@lunora/studio 0.0.0 → 1.0.0-alpha.1

package/dist/index.d.ts

@@ -0,0 +1,1402 @@
+import { F as FunctionDescriptor } from "./packem_shared/app.d-CCmwDEVs.js";
+export { type a as FunctionKind, type R as RunStatus, b as ScheduledJobs, type c as ScheduledJobsProps, d as Studio, e as StudioApp, type S as StudioAppProps, type f as StudioProps, type g as StudioTab } from "./packem_shared/app.d-CCmwDEVs.js";
+import { ReactElement, ReactNode, ErrorInfo, Component, ChangeEvent } from 'react';
+import { CapturedMail } from '@lunora/mail';
+export type { CapturedMail } from '@lunora/mail';
+import { Messages, I18n } from '@lingui/core';
+export type { LunoraClient, ScheduleRecord, StorageObject } from '@lunora/client';
+/** A navigable destination shown in the palette. */
+interface CommandItem {
+  /** Localised domain label, shown as a muted suffix to disambiguate. */
+  readonly group: string;
+  /** Localised sub-page label, the primary search target. */
+  readonly label: string;
+  /** Router path to navigate to on select (e.g. `/logs`). */
+  readonly to: string;
+}
+interface CommandPaletteProps {
+  /** Every navigable destination, in rail order. */
+  readonly items: ReadonlyArray<CommandItem>;
+}
+/** Open the command palette from anywhere (e.g. the top-bar Search button). */
+declare const openCommandPalette: () => void;
+/**
+* Command palette (⌘K / Ctrl-K) — Supabase-style global search. Rendered inside
+* the studio shell so its selection can drive the router's `useNavigate`. Opens
+* on the keyboard shortcut or the {@link OPEN_EVENT} the top-bar Search button
+* dispatches, filters the navigable destinations by a case-insensitive substring
+* over their label and domain, and navigates to the chosen one. Built on the
+* studio's Base UI dialog primitive — no `cmdk`/extra dependency — with a small
+* arrow-key + Enter affordance over the filtered list.
+*/
+declare const CommandPalette: ({
+  items
+}: CommandPaletteProps) => ReactElement;
+interface ConfirmButtonProps {
+  /** Label for the initial trigger (e.g. `Delete`). */
+  readonly children: string;
+  /** Label for the confirm step; defaults to a localised `Confirm`. */
+  readonly confirmLabel?: string;
+  /** Disable the trigger (e.g. while a write is in flight). */
+  readonly disabled?: boolean;
+  /** Action run only after the operator confirms. */
+  readonly onConfirm: () => void;
+  /** `data-testid` for the initial trigger; the confirm/cancel steps derive `${testId}-confirm` / `${testId}-cancel`. */
+  readonly testId: string;
+}
+/**
+* A destructive-action button that requires a second click to fire. The first
+* click swaps the trigger for an inline `Confirm` / `Cancel` pair rather than a
+* blocking `window.confirm`, so the guard is testable and non-modal. The
+* trigger keeps its `testId` (so existing tests that click it still reach the
+* first step); the actual action only runs on the `${testId}-confirm` click.
+*/
+declare const ConfirmButton: ({
+  children,
+  confirmLabel,
+  disabled,
+  onConfirm,
+  testId
+}: ConfirmButtonProps) => ReactElement;
+/**
+* Live-socket status indicator. Reflects the client's aggregate WebSocket health
+* so an operator can tell a healthy live channel from a silently-dropped socket
+* (a panel showing "Live: on" while the socket is down would otherwise look
+* identical to one that's simply idle).
+*/
+declare const ConnectionBadge: () => ReactElement;
+interface ErrorBoundaryProps {
+  readonly children: ReactNode;
+  /**
+  * Localised fallback heading. When omitted, falls back to `${label} failed`
+  * (or `Something went wrong` with no label). A class component can't use the
+  * `useT` hook, so localised text is passed in by its parents.
+  */
+  readonly fallbackTitle?: string;
+  /** Optional label naming the boundary's region, shown in the fallback. */
+  readonly label?: string;
+  /** Localised label for the retry button; defaults to `Try again`. */
+  readonly retryLabel?: string;
+}
+interface ErrorBoundaryState {
+  readonly error: Error | null;
+}
+/**
+* Catches render/lifecycle errors in a panel so one throwing component doesn't
+* blank the whole studio shell. Shows the error message with a "Try again"
+* button that clears the boundary and re-renders its children.
+*/
+declare class ErrorBoundary extends Component<ErrorBoundaryProps, ErrorBoundaryState> {
+  static getDerivedStateFromError(error: Error): ErrorBoundaryState;
+  override state: ErrorBoundaryState;
+  override componentDidCatch(error: Error, info: ErrorInfo): void;
+  readonly reset: () => void;
+  override render(): ReactNode;
+}
+interface ShardInputProps {
+  /** DOM `id` for the input, so an external label's `htmlFor` can target it. Optional. */
+  readonly id?: string;
+  readonly onChange: (value: string) => void;
+  /** `data-testid` for the input (panels keep their existing id, e.g. `mt-shard-input`). */
+  readonly testId: string;
+  readonly value: string;
+}
+/**
+* Shard-key text field shared by every shard-scoped panel. Backed by a
+* `&lt;datalist>` of recently-used shard keys (see {@link loadRecentShards}) so an
+* operator can pick a shard they've visited instead of retyping it — the closest
+* to a shard picker possible without server-side shard enumeration, which
+* Durable Objects don't support. Panels remain responsible for recording a shard
+* as used (via `recordShard`) when they actually query it.
+*/
+declare const ShardInput: ({
+  id,
+  onChange,
+  testId,
+  value
+}: ShardInputProps) => ReactElement;
+declare const ADMIN_FUNCTION_PREFIX = "__lunora_admin__:";
+/**
+* Fully-qualified reserved paths the studio invokes via the client. The
+* `__lunora_admin__:` prefix is spelled out inline rather than interpolated so
+* the values stay emittable under `--isolatedDeclarations`. Every path is
+* intercepted by `ShardDO` before user dispatch and gated by the server's
+* `LUNORA_ADMIN_TOKEN`.
+*/
+declare const ADMIN_FUNCTIONS: {
+  readonly clearCapturedMail: "__lunora_admin__:clearCapturedMail";
+  readonly clearTable: "__lunora_admin__:clearTable";
+  readonly createWorkflowInstance: "__lunora_admin__:createWorkflowInstance";
+  readonly deleteRows: "__lunora_admin__:deleteRows";
+  readonly describeTable: "__lunora_admin__:describeTable";
+  readonly describeTables: "__lunora_admin__:describeTables";
+  readonly exportShard: "__lunora_admin__:exportShard";
+  readonly facetColumn: "__lunora_admin__:facetColumn";
+  readonly getAdvisories: "__lunora_admin__:getAdvisories";
+  readonly getAuditLog: "__lunora_admin__:getAuditLog";
+  readonly getAuthMetrics: "__lunora_admin__:getAuthMetrics";
+  readonly getCapturedMail: "__lunora_admin__:getCapturedMail";
+  readonly getFunctionStats: "__lunora_admin__:getFunctionStats";
+  readonly listSubscriptions: "__lunora_admin__:listSubscriptions";
+  readonly listTableIndexes: "__lunora_admin__:listTableIndexes";
+  readonly listWorkflows: "__lunora_admin__:listWorkflows";
+  readonly getLogs: "__lunora_admin__:getLogs";
+  readonly getMetrics: "__lunora_admin__:getMetrics";
+  readonly getPitrBookmark: "__lunora_admin__:getPitrBookmark";
+  readonly getRequestLog: "__lunora_admin__:getRequestLog";
+  readonly getSecurityAudit: "__lunora_admin__:getSecurityAudit";
+  readonly getSettings: "__lunora_admin__:getSettings";
+  readonly getWorkflowInstanceStatus: "__lunora_admin__:getWorkflowInstanceStatus";
+  readonly importShard: "__lunora_admin__:importShard";
+  readonly listTables: "__lunora_admin__:listTables";
+  readonly maskPolicies: "__lunora_admin__:maskPolicies";
+  readonly migrationStatus: "__lunora_admin__:migrationStatus";
+  readonly pitrRestore: "__lunora_admin__:pitrRestore";
+  readonly readTablePage: "__lunora_admin__:readTablePage";
+  readonly rlsPolicies: "__lunora_admin__:rlsPolicies";
+  readonly runAs: "__lunora_admin__:runAs";
+  readonly runMigration: "__lunora_admin__:runMigration";
+  readonly runSql: "__lunora_admin__:runSql";
+  readonly sendTestMail: "__lunora_admin__:sendTestMail";
+  readonly storageOrphans: "__lunora_admin__:storageOrphans";
+  readonly storageReferences: "__lunora_admin__:storageReferences";
+  readonly storageRules: "__lunora_admin__:storageRules";
+  readonly studioFeatures: "__lunora_admin__:studioFeatures";
+  readonly writeRow: "__lunora_admin__:writeRow";
+};
+/** Comparison a {@link FilterClause} applies, mirroring `@lunora/do`'s `FilterOperator`. `contains` is a substring (LIKE). */
+type FilterOperator = "contains" | "eq" | "gt" | "gte" | "lt" | "lte" | "ne";
+/**
+* One structured column filter passed to `readTablePage`, mirroring `@lunora/do`'s
+* `FilterClause`. AND-combined with the substring search and the other clauses.
+* `value` is sent as-is and bound server-side, so it never injects SQL.
+*/
+interface FilterClause {
+  column: string;
+  operator: FilterOperator;
+  value?: unknown;
+}
+/** Which single-row mutation a {@link WriteRowArgs} performs. */
+type WriteRowOp = "delete" | "insert" | "patch" | "replace";
+/** Arguments for the `__lunora_admin__:writeRow` admin op. */
+interface WriteRowArgs {
+  /** The row's fields. Required for insert/patch/replace; omitted for delete. */
+  doc?: Record<string, unknown>;
+  /** Primary key of the target row. Required for patch/replace/delete. */
+  id?: string;
+  op: WriteRowOp;
+  table: string;
+}
+/** Result of a {@link WriteRowArgs} op — the affected row's primary key. */
+interface WriteRowResult {
+  id: null | string;
+  op: WriteRowOp;
+}
+/** Result of `__lunora_admin__:getCapturedMail` — the dev mail-catcher inbox, newest first. */
+interface CapturedMailResult {
+  entries: CapturedMail[];
+}
+/** Reactive-cache hit/miss/eviction stats, present when a cache is configured. */
+interface CacheStats {
+  bytes: number;
+  entries: number;
+  evictions: number;
+  hits: number;
+  misses: number;
+}
+/** Health snapshot returned by `__lunora_admin__:getMetrics` for one shard. */
+interface ShardMetrics {
+  cache: CacheStats | null;
+  databaseSize: null | number;
+  errors: number;
+  requests: number;
+  shard: string;
+  sinceMs: number;
+  uptimeMs: number;
+}
+/**
+* One full-scan attribution entry on a {@link FunctionCallStat}, mirroring
+* `@lunora/do`'s `FunctionScanAttribution`: how many times the function
+* full-scanned `table`. The causal evidence behind the "missing index" insight.
+*/
+interface FunctionScanAttribution {
+  scans: number;
+  table: string;
+}
+/**
+* Per-function execution counters returned by `__lunora_admin__:getFunctionStats`
+* for one shard. Mirrors `@lunora/do`'s `FunctionCallStat`. Counters are
+* per-DO-instance and reset on hibernation/restart — a "since this instance
+* woke" readout. Durations are handler wall-clock milliseconds.
+*
+* `scans` / `scannedTables` carry the causal full-scan attribution (PLAN3 1.2).
+* They're additive — a worker predating the feature reports `scans: 0` and
+* `scannedTables: []`, so the fields are optional on the wire and the consumer
+* defaults them. `conflicts` (OCC write-contention count, a subset of `errors`)
+* is likewise additive and optional for the same back-compat reason.
+*/
+interface FunctionCallStat {
+  calls: number;
+  /** OCC write-conflict count — a subset of `errors`; absent on a pre-conflict-tracking worker. */
+  conflicts?: number;
+  errors: number;
+  lastCalledAt: number;
+  lastErrorAt: null | number;
+  lastErrorMessage: null | string;
+  maxDurationMs: number;
+  path: string;
+  /** Per-table full-scan attribution, busiest scan first; absent on a pre-1.2 worker. */
+  scannedTables?: FunctionScanAttribution[];
+  /** Total full-table scans across every dispatch; absent on a pre-1.2 worker. */
+  scans?: number;
+  totalDurationMs: number;
+}
+/** Payload of a `__lunora_admin__:getFunctionStats` call, mirroring `@lunora/do`'s `FunctionStatsResult`. */
+interface FunctionStatsResult {
+  functions: FunctionCallStat[];
+  sinceMs: number;
+}
+/**
+* One declared index on a table, mirroring `@lunora/do`'s `TableIndexInfo`.
+* `type` is the index kind; `fields` the indexed columns (sort fields for rank,
+* text + filter fields for search, source field for vector); `unique` is set
+* only for unique secondary indexes.
+*/
+interface TableIndexInfo {
+  fields: string[];
+  name: string;
+  type: "index" | "rank" | "search" | "vector";
+  unique?: boolean;
+}
+/** Payload of a `__lunora_admin__:listTableIndexes` call, mirroring `@lunora/do`'s `TableIndexesResult`. */
+interface TableIndexesResult {
+  indexes: TableIndexInfo[];
+}
+/** Severity of a buffered log entry, mirroring `@lunora/do`'s `LogLevel`. */
+type LogLevel = "debug" | "error" | "info" | "warn";
+/**
+* One buffered log line returned by `__lunora_admin__:getLogs`. `functionPath`
+* is the RPC that produced it (when known); `timestamp` is epoch-ms. Mirrors
+* `@lunora/do`'s `LogEntry`.
+*/
+interface LogEntry {
+  functionPath?: string;
+  level: LogLevel;
+  message: string;
+  timestamp: number;
+}
+/** Payload of a `__lunora_admin__:getLogs` call: the buffered entries, newest first. */
+interface LogsResult {
+  entries: LogEntry[];
+}
+/**
+* One recorded admin operation returned by `__lunora_admin__:getAuditLog`,
+* mirroring `@lunora/do`'s `AuditEntry`. Unlike the in-memory logs, the audit
+* log is durable and survives hibernation/restart. `seq` is a monotonic
+* per-shard cursor; `op` the short op name (`writeRow`, `runMigration`,
+* `importShard`, `applyCdc`); `table`/`id` are present when the op targets one;
+* `detail` carries op-specific context (notably the acting `userId`).
+*/
+interface AuditEntry {
+  detail?: Record<string, unknown>;
+  id?: string;
+  op: string;
+  seq: number;
+  table?: string;
+  ts: number;
+}
+/** Payload of a `__lunora_admin__:getAuditLog` call: the recorded entries, newest first. */
+interface AuditLogResult {
+  entries: AuditEntry[];
+}
+/**
+* How a deployment binding/var classifies, mirroring `@lunora/do`'s `SettingKind`.
+* `var` is a plain Worker var, `secret` a sensitive string (always masked), and
+* `binding` a non-string binding object (R2/KV/DO/D1/queue/service).
+*/
+type SettingKind = "binding" | "secret" | "var";
+/**
+* One row of the read-only deployment-settings view, mirroring `@lunora/do`'s
+* `SettingEntry`. `value` is a masked preview for `var`/`secret` strings (never
+* the raw secret) and `null` for `binding` entries. The server masks every
+* string value, so the studio only ever renders the masked text.
+*/
+interface SettingEntry {
+  /** Coarse runtime class for `binding` entries (`r2`, `kv`, `durable-object`, …). */
+  bindingType?: string;
+  kind: SettingKind;
+  name: string;
+  value: null | string;
+}
+/**
+* Best-effort deploy metadata, mirroring `@lunora/do`'s `DeployInfo`. Every
+* field is optional: the server reads only what the Worker `env` exposes and
+* omits the rest.
+*/
+interface DeployInfo {
+  deploymentId?: string;
+  environment?: string;
+  versionTag?: string;
+  workerUrl?: string;
+}
+/** Payload of a `__lunora_admin__:getSettings` call, mirroring `@lunora/do`'s `SettingsResult`. */
+interface SettingsResult {
+  deploy: DeployInfo;
+  settings: SettingEntry[];
+}
+/**
+* Ordering/visual weight of a {@link SecurityFinding}, mirroring `@lunora/do`'s
+* `SecurityFindingLevel`. Shares the studio's insight-severity vocabulary so the
+* Security and Performance advisors render with one badge palette.
+*/
+type SecurityFindingLevel = "error" | "info" | "warning";
+/**
+* Which deployment-level security heuristic fired, mirroring `@lunora/do`'s
+* `SecurityFindingKind`. The studio maps each kind to a localized title,
+* explanation, and remediation hint; the wire payload carries only the kind,
+* level, and optional `detail`.
+*/
+type SecurityFindingKind = "admin-token-weak" | "auth-secret-weak" | "cookies-insecure" | "cors-wildcard-credentials" | "csrf-disabled" | "dev-args-unredacted" | "security-headers-disabled" | "ws-gate-open";
+/**
+* One detected security issue from `__lunora_admin__:getSecurityAudit`, mirroring
+* `@lunora/do`'s `SecurityFinding`. `detail` carries kind-specific context the
+* studio interpolates into the localized copy (e.g. `{ length, min }` for a weak
+* admin token); absent when the kind needs none.
+*/
+interface SecurityFinding {
+  detail?: Record<string, unknown>;
+  kind: SecurityFindingKind;
+  level: SecurityFindingLevel;
+}
+/** Payload of a `__lunora_admin__:getSecurityAudit` call, mirroring `@lunora/do`'s `SecurityAuditResult`: every finding, worst-first. */
+interface SecurityAuditResult {
+  findings: SecurityFinding[];
+}
+/** A user table plus its current row count. */
+interface TableInfo {
+  name: string;
+  rowCount: number;
+}
+/** A window of rows from one table, plus the column list and total size. */
+interface TablePage {
+  columns: string[];
+  /** Foreign-key columns (column → target table) for `v.id("target")` fields, so the UI can link those cells. */
+  refs?: Record<string, string>;
+  rows: Record<string, unknown>[];
+  total: number;
+}
+/** Direction a data migration is run in. Mirrors `@lunora/do`. */
+type MigrationDirection = "down" | "up";
+/** Lifecycle of a data-migration run. Mirrors `@lunora/do`. */
+type MigrationStatus = "completed" | "failed" | "in_progress";
+/**
+* One persisted migration run-state row, as returned by the
+* `__lunora_admin__:migrationStatus` RPC (`{ migrations: MigrationStatusRow[] }`).
+*/
+interface MigrationStatusRow {
+  changed: number;
+  cursor: null | string;
+  direction: MigrationDirection;
+  error: null | string;
+  id: string;
+  processed: number;
+  startedAt: null | number;
+  status: MigrationStatus;
+  updatedAt: null | number;
+}
+/** Result of a single `__lunora_admin__:runMigration` invocation against one shard. */
+interface MigrationRunResult {
+  changed: number;
+  cursor: null | string;
+  direction: MigrationDirection;
+  dryRun: boolean;
+  id: string;
+  processed: number;
+  status: MigrationStatus;
+}
+/** Arguments accepted by the `__lunora_admin__:runMigration` RPC. */
+interface RunMigrationArgs {
+  batchSize?: number;
+  direction?: MigrationDirection;
+  dryRun?: boolean;
+  id: string;
+  maxBatches?: number;
+}
+/** One NDJSON line: a row from `table`, shaped per its schema. */
+interface ExportRow {
+  doc: Record<string, unknown>;
+  table: string;
+}
+/** A row that could not be inserted during an import. */
+interface ImportError {
+  code: string;
+  line: number;
+  message: string;
+  table: string;
+}
+/** Result of a single `__lunora_admin__:importShard` invocation against one shard. */
+interface ImportShardResult {
+  conflicts: number;
+  errors: ImportError[];
+  inserted: Record<string, number>;
+}
+/**
+* One shard's request total from the worker's `POST /_lunora/admin/shard-traffic`
+* endpoint, mirroring `@lunora/runtime`'s `ShardTrafficEntry`. `requests` is the
+* shard's lifetime dispatch count (`0` for a shard that failed/timed out);
+* `shardKey` is the DO id name (`""` for the root shard). The cross-shard feed
+* the `hot_shard` runtime advisor consumes to compute skew.
+*/
+interface ShardTrafficEntry {
+  requests: number;
+  shardKey: string;
+}
+/**
+* Payload of a `POST /_lunora/admin/shard-traffic` call, mirroring the runtime
+* coordinator's shard-traffic fan-out result: one `{ shardKey, requests }` entry
+* per live shard plus the ok / failed counts. Fanned out on demand (not on the
+* metrics hot path) so the panel can feed `hot_shard` the whole shard set's
+* request volumes.
+*/
+interface ShardTrafficResult {
+  failed: number;
+  ok: number;
+  shards: ShardTrafficEntry[];
+}
+/** Visual + ordering weight of a detected issue. */
+type InsightSeverity = "error" | "info" | "warning";
+/**
+* Which heuristic fired. The panel maps each kind to a localized title/detail,
+* so the detection stays free of presentation strings (and trivially testable).
+*
+* `missing-index` is the causal upgrade of `slow-function`: a slow function
+* whose latency is explained by a full-table scan. When the scan attribution
+* pins the cause, the insight names the scanned table(s) (`tables`) and deep-
+* links to the Schema/Indexes tab to add the index, rather than leaving the
+* slowness an unattributed symptom.
+*/
+type InsightKind = "high-error-rate" | "high-evictions" | "high-write-contention" | "low-cache-hit-rate" | "missing-index" | "slow-function";
+/**
+* One detected issue. `value` is the headline number whose meaning depends on
+* `kind`: a 0–1 rate for cache-hit / error-rate, a millisecond figure for
+* slow-function / missing-index, an entry count for evictions. `fn` is set only
+* for per-function insights; `message` carries the last error for
+* high-error-rate; `tables` carries the full-scanned tables (busiest first) for
+* the causal `missing-index` kind. For `high-write-contention` it is the OCC
+* conflict ratio (conflicts / calls).
+*/
+interface Insight {
+  fn?: string;
+  kind: InsightKind;
+  message?: string;
+  severity: InsightSeverity;
+  tables?: string[];
+  value: number;
+}
+/** Tunable cut-offs for {@link deriveInsights}. Exposed so a host (or a test) can tighten/loosen them. */
+interface InsightThresholds {
+  /** Flag functions whose error ratio is at or above this (0–1). */
+  highErrorRate: number;
+  /** Flag functions whose OCC write-conflict ratio is at or above this (0–1). */
+  highWriteContention: number;
+  /** Flag a cache whose hit rate is below this (0–1). */
+  lowCacheHitRate: number;
+  /** Require this many cache samples (hits + misses) before judging hit rate, to avoid cold-start noise. */
+  minCacheSamples: number;
+  /** Require this many calls before judging a function's conflict ratio. */
+  minConflictCalls: number;
+  /** Require this many calls before judging a function's error ratio. */
+  minErrorCalls: number;
+  /** Flag functions whose slowest call is at or above this many milliseconds. */
+  slowFunctionMs: number;
+}
+declare const DEFAULT_INSIGHT_THRESHOLDS: InsightThresholds;
+/**
+* Derive a prioritised list of issues from the two snapshots the studio
+* already pulls — the `getMetrics` health snapshot and the `getFunctionStats`
+* per-function table. Pure and side-effect-free: same inputs, same output, so
+* the heuristics can be unit-tested without rendering.
+*
+* Heuristics: low-cache-hit-rate (cache below the threshold once enough samples
+* exist — a cold cache isn't a problem); high-evictions (more evictions than
+* hits, so the cache is too small or churning on invalidation); missing-index (a
+* slow function whose latency is *explained* by a full-table scan — the causal
+* upgrade of slow-function, naming the scanned table(s)); slow-function (a
+* function whose slowest call crosses the threshold with no scan attribution to
+* blame); high-error-rate (a function failing over a meaningful count);
+* high-write-contention (a function whose OCC write conflicts make up a
+* meaningful share of calls — a sharding candidate).
+*
+* A slow function with full-scan attribution emits `missing-index` (causal, with
+* `tables`) instead of the bare `slow-function`, so the panel can link straight
+* to the fix rather than restating the symptom.
+*/
+declare const deriveInsights: (metrics: ShardMetrics | null, functions: FunctionCallStat[] | null, thresholds?: InsightThresholds) => Insight[];
+interface InsightsPanelProps {
+  /** Shard key the snapshots target on first load. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+  /**
+  * Fan the cross-shard traffic feed out for `table`, returning each shard's
+  * `{ shardKey, requests }` total — the input the `hot_shard` advisor lint
+  * needs. Defaults to `client.shardTraffic(table)` (the admin-gated
+  * `POST /_lunora/admin/shard-traffic` fan-out). Best-effort: a rejection
+  * leaves `hot_shard` dormant rather than blanking the panel. Injectable so
+  * tests can drive the skew without a worker.
+  */
+  readonly loadShardTraffic?: (table: string) => Promise<ShardTrafficResult>;
+}
+/**
+* The Performance Advisor — a 1-to-1 of Supabase's Performance Advisor: severity
+* tabs over a findings table (via {@link AdvisorView}). It pulls the `getMetrics`
+* health snapshot and `getFunctionStats` per-function table for one shard, then
+* maps the issues {@link deriveInsights} detects (low cache hit rate, high
+* eviction, slow functions, missing indexes, error spikes) into rows. A
+* `missing-index` row carries an inline "add the index" jump to the Schema tab.
+* Both reads are best-effort — one failing still yields the other's insights.
+*/
+declare const InsightsPanel: ({
+  initialShardKey,
+  loadShardTraffic
+}: InsightsPanelProps) => ReactElement;
+/**
+* The Security Advisor — a 1-to-1 of Supabase's Security Advisor: severity tabs
+* (Errors / Warnings / Info) over a findings table. It pulls `getSecurityAudit`
+* (deployment-wide, so it targets the root shard and needs no shard selector) and
+* maps each finding the server derived from the Worker `env` — weak admin token,
+* an open WebSocket gate, a dev-mode request log keeping un-redacted args — into a
+* row. These are signals only lunora can surface: Cloudflare's dashboard can't
+* reason about lunora's admin/WS gates or its log-redaction policy.
+*/
+declare const SecurityAdvisorPanel: () => ReactElement;
+interface ApiDocsPanelProps {
+  /**
+  * Registered functions to document. Mirrors the list the Functions tab's
+  * runner and stats panels receive — a query/mutation/action's `kind` is
+  * compile-time-only, so it must be named here. When omitted the panel still
+  * renders (tables come from the admin RPC) and shows an empty functions list.
+  */
+  readonly functions?: FunctionDescriptor[];
+  /** Shard key the table list is read from. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/** Inputs every function snippet builder closes over — the split path plus its `kind`. */
+/**
+* Per-resource "how to call this from your app" browser, generated from the
+* registered functions and tables the studio already has — no new endpoints.
+* The left rail lists functions grouped by file plus a Tables section; the right
+* pane shows copy-paste snippets (React / Client / CLI for functions; the typed
+* data-model usage for tables).
+*
+* Args are a placeholder: the real argument shape lives in the codegen'd `api`
+* types this browser never loads, the same way Supabase's usage snippets show
+* placeholders.
+*/
+declare const ApiDocsPanel: ({
+  functions,
+  initialShardKey
+}: ApiDocsPanelProps) => ReactElement;
+interface ApiReferencePanelProps {
+  /**
+  * Inline OpenAPI document. When supplied the panel renders it directly and
+  * skips the fetch — used by the mock harness and by hosts that already hold
+  * the generated spec. When omitted the panel fetches the worker's
+  * admin-gated `GET /_lunora/admin/openapi` endpoint via the client.
+  */
+  readonly spec?: unknown;
+}
+/**
+* In-studio OpenAPI reference: renders the generated OpenAPI 3.1 document with
+* the studio-native {@link ReferenceView} — a tag-grouped operation browser,
+* schema tables, a live "try it" console, and copy-paste request samples, all
+* themed to the studio. The spec comes from an inline
+* {@link ApiReferencePanelProps.spec} prop, or — by default — the worker's
+* admin-gated `GET /_lunora/admin/openapi` endpoint fetched through the client.
+*
+* This replaced the embedded Scalar reference (a Vue app in React): Scalar's
+* portal/overlay layers repeatedly intercepted clicks and froze the tab, and it
+* shipped a multi-megabyte bundle. The native view is overlay-free and reuses
+* the studio's own primitives.
+*/
+declare const ApiReferencePanel: ({
+  spec: inlineSpec
+}: ApiReferencePanelProps) => ReactElement;
+interface ApiTabProps {
+  /** Registered functions documented by the snippets sub-view. Threaded host → studio. */
+  readonly functions?: FunctionDescriptor[];
+  /** Shard key the snippets view reads its table list from. */
+  readonly initialShardKey?: string;
+  /**
+  * Inline OpenAPI document for the reference sub-view. When omitted the
+  * reference fetches the worker's `GET /_lunora/admin/openapi` endpoint.
+  */
+  readonly openApiSpec?: unknown;
+  /**
+  * Inline OpenRPC document for the reference sub-view's OpenRPC format. When
+  * omitted the OpenRPC view fetches the worker's `GET /_lunora/admin/openrpc`
+  * endpoint. OpenRPC is the RPC-native spec (RPC functions only); OpenAPI
+  * additionally covers `httpRouter()` REST routes.
+  */
+  readonly openRpcSpec?: unknown;
+}
+/**
+* The studio's API tab. Hosts two complementary surfaces behind a segmented
+* toggle. The Reference view renders a machine-readable spec — the OpenAPI 3.1
+* document or the RPC-native OpenRPC document — through the studio-native
+* reference UI (operation browser, schema tables, a live "try it" console, and a
+* request-sample rail), with a small format switch between them. The Snippets
+* view is the per-function React / Client / CLI copy-paste browser
+* (`api-docs-panel`), the lightweight "how do I call this" DX.
+*
+* Reference is the default; OpenAPI is the default format (the richer,
+* spec-driven view that also covers REST). Each format degrades to a clear
+* empty state when its spec isn't wired.
+*/
+declare const ApiTab: ({
+  functions,
+  initialShardKey,
+  openApiSpec,
+  openRpcSpec
+}: ApiTabProps) => ReactElement;
+interface OpenRpcReferencePanelProps {
+  /**
+  * Inline OpenRPC document. When supplied the panel renders it directly and
+  * skips the fetch — used by the mock harness and by hosts that already hold
+  * the generated spec. When omitted the panel fetches the worker's
+  * admin-gated `GET /_lunora/admin/openrpc` endpoint via the client.
+  */
+  readonly spec?: unknown;
+}
+/**
+* In-studio OpenRPC reference. OpenRPC is the RPC-native spec (a `methods` array
+* over the JSON-RPC-shaped `POST /_lunora/rpc` transport), documenting the RPC
+* functions only. It is parsed into the shared `ApiModel` and rendered by the
+* same studio-native {@link ReferenceView} the OpenAPI panel uses, so both
+* formats share one operation browser, schema view, try-it console, and sample
+* rail.
+*
+* The spec comes from an inline {@link OpenRpcReferencePanelProps.spec} prop, or
+* — by default — the worker's admin-gated `GET /_lunora/admin/openrpc` endpoint.
+*/
+declare const OpenRpcReferencePanel: ({
+  spec: inlineSpec
+}: OpenRpcReferencePanelProps) => ReactElement;
+/**
+* A shareable data-browser view: the table, storage tier, shard, structured
+* filters, substring search, and sort that together reproduce exactly what the
+* grid is showing. This is the unit that is serialized into the URL (so the link
+* IS the query) and persisted by name in {@link loadSavedQueries}. Every field is
+* optional so a partial/legacy URL still hydrates into a sensible default view.
+*/
+interface DataView {
+  /** Structured `column operator value` clauses, AND-combined with the search. */
+  filters?: FilterClause[];
+  /** Single-column sort, server-side; absent → the table's natural order. */
+  orderBy?: {
+    column: string;
+    direction: "asc" | "desc";
+  };
+  /** Substring search across all columns. */
+  search?: string;
+  /** Shard key the view targets; absent/empty → the root shard. */
+  shard?: string;
+  /** The open table. */
+  table?: string;
+  /** Storage tier the table lives in; absent → the shard (SQLite) tier. */
+  tier?: "global" | "shard";
+}
+/** A user-named, persisted {@link DataView} — the "canned query" the saved-queries panel lists. */
+interface SavedQuery {
+  name: string;
+  view: DataView;
+}
+/** Saved queries, most-recently-saved first. Empty when storage is unavailable or empty. */
+interface DataBrowserProps {
+  /**
+  * Allow editing: surfaces insert/edit/delete actions that issue
+  * `__lunora_admin__:writeRow` ops through the schema-aware writer. Off by
+  * default — the browser is read-only unless the host opts in.
+  */
+  readonly editable?: boolean;
+  /**
+  * Names of the `.global()` (D1-backed) tables. A `v.id` ref cell whose target
+  * is one of these is followed cross-tier via `onNavigateToGlobal` instead of
+  * being read from this shard (where it doesn't exist). Supplied by the Table
+  * editor; defaults to none when the browser is used standalone.
+  */
+  readonly globalTableNames?: ReadonlySet<string>;
+  /** Structured filters to hydrate from a shared link / saved query. */
+  readonly initialFilters?: FilterClause[];
+  /** Sort to hydrate from a shared link / saved query. */
+  readonly initialOrderBy?: DataView["orderBy"];
+  /** Substring search to hydrate from a shared link / saved query. */
+  readonly initialSearch?: string;
+  /** Shard key the browser targets on first load. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+  /**
+  * Follow a `v.id` ref whose target is a global table — the Table editor switches
+  * to the global tier and opens that table. When omitted (standalone use), a ref
+  * to a global table falls through to the in-shard read (and surfaces its error).
+  */
+  readonly onNavigateToGlobal?: (table: string, id: string) => void;
+  /**
+  * Called whenever the open table changes, so the host can mirror it to the URL
+  * (the Table editor pushes `?table=…`). Omitted in standalone use.
+  */
+  readonly onSelectTable?: (table: string) => void;
+  /**
+  * Called whenever the loaded view (shard / search / filters / sort) changes, so
+  * the host can mirror it to the URL — making every view a shareable link.
+  * Omitted in standalone use (view state stays in-component).
+  */
+  readonly onViewChange?: (view: Pick<DataView, "filters" | "orderBy" | "search" | "shard">) => void;
+  /** Rows requested per page. Clamped server-side to `[1, 500]`. */
+  readonly pageSize?: number;
+  /**
+  * The canned-query toolbar's handlers + saved list. Supplied by the Table editor
+  * (it owns the router and the `saved-queries` localStorage helper); omitted in
+  * standalone use, which hides the toolbar entirely. `onSaveQuery` receives the
+  * name plus the current view to persist.
+  */
+  readonly queryBar?: {
+    readonly onApplyQuery: (query: SavedQuery) => void;
+    readonly onCopyLink: () => void;
+    readonly onDeleteQuery: (name: string) => void;
+    readonly onSaveQuery: (name: string, view: DataView) => void;
+    readonly saved: ReadonlyArray<SavedQuery>;
+  };
+  /**
+  * The schema/source selector rendered at the top of the table-list sidebar —
+  * the Table editor's `schema public ▾` switch. Supplied when this browser is
+  * composed into the Table editor; omitted when it's used alone.
+  */
+  readonly schemaSwitch?: ReactNode;
+  /**
+  * The table named in the URL. Drives the selection — a deep link or browser
+  * back/forward to a different `?table=…` re-opens that table. Supplied by the
+  * Table editor; omitted in standalone use (selection stays purely in-component).
+  */
+  readonly tableParam?: string;
+}
+/**
+* Read-only data browser for a single shard's SQLite database. Lists the user
+* tables (via the `__lunora_admin__:listTables` RPC), then pages through the
+* rows of whichever table is selected (`__lunora_admin__:readTablePage`).
+*
+* Both calls travel over the ordinary `useLunora` client transport; the
+* admin RPCs are intercepted inside the Durable Object and are gated by the
+* server's `LUNORA_ADMIN_TOKEN`. The host is responsible for configuring the
+* client's auth token — this component issues no credentials of its own.
+*
+* The table view is built on a headless `@tanstack/react-table` model: column
+* defs derive from `page.columns`, sorting and (global) filtering run
+* page-locally over the loaded rows, and the rendered rows are virtualized with
+* `@tanstack/react-virtual` so a large page never inflates the DOM. None of this
+* touches the server — pagination still flows through `readTablePage`. All of
+* that state lives in {@link useDataBrowser}; this component is just the markup.
+*/
+declare const DataBrowser: ({
+  editable,
+  globalTableNames,
+  initialFilters,
+  initialOrderBy,
+  initialSearch,
+  initialShardKey,
+  onNavigateToGlobal,
+  onSelectTable,
+  onViewChange,
+  pageSize: initialPageSize,
+  queryBar,
+  schemaSwitch,
+  tableParam
+}: DataBrowserProps) => ReactElement;
+/** A filter row as edited in the UI — the value is always a string until coerced for the wire. */
+interface EditableFilter {
+  column: string;
+  operator: FilterOperator;
+  value: string;
+}
+/**
+* Convert the UI's string-valued filter rows into wire {@link FilterClause}s:
+* drops rows with no column, and coerces a numeric string to a number for the
+* comparison operators (so `age > 18` compares numerically, not lexically).
+* `contains` always stays a string.
+*/
+declare const toFilterClauses: (filters: ReadonlyArray<EditableFilter>) => FilterClause[];
+/**
+* The data browser's filtering controls: the substring search box plus a stack
+* of structured `column operator value` rows. All state is owned by the parent
+* (the data-browser model); this is the control markup, emitting the full
+* filter array up on every edit. Raw strings (no i18n) to match the surrounding
+* data-browser controls.
+*/
+declare const DataFilters: ({
+  columns,
+  filters,
+  onFiltersChange,
+  onSearchChange,
+  search
+}: {
+  columns: ReadonlyArray<string>;
+  filters: ReadonlyArray<EditableFilter>;
+  onFiltersChange: (filters: EditableFilter[]) => void;
+  onSearchChange: (event: ChangeEvent<HTMLInputElement>) => void;
+  search: string;
+}) => ReactElement;
+interface GlobalDataBrowserProps {
+  /**
+  * Table to open automatically on mount (and whenever it changes). Used by the
+  * Table editor when a `v.id` reference in a shard row points at a `.global()`
+  * table: clicking it switches to the global tier and lands here with that table
+  * pre-selected. Each distinct value is applied once, so the operator can still
+  * navigate away afterwards.
+  */
+  readonly initialTable?: string;
+  /**
+  * Called whenever the open table changes, so the host can mirror it to the URL
+  * (the Table editor pushes `?table=…`). Omitted in standalone use.
+  */
+  readonly onSelectTable?: (table: string) => void;
+  /** Rows requested per page. Clamped server-side to `[1, 500]`. */
+  readonly pageSize?: number;
+  /**
+  * The schema/source selector rendered at the top of the table-list sidebar —
+  * the Table editor's `schema public ▾` switch. Supplied when this browser is
+  * composed into the Table editor; omitted when it's used alone.
+  */
+  readonly schemaSwitch?: ReactNode;
+}
+/**
+* Read-only browser for `.global()` (D1-backed) tables. Twin of `DataBrowser`,
+* but not shard-scoped: it lists tables via `listGlobalTables()` and pages rows
+* via `readGlobalTablePage()`. Laid out like Supabase's Table Editor — a left
+* table sidebar + a bordered grid with a paginated footer — and gated by the
+* server's `LUNORA_ADMIN_TOKEN`.
+*/
+declare const GlobalDataBrowser: ({
+  initialTable,
+  onSelectTable,
+  pageSize: initialPageSize,
+  schemaSwitch
+}?: GlobalDataBrowserProps) => ReactElement;
+interface TableEditorProps {
+  /**
+  * Allow editing the shard-local tables (insert/edit/delete). Forwarded to the
+  * shard {@link DataBrowser}; the global D1 browser is always read-only. Off by
+  * default — see {@link DataBrowser}.
+  */
+  readonly editable?: boolean;
+  /** Shard key the shard browser targets on first load. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/**
+* The Table editor: browses your application's tables across both storage tiers
+* from one section. A schema switch in the sidebar header (Supabase's
+* `schema public ▾`) toggles between the per-shard SQLite browser
+* (`.shardBy(...)`, editable when the host opts in) and the read-only global D1
+* browser (`.global()`) — folding what used to be a separate "Global Tables" tab
+* into a single editor (`STUDIO-REDESIGN-PLAN.md` §2).
+*
+* The active tier and open table live in the URL search params (`?schema=global`,
+* `?table=…`) rather than component state, so every selection is a real, shareable
+* URL and browser back/forward moves between tables and tiers. The browsers push on
+* selection and re-open whatever the URL names.
+*/
+declare const TableEditor: ({
+  editable,
+  initialShardKey
+}: TableEditorProps) => ReactElement;
+interface ExportImportPanelProps {
+  /** Shard key the panel targets. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/**
+* Snapshot and restore a single shard's data as NDJSON.
+*
+* "Export" reads every shard-local row via `__lunora_admin__:exportShard` and
+* renders it as NDJSON for download/copy. "Import" parses NDJSON the operator
+* pastes in and replays it through `__lunora_admin__:importShard`, reporting
+* inserted counts, id conflicts and per-row errors. Globally-scoped (`.global()`)
+* tables live in D1 and are intentionally out of scope here.
+*
+* Both calls travel over the {@link useLunora} client transport and are gated by
+* the server's `LUNORA_ADMIN_TOKEN`.
+*/
+declare const ExportImportPanel: ({
+  initialShardKey
+}: ExportImportPanelProps) => ReactElement;
+interface MigrationsPanelProps {
+  /** Shard key the panel targets. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/**
+* Inspect and drive data migrations on a single shard.
+*
+* Reads the persisted run-state via the `__lunora_admin__:migrationStatus` RPC
+* and lets an operator kick off a migration by id (`__lunora_admin__:runMigration`)
+* with a direction, an optional batch cap and a dry-run toggle. Both calls
+* travel over the ordinary {@link useLunora} client transport and are gated by
+* the server's `LUNORA_ADMIN_TOKEN` — this component issues no credentials of
+* its own.
+*/
+declare const MigrationsPanel: ({
+  initialShardKey
+}: MigrationsPanelProps) => ReactElement;
+interface PitrPanelProps {
+  /** Shard key the PITR ops target. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/**
+* Native Durable-Object point-in-time recovery for one shard — the **Time
+* Travel** view.
+*
+* Reads the shard's current bookmark, previews the bookmark nearest a chosen
+* time, and (behind a confirm step) restores the shard to a time or an explicit
+* bookmark via the `__lunora_admin__:pitrRestore` RPC, surfacing the returned
+* undo bookmark so the restore can be reversed. All ops run over the
+* {@link useLunora} client and are gated by the server's `LUNORA_ADMIN_TOKEN`.
+*
+* In-place recovery covers the last 30 days; for older or off-platform recovery
+* use the snapshot tier (`lunora backup` / the backup registry item).
+*/
+declare const PitrPanel: ({
+  initialShardKey
+}: PitrPanelProps) => ReactElement;
+interface FunctionRunnerProps {
+  /**
+  * Functions to expose. When omitted, the runner auto-discovers them via the
+  * client's `listFunctions()` (the admin-gated `/_lunora/admin/functions`
+  * endpoint), so it works with no wiring when the worker is built with a
+  * `functions` registry. Supply the list to override discovery.
+  */
+  readonly functions?: FunctionDescriptor[];
+  /**
+  * Expose the "Run as identity" control — execute the selected function AS a
+  * chosen authenticated user so an operator can test auth + RLS behavior.
+  * Security-sensitive: the run is forwarded over the admin-gated
+  * `__lunora_admin__:runAs` RPC, which forges the per-request identity. The
+  * host sets this only on a trusted loopback-dev gate (the `Studio` component's
+  * `runAsIdentity` prop); off by default, the runner always runs with the
+  * caller's own (admin) identity.
+  */
+  readonly runAsIdentity?: boolean;
+}
+/**
+* Interactive runner for the registered functions: pick one, edit its JSON
+* arguments, optionally target a shard, then invoke it against the live
+* {@link useLunora} client and inspect the result or error.
+*
+* By default the function list is auto-discovered from the worker's
+* `/_lunora/admin/functions` endpoint; pass an explicit `functions` array to
+* skip discovery (a query/mutation/action's `kind` is compile-time-only, so it
+* must be named).
+*/
+declare const FunctionRunner: ({
+  functions: functionsProp,
+  runAsIdentity
+}?: FunctionRunnerProps) => ReactElement;
+interface FunctionStatsPanelProps {
+  /** Descriptors from codegen, used to annotate each row with the function's `kind`. */
+  readonly functions?: FunctionDescriptor[];
+  /** Shard key the panel reports on. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/**
+* Per-function execution metrics for one shard: call count, error count/rate,
+* mean and slowest handler latency, last-run time, and the most recent error
+* message. Reads via the `__lunora_admin__:getFunctionStats` RPC over the
+* {@link useLunora} client; gated by the server's `LUNORA_ADMIN_TOKEN`.
+*
+* Counters are per-DO-instance and reset on hibernation/restart — this is a
+* "since this instance woke" readout, mirroring the metrics panel. The panel is
+* always live: a subscription opens once the first seed commits a shard and
+* re-pushes on every server write-flush so the table updates as mutations land.
+*/
+declare const FunctionStatsPanel: ({
+  functions,
+  initialShardKey
+}: FunctionStatsPanelProps) => ReactElement;
+interface HomePanelProps {
+  /** Shard key the health digest targets on first load. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/**
+* The Home overview — the studio's landing page. It pulls the root shard's
+* health snapshot, the function stats, the two advisor signals, the live
+* subscription pulse, and the recent admin audit log, then presents an
+* at-a-glance digest: a KPI row (requests, errors, latency, database size), a
+* busiest-functions leaderboard, live connections, recent activity, the advisor
+* summary, and connect/quick-link shortcuts. Every read is best-effort — a
+* missing admin token or a cold instance leaves a card showing a muted
+* placeholder rather than blanking the page.
+*/
+declare const HomePanel: ({
+  initialShardKey
+}: HomePanelProps) => ReactElement;
+interface AuditPanelProps {
+  /** Shard key the panel reports on. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/**
+* Durable audit log for one shard: the admin state-changing operations
+* (`writeRow`, `runMigration`, `importShard`, `applyCdc`) recorded to the
+* reserved `__lunora_audit__` table, newest first. Reads via the
+* `__lunora_admin__:getAuditLog` RPC over the {@link useLunora} client; gated by
+* the server's `LUNORA_ADMIN_TOKEN`.
+*
+* Unlike the logs panel (an in-memory ring that resets on hibernation), the
+* audit log is durable and bounded only by a retention cap. The panel is always
+* live: a subscription opens once the first seed commits a shard and re-pushes on
+* every server write-flush so new entries appear without a manual refresh. The op
+* filter is client-side over the already-fetched buffer — it never triggers a refetch.
+*/
+declare const AuditPanel: ({
+  initialShardKey
+}: AuditPanelProps) => ReactElement;
+interface LogsPanelProps {
+  /** Shard key the panel reports on. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/** A relative time-range window over the Errors buffer, or `all` (no bound). */
+/**
+* The shard's log feed, newest first, over the gated `__lunora_admin__:*` RPC
+* layer (gated by the server's `LUNORA_ADMIN_TOKEN`). Two views.
+*
+* The Requests view (`getRequestLog`) is the durable, structured per-request log
+* `@lunora/do` writes once per `/rpc` dispatch (PLAN3 §1.1): function path,
+* shard, acting user/identity, redacted args, outcome, duration, and tables
+* read/written. It survives hibernation/restart (bounded retention) and is
+* filtered/correlated SERVER-side on function-path prefix, userId, shard,
+* outcome, and a touched table.
+*
+* The Errors view (`getLogs`) is the legacy in-memory RPC-error buffer, which
+* only captures dispatch failures (path + message) and resets on hibernation —
+* kept for the "what's failing on this instance right now" view, filtered
+* client-side.
+*
+* For the raw, un-attributed request firehose (which Lunora deliberately does
+* NOT re-stream), a deep-link to Cloudflare Workers Observability is provided.
+*/
+declare const LogsPanel: ({
+  initialShardKey
+}: LogsPanelProps) => ReactElement;
+interface MailPanelProps {
+  /** Newest-N to load (default 100). */
+  readonly limit?: number;
+}
+/**
+* Dev mail catcher — a unified inbox of every email the app sent. `@lunora/mail`'s
+* capture transport (wired in dev) intercepts each send and persists it to the
+* root-shard mailbox instead of delivering, so verification / forgot-password and
+* any app mail show up here with nothing leaving the machine. Reads the
+* `__lunora_admin__:getCapturedMail` RPC over the {@link useLunora} client;
+* gated by the server's `LUNORA_ADMIN_TOKEN`.
+*
+* The inbox is a single root-shard table with no write-flush to subscribe to, so
+* it polls on a fixed interval (paused while the tab is hidden) — new captured
+* mail appears without a manual refresh. The HTML body is rendered in a fully
+* sandboxed iframe (no script execution) so captured markup can't run in the studio.
+*/
+declare const MailPanel: ({
+  limit
+}: MailPanelProps) => ReactElement;
+interface HealthPanelProps {
+  /** Shard key the metric/log reads target on first load. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/**
+* App-level health & SLO overview. On top of the original single-shard snapshot
+* (recent errors, request/error counts, shards seen) it composes the
+* lunora-attributed SLO signals the studio can already reach — app error
+* rate, auth-failure rate, scheduler backlog, and migration status — each with a
+* status badge, plus durable request/error and auth sparklines, and a
+* worst-first per-function error-rate list. None of this is CF's per-Worker
+* charting: it is attributed to lunora functions, the auth flow, and the
+* scheduler/migration subsystems.
+*
+* Every read is independent and best-effort (via `Promise.allSettled`): a
+* missing `LUNORA_ADMIN_TOKEN`, an unconfigured scheduler, or a cold instance
+* degrades that one tile to `—` without blanking the rest. The overview is always
+* live: a root-shard `getMetrics` subscription drives a full cross-shard re-pull
+* on every write-flush (coalesced so a burst yields at most one in-flight pull).
+*/
+declare const HealthPanel: ({
+  initialShardKey
+}: HealthPanelProps) => ReactElement;
+/** One shard's metrics fetch outcome: the snapshot, or the error that shard returned. */
+interface ShardMetricsResult {
+  error: null | string;
+  metrics: null | ShardMetrics;
+  shard: string;
+}
+/** Totals rolled up across every successfully-fetched shard. */
+interface AggregateMetrics {
+  /** Shards that returned an error (couldn't be reached / unauthorized). */
+  failed: number;
+  /** Combined reactive-cache hit rate across shards with a cache, or `null` when none has one. */
+  hitRate: null | number;
+  /** Shards that returned a snapshot. */
+  reachable: number;
+  /** Sum of `databaseSize` across reachable shards (skips shards reporting `null`). */
+  totalDatabaseSize: number;
+  totalErrors: number;
+  totalRequests: number;
+}
+/**
+* Roll up per-shard metrics into repo-wide totals. Errors-per-shard are kept as
+* `failed` (a shard that's down is data, not a hard failure), and counters are
+* summed only over reachable shards. The combined cache hit-rate weights by each
+* shard's hits+misses so a busy shard dominates a quiet one.
+*/
+declare const aggregateMetrics: (results: ReadonlyArray<ShardMetricsResult>) => AggregateMetrics;
+/**
+* The shard keys to aggregate over. Durable Objects aren't enumerable, so this
+* is the union of the root shard (`""`), an explicit current shard, and the
+* recently-visited shards — de-duplicated, order-stable (root first). It's a
+* best-effort "shards we know about", not every shard that exists.
+*/
+declare const shardsToAggregate: (current: string, recents: ReadonlyArray<string>) => string[];
+interface MetricsPanelProps {
+  /** Shard key the panel reports on. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/**
+* Health snapshot for a single shard: request / error counts (since the DO last
+* woke), its live SQLite size, and reactive-cache hit/miss stats when a cache is
+* configured. Reads via the `__lunora_admin__:getMetrics` RPC over the
+* {@link useLunora} client; gated by the server's `LUNORA_ADMIN_TOKEN`.
+*
+* Counters are per-DO-instance and reset on hibernation/restart — this is a
+* "since this instance woke" readout, not a durable time series.
+*
+* The panel is always live: a `getMetrics` WebSocket subscription opens once the
+* first one-shot seed commits a shard and re-pushes on every server write-flush,
+* accumulating a client-side, in-memory series of requests-per-sample (the delta
+* of `requests` between consecutive samples), rendered as an inline-SVG
+* sparkline. The series is capped at {@link MAX_HISTORY} points and is lost on
+* remount.
+*/
+declare const MetricsPanel: ({
+  initialShardKey
+}: MetricsPanelProps) => ReactElement;
+interface SchemaViewerProps {
+  /** Shard key the viewer targets. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+  /**
+  * Table to auto-expand once the shard's tables load. Set by the Insights
+  * "add the index" deep-link (`/schema?table=&lt;name>`) so the operator lands
+  * directly on the scanned table's index list instead of hunting for it.
+  * Re-applied whenever the value changes, so following the link a second time
+  * (same tab already open) re-expands the target.
+  */
+  readonly initialTable?: string;
+  /**
+  * Enable the visual schema-editor overlay (add table / column / index). Off by
+  * default so the diagram stays read-only. Set only by the loopback dev hosts
+  * (see `StudioProps.schemaEditable`); when true, the authoring overlay
+  * (plan 024 Item 4) renders above the table lists and applies additive edits
+  * through the dev host's local schema-edit endpoint.
+  */
+  readonly schemaEditable?: boolean;
+}
+/**
+* Schema overview that shows both storage tiers so the distinction is never a
+* mystery. The shard section lists every user table in the selected Durable
+* Object with row counts, and probes a table's columns on expand via a one-row
+* `__lunora_admin__:readTablePage` (`PRAGMA table_info`). The global section
+* lists every `.global()` table — including the auth tables (`user`, `session`,
+* …) — via the client's `listGlobalTables()`, reading columns from a one-row
+* `readGlobalTablePage` on expand.
+*
+* Two presentations: a **Table list** (searchable, expandable cards per tier)
+* and a **Graph** — a single React Flow relationship diagram showing both tiers
+* on one canvas, with cross-tier FK edges and its own in-canvas find-table box,
+* tier filter, and legend.
+*
+* Read-only and gated by the server's `LUNORA_ADMIN_TOKEN`, like the rest of the
+* studio's admin surface. Global discovery is best-effort: if D1 isn't
+* configured the global section simply reports it, and the shard section still
+* works.
+*/
+declare const SchemaViewer: ({
+  initialShardKey,
+  initialTable,
+  schemaEditable
+}: SchemaViewerProps) => ReactElement;
+interface SettingsPanelProps {
+  /** Shard key the settings read targets on first load. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/**
+* Read-only **Settings** view of the deployment's config: the Worker vars,
+* secrets, and bindings exposed via `env`, plus best-effort deploy metadata.
+* Reads the `__lunora_admin__:getSettings` RPC over the {@link useLunora} client
+* (gated by the server's `LUNORA_ADMIN_TOKEN`).
+*
+* Strictly view-only: secret values are masked server-side and never returned
+* raw, and there is no editing here. The infrastructure plane lives in
+* Cloudflare/wrangler — a deep-link to the Cloudflare dashboard is provided so
+* you can edit there. Deployment config is static at runtime (it only changes on
+* redeploy), so this loads once on mount — there is no live channel or poll.
+*/
+declare const SettingsPanel: ({
+  initialShardKey
+}: SettingsPanelProps) => ReactElement;
+interface SqlEditorPanelProps {
+  /** Shard key the query runs against on first load. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/**
+* A full-height, Supabase-style SQL editor: a left query sidebar (search + new,
+* a browser-persisted PRIVATE list, and REFERENCE templates), a line-numbered
+* editor pane, and a Results / Explain pane with a Run control + shard selector.
+* Read-only — the `__lunora_admin__:runSql` RPC rejects everything but
+* SELECT / WITH / EXPLAIN, so raw writes can't desync the doc-store's shadow
+* tables (use the Data grid's inline edit for mutations).
+*/
+declare const SqlEditorPanel: ({
+  initialShardKey
+}: SqlEditorPanelProps) => ReactElement;
+interface FileBrowserProps {
+  /** Object-key prefix the browser filters by on first load. */
+  readonly initialPrefix?: string;
+  /** Objects requested per page. Forwarded to the storage `list` limit. */
+  readonly pageSize?: number;
+}
+/**
+* Browse — and mutate — objects in the storage (R2) bucket. Lists keys under an
+* optional prefix via the client's `listStorageObjects`, which hits the worker's
+* admin-gated `GET /_lunora/admin/storage` endpoint — so the worker must be built
+* with a `storageList` function and `adminToken`. Paginates forward by cursor.
+*
+* Each row offers a "Copy URL" (signed/public URL via `signedStorageUrl`) and a
+* confirm-gated "Delete" (`deleteStorageObject`); the toolbar offers an upload
+* (`uploadStorageObject`) into the current prefix. Those write paths require the
+* worker to be built with `storageSignedUrl` / `storageDelete` / `storageUpload`
+* respectively — when absent, the worker responds with a clear `*_NOT_CONFIGURED`
+* error that surfaces inline rather than crashing the panel.
+*
+* All state + behavior lives in {@link useFileBrowser}; this shell only wires the
+* view-model into the toolbar, breadcrumbs, selection bar, list/gallery and the
+* load-more / error / empty affordances.
+*/
+declare const FileBrowser: ({
+  initialPrefix,
+  pageSize
+}: FileBrowserProps) => ReactElement;
+/** Default polling cadence for auto-refresh, in milliseconds. */
+declare const DEFAULT_AUTO_REFRESH_MS = 5e3;
+/**
+* Call `onTick` on a fixed interval while `enabled`, for panels whose backend
+* has no live subscription channel (the scheduler, R2, D1, the SessionDO — all
+* HTTP-only). Polling is the honest "live" here: a timer-driven scheduler has no
+* client-observable write event to push on, so the UI watches jobs count down
+* and disappear by re-asking.
+*
+* Ticks are skipped while the tab is hidden (`document.hidden`) so a backgrounded
+* studio doesn't keep hammering the worker. `onTick` is held in a ref so a
+* fresh closure each render doesn't reset the interval; only `enabled`/`intervalMs`
+* do. The interval is cleared on disable and unmount.
+*/
+declare const useAutoRefresh: (onTick: () => void, enabled: boolean, intervalMs?: number) => void;
+/**
+* Debounced mirror of `value`: returns the latest value only after it has been
+* stable for `delayMs`. Used so a per-keystroke search box drives at most one
+* server round-trip per pause, instead of one request per character.
+*/
+declare const useDebounced: <T>(value: T, delayMs?: number) => T;
+/**
+* The registry of every English source string a call site may pass to `t(...)`.
+*
+* English is the source locale, so each id doubles as the rendered text: Lingui
+* compiles an id verbatim when a catalog has no entry for it. This list is the
+* single source of known strings — {@link MessageId} is derived from it and
+* `TFunction` is typed against that union, so `t("Dat")` (or any string absent
+* here) is a compile error rather than a silently-rendered typo.
+*
+* Add a string here the moment a new call site needs it. To translate, create a
+* sibling catalog (for example `de.ts`) mapping each id to its translation and
+* register it via `createStudioI18n(locale, { en: enMessages, de: deMessages })`.
+*/
+declare const MESSAGE_IDS: readonly ["Lunora AI rules aren't installed.", "lets your coding agent use Lunora correctly.", "Dismiss", ", changed", "(no subject)", "(root)", "{count} active", "{count} calls", "{count} failed", "{total} total", "No subscriptions yet", "Payments", "Plan", "Provider", "Recent webhook events", "Renews", "State", "Subscriptions", "Synced customers, subscriptions, and webhook events.", "{count} messages", "{count} pending changes", "{count} running", "{name} ({rowCount})", "{rangeStart}-{rangeEnd} of {total}", "{rate} ({count} entries)", "{reachable} reachable", "{reachable} reachable, {failed} unreachable", "{status} — processed", "{title} failed", "Actions", "Actions have no React hook — call them through the client.", "Add a widget to chart a saved SQL query on this browser.", "Add index on {table}", "Add row", "Add widget", "admin token", "Aggregating…", "all", "All shards", "API", "API reference unavailable", "API resources", "API usage snippets", "API view", "Arguments", "Auth", "Auth failures", "Auth failures over time", "Cache hit rate", "Call this {kind} from your app.", "Cancel", "Cancel job?", "Cc", "changed", "Chart widgets backed by saved read-only SQL queries.", "Lunora surfaces slow functions, error spikes, and cache problems here.", "Clear", "Clear inbox", "Columns unavailable", "CLI", "Client", "collecting samples…", "Combined cache hit rate", "Commit", "Committing…", "Breadcrumb", "Confirm", "Connect", "Connected", "Connecting…", "Local", "Not connected", "content-type", "Copy", "Copy link", "Copy-paste snippets for calling your functions and tables.", "created", "Cron triggers", "Dashboards", "Data", "Data migrations you run against this shard will be tracked here.", "Data model", "Database", "Database size", "db size", "Delete", "Delete saved query {name}", "Delete?", "direction", "Direction", "Discard", "down", "Dry run", "Dry run: ", "Edit", "Edit widget", "email", "Email preview", "Email your app sends in dev is captured here — nothing is delivered.", "Email your app sent, captured in dev.", "Enter a migration id", "error", "Error rate", "errors", "Errors", "Errors over time", "expires", "Export", "PNG", "SVG", "Export / Import", "Exported {count} rows.", "Facets", "file:function", "Files", "Filter messages", "Filter tables", "Find table…", "Foreign key", "From", "function", "Function", "Function path", "Functions", "Functions by error rate", "Graph", "Headers", "Health", "Indexes", "Hide", "HTML", "id", "Idle", "Import", "Import (writes rows)?", "Inserted {inserted}, {conflicts} conflicts, {errors} errors.", "Interactive OpenAPI reference and copy-paste snippets for your functions.", "Invalid JSON args: {message}", "Invalid JSON: {message}", "Invalid NDJSON: {message}", "ip", "Jobs queued with runAfter / runAt will appear here.", "JSON", "key", "Key prefix", "key prefix (optional)", "Level filter", "line {line} ({table}): {message}", "List", "Live", "Live — changes stream in automatically", "Live unavailable", "Live unavailable: {liveError}", "Live: on", "Load", "Load more", "Load tables", "Logic", "Logs", "Mail", "Mask sensitive columns", "Metrics", "migration id", "Migration id", "Migrations", "Missing index", "name", "Next", "no", "No active sessions.", "no cache configured", "No captured email.", "No cron triggers.", "No function activity yet.", "No functions or tables to document yet.", "No global tables.", "No headers.", "No HTML body.", "No logs.", "No migrations have run on this shard.", "No objects.", "No recent errors.", "No scheduled jobs.", "No tables to graph.", "No tables match your filter.", "No text body.", "No users.", "No widgets yet", "Objects you upload to your R2 buckets will appear here.", "Observability", "of {pages}", "off", "Offline", "ok", "OK", "on", "Open {target} {id}", "Open in new tab", "Outcome filter", "Page", "Plain text", "Prefill", "Previous", "Primary key", "processed", "React", "Read and write this table through the typed data model.", "Recent errors", "Recent logs", "Recently visited shards — click to switch", "Refresh", "Reload tables", "Remove widget", "RLS Policies", "Policies", "No policies defined", "No `definePolicy` is wired through `.use(rls(...))` in this deployment. Add one to guard a table's rows.", "Read", "Insert", "Update", "Guarded by", "Guarded", "Roles", "No roles defined", "No `defineRole` is registered via `rls(policies, { roles })`. Roles back `ctx.auth.can(...)` permission checks.", "Permissions", "Run as identity (userId)", "Leave empty to run as admin", "Dev only: runs the function as this user so you can test auth and RLS. Forged over the admin gate.", "as {userId}", "No policy", "Covered by {procedure}", "Uncovered — reachable without a policy", "Masked columns", "No tables in this deployment's schema.", "Add a `definePolicy` and wire it through `.use(rls(...))` to populate this matrix.", "Pick a function and an identity, then run it to see the access outcome.", "Probe", "Probe this", "Run as (userId)", "Identity (userId) to run as", "Run probe", "Allowed", "Denied", "Probing…", "Set `runAsIdentity` to forge an identity and probe access.", "Dev only: runs the selected function as this user over the admin gate so you can test auth and RLS.", "Inspect access policies per table, and probe a function as any identity.", "Scaffold access rules", "Writes a new deny-by-default policy file under lunora/, or wires one into a procedure, then reruns codegen. Local dev only.", "New policy file", "Wire into a procedure", "Policy name", "Create policy file", "Procedure file path", "Exported procedure", "Policy set identifier", "Wire RLS", "Creating…", "Wiring…", "Scaffolded {label} and reran codegen. Fill in the `when` predicates before relying on it.", "This change must be made by hand — the scaffolder only adds new, deny-by-default rules.", "requests", "Requests", "Requests / interval", "Requests over time", "Requests per interval over time", "Row actions", "Row document JSON", "Rows per page", "Run", "Run migration", "Run migration?", "Running…", "Query name", "Save", "Save query", "Save widget", "Saved", "schedule", "target", "workflow", "Run now", "Run now?", "Running…", "ran", "attempts", "backlog", "Dead letter", "Drop", "Drop job?", "in flight", "Jobs that exhaust their retry budget are parked here instead of being dropped.", "last tried", "max concurrency", "No dead-letter jobs.", "No workpools.", "pool", "Pools", "pools", "Pools created with createWorkpool appear here once they have activity.", "queued", "Retry", "Schedule view", "Scheduled", "scheduled for", "Scheduled jobs", "Scheduler backlog", "Schema", "Schema graph", "Schema view", "search message", "Search messages", "Search rows", "search table…", "Search…", "Select a function or table to see how to call it from your app.", "Select all rows", "Select row", "Send test", "Sent", "Service level", "Sessions", "Sessions for {userId}", "shard", "Shard", "Shard key", "shard key (optional)", "Shard key (optional)", "Shards", "Shards seen", "Signature", "size", "Snippet flavour", "State-changing admin operations are recorded here.", "status", "Storage", "Storage tier", "Storage tiers", "Studio", "Studio areas", "Studio failed", "Switch to dark theme", "Switch to light theme", "Table", "Table list", "Table touched", "Tables", "To", "Token rides the WebSocket URL — it can surface in browser DevTools and server logs. Use a dev-only token.", "Total database size", "Total errors", "Total requests", "Triggers declared with the cronJobs() builder appear here.", "Try again", "unreachable", "up", "updated", "Uptime", "user agent", "User id", "userId", "Users", "Users who sign up to your app will appear here.", "verified", "Widget title", "yes", "A live stream of recent function logs.", "Browse and edit rows across your shard and global tables.", "Browse auth users and their active sessions.", "Browse objects in your R2 storage buckets.", "Export a shard to NDJSON, or import rows from it.", "At-a-glance connection, error, and shard signals.", "Inspect and cancel scheduled jobs.", "Inspect each table and its columns.", "Inspect row-level-security policies and roles, per table.", "Per-shard health and aggregate metrics.", "Review migration status and run them.", "Run registered queries, mutations, and actions.", "Global tables (D1)", "Shard tables", "{shard} tables", "Tables marked .global() (D1-backed, region-replicated) will appear here.", "Select a table to browse its rows.", "Shared across every tenant, stored once in D1. Includes auth tables.", "Partitioned per shard key into separate Durable Objects — scoped to the shard above.", "avg", "calls", "conflicts", "kind", "last error", "last run", "max", "Most called", "No functions have run on this shard yet.", "Recent", "Slowest", "Insights", "Surface slow functions, error spikes, and cache problems.", "No issues detected.", "Low cache hit rate", "High cache eviction rate", "Slow function", "High error rate", "High write contention", "{rate} hit rate over recent traffic.", "{count} entries evicted recently.", "Slowest call took {duration}.", "Slowest call took {duration} — it full-scanned {tables} with no index.", "{rate} of calls failed.", "{rate} of calls hit a write conflict — consider sharding to cut contention.", "Home", "Reports", "SQL / Functions", "Table editor", "Connection, health, and advisor summary for your deployment.", "Collapse sidebar", "Expand sidebar", "SQL editor", "Run read-only SQL against a shard.", "Run", "SQL query", "{count} rows", "Showing the first {max} of {count} rows.", "Showing the {n} most common values.", "No rows returned.", "Private", "Reference", "Search queries…", "New query", "Untitled query", "Delete query", "No saved queries yet — they save to this browser as you type.", "Results", "Explain", "Chart", "History", "Format", "Clear history", "No numeric column to chart.", "Click Run to execute your query.", "Untitled", "New tab", "Close tab", "Tab title", "Double-click to rename", "Discard?", "Discard changes", "Keep editing", "Close other tabs", "Close tabs to the right", "Close all tabs", "Discard unsaved tabs?", "column", "keyword", "Columns", "Show all", "Hide all", "Transpose", "Swap rows and columns", "Field", "Row {n}", "Loading…", "No matching row.", "CSV", "{count} selected", "Delete {count}", "Delete {count} rows?", "Copy", "Copied", "Cell value", "Close", "Form", "Invalid JSON", "Command palette", "No results.", "Quick links", "Security findings", "Performance issues", "View", "All clear", "No data yet", "Get connected", "No issues found", "No security or performance issues detected.", "Client SDK", "React", "CLI", "Advisors", "Security", "Performance", "Warnings", "Info", "Issue type", "Entity/item", "Description", "{count} errors", "{count} warnings", "{count} suggestions", "No errors detected", "No warnings detected", "No suggestions", "Nothing to report for this deployment.", "Security and performance findings for your deployment.", "Review admin gates, credentials, and log redaction.", "Lunora checks admin-token strength, the live-subscription gate, and request-log redaction here.", "No security issues detected.", "Weak admin token", "Weak auth secret", "Session cookies are not Secure", "Wildcard CORS with credentials", "CSRF/origin guard is off", "Security headers are off", "Live admin subscriptions are ungated", "Request log keeps un-redacted args", "Unknown security finding", "Update your worker to a version of Lunora that describes this finding.", "Your admin token is {length} characters — use at least {min} for a brute-force-resistant secret.", "Your auth secret is {length} characters — use at least {min} (e.g. `openssl rand -hex 32`) to sign sessions safely.", "BETTER_AUTH_URL is a plaintext http:// origin, so session cookies cannot be Secure and ride in cleartext. Serve auth over https:// in production.", "LUNORA_ALLOWED_ORIGINS includes a wildcard while credentials are allowed — browsers reject this and it defeats the allowlist. Name explicit origins instead of *.", "LUNORA_SECURITY_CSRF is off, so cross-origin state-changing cookie requests are not blocked. Re-enable it in production to keep mutations un-forgeable.", "LUNORA_SECURITY_HEADERS is off, so HSTS, CSP, nosniff, and frame-options are not applied. Re-enable the baseline headers in production.", "Apply index", "Apply index on {table}", "Apply?", "CREATE INDEX SQL copied to clipboard.", "LUNORA_WS_BEARER is unset, so the WebSocket upgrade gate is open: live admin subscriptions need no credential. Set it to gate them like the HTTP admin RPCs.", "This worker reports a development environment, so the request log stores raw args and identity. Confirm it isn't a mislabeled production deploy.", "Audit", "A durable log of admin state-changing operations.", "Filter audit log", "filter op, table, id", "No audit entries.", "time", "op", "table", "detail", "Settings", "Deployment", "Read-only deployment config — vars, secrets, and bindings.", "Environment & bindings", "No environment variables or bindings.", "Open in Cloudflare", "Remove filter", "View-only — values are masked. Edit vars, secrets, and bindings in wrangler or the Cloudflare dashboard.", "URL", "Environment", "Version", "value", "Cascade impact", "Delete preview — rows that would cascade or be blocked", "No related rows found.", "Restrict relations will block this delete.", "Generate rows", "Generate dummy rows", "Seed {table} with Faker-generated rows. Existing rows are not affected.", "Row count", "(max {max})", "Columns to seed", "FK: no rows in {ref} — will skip", "→ {ref}", "No rows generated — all columns were skipped.", "Inserted {count} rows. Skipped FK columns: {cols}", "Inserted {count} rows successfully.", "Generate & insert", "Inserting…", "Time Travel", "Restore a shard to a point in the last 30 days.", "root", "In-place recovery to any moment in the last 30 days. For older or portable recovery, use the snapshot backup tier.", "Current bookmark", "Restore", "Time (ISO or epoch-ms, last 30 days)", "Preview", "Bookmark for that time", "Or an explicit bookmark (wins over time)", "bookmark string", "Restart the shard now so recovery applies immediately", "Confirm restore", "restarted now", "on next restart", "Restore armed", "Restored to", "Undo bookmark", "Confirm undo", "Undo restore", "role", "Role", "Role (optional)", "Active", "Banned", "unverified", "Manage", "New user", "Create", "Create user", "Creating…", "Password (optional)", "Search users", "Search by email or name…", "Filter by role", "Set role", "Ban user", "Ban reason (optional)", "Days", "Unban", "New password", "Set password", "Impersonate", "Impersonation token", "Revoke", "Revoke all sessions", "Delete user", "Confirm delete", "User details", "Fields", "Linked accounts", "No linked accounts.", "provider", "Unlink", "Security", "Disable two-factor", "No passkeys.", "Operations", "Organizations", "slug", "Members", "Invitations", "Remove", "No organizations.", "Select an organization to view its members and invitations.", "Organizations are not enabled.", "Enable the organization() plugin in your auth config to manage organizations here.", "Browse and manage organizations, members, and invitations.", "Reload", "Manage auth users — roles, bans, sessions, and identity.", "Auth config", "Configuration", "Enabled plugins and session config (read-only).", "Enabled capabilities", "Loading auth configuration…", "Accounts", "Admin", "Passkeys", "Two-factor", "Enabled", "Disabled", "OAuth providers, email templates, and rate limits are configured at deploy time in the better-auth setup and aren't editable here. See the Mail tab for email output.", "Sessions", "Browse and revoke active sessions across all users.", "user", "impersonated by", "Log drains", "Forward logs to Logpush, Tail Workers, or a webhook collector.", "Cloudflare destinations", "Lunora does not ship logs itself — forwarding is handled by Cloudflare. Configure a destination below, then test your collector.", "Logpush", "Stream every request log to R2, a SIEM, or a third-party log service.", "Tail Workers", "Send logs programmatically to a Worker for custom capture and forwarding.", "Workers Logs", "Retain and query recent request logs directly in Cloudflare's dashboard.", "Webhook test", "POST a sample Lunora request-log envelope to your collector to confirm it is reachable.", "https://example.com/logs", "Send test event", "Delivered — status {status} in {latency}ms", "Failed: {message}", "fetch is unavailable in this environment.", "Realtime", "Active WebSocket subscriptions on this shard.", "{count} connections", "{count} subscriptions", "No active subscriptions.", "Connection", "admin", "Folder path", "Grid", "Sort", "Name", "Type", "Modified", "Toggle sort direction", "Thumbnail size", "Link expiry", "15m", "1h", "24h", "7d", "Upload", "Uploading…", "Copy URL", "Download", "Delete object?", "Uploaded {key}", "Deleted {key}", "Summary", "Time range", "All time", "Last 5m", "Last 15m", "Last hour", "filter path", "By level", "By function", "Count", "{count} entries", "Snippets", "Couldn't load the OpenAPI spec: {message}", "No OpenAPI spec configured", "Run `lunora codegen` and wire `_generated/openapi.json` to the worker to render the API reference here.", "API operations", "Filter operations", "No operations match your filter.", "Try it", "Request arguments", "Response body", "Response", "application/json", "Arguments (JSON)", "Send", "Sending…", "Send a request to see the response.", "No example for this response.", "Error", "{ms} ms", "Range", "Value in", "relation", "API spec format", "OpenAPI", "OpenRPC", "Params", "Result", "Field", "Required", "JSON-RPC request", "Couldn't load the OpenRPC spec: {message}", "No OpenRPC spec configured", "Run `lunora codegen --api-spec openrpc` and wire `_generated/openrpc.json` to the worker to render the OpenRPC reference here.", "used by", "Orphan", "1 record", "{count} records", "References shard", "Which shard's records are checked for references to these files. Empty = root shard.", "Orphaned objects", "Find records whose file reference points at an object the bucket no longer has.", "Check for orphans", "Checking…", "No dangling references.", "Every record's file reference points at an object that exists in the bucket.", "Missing object", "→", "Showing the first {count} dangling references — the scan was truncated.", "Per-function call counts, error rates, and latency land here after your first request.", "Function and request logs for this shard show up here as your app handles traffic.", "No tables in this shard.", "Browse Vectorize indexes and run similarity searches.", "dimensions", "field", "Indexes declared with .vectorize() or defineVectorIndex() appear here.", "metadata", "metric", "No matches.", "No vector indexes.", "score", "Search", "Search by similarity…", "Searching…", "vectors", "Vectors", "vs. prev.", "Top functions", "No functions called yet.", "Calls", "Avg", "Err", "Avg latency", "cache hit", "Live connections", "sockets", "active subscriptions", "Recent activity", "No recent activity.", "last interval", "{rate} error rate", "cache entries", "Critical", "Degraded", "All systems healthy", "One or more service levels are breached.", "Some service levels need attention.", "All service levels are within target.", "Analytics", "Analytics is not configured.", "Hot shards", "Latency p50 / p95 per function", "No data points yet.", "Request volume per function", "Set CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN (Analytics Read) in your .dev.vars to enable usage panels.", "Usage and latency from Analytics Engine — request volume, p50/p95, and hot shards.", "(whole bucket)", "Access Rules", "Bucket", "Inspect storage access rules — per bucket, operation, and key prefix.", "No defineStorageRule is wired through .use(storageRules(...)) in this deployment. Add one to gate object access by key prefix.", "No storage rules defined", "Operation", "Storage rules are declared in code with defineStorageRule and gate ctx.storage access per bucket. This view is read-only.", "Write", "Workflows", "Inspect declared Cloudflare Workflows and their bindings.", "Binding", "Class", "No workflows defined", "No defineWorkflow is declared in lunora/workflows.ts in this deployment. Add one to run a durable, multi-step workflow.", "Workflows are declared in code with defineWorkflow and run as durable Cloudflare Workflows. This view is read-only.", "Workflows are declared in code with defineWorkflow and run as durable Cloudflare Workflows. Start an instance and observe its status below.", "Start instance", "Starting…", "Workflow", "Instance id", "Instance id (optional)", "Params (JSON)", "Params (JSON, optional)", "Params must be valid JSON", "Instances", "Status", "Output", "Refresh", "Refreshing…", "Instance history", "Filter by status", "All statuses", "Workflow inspection not configured", "Set CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN in your .dev.vars to enable workflow instance history.", "No instances", "No instances match this filter for the selected workflow.", "Created", "Ended", "Steps", "Step", "Attempts", "Started", "This instance has no recorded steps yet.", "pause", "resume", "terminate", ">100ms avg execution", "50–100ms avg execution", "<50ms avg execution", "{count} tracked statements", "Avg time", "avg", "avg time", "avgTime", "Critical queries", "Exec count", "exec count", "execCount", "Execution count", "Fast queries", "Full statement", "Moderate queries", "No query insights yet", "Overview", "P90 latency", "P95 latency", "Query insights", "Query insights appear once statements are executed against this shard.", "Query leaderboard", "Rows read", "Rows written", "rowsRead", "Slow queries sorted by {sortField}", "Sort by", "Sort queries by", "Statements", "total", "Total time", "total time", "totalTime", "Edit schema", "Add table", "Add column", "Add index", "Rename / drop / change type…", "Table name", "Column name", "Column type", "Index name", "Index fields (comma-separated)", "Optional", "Unique", "Cancel", "Apply", "Applying…", "This edit changes stored data and must go through a migration. Review the migration before applying.", "Open Migrations", "Schema updated.", "Codegen reported diagnostics:", "Editing the schema is only available in local dev.", "Adds a table, column, or index to lunora/schema.ts and reruns codegen.", "Theme", "Dark theme", "Light theme", "System theme", "Integrity"];
+/** A known studio message id — one of the entries in {@link MESSAGE_IDS}. */
+type MessageId = (typeof MESSAGE_IDS)[number];
+/**
+* English message catalog.
+*
+* English is the source locale: every call site passes its English string as the
+* message id (e.g. `t("Save")`), and Lingui compiles the id verbatim when a
+* catalog has no entry for it. So English needs no translations — this stays
+* empty and the source strings render as-is. The known ids live in
+* {@link MESSAGE_IDS}, which types the `t` function.
+*/
+/** The locale the studio ships with and falls back to. */
+declare const DEFAULT_LOCALE = "en";
+/**
+* Locale code to catalog. Each catalog maps an English source string (which
+* doubles as the message id) to its translation. English ships empty: Lingui
+* compiles the id verbatim when a translation is missing, so the source strings
+* render as-is. To add a language, register `{ "Some English text": "…" }`.
+*/
+type StudioCatalogs = Readonly<Record<string, Messages>>;
+/**
+* Translate function: `t("Clear")` or `t("{title} failed", { title })`.
+*
+* `id` is constrained to a known {@link MessageId}, so a typo is a compile error.
+* The interpolation `values` stay loosely typed: mapping each id to its exact
+* placeholder set isn't worth the machinery for the handful of interpolated
+* strings, so a wrong or missing value key isn't caught at this boundary.
+*/
+type TFunction = (id: MessageId, values?: Record<string, unknown>) => string;
+/**
+* Build a studio-scoped Lingui instance. We deliberately use `@lingui/core`'s
+* `setupI18n` (a fresh instance) rather than the global singleton so the
+* studio can never clobber — or be clobbered by — a host app that also uses
+* Lingui.
+*
+* The message compiler is installed explicitly. `@lingui/core` only auto-installs
+* it when `NODE_ENV !== "production"`, but the studio ships as a library and
+* relies on the compiler at runtime to interpolate uncompiled source strings
+* (e.g. `t("{title} failed", { title })`). Without this, a consumer's production
+* build would render `{title}` literally and `console.warn` on every `t(...)`.
+*
+* Pass extra `catalogs` to ship more locales; unknown `locale` codes fall back
+* to `DEFAULT_LOCALE`.
+*/
+declare const createStudioI18n: (locale?: string, catalogs?: StudioCatalogs) => I18n;
+/**
+* Shared default instance. Backs the i18n context's default value so the
+* composable studio and individual exported panels resolve their strings even
+* when rendered without `StudioI18nProvider` (e.g. in tests, or a host's own
+* admin UI). English-only, so it renders source strings as-is.
+*/
+declare const studioI18n: I18n;
+/**
+* Hook returning a `t` bound to the nearest `StudioI18nProvider` (or the
+* shared instance when there's none). This is the runtime stand-in for Lingui's
+* `t` macro — the studio builds with esbuild and tests under Vite 8/Rolldown,
+* neither of which runs Lingui's Babel macro transform, so call sites pass the
+* English string as the id directly.
+*/
+declare const useT: () => TFunction;
+interface StudioI18nProviderProps {
+  /** Catalogs to register in addition to the built-in English one. */
+  readonly catalogs?: StudioCatalogs;
+  readonly children: ReactNode;
+  /** Reuse an existing instance (wins over `locale`/`catalogs`). */
+  readonly i18n?: I18n;
+  /** Active locale; ignored when `i18n` is supplied. Defaults to `en`. */
+  readonly locale?: string;
+}
+/**
+* Provides a studio-scoped Lingui instance to `useT`. Nesting is safe:
+* providers sharing the same instance resolve to the same context value.
+*/
+declare const StudioI18nProvider: ({
+  catalogs,
+  children,
+  i18n,
+  locale
+}: StudioI18nProviderProps) => ReactElement;
+/** Root class the batteries-included app sets so the studio styles stay scoped. */
+declare const STUDIO_ROOT_CLASS = "lunora-studio-root";
+export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, type AggregateMetrics, ApiDocsPanel, type ApiDocsPanelProps, ApiReferencePanel, type ApiReferencePanelProps, ApiTab, type ApiTabProps, type AuditEntry, type AuditLogResult, AuditPanel, type AuditPanelProps, type CacheStats, type CapturedMailResult, type CommandItem, CommandPalette, type CommandPaletteProps, ConfirmButton, type ConfirmButtonProps, ConnectionBadge, DEFAULT_AUTO_REFRESH_MS, DEFAULT_INSIGHT_THRESHOLDS, DEFAULT_LOCALE, DataBrowser, type DataBrowserProps, DataFilters, type DeployInfo, type EditableFilter, ErrorBoundary, type ErrorBoundaryProps, ExportImportPanel, type ExportImportPanelProps, type ExportRow, FileBrowser, type FileBrowserProps, type FilterClause, type FilterOperator, type FunctionCallStat, type FunctionDescriptor, FunctionRunner, type FunctionRunnerProps, FunctionStatsPanel, type FunctionStatsPanelProps, type FunctionStatsResult, GlobalDataBrowser, type GlobalDataBrowserProps, HealthPanel, type HealthPanelProps, HomePanel, type HomePanelProps, type ImportError, type ImportShardResult, type Insight, type InsightKind, type InsightSeverity, type InsightThresholds, InsightsPanel, type InsightsPanelProps, type LogEntry, type LogLevel, LogsPanel, type LogsPanelProps, type LogsResult, MailPanel, type MailPanelProps, type MessageId, MetricsPanel, type MetricsPanelProps, type MigrationDirection, type MigrationRunResult, type MigrationStatus, type MigrationStatusRow, MigrationsPanel, type MigrationsPanelProps, OpenRpcReferencePanel, type OpenRpcReferencePanelProps, PitrPanel, type PitrPanelProps, type RunMigrationArgs, STUDIO_ROOT_CLASS, SchemaViewer, type SchemaViewerProps, SecurityAdvisorPanel, type SecurityAuditResult, type SecurityFinding, type SecurityFindingKind, type SecurityFindingLevel, type SettingEntry, type SettingKind, SettingsPanel, type SettingsPanelProps, type SettingsResult, ShardInput, type ShardInputProps, type ShardMetrics, type ShardMetricsResult, SqlEditorPanel, type SqlEditorPanelProps, type StudioCatalogs, StudioI18nProvider, type StudioI18nProviderProps, type TFunction, TableEditor, type TableEditorProps, type TableIndexInfo, type TableIndexesResult, type TableInfo, type TablePage, type WriteRowArgs, type WriteRowOp, type WriteRowResult, aggregateMetrics, createStudioI18n, deriveInsights, openCommandPalette, shardsToAggregate, studioI18n, toFilterClauses, useAutoRefresh, useDebounced, useT };