@lunora/server 1.0.0-alpha.6 → 1.0.0-alpha.8

package/README.md

@@ -93,6 +93,10 @@ The builder chain is `<builder>.input(validators).<kind>(handler)`, plus `.use(m
 
 > **Determinism:** `query` and `mutation` handlers must be deterministic — they may be re-run on OCC retry or subscription re-evaluation. Read the current time from **`ctx.now`** (epoch ms, captured once per execution — also on `ActionCtx`) instead of `Date.now()`; compute randomness and network results in an `action` (`crypto.randomUUID()`, `fetch`) and pass them into the mutation as arguments. The `nondeterministic_query_mutation` advisor flags `Date.now()`/`Math.random()`/`fetch` in query/mutation handlers.
 
+### Local-first sync engine
+
+`defineShape` declares a **partial replication shape** (a named table view with a server-resolved `where` predicate, AND-composed with RLS) and `defineMutator` declares a **custom mutator** (an authoritative `server` impl plus an optional optimistic `client` twin). Both are discovered by codegen and drive the [local-first sync engine](https://lunora.sh/docs/concepts/local-first) — clients subscribe to shapes over the poke diff protocol and push optimistic writes rebased over the server's authoritative result. The client-side runtime lives in [`@lunora/db`](https://www.npmjs.com/package/@lunora/db).
+
 > This README covers the basics. For the full API, options, and guides, see the **[documentation](https://lunora.sh/docs/packages/server)**.
 
 ## Related

package/dist/index.d.mts

@@ -1,6 +1,6 @@
-import { Validator, Infer, v } from '@lunora/values';
+import { Validator, Infer, ValidatorMap, InferValidatorMap, v } from '@lunora/values';
 export { type ColumnValidator, type Id, type Infer, ValidationError, type Validator, type ValidatorKind, v } from '@lunora/values';
-import { ArgsValidator, InferArgs, RegisteredAction, ActionCtx, MutationCtx, RegisteredMutation, QueryCtx, RegisteredQuery, RegisteredStream, FunctionKind, Secrets, LifecycleEvent, RegisteredLifecycleHook, TableDefinition, RegisteredFunction, VectorIndexDefinition, Schema, AggregateOp, DurableObjectJurisdiction, RelationDefinition, GlobalBackend, OnDeleteAction, TriggerBuilder, TriggerDefinition, VectorEmbedder, VectorMetric, AggregateIndexDefinition, RankIndexDefinition } from "./types.mjs";
+import { ArgsValidator, InferArgs, RegisteredAction, ActionCtx, MutationCtx, RegisteredMutation, QueryCtx, RegisteredQuery, RegisteredStream, FunctionKind, Secrets, LifecycleEvent, RegisteredLifecycleHook, TableDefinition, RegisteredFunction, VectorIndexDefinition, Schema, AggregateOp, DurableObjectJurisdiction, RelationDefinition, GlobalBackend, OnDeleteAction, ExternalSourceDefinition, TriggerBuilder, TriggerDefinition, VectorEmbedder, VectorMetric, AggregateIndexDefinition, RankIndexDefinition } from "./types.mjs";
 export { type AnyApi, type AuthState, type DatabaseReader, type DatabaseWriter, type FunctionVisibility, type IndexDefinition, type IndexRangeBuilder, type LifecycleEventKind, type LunoraLogger, type PaginationOptions, type PaginationResult, type RankSortKey, type ReadOnlyStorage, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type SearchFilterBuilder, type SearchIndexDefinition, type ShardMode, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerCtx, type TriggerDatabase, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type VectorMatch, type VectorMatches, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, anyApi } from "./types.mjs";
 import { Context, Hono } from 'hono';
 import { b as Permission, R as Role, T as TypedDefinePolicyInput, a as Policy, D as DefinePolicyInput, W as WhereInput, c as RlsOptions } from "./packem_shared/types.d-DmvyEMD6.mjs";
@@ -896,6 +896,55 @@ interface RegisteredMigration extends MigrationDefinition {
 /** Declare an online data migration. See the module docs for runtime semantics. */
 declare const defineMigration: (definition: MigrationDefinition) => RegisteredMigration;
 /**
+* A mutator declaration. `server` is authoritative; `client` is the optimistic
+* twin (optional — omit it to let the optimistic write fall through to the
+* server round-trip with no local preview). Both receive the same validated
+* `args`.
+*/
+interface MutatorDefinition<Args extends ValidatorMap = ValidatorMap, ServerContext = MutationCtx, ClientTx = unknown, R = unknown> {
+  /**
+  * Validator for the mutator's arguments. Validated on the DO before `server`
+  * runs and (when present) on the client before `client` runs, so both impls
+  * see the same parsed shape. Omit for a parameterless mutator.
+  */
+  readonly args?: Args;
+  /**
+  * Optimistic client implementation. Runs in a TanStack DB transaction
+  * against the local collections; its writes are applied immediately and
+  * automatically rolled back / rebased as the authoritative result syncs
+  * back. Pure and side-effect-free beyond the local store. Omit to skip the
+  * local preview.
+  */
+  readonly client?: (tx: ClientTx, args: InferValidatorMap<Args>) => Promise<void> | void;
+  /**
+  * Authoritative server implementation. Runs inside the shard DO with a full
+  * {@link MutationContext} (`ctx.db` writer); its writes append to `__cdc_log`
+  * and poke back to subscribers. This is the source of truth — the client
+  * impl is only a prediction of it.
+  */
+  readonly server: (context: ServerContext, args: InferValidatorMap<Args>) => Promise<R> | R;
+}
+/**
+* A {@link MutatorDefinition} plus the codegen discovery marker and a
+* dispatch-shaped `handler` (validates `args`, then runs `server`) so the DO
+* invokes a mutator exactly like a registered procedure.
+*/
+interface RegisteredMutator<Args extends ValidatorMap = ValidatorMap, ServerContext = MutationCtx, ClientTx = unknown, R = unknown> extends MutatorDefinition<Args, ServerContext, ClientTx, R> {
+  readonly __lunoraMutator: true;
+  /** Validate `rawArgs`, then run the authoritative `server` impl. Used by the DO push path. */
+  readonly handler: (context: ServerContext, rawArgs: Record<string, unknown>) => Promise<R>;
+  /**
+  * Marks the dispatch kind so codegen can register the mutator in the same
+  * `LUNORA_FUNCTIONS` table queries/mutations use — the DO's `handleRpc`
+  * reads `kind === "mutation"` to wrap the authoritative `server` impl in the
+  * shard's BEGIN/COMMIT span (all-or-nothing writes), exactly like an
+  * ordinary `mutation`.
+  */
+  readonly kind: "mutation";
+}
+/** Declare a custom mutator. See the module docs for runtime semantics. */
+declare const defineMutator: <Args extends ValidatorMap = ValidatorMap, ServerContext = MutationCtx, ClientTx = unknown, R = unknown>(definition: MutatorDefinition<Args, ServerContext, ClientTx, R>) => RegisteredMutator<Args, ServerContext, ClientTx, R>;
+/**
 * The prefixed tables a single plugin `P` contributes, or an empty map when it
 * ships no schema extension. Mirrors {@link PrefixedTables} at the plugin level
 * so {@link InstalledTables} can fold a tuple of plugins.
@@ -1222,6 +1271,19 @@ interface TableBuilder<Shape extends Record<string, Validator> = Record<string,
   softDelete: (options?: {
     field?: string;
   }) => TableBuilder<Shape>;
+  /**
+  * Materialize this table from an external Postgres/MySQL behind Cloudflare
+  * Hyperdrive (plan 077). A system-driven poll loop reads the tenant slice
+  * (`query`, with params bound from `tenantBy`) and lands it in the DO's SQLite,
+  * after which `defineShape` carries it to clients unchanged. Implies
+  * `.externallyManaged()` (rows come from the ingest loop, not user mutations).
+  *
+  * Orthogonal to `.shardBy()` — combine them for per-tenant DOs. **Under
+  * `.shardBy()` `tenantBy` is mandatory** (the tenant-isolation boundary); the
+  * `external_source_unscoped` advisor lint fails the build when it is absent, and
+  * `external_source_on_global` rejects combining `.source()` with `.global()`.
+  */
+  source: (definition: ExternalSourceDefinition) => TableBuilder<Shape>;
   /** Declare named lifecycle triggers fired inline within the write path. */
   triggers: (build: (t: TriggerBuilder<Shape>) => Record<string, TriggerDefinition>) => TableBuilder<Shape>;
   /** Declare a vector index over a single text field on this table. */
@@ -1735,6 +1797,104 @@ interface RlsContextIn {
 }
 declare const rls: <Context extends RlsContextIn = RlsContextIn>(policies: ReadonlyArray<Policy<Context>>, options?: RlsOptions) => Middleware<Context, Context>;
 /**
+* One `rls()` tag's read policies for a table, paired with the role→permission
+* grants of that SAME middleware. Keeping the role map per-group is what lets a
+* policy's `auth.can(...)` resolve against its own middleware's roles — never a
+* permission registered on a different `rls()` step.
+*/
+interface ScopedReadPolicies {
+  readonly policies: ReadonlyArray<Policy>;
+  readonly rolePermissions: ReadonlyMap<string, ReadonlySet<string>>;
+}
+/** Table-indexed read-policy groups, each scoped to the roles of the rls() middleware that declared it. */
+interface RlsReadRegistry {
+  readonly byTable: ReadonlyMap<string, ReadonlyArray<ScopedReadPolicies>>;
+}
+/** The trusted, server-resolved facts a shape's RLS evaluation runs under. */
+interface ShapeReadWhereRequest {
+  /** The shape ctx (the procedure context a policy `when` reads as `ctx`). */
+  readonly ctx: unknown;
+  /** Resolved identity claims (the socket's verified identity), or `null` when anonymous. */
+  readonly identity: Record<string, unknown> | null;
+  /** `true` when the schema is `.rls("required")` — gates the fail-closed branch. */
+  readonly rlsRequired: boolean;
+  /** Role labels the request carries (drives `auth.can(...)`). */
+  readonly roles: ReadonlyArray<string>;
+  /** The shape's own predicate (`where(ctx, args)`). */
+  readonly shapeWhere: WhereInput;
+  /** Logical table the shape replicates. */
+  readonly table: string;
+  /** `true` when the table is `.public()` (exempt from `.rls("required")` denial). */
+  readonly tablePublic: boolean;
+  /** Verified user id, or `null` when anonymous. */
+  readonly userId: null | string;
+}
+/**
+* Build the read-policy registry from the registered functions (pass
+* `Object.values(LUNORA_FUNCTIONS)`). Only `on: "read"` policies are collected,
+* grouped per `rls()` middleware so each group keeps its own role→permission map
+* (a `(table, when)` pair is de-duplicated within a tag). A tag reused across
+* several procedures (a shared `const guard = rls(...)`) is folded once. This
+* mirrors the request-time `rls()` path exactly: a policy's `auth.can(...)`
+* resolves against the roles of the middleware that declared it, never a union.
+*/
+declare const buildRlsReadRegistry: (functions: Iterable<unknown>) => RlsReadRegistry;
+/**
+* Compute the effective `where` a shape replicates: the table's RLS read
+* base-where AND the shape's own predicate. Returns the shape predicate
+* unchanged for a table with no read policy (a `.public()` or non-RLS table),
+* and the FALSE sentinel (replicate nothing) when a `.rls("required")` schema
+* exposes a protected, policy-less table.
+*/
+declare const composeShapeReadWhere: (registry: RlsReadRegistry, request: ShapeReadWhereRequest) => WhereInput;
+/**
+* A shape declaration. `where` receives the trusted procedure context and the
+* validated client args and returns the same {@link WhereInput} shape the RLS
+* DSL uses, so the DO can AND-merge it with the table's read base-where via the
+* existing where-compiler (zero second predicate implementation).
+*/
+interface ShapeDefinition<Args extends ValidatorMap = ValidatorMap, Context = QueryCtx> {
+  /**
+  * Validator for the client-supplied shape parameters. Validated on the DO
+  * before `where` runs, so a malformed `args` envelope is rejected at the
+  * subscription boundary rather than silently widening the partition. Omit
+  * for a parameterless shape.
+  */
+  readonly args?: Args;
+  /**
+  * Project the replicated rows to these columns (the system columns `_id` and
+  * `_creationTime` are always included). Omit to replicate every column. An
+  * empty array is rejected — it would replicate no data, which is never the
+  * intent.
+  */
+  readonly columns?: ReadonlyArray<string>;
+  /** Logical table this shape replicates a partition of. */
+  readonly table: string;
+  /**
+  * Predicate selecting the rows this shape replicates. AND-composed with the
+  * table's RLS read base-where on the DO. Runs server-side with a trusted
+  * `ctx` (identity/auth the client can't forge) and the validated client
+  * `args`; returns a {@link WhereInput} using the same operator set as the
+  * SQL compiler (`eq`/`in`/`lt`/… + `AND`/`OR`/`NOT`).
+  */
+  readonly where: (context: Context, args: InferValidatorMap<Args>) => WhereInput;
+}
+/** A {@link ShapeDefinition} plus the codegen discovery marker and a dispatch-shaped `compileWhere`. */
+interface RegisteredShape<Args extends ValidatorMap = ValidatorMap, Context = QueryCtx> extends ShapeDefinition<Args, Context> {
+  readonly __lunoraShape: true;
+  /**
+  * Validate `rawArgs`, then evaluate `where` under the trusted `ctx` and
+  * return its {@link WhereInput}. Used by the generated DO's `resolveShape`
+  * override: `ctx` is erased to `unknown` at this dispatch boundary (the DO
+  * builds it from the socket's verified identity and hands it back as the
+  * concrete {@link QueryContext} the predicate expects), exactly like
+  * `RegisteredLunoraFunction.handler` erases its context.
+  */
+  readonly compileWhere: (context: unknown, rawArgs: Record<string, unknown>) => WhereInput;
+}
+/** Declare a replication shape. See the module docs for runtime semantics. */
+declare const defineShape: <Args extends ValidatorMap = ValidatorMap, Context = QueryCtx>(definition: ShapeDefinition<Args, Context>) => RegisteredShape<Args, Context>;
+/**
 * Operations a storage rule can gate. `read` covers `download` / `getMetadata`
 * / `getSignedUrl` / `getUrl`; `write` covers `store` / `generateUploadUrl`;
 * `delete` is `delete`; `list` is a prefix listing (governed via the file
@@ -1817,4 +1977,4 @@ interface StorageContextIn {
 }
 declare const storageRules: <Context extends StorageContextIn = StorageContextIn>(rules: ReadonlyArray<StorageRule<Context>>, options?: StorageRulesOptions) => Middleware<Context, Context>;
 declare const VERSION = "0.0.0";
-export { type ActionBuilder, type ActionCtx, type AggregateIndexDefinition, type AggregateIndexOptions, type AggregateOp, type ArgsValidator, type Component, type ComponentFunctions, type CreateOptions, type DataModelInit, type DefineComponentOptions, type DefinePluginOptions, type DefinePolicyInput, type DefinePresenceOptions, type DefineStorageRuleInput, type DurableObjectJurisdiction, type EmptyArgs, type EnvAccessor, type EnvKeyFailure, type EnvShape, type ExtendableSchema, type FacadeEntry, type FacadeWriterLike, type FunctionKind, type HttpActionCtx, type HttpActionHandler, type HttpMethod, type HttpRoute, type HttpRouteBuilder, type HttpRouteFactory, type HttpRouteHandlerOptions, type HttpStreamHandlerOptions, type InferArgs, type InferEnv, type InlineAggregateIndexOptions, type InlineRankIndexOptions, type InternalActionBuilder, type InternalMutationBuilder, type InternalQueryBuilder, type LifecycleEvent, type LifecycleHandler, type LunoraBuilders, LunoraEnvError, LunoraError, type LunoraErrorCode, type LunoraHttpApp, type LunoraHttpEnv, type LunoraRouteHandler, type ManyRelation, type MaskColumns, type MaskContext, type MaskFn, type MaskOptions, type MaskPolicies, type MaskStrategy, type Middleware, type MiddlewareNext, type MigrationDefinition, type MigrationDocument, type MigrationTransform, type MutationBuilder, type MutationCtx, type OnDeleteAction, type OneRelation, type OrmLike, DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, type Permission, type Plugin, type Policy, type PrefixedTables, type PresenceComponent, type PresenceFunctions, type PresenceMember, type ProtectPublicOptions, type QueryBuilder, type QueryCtx, type RankIndexDefinition, type RankIndexOptions, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMigration, type RegisteredMutation, type RegisteredQuery, type RegisteredStream, type RelationBuilder, type RelationDefinition, type RlsOptions, type Role, type Schema, type SchemaExtension, type StorageOperation, type StorageRule, type StorageRuleContext, type StorageRuleDecision, type StorageRulesOptions, type TableBuilder, type TableDefinition, type TerminalKind, type TriggerBuilder, type TriggerDefinition, type TypedDefinePolicyInput, VERSION, type VectorEmbedder, type VectorIndexDefinition, type VectorIndexOptions, type VectorMetric, type VectorizeOptions, type WhereInput, asBucketStorage, bindOrm, bindTableFacade, composePluginMiddleware, createPolicyDsl, createSecrets, defineAggregateIndex, defineComponent, defineEnv, defineMigration, definePermission, definePlugin, definePolicies, definePolicy, definePresence, defineRankIndex, defineRole, defineSchema, defineSchemaExtension, defineStorageRule, defineStorageRules, defineTable, defineVectorIndex, httpAction, httpRoute, httpRouter, initLunora, installPlugins, mask, mergeSchemaExtension, onConnect, onDisconnect, presenceExtension, protectPublic, redactSecrets, rls, serveStorageObject, storageRules };
+export { type ActionBuilder, type ActionCtx, type AggregateIndexDefinition, type AggregateIndexOptions, type AggregateOp, type ArgsValidator, type Component, type ComponentFunctions, type CreateOptions, type DataModelInit, type DefineComponentOptions, type DefinePluginOptions, type DefinePolicyInput, type DefinePresenceOptions, type DefineStorageRuleInput, type DurableObjectJurisdiction, type EmptyArgs, type EnvAccessor, type EnvKeyFailure, type EnvShape, type ExtendableSchema, type FacadeEntry, type FacadeWriterLike, type FunctionKind, type HttpActionCtx, type HttpActionHandler, type HttpMethod, type HttpRoute, type HttpRouteBuilder, type HttpRouteFactory, type HttpRouteHandlerOptions, type HttpStreamHandlerOptions, type InferArgs, type InferEnv, type InlineAggregateIndexOptions, type InlineRankIndexOptions, type InternalActionBuilder, type InternalMutationBuilder, type InternalQueryBuilder, type LifecycleEvent, type LifecycleHandler, type LunoraBuilders, LunoraEnvError, LunoraError, type LunoraErrorCode, type LunoraHttpApp, type LunoraHttpEnv, type LunoraRouteHandler, type ManyRelation, type MaskColumns, type MaskContext, type MaskFn, type MaskOptions, type MaskPolicies, type MaskStrategy, type Middleware, type MiddlewareNext, type MigrationDefinition, type MigrationDocument, type MigrationTransform, type MutationBuilder, type MutationCtx, type MutatorDefinition, type OnDeleteAction, type OneRelation, type OrmLike, DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, type Permission, type Plugin, type Policy, type PrefixedTables, type PresenceComponent, type PresenceFunctions, type PresenceMember, type ProtectPublicOptions, type QueryBuilder, type QueryCtx, type RankIndexDefinition, type RankIndexOptions, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMigration, type RegisteredMutation, type RegisteredMutator, type RegisteredQuery, type RegisteredShape, type RegisteredStream, type RelationBuilder, type RelationDefinition, type RlsOptions, type RlsReadRegistry, type Role, type Schema, type SchemaExtension, type ShapeDefinition, type ShapeReadWhereRequest, type StorageOperation, type StorageRule, type StorageRuleContext, type StorageRuleDecision, type StorageRulesOptions, type TableBuilder, type TableDefinition, type TerminalKind, type TriggerBuilder, type TriggerDefinition, type TypedDefinePolicyInput, VERSION, type VectorEmbedder, type VectorIndexDefinition, type VectorIndexOptions, type VectorMetric, type VectorizeOptions, type WhereInput, asBucketStorage, bindOrm, bindTableFacade, buildRlsReadRegistry, composePluginMiddleware, composeShapeReadWhere, createPolicyDsl, createSecrets, defineAggregateIndex, defineComponent, defineEnv, defineMigration, defineMutator, definePermission, definePlugin, definePolicies, definePolicy, definePresence, defineRankIndex, defineRole, defineSchema, defineSchemaExtension, defineShape, defineStorageRule, defineStorageRules, defineTable, defineVectorIndex, httpAction, httpRoute, httpRouter, initLunora, installPlugins, mask, mergeSchemaExtension, onConnect, onDisconnect, presenceExtension, protectPublic, redactSecrets, rls, serveStorageObject, storageRules };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-import { Validator, Infer, v } from '@lunora/values';
+import { Validator, Infer, ValidatorMap, InferValidatorMap, v } from '@lunora/values';
 export { type ColumnValidator, type Id, type Infer, ValidationError, type Validator, type ValidatorKind, v } from '@lunora/values';
-import { ArgsValidator, InferArgs, RegisteredAction, ActionCtx, MutationCtx, RegisteredMutation, QueryCtx, RegisteredQuery, RegisteredStream, FunctionKind, Secrets, LifecycleEvent, RegisteredLifecycleHook, TableDefinition, RegisteredFunction, VectorIndexDefinition, Schema, AggregateOp, DurableObjectJurisdiction, RelationDefinition, GlobalBackend, OnDeleteAction, TriggerBuilder, TriggerDefinition, VectorEmbedder, VectorMetric, AggregateIndexDefinition, RankIndexDefinition } from "./types.js";
+import { ArgsValidator, InferArgs, RegisteredAction, ActionCtx, MutationCtx, RegisteredMutation, QueryCtx, RegisteredQuery, RegisteredStream, FunctionKind, Secrets, LifecycleEvent, RegisteredLifecycleHook, TableDefinition, RegisteredFunction, VectorIndexDefinition, Schema, AggregateOp, DurableObjectJurisdiction, RelationDefinition, GlobalBackend, OnDeleteAction, ExternalSourceDefinition, TriggerBuilder, TriggerDefinition, VectorEmbedder, VectorMetric, AggregateIndexDefinition, RankIndexDefinition } from "./types.js";
 export { type AnyApi, type AuthState, type DatabaseReader, type DatabaseWriter, type FunctionVisibility, type IndexDefinition, type IndexRangeBuilder, type LifecycleEventKind, type LunoraLogger, type PaginationOptions, type PaginationResult, type RankSortKey, type ReadOnlyStorage, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type SearchFilterBuilder, type SearchIndexDefinition, type ShardMode, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerCtx, type TriggerDatabase, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type VectorMatch, type VectorMatches, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, anyApi } from "./types.js";
 import { Context, Hono } from 'hono';
 import { b as Permission, R as Role, T as TypedDefinePolicyInput, a as Policy, D as DefinePolicyInput, W as WhereInput, c as RlsOptions } from "./packem_shared/types.d-BDY0FYHK.js";
@@ -896,6 +896,55 @@ interface RegisteredMigration extends MigrationDefinition {
 /** Declare an online data migration. See the module docs for runtime semantics. */
 declare const defineMigration: (definition: MigrationDefinition) => RegisteredMigration;
 /**
+* A mutator declaration. `server` is authoritative; `client` is the optimistic
+* twin (optional — omit it to let the optimistic write fall through to the
+* server round-trip with no local preview). Both receive the same validated
+* `args`.
+*/
+interface MutatorDefinition<Args extends ValidatorMap = ValidatorMap, ServerContext = MutationCtx, ClientTx = unknown, R = unknown> {
+  /**
+  * Validator for the mutator's arguments. Validated on the DO before `server`
+  * runs and (when present) on the client before `client` runs, so both impls
+  * see the same parsed shape. Omit for a parameterless mutator.
+  */
+  readonly args?: Args;
+  /**
+  * Optimistic client implementation. Runs in a TanStack DB transaction
+  * against the local collections; its writes are applied immediately and
+  * automatically rolled back / rebased as the authoritative result syncs
+  * back. Pure and side-effect-free beyond the local store. Omit to skip the
+  * local preview.
+  */
+  readonly client?: (tx: ClientTx, args: InferValidatorMap<Args>) => Promise<void> | void;
+  /**
+  * Authoritative server implementation. Runs inside the shard DO with a full
+  * {@link MutationContext} (`ctx.db` writer); its writes append to `__cdc_log`
+  * and poke back to subscribers. This is the source of truth — the client
+  * impl is only a prediction of it.
+  */
+  readonly server: (context: ServerContext, args: InferValidatorMap<Args>) => Promise<R> | R;
+}
+/**
+* A {@link MutatorDefinition} plus the codegen discovery marker and a
+* dispatch-shaped `handler` (validates `args`, then runs `server`) so the DO
+* invokes a mutator exactly like a registered procedure.
+*/
+interface RegisteredMutator<Args extends ValidatorMap = ValidatorMap, ServerContext = MutationCtx, ClientTx = unknown, R = unknown> extends MutatorDefinition<Args, ServerContext, ClientTx, R> {
+  readonly __lunoraMutator: true;
+  /** Validate `rawArgs`, then run the authoritative `server` impl. Used by the DO push path. */
+  readonly handler: (context: ServerContext, rawArgs: Record<string, unknown>) => Promise<R>;
+  /**
+  * Marks the dispatch kind so codegen can register the mutator in the same
+  * `LUNORA_FUNCTIONS` table queries/mutations use — the DO's `handleRpc`
+  * reads `kind === "mutation"` to wrap the authoritative `server` impl in the
+  * shard's BEGIN/COMMIT span (all-or-nothing writes), exactly like an
+  * ordinary `mutation`.
+  */
+  readonly kind: "mutation";
+}
+/** Declare a custom mutator. See the module docs for runtime semantics. */
+declare const defineMutator: <Args extends ValidatorMap = ValidatorMap, ServerContext = MutationCtx, ClientTx = unknown, R = unknown>(definition: MutatorDefinition<Args, ServerContext, ClientTx, R>) => RegisteredMutator<Args, ServerContext, ClientTx, R>;
+/**
 * The prefixed tables a single plugin `P` contributes, or an empty map when it
 * ships no schema extension. Mirrors {@link PrefixedTables} at the plugin level
 * so {@link InstalledTables} can fold a tuple of plugins.
@@ -1222,6 +1271,19 @@ interface TableBuilder<Shape extends Record<string, Validator> = Record<string,
   softDelete: (options?: {
     field?: string;
   }) => TableBuilder<Shape>;
+  /**
+  * Materialize this table from an external Postgres/MySQL behind Cloudflare
+  * Hyperdrive (plan 077). A system-driven poll loop reads the tenant slice
+  * (`query`, with params bound from `tenantBy`) and lands it in the DO's SQLite,
+  * after which `defineShape` carries it to clients unchanged. Implies
+  * `.externallyManaged()` (rows come from the ingest loop, not user mutations).
+  *
+  * Orthogonal to `.shardBy()` — combine them for per-tenant DOs. **Under
+  * `.shardBy()` `tenantBy` is mandatory** (the tenant-isolation boundary); the
+  * `external_source_unscoped` advisor lint fails the build when it is absent, and
+  * `external_source_on_global` rejects combining `.source()` with `.global()`.
+  */
+  source: (definition: ExternalSourceDefinition) => TableBuilder<Shape>;
   /** Declare named lifecycle triggers fired inline within the write path. */
   triggers: (build: (t: TriggerBuilder<Shape>) => Record<string, TriggerDefinition>) => TableBuilder<Shape>;
   /** Declare a vector index over a single text field on this table. */
@@ -1735,6 +1797,104 @@ interface RlsContextIn {
 }
 declare const rls: <Context extends RlsContextIn = RlsContextIn>(policies: ReadonlyArray<Policy<Context>>, options?: RlsOptions) => Middleware<Context, Context>;
 /**
+* One `rls()` tag's read policies for a table, paired with the role→permission
+* grants of that SAME middleware. Keeping the role map per-group is what lets a
+* policy's `auth.can(...)` resolve against its own middleware's roles — never a
+* permission registered on a different `rls()` step.
+*/
+interface ScopedReadPolicies {
+  readonly policies: ReadonlyArray<Policy>;
+  readonly rolePermissions: ReadonlyMap<string, ReadonlySet<string>>;
+}
+/** Table-indexed read-policy groups, each scoped to the roles of the rls() middleware that declared it. */
+interface RlsReadRegistry {
+  readonly byTable: ReadonlyMap<string, ReadonlyArray<ScopedReadPolicies>>;
+}
+/** The trusted, server-resolved facts a shape's RLS evaluation runs under. */
+interface ShapeReadWhereRequest {
+  /** The shape ctx (the procedure context a policy `when` reads as `ctx`). */
+  readonly ctx: unknown;
+  /** Resolved identity claims (the socket's verified identity), or `null` when anonymous. */
+  readonly identity: Record<string, unknown> | null;
+  /** `true` when the schema is `.rls("required")` — gates the fail-closed branch. */
+  readonly rlsRequired: boolean;
+  /** Role labels the request carries (drives `auth.can(...)`). */
+  readonly roles: ReadonlyArray<string>;
+  /** The shape's own predicate (`where(ctx, args)`). */
+  readonly shapeWhere: WhereInput;
+  /** Logical table the shape replicates. */
+  readonly table: string;
+  /** `true` when the table is `.public()` (exempt from `.rls("required")` denial). */
+  readonly tablePublic: boolean;
+  /** Verified user id, or `null` when anonymous. */
+  readonly userId: null | string;
+}
+/**
+* Build the read-policy registry from the registered functions (pass
+* `Object.values(LUNORA_FUNCTIONS)`). Only `on: "read"` policies are collected,
+* grouped per `rls()` middleware so each group keeps its own role→permission map
+* (a `(table, when)` pair is de-duplicated within a tag). A tag reused across
+* several procedures (a shared `const guard = rls(...)`) is folded once. This
+* mirrors the request-time `rls()` path exactly: a policy's `auth.can(...)`
+* resolves against the roles of the middleware that declared it, never a union.
+*/
+declare const buildRlsReadRegistry: (functions: Iterable<unknown>) => RlsReadRegistry;
+/**
+* Compute the effective `where` a shape replicates: the table's RLS read
+* base-where AND the shape's own predicate. Returns the shape predicate
+* unchanged for a table with no read policy (a `.public()` or non-RLS table),
+* and the FALSE sentinel (replicate nothing) when a `.rls("required")` schema
+* exposes a protected, policy-less table.
+*/
+declare const composeShapeReadWhere: (registry: RlsReadRegistry, request: ShapeReadWhereRequest) => WhereInput;
+/**
+* A shape declaration. `where` receives the trusted procedure context and the
+* validated client args and returns the same {@link WhereInput} shape the RLS
+* DSL uses, so the DO can AND-merge it with the table's read base-where via the
+* existing where-compiler (zero second predicate implementation).
+*/
+interface ShapeDefinition<Args extends ValidatorMap = ValidatorMap, Context = QueryCtx> {
+  /**
+  * Validator for the client-supplied shape parameters. Validated on the DO
+  * before `where` runs, so a malformed `args` envelope is rejected at the
+  * subscription boundary rather than silently widening the partition. Omit
+  * for a parameterless shape.
+  */
+  readonly args?: Args;
+  /**
+  * Project the replicated rows to these columns (the system columns `_id` and
+  * `_creationTime` are always included). Omit to replicate every column. An
+  * empty array is rejected — it would replicate no data, which is never the
+  * intent.
+  */
+  readonly columns?: ReadonlyArray<string>;
+  /** Logical table this shape replicates a partition of. */
+  readonly table: string;
+  /**
+  * Predicate selecting the rows this shape replicates. AND-composed with the
+  * table's RLS read base-where on the DO. Runs server-side with a trusted
+  * `ctx` (identity/auth the client can't forge) and the validated client
+  * `args`; returns a {@link WhereInput} using the same operator set as the
+  * SQL compiler (`eq`/`in`/`lt`/… + `AND`/`OR`/`NOT`).
+  */
+  readonly where: (context: Context, args: InferValidatorMap<Args>) => WhereInput;
+}
+/** A {@link ShapeDefinition} plus the codegen discovery marker and a dispatch-shaped `compileWhere`. */
+interface RegisteredShape<Args extends ValidatorMap = ValidatorMap, Context = QueryCtx> extends ShapeDefinition<Args, Context> {
+  readonly __lunoraShape: true;
+  /**
+  * Validate `rawArgs`, then evaluate `where` under the trusted `ctx` and
+  * return its {@link WhereInput}. Used by the generated DO's `resolveShape`
+  * override: `ctx` is erased to `unknown` at this dispatch boundary (the DO
+  * builds it from the socket's verified identity and hands it back as the
+  * concrete {@link QueryContext} the predicate expects), exactly like
+  * `RegisteredLunoraFunction.handler` erases its context.
+  */
+  readonly compileWhere: (context: unknown, rawArgs: Record<string, unknown>) => WhereInput;
+}
+/** Declare a replication shape. See the module docs for runtime semantics. */
+declare const defineShape: <Args extends ValidatorMap = ValidatorMap, Context = QueryCtx>(definition: ShapeDefinition<Args, Context>) => RegisteredShape<Args, Context>;
+/**
 * Operations a storage rule can gate. `read` covers `download` / `getMetadata`
 * / `getSignedUrl` / `getUrl`; `write` covers `store` / `generateUploadUrl`;
 * `delete` is `delete`; `list` is a prefix listing (governed via the file
@@ -1817,4 +1977,4 @@ interface StorageContextIn {
 }
 declare const storageRules: <Context extends StorageContextIn = StorageContextIn>(rules: ReadonlyArray<StorageRule<Context>>, options?: StorageRulesOptions) => Middleware<Context, Context>;
 declare const VERSION = "0.0.0";
-export { type ActionBuilder, type ActionCtx, type AggregateIndexDefinition, type AggregateIndexOptions, type AggregateOp, type ArgsValidator, type Component, type ComponentFunctions, type CreateOptions, type DataModelInit, type DefineComponentOptions, type DefinePluginOptions, type DefinePolicyInput, type DefinePresenceOptions, type DefineStorageRuleInput, type DurableObjectJurisdiction, type EmptyArgs, type EnvAccessor, type EnvKeyFailure, type EnvShape, type ExtendableSchema, type FacadeEntry, type FacadeWriterLike, type FunctionKind, type HttpActionCtx, type HttpActionHandler, type HttpMethod, type HttpRoute, type HttpRouteBuilder, type HttpRouteFactory, type HttpRouteHandlerOptions, type HttpStreamHandlerOptions, type InferArgs, type InferEnv, type InlineAggregateIndexOptions, type InlineRankIndexOptions, type InternalActionBuilder, type InternalMutationBuilder, type InternalQueryBuilder, type LifecycleEvent, type LifecycleHandler, type LunoraBuilders, LunoraEnvError, LunoraError, type LunoraErrorCode, type LunoraHttpApp, type LunoraHttpEnv, type LunoraRouteHandler, type ManyRelation, type MaskColumns, type MaskContext, type MaskFn, type MaskOptions, type MaskPolicies, type MaskStrategy, type Middleware, type MiddlewareNext, type MigrationDefinition, type MigrationDocument, type MigrationTransform, type MutationBuilder, type MutationCtx, type OnDeleteAction, type OneRelation, type OrmLike, DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, type Permission, type Plugin, type Policy, type PrefixedTables, type PresenceComponent, type PresenceFunctions, type PresenceMember, type ProtectPublicOptions, type QueryBuilder, type QueryCtx, type RankIndexDefinition, type RankIndexOptions, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMigration, type RegisteredMutation, type RegisteredQuery, type RegisteredStream, type RelationBuilder, type RelationDefinition, type RlsOptions, type Role, type Schema, type SchemaExtension, type StorageOperation, type StorageRule, type StorageRuleContext, type StorageRuleDecision, type StorageRulesOptions, type TableBuilder, type TableDefinition, type TerminalKind, type TriggerBuilder, type TriggerDefinition, type TypedDefinePolicyInput, VERSION, type VectorEmbedder, type VectorIndexDefinition, type VectorIndexOptions, type VectorMetric, type VectorizeOptions, type WhereInput, asBucketStorage, bindOrm, bindTableFacade, composePluginMiddleware, createPolicyDsl, createSecrets, defineAggregateIndex, defineComponent, defineEnv, defineMigration, definePermission, definePlugin, definePolicies, definePolicy, definePresence, defineRankIndex, defineRole, defineSchema, defineSchemaExtension, defineStorageRule, defineStorageRules, defineTable, defineVectorIndex, httpAction, httpRoute, httpRouter, initLunora, installPlugins, mask, mergeSchemaExtension, onConnect, onDisconnect, presenceExtension, protectPublic, redactSecrets, rls, serveStorageObject, storageRules };
+export { type ActionBuilder, type ActionCtx, type AggregateIndexDefinition, type AggregateIndexOptions, type AggregateOp, type ArgsValidator, type Component, type ComponentFunctions, type CreateOptions, type DataModelInit, type DefineComponentOptions, type DefinePluginOptions, type DefinePolicyInput, type DefinePresenceOptions, type DefineStorageRuleInput, type DurableObjectJurisdiction, type EmptyArgs, type EnvAccessor, type EnvKeyFailure, type EnvShape, type ExtendableSchema, type FacadeEntry, type FacadeWriterLike, type FunctionKind, type HttpActionCtx, type HttpActionHandler, type HttpMethod, type HttpRoute, type HttpRouteBuilder, type HttpRouteFactory, type HttpRouteHandlerOptions, type HttpStreamHandlerOptions, type InferArgs, type InferEnv, type InlineAggregateIndexOptions, type InlineRankIndexOptions, type InternalActionBuilder, type InternalMutationBuilder, type InternalQueryBuilder, type LifecycleEvent, type LifecycleHandler, type LunoraBuilders, LunoraEnvError, LunoraError, type LunoraErrorCode, type LunoraHttpApp, type LunoraHttpEnv, type LunoraRouteHandler, type ManyRelation, type MaskColumns, type MaskContext, type MaskFn, type MaskOptions, type MaskPolicies, type MaskStrategy, type Middleware, type MiddlewareNext, type MigrationDefinition, type MigrationDocument, type MigrationTransform, type MutationBuilder, type MutationCtx, type MutatorDefinition, type OnDeleteAction, type OneRelation, type OrmLike, DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, type Permission, type Plugin, type Policy, type PrefixedTables, type PresenceComponent, type PresenceFunctions, type PresenceMember, type ProtectPublicOptions, type QueryBuilder, type QueryCtx, type RankIndexDefinition, type RankIndexOptions, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMigration, type RegisteredMutation, type RegisteredMutator, type RegisteredQuery, type RegisteredShape, type RegisteredStream, type RelationBuilder, type RelationDefinition, type RlsOptions, type RlsReadRegistry, type Role, type Schema, type SchemaExtension, type ShapeDefinition, type ShapeReadWhereRequest, type StorageOperation, type StorageRule, type StorageRuleContext, type StorageRuleDecision, type StorageRulesOptions, type TableBuilder, type TableDefinition, type TerminalKind, type TriggerBuilder, type TriggerDefinition, type TypedDefinePolicyInput, VERSION, type VectorEmbedder, type VectorIndexDefinition, type VectorIndexOptions, type VectorMetric, type VectorizeOptions, type WhereInput, asBucketStorage, bindOrm, bindTableFacade, buildRlsReadRegistry, composePluginMiddleware, composeShapeReadWhere, createPolicyDsl, createSecrets, defineAggregateIndex, defineComponent, defineEnv, defineMigration, defineMutator, definePermission, definePlugin, definePolicies, definePolicy, definePresence, defineRankIndex, defineRole, defineSchema, defineSchemaExtension, defineShape, defineStorageRule, defineStorageRules, defineTable, defineVectorIndex, httpAction, httpRoute, httpRouter, initLunora, installPlugins, mask, mergeSchemaExtension, onConnect, onDisconnect, presenceExtension, protectPublic, redactSecrets, rls, serveStorageObject, storageRules };

package/dist/index.mjs

@@ -1,5 +1,5 @@
 export { default as asBucketStorage } from './packem_shared/asBucketStorage-Cnxd9y2q.mjs';
-export { initLunora } from './packem_shared/initLunora-CATvPsVt.mjs';
+export { initLunora } from './packem_shared/initLunora-lxwHTEV3.mjs';
 export { createSecrets } from './packem_shared/createSecrets-TsIP9lOa.mjs';
 export { LunoraEnvError, defineEnv, redactSecrets } from './packem_shared/LunoraEnvError-DjFkpkSP.mjs';
 export { LunoraError } from './packem_shared/LunoraError-DhggBJZF.mjs';
@@ -7,17 +7,20 @@ export { bindOrm, bindTableFacade } from './packem_shared/bindOrm-Ce57S3N9.mjs';
 export { httpAction, httpRoute, httpRouter, serveStorageObject } from './packem_shared/httpAction-B7FYUEgr.mjs';
 export { onConnect, onDisconnect } from './packem_shared/onConnect-CIPXKPyw.mjs';
 export { defineMigration } from './packem_shared/defineMigration-CAJLr6fx.mjs';
+export { defineMutator } from './packem_shared/defineMutator-EIXAWhs9.mjs';
 export { composePluginMiddleware, defineComponent, definePlugin, defineSchemaExtension, installPlugins, mergeSchemaExtension } from './packem_shared/composePluginMiddleware-Ck5_TUO8.mjs';
-export { PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, definePresence, presenceExtension } from './packem_shared/PRESENCE_DEFAULT_TTL_MS-BgBQsqQ-.mjs';
+export { PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, definePresence, presenceExtension } from './packem_shared/PRESENCE_DEFAULT_TTL_MS-C7j9gY_d.mjs';
 export { protectPublic } from './packem_shared/protectPublic-BjFkQ_Or.mjs';
-export { defineAggregateIndex, defineRankIndex, defineSchema, defineTable, defineVectorIndex } from './packem_shared/defineAggregateIndex-C2gT1GzM.mjs';
+export { defineAggregateIndex, defineRankIndex, defineSchema, defineTable, defineVectorIndex } from './packem_shared/defineAggregateIndex-ZdyU78gh.mjs';
+export { defineShape } from './packem_shared/defineShape-CJ27Wx7o.mjs';
 export { anyApi } from './types.mjs';
 export { cronJobs } from '@lunora/scheduler';
 export { ValidationError, v } from '@lunora/values';
+export { buildRlsReadRegistry, composeShapeReadWhere } from './packem_shared/buildRlsReadRegistry-CkxuS69B.mjs';
 export { createPolicyDsl, definePermission, definePolicies, definePolicy, defineRole } from './packem_shared/createPolicyDsl-De67zPDS.mjs';
 export { defineStorageRule, defineStorageRules } from './packem_shared/defineStorageRule-qu0mpilX.mjs';
 export { mask } from './packem_shared/mask-eCUYOwhd.mjs';
-export { rls } from './packem_shared/rls-Bi9HiyDC.mjs';
+export { rls } from './packem_shared/rls-ClmjkkxZ.mjs';
 export { storageRules } from './packem_shared/storageRules-4a30FSpI.mjs';
 
 const VERSION = "0.0.0";

package/dist/packem_shared/{PRESENCE_DEFAULT_TTL_MS-BgBQsqQ-.mjs → PRESENCE_DEFAULT_TTL_MS-C7j9gY_d.mjs}

@@ -1,9 +1,9 @@
 import { v } from '@lunora/values';
-import { initLunora } from './initLunora-CATvPsVt.mjs';
+import { initLunora } from './initLunora-lxwHTEV3.mjs';
 import { LunoraError } from './LunoraError-DhggBJZF.mjs';
 import { onDisconnect } from './onConnect-CIPXKPyw.mjs';
 import { defineSchemaExtension, defineComponent } from './composePluginMiddleware-Ck5_TUO8.mjs';
-import { defineTable } from './defineAggregateIndex-C2gT1GzM.mjs';
+import { defineTable } from './defineAggregateIndex-ZdyU78gh.mjs';
 
 const DEFAULT_TTL_MS = 3e4;
 const MAX_DATA_BYTES = 4096;

package/dist/packem_shared/buildRlsReadRegistry-CkxuS69B.mjs

@@ -0,0 +1,107 @@
+import { indexRolePermissions, computeReadBaseWhere, permissionName } from './rls-ClmjkkxZ.mjs';
+import { r as readRlsTag } from './policy-tag-DvpVH2tv.mjs';
+
+const FALSE_PREDICATE = { OR: [] };
+const readEntryTags = (entry) => {
+  const hoisted = entry?.rls?.tags;
+  if (hoisted) {
+    return hoisted;
+  }
+  const tag = readRlsTag(entry);
+  return tag ? [tag] : [];
+};
+const addTagToRegistry = (byTable, tag) => {
+  const rolePermissions = indexRolePermissions(tag.roles);
+  const seenWhenByTable = /* @__PURE__ */ new Map();
+  const policiesByTable = /* @__PURE__ */ new Map();
+  for (const policy of tag.policies) {
+    if (policy.on !== "read") {
+      continue;
+    }
+    const seen = seenWhenByTable.get(policy.table) ?? /* @__PURE__ */ new Set();
+    if (seen.has(policy.when)) {
+      continue;
+    }
+    seen.add(policy.when);
+    seenWhenByTable.set(policy.table, seen);
+    const list = policiesByTable.get(policy.table) ?? [];
+    list.push(policy);
+    policiesByTable.set(policy.table, list);
+  }
+  for (const [table, policies] of policiesByTable) {
+    const groups = byTable.get(table) ?? [];
+    groups.push({ policies, rolePermissions });
+    byTable.set(table, groups);
+  }
+};
+const isFalsePredicate = (where) => {
+  const or = where.OR;
+  return Array.isArray(or) && or.length === 0 && Object.keys(where).length === 1;
+};
+const andMerge = (injected, caller) => {
+  if (!injected || Object.keys(injected).length === 0) {
+    return caller;
+  }
+  if (isFalsePredicate(injected)) {
+    return injected;
+  }
+  if (Object.keys(caller).length === 0) {
+    return injected;
+  }
+  return { AND: [injected, caller] };
+};
+const evaluateGroupBaseWhere = (group, request) => {
+  const granted = /* @__PURE__ */ new Set();
+  for (const roleName of request.roles) {
+    for (const name of group.rolePermissions.get(roleName) ?? []) {
+      granted.add(name);
+    }
+  }
+  return computeReadBaseWhere(group.policies, {
+    auth: {
+      can: (permission) => granted.has(permissionName(permission)),
+      identity: request.identity,
+      roles: request.roles,
+      userId: request.userId
+    },
+    ctx: request.ctx
+  });
+};
+const resolveReadBaseWhere = (registry, request) => {
+  const groups = registry.byTable.get(request.table);
+  if (!groups || groups.length === 0) {
+    return request.rlsRequired && !request.tablePublic ? FALSE_PREDICATE : void 0;
+  }
+  const predicates = [];
+  for (const group of groups) {
+    const base = evaluateGroupBaseWhere(group, request);
+    if (base === void 0) {
+      return void 0;
+    }
+    if (isFalsePredicate(base)) {
+      continue;
+    }
+    predicates.push(base);
+  }
+  if (predicates.length === 0) {
+    return FALSE_PREDICATE;
+  }
+  return predicates.length === 1 ? predicates[0] : { OR: predicates };
+};
+const buildRlsReadRegistry = (functions) => {
+  const byTable = /* @__PURE__ */ new Map();
+  const seenTags = /* @__PURE__ */ new Set();
+  for (const entry of functions) {
+    for (const tag of readEntryTags(entry)) {
+      if (seenTags.has(tag)) {
+        continue;
+      }
+      seenTags.add(tag);
+      addTagToRegistry(byTable, tag);
+    }
+  }
+  return { byTable };
+};
+const composeShapeReadWhere = (registry, request) => andMerge(resolveReadBaseWhere(registry, request), request.shapeWhere);
+
+export { buildRlsReadRegistry, composeShapeReadWhere };

package/dist/packem_shared/{defineAggregateIndex-C2gT1GzM.mjs → defineAggregateIndex-ZdyU78gh.mjs}

@@ -41,6 +41,7 @@ const defineTable = (inputShape) => {
   let isExternallyManaged = false;
   let isPublic = false;
   let softDelete;
+  let externalSource;
   const builder = {
     aggregateIndex(name, options) {
       const op = options?.op ?? "count";
@@ -63,6 +64,9 @@ const defineTable = (inputShape) => {
     get aggregateIndexes() {
       return aggregateIndexes;
     },
+    get externalSource() {
+      return externalSource;
+    },
     externallyManaged() {
       isExternallyManaged = true;
       return builder;
@@ -137,6 +141,17 @@ const defineTable = (inputShape) => {
     get softDeleteMode() {
       return softDelete;
     },
+    source(definition) {
+      if (!definition.binding) {
+        throw new Error("source: `binding` is required (the wrangler Hyperdrive binding name)");
+      }
+      if (!definition.query) {
+        throw new Error("source: `query` is required (the tenant-membership SQL)");
+      }
+      externalSource = definition;
+      isExternallyManaged = true;
+      return builder;
+    },
     softDelete(options) {
       const field = options?.field ?? "deletedAt";
       softDelete = { field };
@@ -243,9 +258,33 @@ const attachStandaloneIndexes = (tables, aggregateIndexes, rankIndexes) => {
     table.rankIndexes.push(index);
   }
 };
+const validateExternalSources = (tables) => {
+  for (const [name, table] of Object.entries(tables)) {
+    const source = table.externalSource;
+    if (!source) {
+      continue;
+    }
+    if (table.shardMode.kind === "global") {
+      throw new Error(
+        `defineSchema: table "${name}" cannot be both .source() and .global() — a sourced table materializes into a shard DO's SQLite, a global table lives in the external tier`
+      );
+    }
+    if (table.shardMode.kind === "shardBy" && !source.tenantBy) {
+      throw new Error(
+        `defineSchema: sourced + .shardBy() table "${name}" needs a \`tenantBy\` mapper — without it every tenant's DO would run the same unscoped query and replicate the whole multitenant table (a cross-tenant leak). Add \`tenantBy: (shardKey) => [shardKey]\` binding the shard key into the query's parameters.`
+      );
+    }
+    if (source.mode === "incremental") {
+      throw new Error(
+        `defineSchema: table "${name}" uses \`mode: "incremental"\`, which is not yet implemented — only "full-pull" (the default) is supported. Remove \`mode\` or set it to "full-pull".`
+      );
+    }
+  }
+};
 const defineSchema = (tables, vectorIndexes = {}, aggregateIndexes = {}, rankIndexes = {}) => {
   fillIndexTableNames(tables);
   attachStandaloneIndexes(tables, aggregateIndexes, rankIndexes);
+  validateExternalSources(tables);
   return withExtend({ tables, vectorIndexes });
 };
 

package/dist/packem_shared/defineMutator-EIXAWhs9.mjs

@@ -0,0 +1,11 @@
+import { v as validateArgs } from './functions-Di9FUNkf.mjs';
+
+const defineMutator = (definition) => {
+  const handler = async (context, rawArgs) => {
+    const parsed = validateArgs(definition.args ?? {}, rawArgs);
+    return definition.server(context, parsed);
+  };
+  return { __lunoraMutator: true, ...definition, handler, kind: "mutation" };
+};
+
+export { defineMutator };

package/dist/packem_shared/defineShape-CJ27Wx7o.mjs

@@ -0,0 +1,17 @@
+import { v as validateArgs } from './functions-Di9FUNkf.mjs';
+
+const defineShape = (definition) => {
+  if (definition.table.trim() === "") {
+    throw new Error("defineShape: `table` must be a non-empty string");
+  }
+  if (definition.columns?.length === 0) {
+    throw new Error("defineShape: `columns` must list at least one column when provided");
+  }
+  const compileWhere = (context, rawArgs) => {
+    const parsed = validateArgs(definition.args ?? {}, rawArgs);
+    return definition.where(context, parsed);
+  };
+  return { __lunoraShape: true, ...definition, compileWhere };
+};
+
+export { defineShape };

package/dist/packem_shared/functions-Di9FUNkf.mjs

@@ -0,0 +1,5 @@
+import { parseValidatorMap } from '@lunora/values';
+
+const validateArgs = (validators, args) => parseValidatorMap(validators, args, "args");
+
+export { validateArgs as v };

package/dist/packem_shared/{initLunora-CATvPsVt.mjs → initLunora-lxwHTEV3.mjs}

@@ -1,8 +1,7 @@
-import { parseValidatorMap } from '@lunora/values';
+import { v as validateArgs } from './functions-Di9FUNkf.mjs';
+import { r as readRlsTag } from './policy-tag-DvpVH2tv.mjs';
 import { r as runMiddlewareChain } from './run-middleware-CYQOuoV6.mjs';
 
-const validateArgs = (validators, args) => parseValidatorMap(validators, args, "args");
-
 const runMiddleware = (middlewares, baseContext) => runMiddlewareChain(middlewares, baseContext, (context) => context);
 const makeHandler = (args, middlewares, userHandler, output) => async (context, rawArgs) => {
   const parsed = validateArgs(args, rawArgs);
@@ -35,16 +34,29 @@ const makeStreamHandler = (args, middlewares, userHandler) => (context, rawArgs,
     }
   })();
 };
+const collectRls = (middlewares) => {
+  const tags = [];
+  for (const middleware of middlewares) {
+    const tag = readRlsTag(middleware);
+    if (!tag) {
+      continue;
+    }
+    tags.push(tag);
+  }
+  return tags.length > 0 ? { tags } : void 0;
+};
 const makeBuilder = (kind, state, visibility) => {
   return {
     __lunoraProcedure: kind,
     ...visibility ? { __lunoraVisibility: visibility } : {},
     input: (validators) => makeBuilder(kind, { ...state, args: { ...state.args, ...validators } }, visibility),
     [kind]: (userHandler) => {
+      const rls = collectRls(state.middlewares);
       return {
         args: state.args,
         handler: makeHandler(state.args, state.middlewares, userHandler, state.output),
         kind,
+        ...rls ? { rls } : {},
         ...visibility ? { visibility } : {}
       };
     },
@@ -55,10 +67,12 @@ const makeBuilder = (kind, state, visibility) => {
     // unconditionally keeps the runtime free of per-kind branching.
     ...kind === "query" ? {
       stream: (userHandler) => {
+        const rls = collectRls(state.middlewares);
         return {
           args: state.args,
           handler: makeStreamHandler(state.args, state.middlewares, userHandler),
           kind: "stream",
+          ...rls ? { rls } : {},
           ...visibility ? { visibility } : {}
         };
       }

package/dist/packem_shared/policy-tag-DvpVH2tv.mjs

@@ -0,0 +1,13 @@
+const RLS_TAG = /* @__PURE__ */ Symbol.for("lunora.rls.middleware-policies");
+const tagRlsMiddleware = (middleware, tag) => {
+  Object.defineProperty(middleware, RLS_TAG, { configurable: true, enumerable: false, value: tag });
+  return middleware;
+};
+const readRlsTag = (middleware) => {
+  if (middleware === null || typeof middleware !== "function" && typeof middleware !== "object") {
+    return void 0;
+  }
+  return middleware[RLS_TAG];
+};
+
+export { readRlsTag as r, tagRlsMiddleware as t };

package/dist/packem_shared/{rls-Bi9HiyDC.mjs → rls-ClmjkkxZ.mjs}

@@ -1,5 +1,6 @@
 import { LunoraError } from './LunoraError-DhggBJZF.mjs';
 import { bindTableFacade, bindOrm } from './bindOrm-Ce57S3N9.mjs';
+import { t as tagRlsMiddleware } from './policy-tag-DvpVH2tv.mjs';
 
 const DEFAULT_BATCH_LIMIT = 500;
 const assertBatchLimit = (count, limit, op) => {
@@ -532,7 +533,7 @@ const indexRolePermissions = (roles) => {
 const rls = (policies, options = {}) => {
   const perTable = indexByTable(policies);
   const rolePermissions = indexRolePermissions(options.roles);
-  return async ({ ctx, next }) => {
+  const middleware = async ({ ctx, next }) => {
     const auth = ctx.auth ?? {};
     const identity = await auth.getIdentity?.() ?? null;
     const roles = auth.roles ?? [];
@@ -562,6 +563,7 @@ const rls = (policies, options = {}) => {
     }
     return next({ ctx: extension });
   };
+  return tagRlsMiddleware(middleware, { policies, roles: options.roles ?? [] });
 };
 
 export { computeReadBaseWhere, evaluateWrite, indexRolePermissions, matchesWhere, permissionName, rls };

package/dist/rls/testing.mjs

@@ -1,4 +1,4 @@
-import { indexRolePermissions, computeReadBaseWhere, matchesWhere, evaluateWrite, permissionName } from '../packem_shared/rls-Bi9HiyDC.mjs';
+import { indexRolePermissions, computeReadBaseWhere, matchesWhere, evaluateWrite, permissionName } from '../packem_shared/rls-ClmjkkxZ.mjs';
 
 const expectPolicy = (policies, options = {}) => {
   const rolePermissions = indexRolePermissions(options.roles);

package/dist/types.d.mts

@@ -23,6 +23,51 @@ type ShardMode = {
 } | {
   kind: "root";
 };
+/** Poll cadence for a sourced table — `"manual"` (pull only on an explicit trigger) or a fixed interval. */
+type ExternalSourceRefresh = "manual" | {
+  everyMs: number;
+};
+/**
+* Delete-detection mode for external-source ingest. `"full-pull"` (default) reads
+* the whole tenant membership each tick and diffs it, so it observes upstream
+* deletes; `"incremental"` pulls only changed rows (cheap) and is blind to deletes
+* unless paired with a soft-delete column or a `reconcileEveryMs` full-pull sweep.
+*/
+type ExternalSourceMode = "full-pull" | "incremental";
+/**
+* Config for `.source(...)` (plan 077): declares a table as **materialized from an
+* external Postgres/MySQL behind Cloudflare Hyperdrive**, not written by user
+* mutations. A system-driven poll loop reads the tenant slice and lands it in the
+* DO's SQLite (via the validated CDC writer), after which `defineShape` carries it
+* to clients unchanged. Orthogonal to `shardMode` — a sourced table almost always
+* also `.shardBy()`s, in which case `tenantBy` is the mandatory tenant-isolation
+* boundary (enforced by the `external_source_unscoped` advisor lint).
+*/
+interface ExternalSourceDefinition {
+  /** The wrangler Hyperdrive binding name the poll loop reads from. */
+  binding: string;
+  /** Project the materialized rows to these columns (passed to the membership diff). Omit ⇒ the full mapped document. */
+  columns?: ReadonlyArray<string>;
+  /** Column whose value becomes the Lunora `_id`. Defaults to `"id"`. */
+  idColumn?: string;
+  /** Transform an external row into the stored document body. Omit ⇒ every selected column except `idColumn` is copied. */
+  map?: (row: Record<string, unknown>) => Record<string, unknown>;
+  /** Delete-detection mode. Defaults to `"full-pull"`. */
+  mode?: ExternalSourceMode;
+  /** The full tenant-membership query, with driver-native placeholders (`$1` / `?`). `tenantBy` binds its params. */
+  query: string;
+  /** `"incremental"` only: run a full-pull reconcile this often to garbage-collect tombstones the incremental path can't see. */
+  reconcileEveryMs?: number;
+  /** Poll cadence, or `"manual"`. Omit ⇒ the runtime's size-scaled default. */
+  refresh?: ExternalSourceRefresh;
+  /**
+  * **Mandatory under `.shardBy()`**: map this DO's shard key → the query's bound
+  * params, so a tenant DO can only ever pull its own rows. An unscoped sourced +
+  * sharded table replicates the whole multitenant table into every shard — the
+  * `external_source_unscoped` advisor lint fails the build when this is absent.
+  */
+  tenantBy?: (shardKey: string) => ReadonlyArray<unknown>;
+}
 interface IndexDefinition {
   fields: ReadonlyArray<string>;
   name: string;
@@ -138,6 +183,14 @@ interface TableDefinition<Shape extends Record<string, Validator> = Record<strin
   * without scanning the underlying table.
   */
   aggregateIndexes: ReadonlyArray<AggregateIndexDefinition>;
+  /**
+  * Set by `.source(...)` (named `externalSource`, not `source`, so the data
+  * field doesn't collide with the fluent `.source()` builder method — same
+  * convention as `shardBy()`/`shardMode`). When present, the table is
+  * materialized from an external Hyperdrive-backed database by a system poll
+  * loop rather than user mutations. Implies `isExternallyManaged`.
+  */
+  externalSource?: ExternalSourceDefinition;
   indexes: ReadonlyArray<IndexDefinition>;
   /**
   * `true` when `.externallyManaged()` was called — the table's rows are
@@ -1101,4 +1154,4 @@ interface ActionCtx {
 */
 type AnyApi = Record<string, Record<string, RegisteredFunction<ArgsValidator, unknown, FunctionKind>>>;
 declare const anyApi: AnyApi;
-export { type ActionCtx, type AggregateIndexDefinition, type AggregateOp, type AnyApi, type ArgsValidator, type AuthState, type DatabaseReader, type DatabaseWriter, type DurableObjectJurisdiction, type FunctionKind, type FunctionVisibility, type GlobalBackend, type IndexDefinition, type IndexRangeBuilder, type InferArgs, type LifecycleEvent, type LifecycleEventKind, type LunoraLogger, type MutationCtx, type OnDeleteAction, type PaginationOptions, type PaginationResult, type QueryCtx, type RankIndexDefinition, type RankSortKey, type ReadOnlyStorage, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMutation, type RegisteredQuery, type RegisteredStream, type RelationDefinition, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type Schema, type SearchFilterBuilder, type SearchIndexDefinition, type Secrets, type SecretsStoreSecretLike, type ShardMode, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableDefinition, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerBuilder, type TriggerCtx, type TriggerDatabase, type TriggerDefinition, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type VectorEmbedder, type VectorIndexDefinition, type VectorMatch, type VectorMatches, type VectorMetric, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, anyApi };
+export { type ActionCtx, type AggregateIndexDefinition, type AggregateOp, type AnyApi, type ArgsValidator, type AuthState, type DatabaseReader, type DatabaseWriter, type DurableObjectJurisdiction, type ExternalSourceDefinition, type ExternalSourceMode, type ExternalSourceRefresh, type FunctionKind, type FunctionVisibility, type GlobalBackend, type IndexDefinition, type IndexRangeBuilder, type InferArgs, type LifecycleEvent, type LifecycleEventKind, type LunoraLogger, type MutationCtx, type OnDeleteAction, type PaginationOptions, type PaginationResult, type QueryCtx, type RankIndexDefinition, type RankSortKey, type ReadOnlyStorage, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMutation, type RegisteredQuery, type RegisteredStream, type RelationDefinition, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type Schema, type SearchFilterBuilder, type SearchIndexDefinition, type Secrets, type SecretsStoreSecretLike, type ShardMode, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableDefinition, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerBuilder, type TriggerCtx, type TriggerDatabase, type TriggerDefinition, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type VectorEmbedder, type VectorIndexDefinition, type VectorMatch, type VectorMatches, type VectorMetric, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, anyApi };

package/dist/types.d.ts

@@ -23,6 +23,51 @@ type ShardMode = {
 } | {
   kind: "root";
 };
+/** Poll cadence for a sourced table — `"manual"` (pull only on an explicit trigger) or a fixed interval. */
+type ExternalSourceRefresh = "manual" | {
+  everyMs: number;
+};
+/**
+* Delete-detection mode for external-source ingest. `"full-pull"` (default) reads
+* the whole tenant membership each tick and diffs it, so it observes upstream
+* deletes; `"incremental"` pulls only changed rows (cheap) and is blind to deletes
+* unless paired with a soft-delete column or a `reconcileEveryMs` full-pull sweep.
+*/
+type ExternalSourceMode = "full-pull" | "incremental";
+/**
+* Config for `.source(...)` (plan 077): declares a table as **materialized from an
+* external Postgres/MySQL behind Cloudflare Hyperdrive**, not written by user
+* mutations. A system-driven poll loop reads the tenant slice and lands it in the
+* DO's SQLite (via the validated CDC writer), after which `defineShape` carries it
+* to clients unchanged. Orthogonal to `shardMode` — a sourced table almost always
+* also `.shardBy()`s, in which case `tenantBy` is the mandatory tenant-isolation
+* boundary (enforced by the `external_source_unscoped` advisor lint).
+*/
+interface ExternalSourceDefinition {
+  /** The wrangler Hyperdrive binding name the poll loop reads from. */
+  binding: string;
+  /** Project the materialized rows to these columns (passed to the membership diff). Omit ⇒ the full mapped document. */
+  columns?: ReadonlyArray<string>;
+  /** Column whose value becomes the Lunora `_id`. Defaults to `"id"`. */
+  idColumn?: string;
+  /** Transform an external row into the stored document body. Omit ⇒ every selected column except `idColumn` is copied. */
+  map?: (row: Record<string, unknown>) => Record<string, unknown>;
+  /** Delete-detection mode. Defaults to `"full-pull"`. */
+  mode?: ExternalSourceMode;
+  /** The full tenant-membership query, with driver-native placeholders (`$1` / `?`). `tenantBy` binds its params. */
+  query: string;
+  /** `"incremental"` only: run a full-pull reconcile this often to garbage-collect tombstones the incremental path can't see. */
+  reconcileEveryMs?: number;
+  /** Poll cadence, or `"manual"`. Omit ⇒ the runtime's size-scaled default. */
+  refresh?: ExternalSourceRefresh;
+  /**
+  * **Mandatory under `.shardBy()`**: map this DO's shard key → the query's bound
+  * params, so a tenant DO can only ever pull its own rows. An unscoped sourced +
+  * sharded table replicates the whole multitenant table into every shard — the
+  * `external_source_unscoped` advisor lint fails the build when this is absent.
+  */
+  tenantBy?: (shardKey: string) => ReadonlyArray<unknown>;
+}
 interface IndexDefinition {
   fields: ReadonlyArray<string>;
   name: string;
@@ -138,6 +183,14 @@ interface TableDefinition<Shape extends Record<string, Validator> = Record<strin
   * without scanning the underlying table.
   */
   aggregateIndexes: ReadonlyArray<AggregateIndexDefinition>;
+  /**
+  * Set by `.source(...)` (named `externalSource`, not `source`, so the data
+  * field doesn't collide with the fluent `.source()` builder method — same
+  * convention as `shardBy()`/`shardMode`). When present, the table is
+  * materialized from an external Hyperdrive-backed database by a system poll
+  * loop rather than user mutations. Implies `isExternallyManaged`.
+  */
+  externalSource?: ExternalSourceDefinition;
   indexes: ReadonlyArray<IndexDefinition>;
   /**
   * `true` when `.externallyManaged()` was called — the table's rows are
@@ -1101,4 +1154,4 @@ interface ActionCtx {
 */
 type AnyApi = Record<string, Record<string, RegisteredFunction<ArgsValidator, unknown, FunctionKind>>>;
 declare const anyApi: AnyApi;
-export { type ActionCtx, type AggregateIndexDefinition, type AggregateOp, type AnyApi, type ArgsValidator, type AuthState, type DatabaseReader, type DatabaseWriter, type DurableObjectJurisdiction, type FunctionKind, type FunctionVisibility, type GlobalBackend, type IndexDefinition, type IndexRangeBuilder, type InferArgs, type LifecycleEvent, type LifecycleEventKind, type LunoraLogger, type MutationCtx, type OnDeleteAction, type PaginationOptions, type PaginationResult, type QueryCtx, type RankIndexDefinition, type RankSortKey, type ReadOnlyStorage, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMutation, type RegisteredQuery, type RegisteredStream, type RelationDefinition, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type Schema, type SearchFilterBuilder, type SearchIndexDefinition, type Secrets, type SecretsStoreSecretLike, type ShardMode, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableDefinition, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerBuilder, type TriggerCtx, type TriggerDatabase, type TriggerDefinition, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type VectorEmbedder, type VectorIndexDefinition, type VectorMatch, type VectorMatches, type VectorMetric, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, anyApi };
+export { type ActionCtx, type AggregateIndexDefinition, type AggregateOp, type AnyApi, type ArgsValidator, type AuthState, type DatabaseReader, type DatabaseWriter, type DurableObjectJurisdiction, type ExternalSourceDefinition, type ExternalSourceMode, type ExternalSourceRefresh, type FunctionKind, type FunctionVisibility, type GlobalBackend, type IndexDefinition, type IndexRangeBuilder, type InferArgs, type LifecycleEvent, type LifecycleEventKind, type LunoraLogger, type MutationCtx, type OnDeleteAction, type PaginationOptions, type PaginationResult, type QueryCtx, type RankIndexDefinition, type RankSortKey, type ReadOnlyStorage, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMutation, type RegisteredQuery, type RegisteredStream, type RelationDefinition, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type Schema, type SearchFilterBuilder, type SearchIndexDefinition, type Secrets, type SecretsStoreSecretLike, type ShardMode, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableDefinition, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerBuilder, type TriggerCtx, type TriggerDatabase, type TriggerDefinition, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type VectorEmbedder, type VectorIndexDefinition, type VectorMatch, type VectorMatches, type VectorMetric, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, anyApi };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/server",
-  "version": "1.0.0-alpha.6",
+  "version": "1.0.0-alpha.8",
   "description": "Server primitives for Lunora: defineSchema, defineTable, query, mutation, and action",
   "keywords": [
     "backend",