinition>;
+}) => SchemaExtension<T>;
+/**
+ * A plugin packages an optional schema extension and optional middleware.
+ * Both are independently usable: an app can install only the schema (e.g.
+ * for plugins that ship background workers but no per-request behavior)
+ * or only the middleware (plugins that augment ctx without persistent
+ * state).
+ */
+interface Plugin<TExtension extends Record<string, TableDefinition> = Record<string, TableDefinition>, TContextIn = unknown, TContextOut = TContextIn> {
+  /**
+   * Optional schema extension. Apps install via
+   * `defineSchema(...).extend(plugin.extension)`.
+   */
+  readonly extension?: SchemaExtension<TExtension>;
+  /** Stable key identifying the plugin. Matches `extension.key` when set. */
+  readonly key: string;
+  /**
+   * Optional middleware. Users attach with `c.query.use(plugin.middleware)`.
+   * The middleware can extend `ctx`; convention is to attach helpers under
+   * `ctx.api.&lt;key>`, e.g.
+   *
+   * ```ts
+   * middleware: ({ ctx, next }) =>
+   *     next({ ctx: { api: { ...ctx.api, ratelimit: api } } })
+   * ```
+   */
+  readonly middleware?: Middleware<TContextIn, TContextOut>;
 }
-interface AggregateArgs$1 {
-  field?: string;
-  op: string;
-  where?: unknown;
+/** Options to {@link definePlugin}. */
+interface DefinePluginOptions<TExtension extends Record<string, TableDefinition>, TContextIn, TContextOut> {
+  extension?: SchemaExtension<TExtension>;
+  middleware?: Middleware<TContextIn, TContextOut>;
 }
-interface GroupByArgs$1 {
-  agg?: {
-    field?: string;
-    op: string;
+/**
+ * Call signatures for {@link definePlugin}. When `extension` is supplied the
+ * returned plugin's `extension` is typed as PRESENT (not `?`), so the
+ * canonical install pattern `defineSchema(...).extend(plugin.extension)`
+ * typechecks without a non-null assertion — the shape every scaffold template
+ * ships. The bare-options signature keeps `extension` optional for plugins
+ * that carry only middleware.
+ */
+interface DefinePluginFunction {
+  <TExtension extends Record<string, TableDefinition>, TContextIn = unknown, TContextOut = TContextIn>(key: string, options: DefinePluginOptions<TExtension, TContextIn, TContextOut> & {
+    extension: SchemaExtension<TExtension>;
+  }): Plugin<TExtension, TContextIn, TContextOut> & {
+    readonly extension: SchemaExtension<TExtension>;
   };
-  by: ReadonlyArray<string>;
-  where?: unknown;
+  <TExtension extends Record<string, TableDefinition>, TContextIn = unknown, TContextOut = TContextIn>(key: string, options: DefinePluginOptions<TExtension, TContextIn, TContextOut>): Plugin<TExtension, TContextIn, TContextOut>;
 }
-interface TableReaderLike$1 {
-  collect: () => Promise<Record<string, unknown>[]>;
-  filter: (predicate: (document: Record<string, unknown>) => boolean) => TableReaderLike$1;
-  first: () => Promise<Record<string, unknown> | null>;
-  order: (direction: "asc" | "desc") => TableReaderLike$1;
-  paginate: (options: {
-    cursor?: null | string;
-    numItems: number;
-  }) => Promise<QueryPage$1>;
-  take: (limit: number) => Promise<Record<string, unknown>[]>;
-  unique: () => Promise<Record<string, unknown> | null>;
-  withGeoIndex: (indexName: string, build: (q: unknown) => unknown) => TableReaderLike$1;
-  withIndex: (indexName: string, range?: (q: unknown) => unknown) => TableReaderLike$1;
-  withSearchIndex: (indexName: string, search: (q: unknown) => unknown) => TableReaderLike$1;
+/**
+ * Package a schema extension + middleware as a reusable plugin. Either
+ * field is optional — `definePlugin("foo", {})` is valid but degenerate.
+ */
+declare const definePlugin: DefinePluginFunction;
+/**
+ * Bundle of registered functions a {@link Component} ships. Keys are the
+ * function's local name (e.g. `check`, `reset`); the registered function
+ * value carries its own kind / args / handler.
+ *
+ * Users re-export from their own lunora module so codegen picks them up:
+ *
+ * ```ts
+ * // lunora/ratelimit.ts
+ * import { ratelimit } from "@vendor/ratelimit-component";
+ * export const { check, reset } = ratelimit.functions;
+ * // Emits as `ratelimit:check` / `ratelimit:reset` in the generated `api`.
+ * ```
+ *
+ * Codegen follows the re-export back to the bundled `query/mutation/action`
+ * call (property access or destructuring both work), so the functions land in
+ * the generated `api` under the re-exporting file's namespace.
+ */
+type ComponentFunctions = Readonly<Record<string, RegisteredFunction<any, any, FunctionKind>>>;
+/**
+ * Component = {@link Plugin} with a bundle of registered functions. The
+ * extension + middleware + functions are independent: a component can ship
+ * functions without a schema (e.g. a stateless utility), or a schema
+ * without functions (e.g. shared table definitions), and any combination.
+ */
+interface Component<TExtension extends Record<string, TableDefinition> = Record<string, TableDefinition>, TContextIn = unknown, TContextOut = TContextIn, F extends ComponentFunctions = ComponentFunctions> extends Plugin<TExtension, TContextIn, TContextOut> {
+  readonly functions: F;
+}
+interface DefineComponentOptions<TExtension extends Record<string, TableDefinition>, TContextIn, TContextOut, F extends ComponentFunctions> extends DefinePluginOptions<TExtension, TContextIn, TContextOut> {
+  /** Registered functions the component ships. Keys are the function's local name. */
+  functions?: F;
 }
 /**
- * Structural projection of the runtime ORM writer — the same subset
- * `../rls/middleware` mirrors, so the wrapper is interchangeable between
- * `@lunora/do`'s and `@lunora/d1`'s `DatabaseWriterLike` without an
- * inter-package dependency. `rankBefore` is optional (the D1 twin omits it).
+ * Convenience wrapper around {@link definePlugin} that also bundles a set
+ * of registered functions. The resulting `component.functions` object is a
+ * record of `name → registered query/mutation/action`; consumers
+ * re-export entries so codegen discovers them as user functions:
+ *
+ * ```ts
+ * export const ratelimit = defineComponent("ratelimit", {
+ *     // Bare `buckets` merges in as `ratelimit_buckets`.
+ *     extension: defineSchemaExtension("ratelimit", { tables: { buckets } }),
+ *     middleware: ({ ctx, next }) => next({ ctx: { ...ctx, ratelimit: api(ctx) } }),
+ *     functions: {
+ *         check: query.input({ key: v.string() }).query(async ({ ctx, args }) => ...),
+ *         reset: mutation.input({ key: v.string() }).mutation(async ({ ctx, args }) => ...),
+ *     },
+ * });
+ * ```
+ *
+ * Re-exporting an entry (by property access or destructuring) is enough for
+ * codegen to discover it in the host app's namespace — the discovery resolver
+ * chases the re-export back to the bundled registration call.
  */
-interface MaskDatabase {
-  aggregate: (tableName: string, options: AggregateArgs$1) => Promise<null | number>;
-  count: (tableName: string, whereOrArgs?: unknown) => Promise<number>;
-  delete: (id: string, expectedTable?: string) => Promise<void>;
-  deleteMany: (ids: ReadonlyArray<string>, options?: {
-    limit?: number;
-  }) => Promise<{
-    deleted: number;
-  }>;
-  deleteWhere?: (tableName: string, where: Record<string, unknown>, options?: {
-    limit?: number;
-  }) => Promise<{
-    deleted: number;
-  }>;
-  findFirst: (tableName: string, args?: QueryArgs$1) => Promise<Record<string, unknown> | null>;
-  findFirstOrThrow: (tableName: string, args?: QueryArgs$1) => Promise<Record<string, unknown>>;
-  findMany: (tableName: string, args?: QueryArgs$1) => Promise<QueryPage$1>;
-  get: (id: string, expectedTable?: string) => Promise<Record<string, unknown> | null>;
-  groupBy: (tableName: string, options: GroupByArgs$1) => Promise<ReadonlyArray<{
-    key: Record<string, unknown>;
-    value: null | number;
-  }>>;
-  insert: (tableName: string, document: Record<string, unknown>) => Promise<string>;
-  insertMany: (tableName: string, documents: ReadonlyArray<Record<string, unknown>>, options?: {
-    limit?: number;
-    skipDuplicates?: boolean;
-  }) => Promise<(string | null)[]>;
-  lookupById?: (id: string, expectedTable?: string) => Promise<null | {
-    row: Record<string, unknown>;
-    tableName: string;
-  }>;
-  patch: (id: string, patch: Record<string, unknown>, expectedTable?: string) => Promise<void>;
-  patchMany: (patches: ReadonlyArray<{
-    id: string;
-    patch: Record<string, unknown>;
-  }>, options?: {
-    limit?: number;
-  }) => Promise<{
-    patched: number;
-  }>;
-  patchWhere?: (tableName: string, args: {
-    patch: Record<string, unknown>;
-    where: Record<string, unknown>;
-  }, options?: {
-    limit?: number;
-  }) => Promise<{
-    patched: number;
-  }>;
-  query: (tableName: string) => TableReaderLike$1;
-  rank: (tableName: string, indexName: string, options: unknown) => Promise<null | {
-    position: number;
-    total: number;
-  }>;
-  rankBefore?: (tableName: string, indexName: string, options: unknown) => Promise<{
-    before: number;
-    total: number;
-  }>;
-  rankPage: (tableName: string, indexName: string, options?: unknown) => Promise<QueryPage$1>;
-  replace: (id: string, document: Record<string, unknown>, expectedTable?: string) => Promise<void>;
-}
-/** Roles list source on the context. Tolerant of older auth states (mirrors RLS's `AuthLike`). */
-type AuthLike$1 = {
-  getIdentity?: () => Promise<Record<string, unknown> | null>;
-  roles?: ReadonlyArray<string>;
-  userId?: null | string;
-};
-interface MaskContextIn {
-  auth?: AuthLike$1;
-  db: MaskDatabase;
-}
+declare const defineComponent: <TExtension extends Record<string, TableDefinition>, TContextIn = unknown, TContextOut = TContextIn, F extends ComponentFunctions = ComponentFunctions>(key: string, options: DefineComponentOptions<TExtension, TContextIn, TContextOut, F>) => Component<TExtension, TContextIn, TContextOut, F>;
 /**
- * Procedure-builder middleware. Apply per-request via `.use(mask(policies))`.
- * Closes over the policy map at builder-construction time; resolves identity +
- * the `bypass` decision per call against the live ctx.
- *
- * IMPORTANT: a mask is in scope only for procedures whose builder chain
- * includes this middleware — opt-in, never global (the same invariant as RLS).
+ * Map every key `K` of an extension's table map `X` to its auto-prefixed name
+ * `${Key}_${K}`. Mirrors the runtime prefixing in {@link mergeSchemaExtension}
+ * so the typed `.extend(...)` chain reflects the real merged table names.
  */
-declare const mask: <Context extends MaskContextIn = MaskContextIn>(policies: MaskPolicies<Context>, options?: MaskOptions<Context>) => Middleware<Context, Context>;
-/** A document handed to a migration transform: the stored row including `_id`/`_creationTime`. */
-type MigrationDocument = Record<string, unknown>;
+type PrefixedTables<X extends Record<string, TableDefinition>, Key extends string> = { [K in keyof X as K extends string ? `${Key}_${K}` : K]: X[K]; };
 /**
- * The read surface a transform reaches through its `ctx`.
+ * Merge a {@link SchemaExtension} into an existing schema. Returns a new
+ * schema object — never mutates the input.
  *
- * Read-only by design: the runner accounts for exactly one rewrite per row read,
- * and a transform writing directly would make that count describe something
- * other than what happened. Scoped to the shard the runner is walking.
+ * Extension tables are auto-namespaced: each bare table name is prefixed with
+ * the extension `key` (`buckets` → `ratelimit_buckets`), Convex-Components
+ * style, and every intra-extension reference (relation targets, aggregate /
+ * rank index `on`, standalone vector index `table`) is rewritten to match.
+ * References to base/app tables are left untouched.
+ *
+ * Because each extension lives in its own `key` namespace, app↔component
+ * collisions are impossible. The only remaining hard error is two extensions
+ * sharing the same `key` and producing the same prefixed table (or vector
+ * index) name — silent shadow would let one plugin hijack another's data.
+ *
+ * Re-runs {@link validateIndexFields} against the merged table set before
+ * returning: `defineSchema` only validates the tables it was called with, so
+ * without this an extension-contributed index with a typo'd/out-of-shape
+ * field (or a duplicate name within one kind) would never be checked at all.
+ * Re-validating the whole merged set (base + prefixed extension tables) is
+ * cheap and idempotent for the base tables, which already passed this same
+ * check when the base schema was built. Both callers of this function —
+ * `withExtend.extend()` (`./schema`) and `installPlugins` (below) — get the
+ * re-validation for free from this single call site (plan 258 §4/§9 Q3).
  */
-interface MigrationReader {
-  count: (table: string, where?: Record<string, unknown>) => Promise<number>;
-  findFirst: (table: string, args?: Record<string, unknown>) => Promise<MigrationDocument | null>;
-  findMany: (table: string, args?: Record<string, unknown>) => Promise<{
-    isDone: boolean;
-    page: MigrationDocument[];
-  }>;
-  get: (id: string, expectedTable?: string) => Promise<MigrationDocument | null>;
-}
-/** The context handed to a transform alongside the row. */
-interface MigrationCtx {
-  db: MigrationReader;
-}
+declare const mergeSchemaExtension: <T extends Record<string, TableDefinition>, X extends Record<string, TableDefinition>, Key extends string = string>(base: Schema<T>, extension: SchemaExtension<X> & {
+  readonly key: Key;
+}) => Schema<PrefixedTables<X, Key> & T>;
 /**
- * Transform applied to one document. Return a new document to rewrite the row,
- * or `undefined` to leave it untouched (skipped, not counted as changed). The
- * runner always preserves the original `_id` and `_creationTime`, so the
- * returned document neither needs to nor should change row identity.
+ * Install several plugins' schema extensions in one call — the one-shot
+ * counterpart to chaining `defineSchema(...).extend(a).extend(b)`. Plugins
+ * without an `extension` (middleware-only) are skipped; tables from those that
+ * do are auto-prefixed and reference-rewritten exactly as
+ * {@link mergeSchemaExtension} does for a single `.extend(...)`.
  *
- * The second parameter carries a shard-scoped reader. Without it a transform
- * could only rewrite the row it was handed — enough for a backfill whose new
- * value is a pure function of the old row (`displayName = name ?? "Anonymous"`),
- * but not for the shape people actually write: read the parent, copy a field
- * down onto its children.
+ * ```ts
+ * const schema = installPlugins(defineSchema({ todos }), [ratelimit, audit]);
+ * // → todos + ratelimit_* + audit_*
+ * ```
  *
- * May return a promise, since a cross-table read is asynchronous.
+ * Pair it with {@link composePluginMiddleware} to attach every plugin's
+ * middleware in a single `.use(...)`, so installing N plugins is two calls
+ * rather than N `.extend(...)` + N `.use(...)`.
+ */
+declare const installPlugins: <T extends Record<string, TableDefinition>, const Plugins extends ReadonlyArray<Plugin<any, any, any>>>(base: Schema<T>, plugins: Plugins) => Schema<InstalledTables<T, Plugins>>;
+/**
+ * Compose every plugin's middleware into a single middleware you attach with one
+ * `.use(...)`. Plugins without middleware (schema-only) are skipped; the rest run
+ * in array order, each seeing the context the previous one widened, so the final
+ * `next({ ctx })` the builder receives carries every plugin's `ctx.api.&lt;key>`
+ * additions. Equivalent to `.use(a.middleware).use(b.middleware)…` but as one
+ * value, the middleware sibling of {@link installPlugins}.
  *
- * **A shard key cannot be backfilled this way, even with a reader.** A row whose
- * shard-key field is unset does not belong to any shard, so a shard-scoped query
- * will not enumerate it; and writing the key would have to MOVE the row to a
- * different Durable Object, which a per-shard runner cannot do. Re-keying is an
- * export → transform → import, not a migration.
+ * `ContextIn` is left free so the builder infers it from the context at the
+ * `.use(...)` site; the result type widens it by the union of the plugins'
+ * outputs.
  */
-type MigrationTransform = (document: MigrationDocument, ctx: MigrationCtx) => MigrationDocument | Promise<MigrationDocument | undefined | void> | undefined | void;
-interface MigrationDefinition {
-  /** Rows fetched and rewritten per batch. Defaults to the runner's batch size when omitted. */
-  readonly batchSize?: number;
-  /** Optional reverse transform, applied by `migrate down`. */
-  readonly down?: MigrationTransform;
-  /** Stable, unique identifier — the key per-shard run-state is tracked under. */
-  readonly id: string;
-  /** Table whose documents this migration iterates. */
-  readonly table: string;
-  /** Forward transform, applied to every row by `migrate up`. */
-  readonly up: MigrationTransform;
+declare const composePluginMiddleware: <ContextIn = unknown, const Plugins extends ReadonlyArray<Plugin<any, any, any>> = ReadonlyArray<Plugin<any, any, any>>>(plugins: Plugins) => Middleware<ContextIn, ComposedOut<Plugins> & ContextIn>;
+/** Options for `.vectorize(field, opts)` (DSL Shape A). */
+interface VectorizeOptions<Shape extends Record<string, Validator> = Record<string, Validator>> {
+  dimensions: number;
+  embed: VectorEmbedder;
+  /** Logical index name; must match a `[[vectorize]]` binding in wrangler. */
+  index: string;
+  /** Fields mirrored into Vectorize metadata for filtering. */
+  metadata?: ReadonlyArray<keyof Shape & string>;
+  metric: VectorMetric;
 }
-/** A {@link MigrationDefinition} plus the codegen discovery marker. */
-interface RegisteredMigration extends MigrationDefinition {
-  readonly __lunoraMigration: true;
+/** A `one` (many-to-one) relation descriptor; phantom `Target` carries the target table name. */
+interface OneRelation<Target extends string = string> extends RelationDefinition {
+  readonly __target?: Target;
+  readonly kind: "one";
+}
+/** A `many` (one-to-many) relation descriptor; phantom `Target` carries the target table name. */
+interface ManyRelation<Target extends string = string> extends RelationDefinition {
+  readonly __target?: Target;
+  readonly kind: "many";
+}
+/** The `r` argument passed to `.relations((r) => …)`. */
+interface RelationBuilder {
+  /** One-to-many: the FK `field` lives on the target table, matching this table's `references` (default `_id`). */
+  many: <Target extends string>(table: Target, options: {
+    field: string;
+    references?: string;
+  }) => ManyRelation<Target>;
+  /** Many-to-one: the FK `field` lives on this table, pointing at `table`.`references` (default `_id`). */
+  one: <Target extends string>(table: Target, options: {
+    field: string;
+    onDelete?: OnDeleteAction;
+    references?: string;
+  }) => OneRelation<Target>;
 }
-/** Declare an online data migration. See the module docs for runtime semantics. */
-declare const defineMigration: (definition: MigrationDefinition) => RegisteredMigration;
 /**
- * A mutator declaration. `server` is authoritative; `client` is the optimistic
- * twin (optional — omit it to let the optimistic write fall through to the
- * server round-trip with no local preview). Both receive the same validated
- * `args`.
+ * Options for the inline `.aggregateIndex(name, opts)` builder. `op` defaults to
+ * `count` so `aggregateIndex("byUser", { by: ["userId"] })` is a single-line
+ * `COUNT(*) GROUP BY userId` accelerator.
  */
-interface MutatorDefinition<Args extends ValidatorMap = ValidatorMap, ServerContext = MutationCtx, ClientTx = unknown, R = unknown> {
+interface InlineAggregateIndexOptions<Shape extends Record<string, Validator> = Record<string, Validator>> {
+  /** Group keys; counter rows are one per distinct tuple. Omitted = single-row aggregate over the whole table. */
+  by?: ReadonlyArray<keyof Shape & string>;
+  /** The column the reducer applies to. Required for `sum`/`min`/`max`/`avg`; ignored for `count`. */
+  field?: keyof Shape & string;
+  /** Reducer (default `count`). */
+  op?: AggregateOp;
+  /** Static predicate baked into the counter — only matching rows are aggregated. */
+  where?: Record<string, unknown>;
+}
+/**
+ * Options for the inline `.rankIndex(name, opts)` builder. `sortBy` is required;
+ * accepts either an array of `{ field, direction }` keys, or the shorthand
+ * `["field"]` (asc) / `{ field: "desc" }` map entries. `partitionBy` scopes the
+ * rank — omitted ⇒ one global rank over the whole table.
+ */
+interface InlineRankIndexOptions<Shape extends Record<string, Validator> = Record<string, Validator>> {
+  /** Columns that scope each ranking; omitted ⇒ one global rank. */
+  partitionBy?: ReadonlyArray<keyof Shape & string>;
+  /** Ordered sort keys driving the rank. Required. */
+  sortBy: ReadonlyArray<{
+    direction?: "asc" | "desc";
+    field: keyof Shape & string;
+  }>;
+  /** Static predicate baked into the index; only matching rows enter. */
+  where?: Record<string, unknown>;
+}
+interface TableBuilder<Shape extends Record<string, Validator> = Record<string, Validator>> extends TableDefinition<Shape> {
+  /** Declare an aggregate (counter/sum/…) maintained by triggers for O(1) reads. */
+  aggregateIndex: (name: string, options?: InlineAggregateIndexOptions<Shape>) => TableBuilder<Shape>;
   /**
-   * Validator for the mutator's arguments. Validated on the DO before `server`
-   * runs and (when present) on the client before `client` runs, so both impls
-   * see the same parsed shape. Omit for a parameterless mutator.
+   * Mark this table as written outside Lunora's discoverable insert path —
+   * by an adapter, a migration, or framework middleware (e.g. `@lunora/auth`'s
+   * better-auth tables, `@lunora/ratelimit`'s store). Advisor insert-path lints
+   * (`table_without_insert`) then skip it instead of flagging the absent
+   * `ctx.db.insert(...)`.
    */
-  readonly args?: Args;
+  externallyManaged: () => TableBuilder<Shape>;
   /**
-   * Optimistic client implementation. Runs in a TanStack DB transaction
-   * against the local collections; its writes are applied immediately and
-   * automatically rolled back / rebased as the authoritative result syncs
-   * back. Pure and side-effect-free beyond the local store. Omit to skip the
-   * local preview.
-   */
-  readonly client?: (tx: ClientTx, args: InferValidatorMap<Args>) => Promise<void> | void;
+   * Declare a geospatial index over a `v.geoPoint()` column. The runtime keeps
+   * a geohash companion so `withGeoIndex(name, q => q.near(point, radius))` and
+   * `.within(bbox)` resolve as a geohash-prefix range scan + Haversine
+   * refine/sort. `options.precision` tunes the geohash length (default 9).
+   */
+  geoIndex: (name: string, options: {
+    field: keyof Shape & string;
+    precision?: number;
+  }) => TableBuilder<Shape>;
   /**
-   * Owner-scope the write: names the column carrying the row owner (e.g.
-   * `owner: "userId"`). Before `server` runs, the mutator requires a verified
-   * identity, rejects a client-supplied owner that disagrees with it, and sets
-   * the column to the verified value — so the impl reads `args[owner]` without
-   * trusting the client and never repeats the check by hand.
+   * Mark this table as global (cross-shard). Backed by **D1** by default;
+   * pass `{ backend: "hyperdrive" }` to store it in a Postgres/MySQL database
+   * via Cloudflare Hyperdrive (PlanetScale, Neon, …) instead. Either way the
+   * table stays reactive — live queries re-run on write.
+   */
+  global: (options?: {
+    backend?: GlobalBackend;
+  }) => TableBuilder<Shape>;
+  /** Add a secondary index. */
+  index: (name: string, fields: ReadonlyArray<(keyof Shape & string) | (typeof SYSTEM_INDEX_FIELDS)[number]>, options?: {
+    unique?: boolean;
+  }) => TableBuilder<Shape>;
+  /**
+   * Name the column holding the owning user's id, so "only the owner sees these
+   * rows" is declared once here rather than restated in every shape.
    *
-   * This replaces the "every mutator opens with `assertOwner(ctx, args.userId)`"
-   * pattern, and is the write-side counterpart to an `owner`-scoped
-   * {@link import("./shapes").ShapeDefinition}. Unlike a shape it takes the column
-   * NAME rather than `true`: a shape is bound to one `table`, so the table's
-   * `.ownedBy(field)` resolves unambiguously, whereas one mutator may write
-   * several tables and has no single owning table to read it from.
+   * A `defineShape({ table, owner: true })` over this table derives its predicate
+   * from the field: the subscriber's verified `ctx.auth.userId` must match, and an
+   * anonymous subscriber is denied. Pairs naturally with `.shardBy(field)` on the
+   * same column — the shard key routes the storage, `ownedBy` states who the rows
+   * belong to — but the two are independent and either can be used alone.
    *
-   * Declare the column `v.optional(...)` to leave it off the wire entirely; it is
-   * injected either way.
+   * This is a *shape* declaration, not an RLS policy: it narrows what a shape
+   * replicates. Guarding procedure reads/writes is still `rls(...)`'s job.
    */
-  readonly owner?: string;
+  ownedBy: (field: keyof Shape & string) => TableBuilder<Shape>;
   /**
-   * Authoritative server implementation. Runs inside the shard DO with a full
-   * {@link MutationContext} (`ctx.db` writer); its writes append to `__cdc_log`
-   * and poke back to subscribers. This is the source of truth — the client
-   * impl is only a prediction of it.
+   * Opt this table OUT of secure-by-default RLS. Under a schema marked
+   * `.rls("required")`, every table is protected (the write path denies raw,
+   * non-RLS `ctx.db` access); calling `.public()` exempts this one table so a
+   * plain `query`/`mutation` may read/write it without an RLS policy. No effect
+   * when the schema does not require RLS.
    */
-  readonly server: (context: ServerContext, args: InferValidatorMap<Args>) => Promise<R> | R;
-}
-/**
- * A {@link MutatorDefinition} plus the codegen discovery marker and a
- * dispatch-shaped `handler` (validates `args`, then runs `server`) so the DO
- * invokes a mutator exactly like a registered procedure.
- */
-interface RegisteredMutator<Args extends ValidatorMap = ValidatorMap, ServerContext = MutationCtx, ClientTx = unknown, R = unknown> extends MutatorDefinition<Args, ServerContext, ClientTx, R> {
-  readonly __lunoraMutator: true;
-  /** Validate `rawArgs`, then run the authoritative `server` impl. Used by the DO push path. */
-  readonly handler: (context: ServerContext, rawArgs: Record<string, unknown>) => Promise<R>;
+  public: () => TableBuilder<Shape>;
   /**
-   * Marks the dispatch kind so codegen can register the mutator in the same
-   * `LUNORA_FUNCTIONS` table queries/mutations use — the DO's `handleRpc`
-   * reads `kind === "mutation"` to wrap the authoritative `server` impl in the
-   * shard's BEGIN/COMMIT span (all-or-nothing writes), exactly like an
-   * ordinary `mutation`.
+   * Declare a rank index (sorted companion table, btree-backed) for
+   * `rank(row)` / `rankPage()` reads in O(log n). See {@link RankIndexDefinition}.
    */
-  readonly kind: "mutation";
-}
-/** Declare a custom mutator. See the module docs for runtime semantics. */
-declare const defineMutator: <Args extends ValidatorMap = ValidatorMap, ServerContext = MutationCtx, ClientTx = unknown, R = unknown>(definition: MutatorDefinition<Args, ServerContext, ClientTx, R>) => RegisteredMutator<Args, ServerContext, ClientTx, R>;
-/**
- * The prefixed tables a single plugin `P` contributes, or an empty map when it
- * ships no schema extension. Mirrors {@link PrefixedTables} at the plugin level
- * so {@link InstalledTables} can fold a tuple of plugins.
- */
-type ExtensionTablesOf<P> = P extends {
-  readonly extension: SchemaExtension<infer X> & {
-    readonly key: infer K;
-  };
-} ? K extends string ? PrefixedTables<X, K> : Record<never, never> : Record<never, never>;
-/**
- * Fold a tuple of plugins onto a base table map `T`, accumulating each plugin's
- * auto-prefixed extension tables left-to-right — the type-level mirror of
- * {@link installPlugins} applying `mergeSchemaExtension` for each plugin in turn.
- */
-type InstalledTables<T extends Record<string, TableDefinition>, Plugins extends ReadonlyArray<unknown>> = Plugins extends readonly [infer Head, ...infer Rest] ? InstalledTables<ExtensionTablesOf<Head> & T, Rest> : T;
-/**
- * Union every plugin's `ContextOut` in a tuple — the type-level mirror of the
- * `ctx.api.&lt;key>` additions {@link composePluginMiddleware} accumulates as each
- * plugin middleware runs. Independent of the incoming context, which the builder
- * infers at the `.use(...)` site.
- */
-type ComposedOut<Plugins extends ReadonlyArray<unknown>> = Plugins extends readonly [infer Head, ...infer Rest] ? ComposedOut<Rest> & (Head extends Plugin<any, any, infer Out> ? Out : unknown) : unknown;
-/**
- * Schema fragment a plugin contributes. Same shape as the `tables` map
- * passed to `defineSchema`. Optional `vectorIndexes` mirror the top-level
- * `defineSchema` argument so a plugin can ship vector decls alongside its
- * tables.
- */
-interface SchemaExtension<T extends Record<string, TableDefinition> = Record<string, TableDefinition>> {
-  /** Stable key identifying the plugin that owns this extension. */
-  readonly key: string;
+  rankIndex: (name: string, options: InlineRankIndexOptions<Shape>) => TableBuilder<Shape>;
+  /** Declare relations to other tables, loaded via `findMany({ with })`. */
+  relations: (build: (r: RelationBuilder) => Record<string, RelationDefinition>) => TableBuilder<Shape>;
   /**
-   * Extension tables, keyed by **bare** name (e.g. `buckets`). At merge time
-   * each is auto-prefixed with `key` (`ratelimit_buckets`) so it can't
-   * collide with an app table; do **not** namespace manually.
+   * Add a full-text search index over `field`, queried with
+   * `.withSearchIndex(name, q => q.search(field, term))`. `field` may be a
+   * dot-separated path into a nested object (`"properties.name"`).
+   * `filterFields` (at most 16) lists the columns `.eq()` may narrow by inside
+   * the search. `language` selects the text analysis (accent folding always,
+   * plus that language's stopwords). `staged: true` skips the migration-time
+   * backfill on a large existing table. `strategy: "native"` uses the engine's
+   * own full-text index where it has one (Postgres) — faster on large corpora,
+   * at the cost of the engine ranking rather than the shared scorer.
    */
-  readonly tables: T;
+  searchIndex: (name: string, options: {
+    field: string;
+    filterFields?: ReadonlyArray<string>;
+    language?: SearchLanguage;
+    staged?: boolean;
+    strategy?: SearchStrategy;
+  }) => TableBuilder<Shape>;
+  /** Route storage by the named field — one DO per distinct value. */
+  shardBy: (field: keyof Shape & string) => TableBuilder<Shape>;
   /**
-   * Optional standalone vector indexes the plugin ships, keyed by index
-   * name. Merged into the host schema's `vectorIndexes`; a key collision
-   * with the base schema is a hard error (same policy as tables).
+   * Turn on soft delete. Adds a nullable timestamp column (`options.field`,
+   * default `deletedAt`) and changes `ctx.db.&lt;table>.delete()` to **set** it
+   * instead of removing the row; `onDelete: "cascade"` children are recursively
+   * soft-deleted too. **List reads** (`findMany`/`findFirst`/`query()`/`count`/
+   * `aggregate`/relation loads) then hide soft-deleted rows unless they pass
+   * `includeDeleted: true`; by-id `get`/`patch`/`replace` and the new
+   * `restore()` still address the row directly. `hardDelete()` physically
+   * removes it (cascading as a real delete). Note: `includeDeleted` is a read
+   * scope, not access control — anyone who can run the read can set it; a unique
+   * index still rejects a new row that collides with a soft-deleted one (the row
+   * physically persists).
    */
-  readonly vectorIndexes?: Record<string, VectorIndexDefinition>;
-}
-/**
- * Build a {@link SchemaExtension}. The `key` is a runtime tag (used for
- * error messages on collision) and a type-level brand.
- */
-declare const defineSchemaExtension: <T extends Record<string, TableDefinition>>(key: string, options: {
-  tables: T;
-  vectorIndexes?: Record<string, VectorIndexDefinition>;
-}) => SchemaExtension<T>;
-/**
- * A plugin packages an optional schema extension and optional middleware.
- * Both are independently usable: an app can install only the schema (e.g.
- * for plugins that ship background workers but no per-request behavior)
- * or only the middleware (plugins that augment ctx without persistent
- * state).
- */
-interface Plugin<TExtension extends Record<string, TableDefinition> = Record<string, TableDefinition>, TContextIn = unknown, TContextOut = TContextIn> {
+  softDelete: (options?: {
+    field?: string;
+  }) => TableBuilder<Shape>;
   /**
-   * Optional schema extension. Apps install via
-   * `defineSchema(...).extend(plugin.extension)`.
+   * Materialize this table from an external Postgres/MySQL behind Cloudflare
+   * Hyperdrive (plan 077). A system-driven poll loop reads the tenant slice
+   * (`query`, with params bound from `tenantBy`) and lands it in the DO's SQLite,
+   * after which `defineShape` carries it to clients unchanged. Implies
+   * `.externallyManaged()` (rows come from the ingest loop, not user mutations).
+   *
+   * Orthogonal to `.shardBy()` — combine them for per-tenant DOs. **Under
+   * `.shardBy()` `tenantBy` is mandatory** (the tenant-isolation boundary); the
+   * `external_source_unscoped` advisor lint fails the build when it is absent, and
+   * `external_source_on_global` rejects combining `.source()` with `.global()`.
    */
-  readonly extension?: SchemaExtension<TExtension>;
-  /** Stable key identifying the plugin. Matches `extension.key` when set. */
-  readonly key: string;
+  source: (definition: ExternalSourceDefinition) => TableBuilder<Shape>;
+  /** Declare named lifecycle triggers fired inline within the write path. */
+  triggers: (build: (t: TriggerBuilder<Shape>) => Record<string, TriggerDefinition>) => TableBuilder<Shape>;
   /**
-   * Optional middleware. Users attach with `c.query.use(plugin.middleware)`.
-   * The middleware can extend `ctx`; convention is to attach helpers under
-   * `ctx.api.&lt;key>`, e.g.
-   *
-   * ```ts
-   * middleware: ({ ctx, next }) =>
-   *     next({ ctx: { api: { ...ctx.api, ratelimit: api } } })
-   * ```
+   * Declare a table-level TTL: a DO alarm-driven sweep auto-deletes rows whose
+   * expiry has passed (or soft-deletes them when the table also
+   * `.softDelete()`s). `field` is an epoch-millisecond column; without
+   * `options.after` its value is the absolute expiry instant, with `after` the
+   * row expires `after` ms past `field` (`field + after`). Coarse, cheap,
+   * table-level — for per-row schedules use `@lunora/scheduler`.
    */
-  readonly middleware?: Middleware<TContextIn, TContextOut>;
+  ttl: (field: keyof Shape & string, options?: {
+    after?: number;
+  }) => TableBuilder<Shape>;
+  /** Declare a vector index over a single text field on this table. */
+  vectorize: (field: keyof Shape & string, options: VectorizeOptions<Shape>) => TableBuilder<Shape>;
 }
-/** Options to {@link definePlugin}. */
-interface DefinePluginOptions<TExtension extends Record<string, TableDefinition>, TContextIn, TContextOut> {
-  extension?: SchemaExtension<TExtension>;
-  middleware?: Middleware<TContextIn, TContextOut>;
+/** Options for `defineVectorIndex(...)` (DSL Shape B). */
+interface VectorIndexOptions {
+  dimensions: number;
+  embed: VectorEmbedder;
+  /** Optional projection of the source row into Vectorize metadata. */
+  metadata?: (row: Record<string, unknown>) => Record<string, unknown>;
+  metric: VectorMetric;
+  /** The vector source: which table, and how to derive the embedded text. */
+  source: {
+    select: (row: Record<string, unknown>) => string;
+    table: string;
+  };
 }
 /**
- * Call signatures for {@link definePlugin}. When `extension` is supplied the
- * returned plugin's `extension` is typed as PRESENT (not `?`), so the
- * canonical install pattern `defineSchema(...).extend(plugin.extension)`
- * typechecks without a non-null assertion — the shape every scaffold template
- * ships. The bare-options signature keeps `extension` optional for plugins
- * that carry only middleware.
+ * Build a table definition. Returned object is both the table definition (for
+ * `defineSchema`) and a fluent builder for indexes + sharding metadata.
  */
-interface DefinePluginFunction {
-  <TExtension extends Record<string, TableDefinition>, TContextIn = unknown, TContextOut = TContextIn>(key: string, options: DefinePluginOptions<TExtension, TContextIn, TContextOut> & {
-    extension: SchemaExtension<TExtension>;
-  }): Plugin<TExtension, TContextIn, TContextOut> & {
-    readonly extension: SchemaExtension<TExtension>;
-  };
-  <TExtension extends Record<string, TableDefinition>, TContextIn = unknown, TContextOut = TContextIn>(key: string, options: DefinePluginOptions<TExtension, TContextIn, TContextOut>): Plugin<TExtension, TContextIn, TContextOut>;
-}
+declare const defineTable: <Shape extends Record<string, Validator>>(inputShape: Shape) => TableBuilder<Shape>;
 /**
- * Package a schema extension + middleware as a reusable plugin. Either
- * field is optional — `definePlugin("foo", {})` is valid but degenerate.
+ * Declare a standalone vector index (DSL Shape B). Pass the returned value in
+ * the `vectorIndexes` map of {@link defineSchema} when the source is derived
+ * from multiple fields or a computation rather than a single column.
  */
-declare const definePlugin: DefinePluginFunction;
+declare const defineVectorIndex: (options: VectorIndexOptions) => VectorIndexDefinition;
 /**
- * Bundle of registered functions a {@link Component} ships. Keys are the
- * function's local name (e.g. `check`, `reset`); the registered function
- * value carries its own kind / args / handler.
- *
- * Users re-export from their own lunora module so codegen picks them up:
- *
- * ```ts
- * // lunora/ratelimit.ts
- * import { ratelimit } from "@vendor/ratelimit-component";
- * export const { check, reset } = ratelimit.functions;
- * // Emits as `ratelimit:check` / `ratelimit:reset` in the generated `api`.
- * ```
- *
- * Codegen follows the re-export back to the bundled `query/mutation/action`
- * call (property access or destructuring both work), so the functions land in
- * the generated `api` under the re-exporting file's namespace.
+ * Options for the standalone `defineAggregateIndex(name, opts)` helper (DSL
+ * Shape B). Unlike the inline `.aggregateIndex(...)` builder, this form takes
+ * the owning table explicitly via `on` — handy when a single counter wants to
+ * live next to the schema map rather than inside a table chain.
  */
-type ComponentFunctions = Readonly<Record<string, RegisteredFunction<any, any, FunctionKind>>>;
+interface AggregateIndexOptions {
+  by?: ReadonlyArray<string>;
+  field?: string;
+  on: string;
+  op?: AggregateOp;
+  where?: Record<string, unknown>;
+}
 /**
- * Component = {@link Plugin} with a bundle of registered functions. The
- * extension + middleware + functions are independent: a component can ship
- * functions without a schema (e.g. a stateless utility), or a schema
- * without functions (e.g. shared table definitions), and any combination.
+ * Declare a standalone aggregate index. Pass the returned value to
+ * `defineSchema(tables, vectorIndexes, aggregateIndexes)` keyed by index name —
+ * the schema attaches it to `tables[on].aggregateIndexes` so runtime consumers
+ * (DO + D1) read every index uniformly off the table definition.
  */
-interface Component<TExtension extends Record<string, TableDefinition> = Record<string, TableDefinition>, TContextIn = unknown, TContextOut = TContextIn, F extends ComponentFunctions = ComponentFunctions> extends Plugin<TExtension, TContextIn, TContextOut> {
-  readonly functions: F;
-}
-interface DefineComponentOptions<TExtension extends Record<string, TableDefinition>, TContextIn, TContextOut, F extends ComponentFunctions> extends DefinePluginOptions<TExtension, TContextIn, TContextOut> {
-  /** Registered functions the component ships. Keys are the function's local name. */
-  functions?: F;
+declare const defineAggregateIndex: (name: string, options: AggregateIndexOptions) => AggregateIndexDefinition;
+/**
+ * Options for the standalone `defineRankIndex(name, opts)` helper (DSL Shape B).
+ * Mirrors the inline `.rankIndex(...)` builder but takes the owning table via
+ * `table` so it can sit next to the schema map.
+ */
+interface RankIndexOptions {
+  partitionBy?: ReadonlyArray<string>;
+  sortBy: ReadonlyArray<{
+    direction?: "asc" | "desc";
+    field: string;
+  }>;
+  table: string;
+  where?: Record<string, unknown>;
 }
 /**
- * Convenience wrapper around {@link definePlugin} that also bundles a set
- * of registered functions. The resulting `component.functions` object is a
- * record of `name → registered query/mutation/action`; consumers
- * re-export entries so codegen discovers them as user functions:
- *
- * ```ts
- * export const ratelimit = defineComponent("ratelimit", {
- *     // Bare `buckets` merges in as `ratelimit_buckets`.
- *     extension: defineSchemaExtension("ratelimit", { tables: { buckets } }),
- *     middleware: ({ ctx, next }) => next({ ctx: { ...ctx, ratelimit: api(ctx) } }),
- *     functions: {
- *         check: query.input({ key: v.string() }).query(async ({ ctx, args }) => ...),
- *         reset: mutation.input({ key: v.string() }).mutation(async ({ ctx, args }) => ...),
- *     },
- * });
- * ```
- *
- * Re-exporting an entry (by property access or destructuring) is enough for
- * codegen to discover it in the host app's namespace — the discovery resolver
- * chases the re-export back to the bundled registration call.
+ * Declare a standalone rank index. Pass the returned value to
+ * `defineSchema(tables, vectorIndexes, aggregateIndexes, rankIndexes)` keyed
+ * by index name — the schema attaches it to `tables[on].rankIndexes`.
  */
-declare const defineComponent: <TExtension extends Record<string, TableDefinition>, TContextIn = unknown, TContextOut = TContextIn, F extends ComponentFunctions = ComponentFunctions>(key: string, options: DefineComponentOptions<TExtension, TContextIn, TContextOut, F>) => Component<TExtension, TContextIn, TContextOut, F>;
+declare const defineRankIndex: (name: string, options: RankIndexOptions) => RankIndexDefinition;
 /**
- * Map every key `K` of an extension's table map `X` to its auto-prefixed name
- * `${Key}_${K}`. Mirrors the runtime prefixing in {@link mergeSchemaExtension}
- * so the typed `.extend(...)` chain reflects the real merged table names.
+ * Build the application schema. The first argument is the table map; the
+ * optional second argument registers standalone `defineVectorIndex(...)`
+ * declarations (DSL Shape B) keyed by index name. The optional third argument
+ * registers standalone `defineAggregateIndex(...)` declarations (DSL Shape B);
+ * the optional fourth argument registers standalone `defineRankIndex(...)`
+ * declarations. Both are folded into the matching `tables[on].*Indexes` array
+ * so runtime backends read every index uniformly off the table definition.
  */
-type PrefixedTables<X extends Record<string, TableDefinition>, Key extends string> = { [K in keyof X as K extends string ? `${Key}_${K}` : K]: X[K]; };
 /**
- * Merge a {@link SchemaExtension} into an existing schema. Returns a new
- * schema object — never mutates the input.
- *
- * Extension tables are auto-namespaced: each bare table name is prefixed with
- * the extension `key` (`buckets` → `ratelimit_buckets`), Convex-Components
- * style, and every intra-extension reference (relation targets, aggregate /
- * rank index `on`, standalone vector index `table`) is rewritten to match.
- * References to base/app tables are left untouched.
+ * Schema with an in-place `.extend(plugin.extension)` method. Used so apps
+ * can compose plugin schemas: `defineSchema({...}).extend(authPlugin.extension)`.
  *
- * Because each extension lives in its own `key` namespace, app↔component
- * collisions are impossible. The only remaining hard error is two extensions
- * sharing the same `key` and producing the same prefixed table (or vector
- * index) name — silent shadow would let one plugin hijack another's data.
+ * `extend` is non-mutating — returns a fresh `ExtendableSchema` containing
+ * the merged tables. Extension tables are auto-namespaced by the extension
+ * `key` (`buckets` → `ratelimit_buckets`), so the merged type carries the
+ * prefixed names via {@link PrefixedTables}. Chains:
+ * `defineSchema(...).extend(a).extend(b)` is the typed equivalent of merging
+ * `a`'s prefixed tables then `b`'s.
  */
-declare const mergeSchemaExtension: <T extends Record<string, TableDefinition>, X extends Record<string, TableDefinition>, Key extends string = string>(base: Schema<T>, extension: SchemaExtension<X> & {
-  readonly key: Key;
-}) => Schema<PrefixedTables<X, Key> & T>;
+type ExtendableSchema<T extends Record<string, TableDefinition>> = {
+  extend: <X extends Record<string, TableDefinition>, Key extends string>(extension: SchemaExtension<X> & {
+    readonly key: Key;
+  }) => ExtendableSchema<PrefixedTables<X, Key> & T>;
+  /**
+   * Pin every Durable Object the app reaches — shards, fan-out, subscriptions,
+   * the scheduler, and `ctx.containers` — to a Cloudflare data-residency
+   * jurisdiction (`"eu"`, `"us"`, `"fedramp"`). Codegen reads this off the
+   * schema and emits it into the generated worker's `createWorker({ jurisdiction })`
+   * (and `ctx.scheduler` / `ctx.containers`). Non-mutating: returns a fresh
+   * `ExtendableSchema`, so it composes with `.rls(...)` / `.extend(...)` in any order.
+   *
+   * ⚠️ **Set this once, before your first deploy — changing or removing it
+   * strands data.** A Durable Object name maps to a *different* ID in each
+   * jurisdiction, so toggling this on an existing app makes every shard, scheduler
+   * job, and session DO resolve to a NEW, empty DO; the previous data stays in the
+   * old jurisdiction's DOs and is no longer reachable. There is no in-place
+   * migration — you would have to export from the old jurisdiction and import
+   * into the new one.
+   *
+   * Note: this pins **DO-backed** state only. D1-backed state — `.global()`
+   * tables and `@lunora/auth` sessions alike — is governed by D1's own location
+   * settings, not this option.
+   * @see https://developers.cloudflare.com/durable-objects/reference/data-location/
+   */
+  jurisdiction: (jurisdiction: DurableObjectJurisdiction) => ExtendableSchema<T>;
+  /**
+   * Turn on secure-by-default RLS for the whole schema. Every table is then
+   * protected — the DO/D1 write path denies raw, non-RLS `ctx.db` access, so a
+   * procedure that forgets `.use(rls(...))` fails closed. Opt a table out with
+   * `.public()`. Non-mutating: returns a fresh `ExtendableSchema` carrying the
+   * mode, so `.rls("required")` composes with `.extend(...)` either order.
+   */
+  rls: (mode: "required") => ExtendableSchema<T>;
+} & Schema<T>;
 /**
- * Install several plugins' schema extensions in one call — the one-shot
- * counterpart to chaining `defineSchema(...).extend(a).extend(b)`. Plugins
- * without an `extension` (middleware-only) are skipped; tables from those that
- * do are auto-prefixed and reference-rewritten exactly as
- * {@link mergeSchemaExtension} does for a single `.extend(...)`.
+ * Columns every row carries implicitly (never part of a table's declared
+ * `shape`), so `.index()` may legitimately name them. The single source for
+ * both the compile-time allow-list (`TableBuilder["index"]`'s `fields` type,
+ * via `(typeof SYSTEM_INDEX_FIELDS)[number]`) and the runtime cross-check
+ * below (via `SYSTEM_INDEX_FIELDS_SET`) — declared once so the two can't
+ * drift apart.
+ */
+declare const SYSTEM_INDEX_FIELDS: readonly ["_creationTime", "_id"];
+/**
+ * Per-table, per-KIND index→declared-fields map: for each table, each index
+ * KIND (`index` | `rank` | `geo`) that has at least one declared index maps
+ * to a name→fields record for that kind only. Distilled by
+ * {@link indexFieldsFromSchema}; this is the shape `mask()`'s
+ * `MaskOptions.indexFields` expects (see `./mask/types`), so a table not
+ * present here (no declared indexes of any kind) is simply absent from the
+ * map rather than mapped to `{}`, and a kind with no declared indexes on a
+ * table that HAS other kinds is simply absent from that table's entry.
  *
- * ```ts
- * const schema = installPlugins(defineSchema({ todos }), [ratelimit, audit]);
- * // → todos + ratelimit_* + audit_*
- * ```
+ * Kept per kind (rather than one flat name→fields record) because the engine
+ * resolves `withIndex`/`withGeoIndex`/rank reads in THREE separate
+ * namespaces (`tableDefinition.indexes` / `.geoIndexes` / `.rankIndexes` —
+ * see `@lunora/shard-engine`'s `ctx-db.ts`), so the same name can legally and
+ * unambiguously denote a different index per kind. A flat map would let one
+ * kind's fields silently shadow another's for a colliding name, producing a
+ * wrong-namespace answer from the mask guard (checking the wrong index's
+ * fields) instead of the documented fail-open (missing lookup) — see plan 258.
+ */
+type IndexFieldsByTable = Readonly<Record<string, {
+  readonly geo?: Readonly<Record<string, ReadonlyArray<string>>>;
+  readonly index?: Readonly<Record<string, ReadonlyArray<string>>>;
+  readonly rank?: Readonly<Record<string, ReadonlyArray<string>>>;
+}>>;
+declare const indexFieldsFromSchema: (schema: Schema) => IndexFieldsByTable;
+declare const defineSchema: <T extends Record<string, TableDefinition>>(tables: T, vectorIndexes?: Record<string, VectorIndexDefinition>, aggregateIndexes?: Record<string, AggregateIndexDefinition>, rankIndexes?: Record<string, RankIndexDefinition>) => ExtendableSchema<T>;
+/**
+ * Context handed to a {@link MaskFn} (and to {@link MaskOptions.bypass}). The
+ * `auth` shape mirrors RLS's `PolicyContext.auth` one-for-one — same identity
+ * resolver, same `can(...)` permission check — so an author can branch a mask
+ * on the caller's role/permission. `row` is the full pre-mask row the column
+ * belongs to; `column` is the column currently being masked. Both are absent
+ * when the context is used for the procedure-wide `bypass` check (no specific
+ * cell is in play yet).
+ */
+interface MaskContext<Context = unknown> {
+  readonly auth: {
+    /** `true` when any of the request's `roles` grants `permission` (see {@link MaskOptions.roles}). Fails closed for unregistered roles. */
+    readonly can: (permission: Permission | string) => boolean;
+    readonly identity?: Record<string, unknown> | null;
+    readonly roles: ReadonlyArray<string>;
+    readonly userId: null | string;
+  };
+  /** The column currently being masked. Present only inside a per-cell {@link MaskFn}. */
+  readonly column?: string;
+  readonly ctx: Context;
+  /** The full pre-mask row the masked cell belongs to. Present only inside a per-cell {@link MaskFn}. */
+  readonly row?: Record<string, unknown>;
+}
+/**
+ * A custom masking function. Receives the raw cell value and the
+ * {@link MaskContext}, returns the value to surface. Use it for partial masks
+ * (`maskMiddle(phone)`), role-aware reveals (`ctx.auth.can(...) ? value : null`),
+ * or format-preserving tokens. A function that **throws** fails closed — the
+ * cell is redacted to `null`, never leaked raw.
+ */
+type MaskFn<Context = unknown> = (value: unknown, context: MaskContext<Context>) => unknown;
+/**
+ * How a column is masked:
  *
- * Pair it with {@link composePluginMiddleware} to attach every plugin's
- * middleware in a single `.use(...)`, so installing N plugins is two calls
- * rather than N `.extend(...)` + N `.use(...)`.
+ * - `"redact"` — drop the value to `null`. The simplest, safest strategy, and
+ * the right choice for any value that must actually be kept secret.
+ * - `"hash"` — replace with a stable token (unsalted 32-bit FNV-1a hex) so the
+ * same input always yields the same token (joinable/groupable client-side).
+ * **This is NOT a confidentiality control.** It is a non-cryptographic,
+ * unsalted, deterministic, narrow (~2^32) digest: low-entropy values (emails,
+ * phone numbers, SSNs) are brute-force-recoverable by the very caller you are
+ * masking from, and identical values always produce identical tokens across
+ * rows/columns/tenants (enabling correlation). Use `"hash"` ONLY when you want a
+ * stable pseudonym for grouping/joining and leaking the value is acceptable —
+ * never to hide sensitive PII. For PII that must stay hidden, use `"redact"`.
+ * - a {@link MaskFn} — author-defined transform (partial mask, role-aware reveal).
  */
-declare const installPlugins: <T extends Record<string, TableDefinition>, const Plugins extends ReadonlyArray<Plugin<any, any, any>>>(base: Schema<T>, plugins: Plugins) => Schema<InstalledTables<T, Plugins>>;
+type MaskStrategy<Context = unknown> = "hash" | "redact" | MaskFn<Context>;
+/** Per-column strategy map for one table: `{ email: "redact", phone: maskMiddle }`. */
+type MaskColumns<Context = unknown> = Record<string, MaskStrategy<Context>>;
 /**
- * Compose every plugin's middleware into a single middleware you attach with one
- * `.use(...)`. Plugins without middleware (schema-only) are skipped; the rest run
- * in array order, each seeing the context the previous one widened, so the final
- * `next({ ctx })` the builder receives carries every plugin's `ctx.api.&lt;key>`
- * additions. Equivalent to `.use(a.middleware).use(b.middleware)…` but as one
- * value, the middleware sibling of {@link installPlugins}.
+ * The mask declaration passed to `mask(...)`: a table → column → strategy map.
+ * Deliberately a plain object literal so the codegen feeder can statically read
+ * which columns a procedure masks (powering the `mask_uncovered_pii_column`
+ * advisor lint), exactly as the RLS feeder reads policy tables.
+ */
+type MaskPolicies<Context = unknown> = Record<string, MaskColumns<Context>>;
+/**
+ * Options for `mask(policies, options)`.
  *
- * `ContextIn` is left free so the builder infers it from the context at the
- * `.use(...)` site; the result type widens it by the union of the plugins'
- * outputs.
+ * - `roles` registers the role→permission grants that back `ctx.auth.can(...)`
+ * inside a {@link MaskFn} — identical to `rls(policies, { roles })`. A role
+ * not listed grants no permissions (fails closed for unknown roles).
+ * - `bypass` is a procedure-wide escape hatch: when it returns `true` the whole
+ * mask is skipped (the caller sees raw values). Use it for a privileged
+ * viewer — `bypass: ({ auth }) => auth.can("pii:view")`. Prefer this over
+ * branching every column when an entire class of caller should see clear data.
+ * - `indexFields` closes the bare-index-scan / rank / geo position oracle (see
+ * the `mask/middleware` module docblock's "Residual read-position oracles" section).
  */
-declare const composePluginMiddleware: <ContextIn = unknown, const Plugins extends ReadonlyArray<Plugin<any, any, any>> = ReadonlyArray<Plugin<any, any, any>>>(plugins: Plugins) => Middleware<ContextIn, ComposedOut<Plugins> & ContextIn>;
-/** Options for `.vectorize(field, opts)` (DSL Shape A). */
-interface VectorizeOptions<Shape extends Record<string, Validator> = Record<string, Validator>> {
-  dimensions: number;
-  embed: VectorEmbedder;
-  /** Logical index name; must match a `[[vectorize]]` binding in wrangler. */
-  index: string;
-  /** Fields mirrored into Vectorize metadata for filtering. */
-  metadata?: ReadonlyArray<keyof Shape & string>;
-  metric: VectorMetric;
+interface MaskOptions<Context = unknown> {
+  readonly bypass?: (context: MaskContext<Context>) => boolean;
+  /**
+   * Per-table, per-KIND index→declared-fields map (regular index `fields`
+   * under `index`; rank index `sortBy` ∪ `partitionBy` under `rank`; geo
+   * index `field` under `geo`). Supplied to close the bare-index-scan /
+   * rank / geo position oracle: a `withIndex(name)` with no range callback,
+   * a `rank`/`rankPage`/`rankBefore` read, or a `withGeoIndex` read, over an
+   * index whose DECLARED fields (for that read's own kind) intersect a
+   * masked column, is rejected. Kept per kind — rather than one flat
+   * name→fields map — because the engine resolves `withIndex` /
+   * `withGeoIndex` / rank reads in three separate namespaces, so the same
+   * index name can legally denote a different index per kind; a flat map
+   * would let one kind's fields shadow another's for a colliding name.
+   * OPTIONAL and additive — omit it and behaviour is unchanged (the oracle
+   * stays open, exactly as before this option existed). Build it with
+   * `indexFieldsFromSchema` (exported from `@lunora/server`):
+   * `mask(policies, { indexFields: indexFieldsFromSchema(schema) })`.
+   */
+  readonly indexFields?: IndexFieldsByTable;
+  readonly roles?: ReadonlyArray<Role>;
 }
-/** A `one` (many-to-one) relation descriptor; phantom `Target` carries the target table name. */
-interface OneRelation<Target extends string = string> extends RelationDefinition {
-  readonly __target?: Target;
-  readonly kind: "one";
+interface QueryPage$1 {
+  continueCursor: null | string;
+  isDone: boolean;
+  page: Record<string, unknown>[];
 }
-/** A `many` (one-to-many) relation descriptor; phantom `Target` carries the target table name. */
-interface ManyRelation<Target extends string = string> extends RelationDefinition {
-  readonly __target?: Target;
-  readonly kind: "many";
+interface QueryArgs$1 {
+  baseWhere?: unknown;
+  cursor?: null | string;
+  limit?: number;
+  orderBy?: ReadonlyArray<Record<string, unknown>>;
+  where?: unknown;
+  with?: Record<string, unknown>;
 }
-/** The `r` argument passed to `.relations((r) => …)`. */
-interface RelationBuilder {
-  /** One-to-many: the FK `field` lives on the target table, matching this table's `references` (default `_id`). */
-  many: <Target extends string>(table: Target, options: {
-    field: string;
-    references?: string;
-  }) => ManyRelation<Target>;
-  /** Many-to-one: the FK `field` lives on this table, pointing at `table`.`references` (default `_id`). */
-  one: <Target extends string>(table: Target, options: {
-    field: string;
-    onDelete?: OnDeleteAction;
-    references?: string;
-  }) => OneRelation<Target>;
+interface AggregateArgs$1 {
+  field?: string;
+  op: string;
+  where?: unknown;
 }
-/**
- * Options for the inline `.aggregateIndex(name, opts)` builder. `op` defaults to
- * `count` so `aggregateIndex("byUser", { by: ["userId"] })` is a single-line
- * `COUNT(*) GROUP BY userId` accelerator.
- */
-interface InlineAggregateIndexOptions<Shape extends Record<string, Validator> = Record<string, Validator>> {
-  /** Group keys; counter rows are one per distinct tuple. Omitted = single-row aggregate over the whole table. */
-  by?: ReadonlyArray<keyof Shape & string>;
-  /** The column the reducer applies to. Required for `sum`/`min`/`max`/`avg`; ignored for `count`. */
-  field?: keyof Shape & string;
-  /** Reducer (default `count`). */
-  op?: AggregateOp;
-  /** Static predicate baked into the counter — only matching rows are aggregated. */
-  where?: Record<string, unknown>;
+interface GroupByArgs$1 {
+  agg?: {
+    field?: string;
+    op: string;
+  };
+  by: ReadonlyArray<string>;
+  where?: unknown;
+}
+/** One row of a `.collectWithScores()` result — mirrors `@lunora/shard-engine`'s `ScoredDocument`. */
+type ScoredDocument = GeoScoredDocument | SearchScoredDocument;
+/** A `.withGeoIndex()` row — mirrors `@lunora/shard-engine`'s `GeoScoredDocument`. */
+interface GeoScoredDocument {
+  distanceMeters: null | number;
+  document: Record<string, unknown>;
+  score?: never;
+}
+/** A `.withSearchIndex()` row — mirrors `@lunora/shard-engine`'s `SearchScoredDocument`. */
+interface SearchScoredDocument {
+  distanceMeters?: never;
+  document: Record<string, unknown>;
+  score: number;
+}
+interface TableReaderLike$1 {
+  [Symbol.asyncIterator]: () => AsyncIterator<Record<string, unknown>>;
+  collect: () => Promise<Record<string, unknown>[]>;
+  collectWithScores: () => Promise<ScoredDocument[]>;
+  filter: (predicate: (document: Record<string, unknown>) => boolean) => TableReaderLike$1;
+  first: () => Promise<Record<string, unknown> | null>;
+  order: (direction: "asc" | "desc") => TableReaderLike$1;
+  paginate: (options: {
+    cursor?: null | string;
+    numItems: number;
+  }) => Promise<QueryPage$1>;
+  take: (limit: number) => Promise<Record<string, unknown>[]>;
+  unique: () => Promise<Record<string, unknown> | null>;
+  withGeoIndex: (indexName: string, build: (q: unknown) => unknown) => TableReaderLike$1;
+  withIndex: (indexName: string, range?: (q: unknown) => unknown) => TableReaderLike$1;
+  withSearchIndex: (indexName: string, search: (q: unknown) => unknown) => TableReaderLike$1;
 }
 /**
- * Options for the inline `.rankIndex(name, opts)` builder. `sortBy` is required;
- * accepts either an array of `{ field, direction }` keys, or the shorthand
- * `["field"]` (asc) / `{ field: "desc" }` map entries. `partitionBy` scopes the
- * rank — omitted ⇒ one global rank over the whole table.
+ * Structural projection of the runtime ORM writer — the same subset
+ * `../rls/middleware` mirrors, so the wrapper is interchangeable between
+ * `@lunora/do`'s and `@lunora/d1`'s `DatabaseWriterLike` without an
+ * inter-package dependency. `rankBefore` is optional (the D1 twin omits it).
  */
-interface InlineRankIndexOptions<Shape extends Record<string, Validator> = Record<string, Validator>> {
-  /** Columns that scope each ranking; omitted ⇒ one global rank. */
-  partitionBy?: ReadonlyArray<keyof Shape & string>;
-  /** Ordered sort keys driving the rank. Required. */
-  sortBy: ReadonlyArray<{
-    direction?: "asc" | "desc";
-    field: keyof Shape & string;
+interface MaskDatabase {
+  aggregate: (tableName: string, options: AggregateArgs$1) => Promise<null | number>;
+  count: (tableName: string, whereOrArgs?: unknown) => Promise<number>;
+  delete: (id: string, expectedTable?: string) => Promise<void>;
+  deleteMany: (ids: ReadonlyArray<string>, options?: {
+    limit?: number;
+  }) => Promise<{
+    deleted: number;
   }>;
-  /** Static predicate baked into the index; only matching rows enter. */
-  where?: Record<string, unknown>;
-}
-interface TableBuilder<Shape extends Record<string, Validator> = Record<string, Validator>> extends TableDefinition<Shape> {
-  /** Declare an aggregate (counter/sum/…) maintained by triggers for O(1) reads. */
-  aggregateIndex: (name: string, options?: InlineAggregateIndexOptions<Shape>) => TableBuilder<Shape>;
-  /**
-   * Mark this table as written outside Lunora's discoverable insert path —
-   * by an adapter, a migration, or framework middleware (e.g. `@lunora/auth`'s
-   * better-auth tables, `@lunora/ratelimit`'s store). Advisor insert-path lints
-   * (`table_without_insert`) then skip it instead of flagging the absent
-   * `ctx.db.insert(...)`.
-   */
-  externallyManaged: () => TableBuilder<Shape>;
-  /**
-   * Declare a geospatial index over a `v.geoPoint()` column. The runtime keeps
-   * a geohash companion so `withGeoIndex(name, q => q.near(point, radius))` and
-   * `.within(bbox)` resolve as a geohash-prefix range scan + Haversine
-   * refine/sort. `options.precision` tunes the geohash length (default 9).
-   */
-  geoIndex: (name: string, options: {
-    field: keyof Shape & string;
-    precision?: number;
-  }) => TableBuilder<Shape>;
-  /**
-   * Mark this table as global (cross-shard). Backed by **D1** by default;
-   * pass `{ backend: "hyperdrive" }` to store it in a Postgres/MySQL database
-   * via Cloudflare Hyperdrive (PlanetScale, Neon, …) instead. Either way the
-   * table stays reactive — live queries re-run on write.
-   */
-  global: (options?: {
-    backend?: GlobalBackend;
-  }) => TableBuilder<Shape>;
-  /** Add a secondary index. */
-  index: (name: string, fields: ReadonlyArray<string>, options?: {
-    unique?: boolean;
-  }) => TableBuilder<Shape>;
-  /**
-   * Name the column holding the owning user's id, so "only the owner sees these
-   * rows" is declared once here rather than restated in every shape.
-   *
-   * A `defineShape({ table, owner: true })` over this table derives its predicate
-   * from the field: the subscriber's verified `ctx.auth.userId` must match, and an
-   * anonymous subscriber is denied. Pairs naturally with `.shardBy(field)` on the
-   * same column — the shard key routes the storage, `ownedBy` states who the rows
-   * belong to — but the two are independent and either can be used alone.
-   *
-   * This is a *shape* declaration, not an RLS policy: it narrows what a shape
-   * replicates. Guarding procedure reads/writes is still `rls(...)`'s job.
-   */
-  ownedBy: (field: keyof Shape & string) => TableBuilder<Shape>;
-  /**
-   * Opt this table OUT of secure-by-default RLS. Under a schema marked
-   * `.rls("required")`, every table is protected (the write path denies raw,
-   * non-RLS `ctx.db` access); calling `.public()` exempts this one table so a
-   * plain `query`/`mutation` may read/write it without an RLS policy. No effect
-   * when the schema does not require RLS.
-   */
-  public: () => TableBuilder<Shape>;
-  /**
-   * Declare a rank index (sorted companion table, btree-backed) for
-   * `rank(row)` / `rankPage()` reads in O(log n). See {@link RankIndexDefinition}.
-   */
-  rankIndex: (name: string, options: InlineRankIndexOptions<Shape>) => TableBuilder<Shape>;
-  /** Declare relations to other tables, loaded via `findMany({ with })`. */
-  relations: (build: (r: RelationBuilder) => Record<string, RelationDefinition>) => TableBuilder<Shape>;
-  /**
-   * Add a full-text search index over `field`, queried with
-   * `.withSearchIndex(name, q => q.search(field, term))`. `field` may be a
-   * dot-separated path into a nested object (`"properties.name"`).
-   * `filterFields` (at most 16) lists the columns `.eq()` may narrow by inside
-   * the search. `language` selects the text analysis (accent folding always,
-   * plus that language's stopwords). `staged: true` skips the migration-time
-   * backfill on a large existing table. `strategy: "native"` uses the engine's
-   * own full-text index where it has one (Postgres) — faster on large corpora,
-   * at the cost of the engine ranking rather than the shared scorer.
-   */
-  searchIndex: (name: string, options: {
-    field: string;
-    filterFields?: ReadonlyArray<string>;
-    language?: SearchLanguage;
-    staged?: boolean;
-    strategy?: SearchStrategy;
-  }) => TableBuilder<Shape>;
-  /** Route storage by the named field — one DO per distinct value. */
-  shardBy: (field: keyof Shape & string) => TableBuilder<Shape>;
-  /**
-   * Turn on soft delete. Adds a nullable timestamp column (`options.field`,
-   * default `deletedAt`) and changes `ctx.db.&lt;table>.delete()` to **set** it
-   * instead of removing the row; `onDelete: "cascade"` children are recursively
-   * soft-deleted too. **List reads** (`findMany`/`findFirst`/`query()`/`count`/
-   * `aggregate`/relation loads) then hide soft-deleted rows unless they pass
-   * `includeDeleted: true`; by-id `get`/`patch`/`replace` and the new
-   * `restore()` still address the row directly. `hardDelete()` physically
-   * removes it (cascading as a real delete). Note: `includeDeleted` is a read
-   * scope, not access control — anyone who can run the read can set it; a unique
-   * index still rejects a new row that collides with a soft-deleted one (the row
-   * physically persists).
-   */
-  softDelete: (options?: {
-    field?: string;
-  }) => TableBuilder<Shape>;
-  /**
-   * Materialize this table from an external Postgres/MySQL behind Cloudflare
-   * Hyperdrive (plan 077). A system-driven poll loop reads the tenant slice
-   * (`query`, with params bound from `tenantBy`) and lands it in the DO's SQLite,
-   * after which `defineShape` carries it to clients unchanged. Implies
-   * `.externallyManaged()` (rows come from the ingest loop, not user mutations).
-   *
-   * Orthogonal to `.shardBy()` — combine them for per-tenant DOs. **Under
-   * `.shardBy()` `tenantBy` is mandatory** (the tenant-isolation boundary); the
-   * `external_source_unscoped` advisor lint fails the build when it is absent, and
-   * `external_source_on_global` rejects combining `.source()` with `.global()`.
-   */
-  source: (definition: ExternalSourceDefinition) => TableBuilder<Shape>;
-  /** Declare named lifecycle triggers fired inline within the write path. */
-  triggers: (build: (t: TriggerBuilder<Shape>) => Record<string, TriggerDefinition>) => TableBuilder<Shape>;
-  /**
-   * Declare a table-level TTL: a DO alarm-driven sweep auto-deletes rows whose
-   * expiry has passed (or soft-deletes them when the table also
-   * `.softDelete()`s). `field` is an epoch-millisecond column; without
-   * `options.after` its value is the absolute expiry instant, with `after` the
-   * row expires `after` ms past `field` (`field + after`). Coarse, cheap,
-   * table-level — for per-row schedules use `@lunora/scheduler`.
-   */
-  ttl: (field: keyof Shape & string, options?: {
-    after?: number;
-  }) => TableBuilder<Shape>;
-  /** Declare a vector index over a single text field on this table. */
-  vectorize: (field: keyof Shape & string, options: VectorizeOptions<Shape>) => TableBuilder<Shape>;
+  deleteWhere?: (tableName: string, where: Record<string, unknown>, options?: {
+    limit?: number;
+  }) => Promise<{
+    deleted: number;
+  }>;
+  findFirst: (tableName: string, args?: QueryArgs$1) => Promise<Record<string, unknown> | null>;
+  findFirstOrThrow: (tableName: string, args?: QueryArgs$1) => Promise<Record<string, unknown>>;
+  findMany: (tableName: string, args?: QueryArgs$1) => Promise<QueryPage$1>;
+  get: (id: string, expectedTable?: string) => Promise<Record<string, unknown> | null>;
+  groupBy: (tableName: string, options: GroupByArgs$1) => Promise<ReadonlyArray<{
+    key: Record<string, unknown>;
+    value: null | number;
+  }>>;
+  insert: (tableName: string, document: Record<string, unknown>) => Promise<string>;
+  insertMany: (tableName: string, documents: ReadonlyArray<Record<string, unknown>>, options?: {
+    limit?: number;
+    skipDuplicates?: boolean;
+  }) => Promise<(string | null)[]>;
+  lookupById?: (id: string, expectedTable?: string) => Promise<null | {
+    row: Record<string, unknown>;
+    tableName: string;
+  }>;
+  patch: (id: string, patch: Record<string, unknown>, expectedTable?: string) => Promise<void>;
+  patchMany: (patches: ReadonlyArray<{
+    id: string;
+    patch: Record<string, unknown>;
+  }>, options?: {
+    limit?: number;
+  }) => Promise<{
+    patched: number;
+  }>;
+  patchWhere?: (tableName: string, args: {
+    patch: Record<string, unknown>;
+    where: Record<string, unknown>;
+  }, options?: {
+    limit?: number;
+  }) => Promise<{
+    patched: number;
+  }>;
+  query: (tableName: string) => TableReaderLike$1;
+  rank: (tableName: string, indexName: string, options: unknown) => Promise<null | {
+    position: number;
+    total: number;
+  }>;
+  rankBefore?: (tableName: string, indexName: string, options: unknown) => Promise<{
+    before: number;
+    total: number;
+  }>;
+  rankPage: (tableName: string, indexName: string, options?: unknown) => Promise<QueryPage$1>;
+  /** Cross-shard companion to `rankPage`, gated the same way `rankPage` is masked below. */
+  rankPageRows?: (tableName: string, indexName: string, options?: unknown) => Promise<ShardRankPageResultLike>;
+  replace: (id: string, document: Record<string, unknown>, expectedTable?: string) => Promise<void>;
 }
-/** Options for `defineVectorIndex(...)` (DSL Shape B). */
-interface VectorIndexOptions {
-  dimensions: number;
-  embed: VectorEmbedder;
-  /** Optional projection of the source row into Vectorize metadata. */
-  metadata?: (row: Record<string, unknown>) => Record<string, unknown>;
-  metric: VectorMetric;
-  /** The vector source: which table, and how to derive the embedded text. */
-  source: {
-    select: (row: Record<string, unknown>) => string;
-    table: string;
-  };
+/** Roles list source on the context. Tolerant of older auth states (mirrors RLS's `AuthLike`). */
+type AuthLike$1 = {
+  getIdentity?: () => Promise<Record<string, unknown> | null>;
+  roles?: ReadonlyArray<string>;
+  userId?: null | string;
+};
+interface MaskContextIn {
+  auth?: AuthLike$1;
+  db: MaskDatabase;
 }
 /**
- * Build a table definition. Returned object is both the table definition (for
- * `defineSchema`) and a fluent builder for indexes + sharding metadata.
- */
-declare const defineTable: <Shape extends Record<string, Validator>>(inputShape: Shape) => TableBuilder<Shape>;
-/**
- * Declare a standalone vector index (DSL Shape B). Pass the returned value in
- * the `vectorIndexes` map of {@link defineSchema} when the source is derived
- * from multiple fields or a computation rather than a single column.
- */
-declare const defineVectorIndex: (options: VectorIndexOptions) => VectorIndexDefinition;
-/**
- * Options for the standalone `defineAggregateIndex(name, opts)` helper (DSL
- * Shape B). Unlike the inline `.aggregateIndex(...)` builder, this form takes
- * the owning table explicitly via `on` — handy when a single counter wants to
- * live next to the schema map rather than inside a table chain.
+ * Procedure-builder middleware. Apply per-request via `.use(mask(policies))`.
+ * Closes over the policy map at builder-construction time; resolves identity +
+ * the `bypass` decision per call against the live ctx.
+ *
+ * IMPORTANT: a mask is in scope only for procedures whose builder chain
+ * includes this middleware — opt-in, never global (the same invariant as RLS).
  */
-interface AggregateIndexOptions {
-  by?: ReadonlyArray<string>;
-  field?: string;
-  on: string;
-  op?: AggregateOp;
-  where?: Record<string, unknown>;
-}
+declare const mask: <Context extends MaskContextIn = MaskContextIn>(policies: MaskPolicies<Context>, options?: MaskOptions<Context>) => Middleware<Context, Context>;
+/** Project-wide masked-column registry: every table any registered function masks, unioned. */
+type MaskRegistry = ReadonlyMap<string, ReadonlySet<string>>;
 /**
- * Declare a standalone aggregate index. Pass the returned value to
- * `defineSchema(tables, vectorIndexes, aggregateIndexes)` keyed by index name —
- * the schema attaches it to `tables[on].aggregateIndexes` so runtime consumers
- * (DO + D1) read every index uniformly off the table definition.
+ * Build the project-wide masked-column registry from the registered functions
+ * (pass `Object.values(LUNORA_FUNCTIONS)`) — the mask-column twin of
+ * `buildRlsReadRegistry`. Unions every function's `.use(mask(...))` columns
+ * per table: a column masked by ANY registered function counts as masked in
+ * the registry — there is no "which procedure would this shape have gone
+ * through" question to narrow by, so the union is the only safe answer.
  */
-declare const defineAggregateIndex: (name: string, options: AggregateIndexOptions) => AggregateIndexDefinition;
+declare const buildMaskRegistry: (functions: Iterable<unknown>) => MaskRegistry;
+/** A document handed to a migration transform: the stored row including `_id`/`_creationTime`. */
+type MigrationDocument = Record<string, unknown>;
 /**
- * Options for the standalone `defineRankIndex(name, opts)` helper (DSL Shape B).
- * Mirrors the inline `.rankIndex(...)` builder but takes the owning table via
- * `table` so it can sit next to the schema map.
+ * The read surface a transform reaches through its `ctx`.
+ *
+ * Read-only by design: the runner accounts for exactly one rewrite per row read,
+ * and a transform writing directly would make that count describe something
+ * other than what happened. Scoped to the shard the runner is walking.
  */
-interface RankIndexOptions {
-  partitionBy?: ReadonlyArray<string>;
-  sortBy: ReadonlyArray<{
-    direction?: "asc" | "desc";
-    field: string;
+interface MigrationReader {
+  count: (table: string, where?: Record<string, unknown>) => Promise<number>;
+  findFirst: (table: string, args?: Record<string, unknown>) => Promise<MigrationDocument | null>;
+  findMany: (table: string, args?: Record<string, unknown>) => Promise<{
+    isDone: boolean;
+    page: MigrationDocument[];
   }>;
-  table: string;
-  where?: Record<string, unknown>;
+  get: (id: string, expectedTable?: string) => Promise<MigrationDocument | null>;
+}
+/** The context handed to a transform alongside the row. */
+interface MigrationCtx {
+  db: MigrationReader;
 }
 /**
- * Declare a standalone rank index. Pass the returned value to
- * `defineSchema(tables, vectorIndexes, aggregateIndexes, rankIndexes)` keyed
- * by index name — the schema attaches it to `tables[on].rankIndexes`.
- */
-declare const defineRankIndex: (name: string, options: RankIndexOptions) => RankIndexDefinition;
-/**
- * Build the application schema. The first argument is the table map; the
- * optional second argument registers standalone `defineVectorIndex(...)`
- * declarations (DSL Shape B) keyed by index name. The optional third argument
- * registers standalone `defineAggregateIndex(...)` declarations (DSL Shape B);
- * the optional fourth argument registers standalone `defineRankIndex(...)`
- * declarations. Both are folded into the matching `tables[on].*Indexes` array
- * so runtime backends read every index uniformly off the table definition.
+ * Transform applied to one document. Return a new document to rewrite the row,
+ * or `undefined` to leave it untouched (skipped, not counted as changed). The
+ * runner always preserves the original `_id` and `_creationTime`, so the
+ * returned document neither needs to nor should change row identity.
+ *
+ * The second parameter carries a shard-scoped reader. Without it a transform
+ * could only rewrite the row it was handed — enough for a backfill whose new
+ * value is a pure function of the old row (`displayName = name ?? "Anonymous"`),
+ * but not for the shape people actually write: read the parent, copy a field
+ * down onto its children.
+ *
+ * May return a promise, since a cross-table read is asynchronous.
+ *
+ * **A shard key cannot be backfilled this way, even with a reader.** A row whose
+ * shard-key field is unset does not belong to any shard, so a shard-scoped query
+ * will not enumerate it; and writing the key would have to MOVE the row to a
+ * different Durable Object, which a per-shard runner cannot do. Re-keying is an
+ * export → transform → import, not a migration.
  */
+type MigrationTransform = (document: MigrationDocument, ctx: MigrationCtx) => MigrationDocument | Promise<MigrationDocument | undefined | void> | undefined | void;
+interface MigrationDefinition {
+  /** Rows fetched and rewritten per batch. Defaults to the runner's batch size when omitted. */
+  readonly batchSize?: number;
+  /** Optional reverse transform, applied by `migrate down`. */
+  readonly down?: MigrationTransform;
+  /** Stable, unique identifier — the key per-shard run-state is tracked under. */
+  readonly id: string;
+  /** Table whose documents this migration iterates. */
+  readonly table: string;
+  /** Forward transform, applied to every row by `migrate up`. */
+  readonly up: MigrationTransform;
+}
+/** A {@link MigrationDefinition} plus the codegen discovery marker. */
+interface RegisteredMigration extends MigrationDefinition {
+  readonly __lunoraMigration: true;
+}
+/** Declare an online data migration. See the module docs for runtime semantics. */
+declare const defineMigration: (definition: MigrationDefinition) => RegisteredMigration;
 /**
- * Schema with an in-place `.extend(plugin.extension)` method. Used so apps
- * can compose plugin schemas: `defineSchema({...}).extend(authPlugin.extension)`.
- *
- * `extend` is non-mutating — returns a fresh `ExtendableSchema` containing
- * the merged tables. Extension tables are auto-namespaced by the extension
- * `key` (`buckets` → `ratelimit_buckets`), so the merged type carries the
- * prefixed names via {@link PrefixedTables}. Chains:
- * `defineSchema(...).extend(a).extend(b)` is the typed equivalent of merging
- * `a`'s prefixed tables then `b`'s.
+ * A mutator declaration. `server` is authoritative; `client` is the optimistic
+ * twin (optional — omit it to let the optimistic write fall through to the
+ * server round-trip with no local preview). Both receive the same validated
+ * `args`.
  */
-type ExtendableSchema<T extends Record<string, TableDefinition>> = {
-  extend: <X extends Record<string, TableDefinition>, Key extends string>(extension: SchemaExtension<X> & {
-    readonly key: Key;
-  }) => ExtendableSchema<PrefixedTables<X, Key> & T>;
+interface MutatorDefinition<Args extends ValidatorMap = ValidatorMap, ServerContext = MutationCtx, ClientTx = unknown, R = unknown> {
   /**
-   * Pin every Durable Object the app reaches — shards, fan-out, subscriptions,
-   * the scheduler, and `ctx.containers` — to a Cloudflare data-residency
-   * jurisdiction (`"eu"`, `"us"`, `"fedramp"`). Codegen reads this off the
-   * schema and emits it into the generated worker's `createWorker({ jurisdiction })`
-   * (and `ctx.scheduler` / `ctx.containers`). Non-mutating: returns a fresh
-   * `ExtendableSchema`, so it composes with `.rls(...)` / `.extend(...)` in any order.
+   * Validator for the mutator's arguments. Validated on the DO before `server`
+   * runs and (when present) on the client before `client` runs, so both impls
+   * see the same parsed shape. Omit for a parameterless mutator.
+   */
+  readonly args?: Args;
+  /**
+   * Optimistic client implementation. Runs in a TanStack DB transaction
+   * against the local collections; its writes are applied immediately and
+   * automatically rolled back / rebased as the authoritative result syncs
+   * back. Pure and side-effect-free beyond the local store. Omit to skip the
+   * local preview.
+   */
+  readonly client?: (tx: ClientTx, args: InferValidatorMap<Args>) => Promise<void> | void;
+  /**
+   * Owner-scope the write: names the column carrying the row owner (e.g.
+   * `owner: "userId"`). Before `server` runs, the mutator requires a verified
+   * identity, rejects a client-supplied owner that disagrees with it, and sets
+   * the column to the verified value — so the impl reads `args[owner]` without
+   * trusting the client and never repeats the check by hand.
    *
-   * ⚠️ **Set this once, before your first deploy — changing or removing it
-   * strands data.** A Durable Object name maps to a *different* ID in each
-   * jurisdiction, so toggling this on an existing app makes every shard, scheduler
-   * job, and session DO resolve to a NEW, empty DO; the previous data stays in the
-   * old jurisdiction's DOs and is no longer reachable. There is no in-place
-   * migration — you would have to export from the old jurisdiction and import
-   * into the new one.
+   * This replaces the "every mutator opens with `assertOwner(ctx, args.userId)`"
+   * pattern, and is the write-side counterpart to an `owner`-scoped
+   * {@link import("./shapes").ShapeDefinition}. Unlike a shape it takes the column
+   * NAME rather than `true`: a shape is bound to one `table`, so the table's
+   * `.ownedBy(field)` resolves unambiguously, whereas one mutator may write
+   * several tables and has no single owning table to read it from.
    *
-   * Note: this pins **DO-backed** state only. D1-backed state — `.global()`
-   * tables and `@lunora/auth` sessions alike — is governed by D1's own location
-   * settings, not this option.
-   * @see https://developers.cloudflare.com/durable-objects/reference/data-location/
+   * Declare the column `v.optional(...)` to leave it off the wire entirely; it is
+   * injected either way.
    */
-  jurisdiction: (jurisdiction: DurableObjectJurisdiction) => ExtendableSchema<T>;
+  readonly owner?: string;
   /**
-   * Turn on secure-by-default RLS for the whole schema. Every table is then
-   * protected — the DO/D1 write path denies raw, non-RLS `ctx.db` access, so a
-   * procedure that forgets `.use(rls(...))` fails closed. Opt a table out with
-   * `.public()`. Non-mutating: returns a fresh `ExtendableSchema` carrying the
-   * mode, so `.rls("required")` composes with `.extend(...)` either order.
+   * Authoritative server implementation. Runs inside the shard DO with a full
+   * {@link MutationContext} (`ctx.db` writer); its writes append to `__cdc_log`
+   * and poke back to subscribers. This is the source of truth — the client
+   * impl is only a prediction of it.
    */
-  rls: (mode: "required") => ExtendableSchema<T>;
-} & Schema<T>;
-declare const defineSchema: <T extends Record<string, TableDefinition>>(tables: T, vectorIndexes?: Record<string, VectorIndexDefinition>, aggregateIndexes?: Record<string, AggregateIndexDefinition>, rankIndexes?: Record<string, RankIndexDefinition>) => ExtendableSchema<T>;
+  readonly server: (context: ServerContext, args: InferValidatorMap<Args>) => Promise<R> | R;
+}
+/**
+ * A {@link MutatorDefinition} plus the codegen discovery marker and a
+ * dispatch-shaped `handler` (validates `args`, then runs `server`) so the DO
+ * invokes a mutator exactly like a registered procedure.
+ */
+interface RegisteredMutator<Args extends ValidatorMap = ValidatorMap, ServerContext = MutationCtx, ClientTx = unknown, R = unknown> extends MutatorDefinition<Args, ServerContext, ClientTx, R> {
+  readonly __lunoraMutator: true;
+  /** Validate `rawArgs`, then run the authoritative `server` impl. Used by the DO push path. */
+  readonly handler: (context: ServerContext, rawArgs: Record<string, unknown>) => Promise<R>;
+  /**
+   * Marks the dispatch kind so codegen can register the mutator in the same
+   * `LUNORA_FUNCTIONS` table queries/mutations use — the DO's `handleRpc`
+   * reads `kind === "mutation"` to wrap the authoritative `server` impl in the
+   * shard's BEGIN/COMMIT span (all-or-nothing writes), exactly like an
+   * ordinary `mutation`.
+   */
+  readonly kind: "mutation";
+}
+/** Declare a custom mutator. See the module docs for runtime semantics. */
+declare const defineMutator: <Args extends ValidatorMap = ValidatorMap, ServerContext = MutationCtx, ClientTx = unknown, R = unknown>(definition: MutatorDefinition<Args, ServerContext, ClientTx, R>) => RegisteredMutator<Args, ServerContext, ClientTx, R>;
 /** Default time-to-live for a presence row: a heartbeat keeps a member "present" for this long. */
 declare const DEFAULT_TTL_MS = 3e4;
 declare const PRESENCE_BARE_TABLE = "present";
@@ -2221,6 +2347,13 @@ interface DatabaseWriterLike {
    * Required for the same reason as `aggregate`.
    */
   rankPage: (tableName: string, indexName: string, options?: RankPageArgs) => Promise<QueryPage>;
+  /**
+   * Cross-shard companion to `rankPage`: same ranked slice, but each row
+   * keeps its rank-key tuple for the query coordinator's k-way merge. Same
+   * count-of-partition RLS hazard as `rankPage` — failed closed under a read
+   * policy for the identical reason (see `rankPage` above).
+   */
+  rankPageRows?: (tableName: string, indexName: string, options?: RankPageArgs) => Promise<ShardRankPageResultLike>;
   replace: (id: string, document: Record<string, unknown>, expectedTable?: string) => Promise<void>;
   restore?: (id: string, expectedTable?: string) => Promise<void>;
   /**
@@ -2502,4 +2635,4 @@ interface StorageContextIn {
 }
 declare const storageRules: <Context extends StorageContextIn = StorageContextIn>(rules: ReadonlyArray<StorageRule<Context>>, options?: StorageRulesOptions) => Middleware<Context, Context>;
 declare const VERSION = "0.0.0";
-export { type ActionBuilder, type ActionCtx, type AggregateIndexDefinition, type AggregateIndexOptions, type AggregateOp, type ArgsValidator, type Component, type ComponentFunctions, type CreateOptions, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, type DataModelInit, type DefineComponentOptions, type DefineIdentityOptions, type DefineListArgsConfig, type DefinePluginOptions, type DefinePolicyInput, type DefinePresenceOptions, type DefineStorageRuleInput, type DurableObjectJurisdiction, type EmptyArgs, type EnvAccessor, type EnvKeyFailure, type EnvShape, type ExposeConfig, type ExtendableSchema, type FacadeEntry, type FacadeWriterLike, type FunctionKind, type HttpActionCtx, type HttpActionHandler, type HttpMethod, type HttpRoute, type HttpRouteBuilder, type HttpRouteFactory, type HttpRouteHandlerOptions, type HttpStreamHandlerOptions, type IdentityContract, type IdentityRejectMode, type IdentityValidation, type InferArgs, type InferEnv, type InferIdentity, type InlineAggregateIndexOptions, type InlineRankIndexOptions, type InternalActionBuilder, type InternalMutationBuilder, type InternalQueryBuilder, type LifecycleEvent, type LifecycleHandler, type ListArgsSpec, type ListArgsValidators, type ListArgsValue, type ListFilterOperators, type ListOrderByEntry, type ListWhere, type LunoraBuilders, LunoraEnvError, LunoraError, type LunoraHttpApp, type LunoraHttpEnv, type LunoraRouteHandler, type ManyRelation, type MaskColumns, type MaskContext, type MaskFn, type MaskOptions, type MaskPolicies, type MaskStrategy, type Middleware, type MiddlewareNext, type MigrationCtx, type MigrationDefinition, type MigrationDocument, type MigrationReader, type MigrationTransform, type MutationBuilder, type MutationCtx, type MutatorDefinition, type OnDeleteAction, type OneRelation, type OrmLike, DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, type Permission, type Plugin, type Policy, type PrefixedTables, type PresenceComponent, type PresenceFunctions, type PresenceMember, type ProtectPublicOptions, type QueryBuilder, type QueryCtx, type RankIndexDefinition, type RankIndexOptions, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMigration, type RegisteredMutation, type RegisteredMutator, type RegisteredQuery, type RegisteredShape, type RegisteredStream, type RelationBuilder, type RelationDefinition, type RlsOptions, type RlsReadRegistry, type Role, type Schema, type SchemaExtension, type ShapeDefinition, type ShapeReadWhereRequest, type StorageOperation, type StorageRule, type StorageRuleContext, type StorageRuleDecision, type StorageRulesOptions, type TableBuilder, type TableDefinition, type TerminalKind, type TriggerBuilder, type TriggerDefinition, type TypedDefinePolicyInput, VERSION, type VectorEmbedder, type VectorIndexDefinition, type VectorIndexOptions, type VectorMetric, type VectorizeOptions, type WhereInput, allowAll, asBucketStorage, bindOrm, bindTableFacade, buildRlsReadRegistry, clampLimit, composePluginMiddleware, composeShapeReadWhere, createPolicyDsl, createSecrets, defineAggregateIndex, defineComponent, defineEnv, defineIdentity, defineListArgs, defineMigration, defineMutator, definePermission, definePlugin, definePolicies, definePolicy, definePresence, defineRankIndex, defineRole, defineSchema, defineSchemaExtension, defineShape, defineStorageRule, defineStorageRules, defineTable, defineVectorIndex, deny, httpAction, httpRoute, httpRouter, initLunora, installPlugins, isDeny, isSafeHeaderValue, mask, mergeSchemaExtension, onConnect, onDisconnect, presenceExtension, protectPublic, redactSecrets, rls, serveStorageObject, storageRules, toWhereInput };
+export { type ActionBuilder, type ActionCtx, type AggregateIndexDefinition, type AggregateIndexOptions, type AggregateOp, type ArgsValidator, type Component, type ComponentFunctions, type CreateOptions, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, type DataModelInit, type DefineComponentOptions, type DefineIdentityOptions, type DefineListArgsConfig, type DefinePluginOptions, type DefinePolicyInput, type DefinePresenceOptions, type DefineStorageRuleInput, type DurableObjectJurisdiction, type EmptyArgs, type EnvAccessor, type EnvKeyFailure, type EnvShape, type ExposeConfig, type ExtendableSchema, type FacadeEntry, type FacadeWriterLike, type FunctionKind, type HttpActionCtx, type HttpActionHandler, type HttpMethod, type HttpRoute, type HttpRouteBuilder, type HttpRouteFactory, type HttpRouteHandlerOptions, type HttpStreamHandlerOptions, type IdentityContract, type IdentityRejectMode, type IdentityValidation, type IndexFieldsByTable, type InferArgs, type InferEnv, type InferIdentity, type InlineAggregateIndexOptions, type InlineRankIndexOptions, type InternalActionBuilder, type InternalMutationBuilder, type InternalQueryBuilder, type LifecycleEvent, type LifecycleHandler, type ListArgsSpec, type ListArgsValidators, type ListArgsValue, type ListFilterOperators, type ListOrderByEntry, type ListWhere, type LunoraBuilders, LunoraEnvError, LunoraError, type LunoraHttpApp, type LunoraHttpEnv, type LunoraRouteHandler, type ManyRelation, type MaskColumns, type MaskContext, type MaskFn, type MaskOptions, type MaskPolicies, type MaskRegistry, type MaskStrategy, type Middleware, type MiddlewareNext, type MigrationCtx, type MigrationDefinition, type MigrationDocument, type MigrationReader, type MigrationTransform, type MutationBuilder, type MutationCtx, type MutatorDefinition, type OnDeleteAction, type OneRelation, type OrmLike, DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, type Permission, type Plugin, type Policy, type PrefixedTables, type PresenceComponent, type PresenceFunctions, type PresenceMember, type ProtectPublicOptions, type QueryBuilder, type QueryCtx, type RankIndexDefinition, type RankIndexOptions, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMigration, type RegisteredMutation, type RegisteredMutator, type RegisteredQuery, type RegisteredShape, type RegisteredStream, type RelationBuilder, type RelationDefinition, type RlsOptions, type RlsReadRegistry, type Role, type Schema, type SchemaExtension, type ShapeDefinition, type ShapeReadWhereRequest, type StorageOperation, type StorageRule, type StorageRuleContext, type StorageRuleDecision, type StorageRulesOptions, type TableBuilder, type TableDefinition, type TerminalKind, type TriggerBuilder, type TriggerDefinition, type TypedDefinePolicyInput, VERSION, type VectorEmbedder, type VectorIndexDefinition, type VectorIndexOptions, type VectorMetric, type VectorizeOptions, type WhereInput, allowAll, asBucketStorage, bindOrm, bindTableFacade, buildMaskRegistry, buildRlsReadRegistry, clampLimit, composePluginMiddleware, composeShapeReadWhere, createPolicyDsl, createSecrets, defineAggregateIndex, defineComponent, defineEnv, defineIdentity, defineListArgs, defineMigration, defineMutator, definePermission, definePlugin, definePolicies, definePolicy, definePresence, defineRankIndex, defineRole, defineSchema, defineSchemaExtension, defineShape, defineStorageRule, defineStorageRules, defineTable, defineVectorIndex, deny, httpAction, httpRoute, httpRouter, indexFieldsFromSchema, initLunora, installPlugins, isDeny, isSafeHeaderValue, mask, mergeSchemaExtension, onConnect, onDisconnect, presenceExtension, protectPublic, redactSecrets, rls, serveStorageObject, storageRules, toWhereInput };