@lunora/studio 1.0.0-alpha.16 → 1.0.0-alpha.161

package/dist/index.d.mts

@@ -0,0 +1,1527 @@
+import { F as FunctionDescriptor } from "./packem_shared/app.d-BbmO2HA2.mjs";
+export { type a as FunctionKind, type R as RunStatus, b as ScheduledJobs, type c as ScheduledJobsProps, d as Studio, e as StudioApp, type S as StudioAppProps, type f as StudioProps } from "./packem_shared/app.d-BbmO2HA2.mjs";
+import { ReactElement, ReactNode, ErrorInfo, Component, ChangeEvent } from 'react';
+import { CapturedMail } from '@lunora/mail';
+export type {
+/**
+ * One captured outbound email as served by `__lunora_admin__:getCapturedMail`.
+ * Persisted by `@lunora/mail`'s dev capture transport into the root-shard
+ * mailbox and rendered by the studio Mail inbox. `html`/`text` are the rendered
+ * bodies; `to`/`cc`/`bcc` are the original recipient lists; `capturedAt` is
+ * epoch-ms.
+ *
+ * Re-exported verbatim from `@lunora/mail`, the canonical owner of the
+ * captured-mail wire type (also imported at the top of this file for local use
+ * in {@link CapturedMailResult}). This is NOT one of the hand-mirrored
+ * `@lunora/do` shapes below — it shares the real source of truth, so a field
+ * added in `@lunora/mail` flows here automatically.
+ */
+CapturedMail } from '@lunora/mail';
+import { HealthBody } from '@lunora/runtime';
+import { Messages, I18n } from '@lingui/core';
+export type { LunoraClient, ScheduleRecord, StorageObject } from '@lunora/client';
+import '@lunora/bindings/analytics';
+/**
+ * The studio's navigation taxonomy: which pages exist and which domain each one
+ * belongs to.
+ *
+ * Its own module so the label maps (`nav-labels.ts`) can name these types without
+ * importing `studio.tsx`, which pulls in every lazy panel behind it.
+ */
+/** Identifier for each built-in studio tab. */
+type StudioTab = "agents" | "analytics" | "api" | "audit" | "authAudit" | "authConfig" | "authSessions" | "containers" | "dashboards" | "data" | "deploymentHealth" | "drains" | "export" | "fanout" | "files" | "flags" | "functions" | "health" | "home" | "insights" | "issues" | "kv" | "logs" | "mail" | "metrics" | "migrations" | "notifications" | "organizations" | "payments" | "permissions" | "pitr" | "queues" | "reactors" | "realtime" | "rls" | "schedule" | "schema" | "advisorHealth" | "evals" | "security" | "settings" | "sql" | "storageRules" | "traces" | "users" | "vectors" | "workflows";
+/**
+ * One palette entry: a navigable destination, or an action to run.
+ *
+ * `run` exists because not everything the palette should reach is a page. The
+ * operation console has no route and no button — the keyboard chord was the only
+ * way in, which makes it undiscoverable, and unreachable at all once an operator
+ * rebinds the key and forgets what to.
+ */
+interface CommandItem {
+  /** Localised domain label, shown as a muted suffix to disambiguate. */
+  readonly group: string;
+  /** Localised sub-page label, the primary search target. */
+  readonly label: string;
+  /** Run on select. Mutually exclusive with `to`. */
+  readonly run?: () => void;
+  /** Router path to navigate to on select (e.g. `/logs`). Mutually exclusive with `run`. */
+  readonly to?: string;
+}
+interface CommandPaletteProps {
+  /** Every navigable destination, in rail order. */
+  readonly items: ReadonlyArray<CommandItem>;
+}
+/** Open the command palette from anywhere (e.g. the top-bar Search button). */
+declare const openCommandPalette: () => void;
+/**
+ * Command palette (⌘K / Ctrl-K) — Supabase-style global search. Rendered inside
+ * the studio shell so its selection can drive the router's `useNavigate`. Opens
+ * on the keyboard shortcut or the {@link OPEN_EVENT} the top-bar Search button
+ * dispatches, filters the navigable destinations by a case-insensitive substring
+ * over their label and domain, and navigates to the chosen one. Built on the
+ * studio's Base UI dialog primitive — no `cmdk`/extra dependency — with a small
+ * arrow-key + Enter affordance over the filtered list.
+ */
+declare const CommandPalette: ({ items }: CommandPaletteProps) => ReactElement;
+interface ConfirmButtonProps {
+  /** Label for the initial trigger (e.g. `Delete`). */
+  readonly children: string;
+  /** Label for the confirm step; defaults to a localised `Confirm`. */
+  readonly confirmLabel?: string;
+  /** Disable the trigger (e.g. while a write is in flight). */
+  readonly disabled?: boolean;
+  /** Action run only after the operator confirms. */
+  readonly onConfirm: () => void;
+  /** `data-testid` for the initial trigger; the confirm/cancel steps derive `${testId}-confirm` / `${testId}-cancel`. */
+  readonly testId: string;
+}
+/**
+ * A destructive-action button that requires a second click to fire. The first
+ * click swaps the trigger for an inline `Confirm` / `Cancel` pair rather than a
+ * blocking `window.confirm`, so the guard is testable and non-modal. The
+ * trigger keeps its `testId` (so existing tests that click it still reach the
+ * first step); the actual action only runs on the `${testId}-confirm` click.
+ */
+declare const ConfirmButton: ({ children, confirmLabel, disabled, onConfirm, testId }: ConfirmButtonProps) => ReactElement;
+/**
+ * Live-socket status indicator. Reflects the client's aggregate WebSocket health
+ * so an operator can tell a healthy live channel from a silently-dropped socket
+ * (a panel showing "Live: on" while the socket is down would otherwise look
+ * identical to one that's simply idle).
+ */
+declare const ConnectionBadge: () => ReactElement;
+interface ErrorBoundaryProps {
+  readonly children: ReactNode;
+  /**
+   * Localised fallback heading. When omitted, falls back to `${label} failed`
+   * (or `Something went wrong` with no label). A class component can't use the
+   * `useT` hook, so localised text is passed in by its parents.
+   */
+  readonly fallbackTitle?: string;
+  /** Optional label naming the boundary's region, shown in the fallback. */
+  readonly label?: string;
+  /** Localised label for the retry button; defaults to `Try again`. */
+  readonly retryLabel?: string;
+}
+interface ErrorBoundaryState {
+  readonly error: Error | null;
+}
+/**
+ * Catches render/lifecycle errors in a panel so one throwing component doesn't
+ * blank the whole studio shell. Shows the error message with a "Try again"
+ * button that clears the boundary and re-renders its children.
+ */
+declare class ErrorBoundary extends Component<ErrorBoundaryProps, ErrorBoundaryState> {
+  static getDerivedStateFromError(error: Error): ErrorBoundaryState;
+  override state: ErrorBoundaryState;
+  override componentDidCatch(error: Error, info: ErrorInfo): void;
+  readonly reset: () => void;
+  override render(): ReactNode;
+}
+interface ShardInputProps {
+  /** DOM `id` for the input, so an external label's `htmlFor` can target it. Optional. */
+  readonly id?: string;
+  readonly onChange: (value: string) => void;
+  /** `data-testid` for the input (panels keep their existing id, e.g. `mt-shard-input`). */
+  readonly testId: string;
+  readonly value: string;
+}
+/**
+ * Shard-key text field shared by every shard-scoped panel. Backed by a
+ * `<datalist>` of recently-used shard keys (see {@link loadRecentShards}) so an
+ * operator can pick a shard they've visited instead of retyping it — the closest
+ * to a shard picker possible without server-side shard enumeration, which
+ * Durable Objects don't support. Panels remain responsible for recording a shard
+ * as used (via `recordShard`) when they actually query it.
+ */
+declare const ShardInput: ({ id, onChange, testId, value }: ShardInputProps) => ReactElement;
+interface AdvisorHealthPanelProps {
+  /** Scopes the `data-testid`s. */
+  readonly testId?: string;
+}
+/**
+ * The Advisors **Health** tab: one score for the deployment, the coverage split, and
+ * every procedure ranked worst-first.
+ *
+ * Scoring runs client-side over the two admin reads rather than being baked into
+ * the worker: `scoreAdvisor` is a pure function, so the panel reuses the exact
+ * arithmetic the CLI gate uses — one implementation, no chance of the dashboard
+ * and CI disagreeing about the same deployment.
+ *
+ * Both reads are needed. The advisories are the numerator and the procedures the
+ * denominator; without the latter there is no way to tell one failing handler
+ * out of two from one out of two hundred.
+ */
+declare const AdvisorHealthPanel: ({ testId }: AdvisorHealthPanelProps) => ReactElement;
+declare const ADMIN_FUNCTION_PREFIX = "__lunora_admin__:";
+/**
+ * Fully-qualified reserved paths the studio invokes via the client. The
+ * `__lunora_admin__:` prefix is spelled out inline rather than interpolated so
+ * the values stay emittable under `--isolatedDeclarations`. Every path is
+ * intercepted by `ShardDO` before user dispatch and gated by the server's
+ * `LUNORA_ADMIN_TOKEN`.
+ */
+declare const ADMIN_FUNCTIONS: {
+  readonly aiAvailable: "__lunora_admin__:aiAvailable";
+  readonly aiChartConfig: "__lunora_admin__:aiChartConfig";
+  readonly aiGenerateSql: "__lunora_admin__:aiGenerateSql";
+  readonly aiTableFilter: "__lunora_admin__:aiTableFilter";
+  readonly assignIssue: "__lunora_admin__:assignIssue";
+  readonly backRelationCounts: "__lunora_admin__:backRelationCounts";
+  readonly clearCapturedMail: "__lunora_admin__:clearCapturedMail";
+  readonly clearQueueMessages: "__lunora_admin__:clearQueueMessages";
+  readonly clearTable: "__lunora_admin__:clearTable";
+  readonly createWorkflowInstance: "__lunora_admin__:createWorkflowInstance";
+  readonly deleteRows: "__lunora_admin__:deleteRows";
+  readonly describeTable: "__lunora_admin__:describeTable";
+  readonly describeTables: "__lunora_admin__:describeTables";
+  readonly explainIssue: "__lunora_admin__:explainIssue";
+  readonly exportShard: "__lunora_admin__:exportShard";
+  readonly facetColumn: "__lunora_admin__:facetColumn";
+  readonly getAdvisories: "__lunora_admin__:getAdvisories";
+  readonly getAdvisorProcedures: "__lunora_admin__:getAdvisorProcedures";
+  readonly getAuditLog: "__lunora_admin__:getAuditLog";
+  readonly getAuthAuditLog: "__lunora_admin__:getAuthAuditLog";
+  readonly getAuthMetrics: "__lunora_admin__:getAuthMetrics";
+  readonly getCapturedMail: "__lunora_admin__:getCapturedMail";
+  readonly getFanoutMetrics: "__lunora_admin__:getFanoutMetrics";
+  readonly getFunctionStats: "__lunora_admin__:getFunctionStats";
+  readonly getIssues: "__lunora_admin__:getIssues";
+  readonly lintSql: "__lunora_admin__:lintSql";
+  readonly listFlags: "__lunora_admin__:listFlags";
+  readonly listReactors: "__lunora_admin__:listReactors";
+  readonly listPushSubscriptions: "__lunora_admin__:listPushSubscriptions";
+  readonly listQueues: "__lunora_admin__:listQueues";
+  readonly listSubscriptions: "__lunora_admin__:listSubscriptions";
+  readonly listTableIndexes: "__lunora_admin__:listTableIndexes";
+  readonly listTablesIndexes: "__lunora_admin__:listTablesIndexes";
+  readonly listWorkflows: "__lunora_admin__:listWorkflows";
+  readonly getLogs: "__lunora_admin__:getLogs";
+  readonly getMetricHistory: "__lunora_admin__:getMetricHistory";
+  readonly getMetricSeries: "__lunora_admin__:getMetricSeries";
+  readonly getMetrics: "__lunora_admin__:getMetrics";
+  readonly getPitrBookmark: "__lunora_admin__:getPitrBookmark";
+  readonly getQueryInsights: "__lunora_admin__:getQueryInsights";
+  readonly getQueueMessages: "__lunora_admin__:getQueueMessages";
+  readonly getRequestLog: "__lunora_admin__:getRequestLog";
+  readonly getSecurityAudit: "__lunora_admin__:getSecurityAudit";
+  readonly getSettings: "__lunora_admin__:getSettings";
+  readonly getTraces: "__lunora_admin__:getTraces";
+  readonly getWorkflowInstanceStatus: "__lunora_admin__:getWorkflowInstanceStatus";
+  readonly ignoreIssue: "__lunora_admin__:ignoreIssue";
+  readonly importShard: "__lunora_admin__:importShard";
+  readonly listTables: "__lunora_admin__:listTables";
+  readonly maskPolicies: "__lunora_admin__:maskPolicies";
+  readonly migrationStatus: "__lunora_admin__:migrationStatus";
+  readonly patchRows: "__lunora_admin__:patchRows";
+  readonly pitrRestore: "__lunora_admin__:pitrRestore";
+  readonly readTablePage: "__lunora_admin__:readTablePage";
+  readonly replayQueueMessage: "__lunora_admin__:replayQueueMessage";
+  readonly resolveIssue: "__lunora_admin__:resolveIssue";
+  readonly rlsPolicies: "__lunora_admin__:rlsPolicies";
+  readonly schemaHistory: "__lunora_admin__:schemaHistory";
+  readonly schemaVersion: "__lunora_admin__:schemaVersion";
+  readonly runAs: "__lunora_admin__:runAs";
+  readonly runMigration: "__lunora_admin__:runMigration";
+  readonly runSql: "__lunora_admin__:runSql";
+  readonly sendQueueMessage: "__lunora_admin__:sendQueueMessage";
+  readonly sendTestMail: "__lunora_admin__:sendTestMail";
+  readonly setIssueSeverity: "__lunora_admin__:setIssueSeverity";
+  readonly storageOrphans: "__lunora_admin__:storageOrphans";
+  readonly storageReferences: "__lunora_admin__:storageReferences";
+  readonly storageRules: "__lunora_admin__:storageRules";
+  readonly studioFeatures: "__lunora_admin__:studioFeatures";
+  readonly writeRow: "__lunora_admin__:writeRow";
+};
+/** Comparison a {@link FilterClause} applies, mirroring `@lunora/do`'s `FilterOperator`. `contains` is a substring (LIKE). */
+type FilterOperator = "contains" | "eq" | "gt" | "gte" | "lt" | "lte" | "ne";
+/**
+ * One structured column filter passed to `readTablePage`, mirroring `@lunora/do`'s
+ * `FilterClause`. AND-combined with the substring search and the other clauses.
+ * `value` is sent as-is and bound server-side, so it never injects SQL.
+ */
+interface FilterClause {
+  column: string;
+  operator: FilterOperator;
+  value?: unknown;
+}
+/** Which single-row mutation a {@link WriteRowArgs} performs. */
+type WriteRowOp = "delete" | "insert" | "patch" | "replace";
+/** Arguments for the `__lunora_admin__:writeRow` admin op. */
+interface WriteRowArgs {
+  /** The row's fields. Required for insert/patch/replace; omitted for delete. */
+  doc?: Record<string, unknown>;
+  /** Primary key of the target row. Required for patch/replace/delete. */
+  id?: string;
+  op: WriteRowOp;
+  table: string;
+}
+/** Result of a {@link WriteRowArgs} op — the affected row's primary key. */
+interface WriteRowResult {
+  id: null | string;
+  op: WriteRowOp;
+}
+/** Result of `__lunora_admin__:getCapturedMail` — the dev mail-catcher inbox, newest first. */
+interface CapturedMailResult {
+  entries: CapturedMail[];
+}
+/** Reactive-cache hit/miss/eviction stats, present when a cache is configured. */
+interface CacheStats {
+  bytes: number;
+  entries: number;
+  evictions: number;
+  hits: number;
+  misses: number;
+}
+/** Health snapshot returned by `__lunora_admin__:getMetrics` for one shard. */
+interface ShardMetrics {
+  /**
+   * Reactive-cache stats. `null` is the shard saying "no cache configured";
+   * **absent** is a payload that carries no `cache` key at all — an older shard,
+   * or any response shaped before the field existed.
+   *
+   * Optional on purpose: this arrives as untrusted JSON off the admin wire and
+   * `useAdminQuery` casts it straight to this type, so declaring it required
+   * made the type lie and let consumers write `cache === null` and then
+   * dereference `undefined`. Optional makes the compiler reject that.
+   */
+  cache?: CacheStats | null;
+  databaseSize: null | number;
+  errors: number;
+  requests: number;
+  shard: string;
+  sinceMs: number;
+  uptimeMs: number;
+}
+/**
+ * One full-scan attribution entry on a {@link FunctionCallStat}, mirroring
+ * `@lunora/do`'s `FunctionScanAttribution`: how many times the function
+ * full-scanned `table`. The causal evidence behind the "missing index" insight.
+ */
+interface FunctionScanAttribution {
+  scans: number;
+  table: string;
+}
+/**
+ * Per-function execution counters returned by `__lunora_admin__:getFunctionStats`
+ * for one shard. Mirrors `@lunora/do`'s `FunctionCallStat`. Counters are
+ * per-DO-instance and reset on hibernation/restart — a "since this instance
+ * woke" readout. Durations are handler wall-clock milliseconds.
+ *
+ * `scans` / `scannedTables` carry the causal full-scan attribution (PLAN3 1.2).
+ * They're additive — a worker predating the feature reports `scans: 0` and
+ * `scannedTables: []`, so the fields are optional on the wire and the consumer
+ * defaults them. `conflicts` (OCC write-contention count, a subset of `errors`)
+ * is likewise additive and optional for the same back-compat reason.
+ */
+interface FunctionCallStat {
+  calls: number;
+  /** OCC write-conflict count — a subset of `errors`; absent on a pre-conflict-tracking worker. */
+  conflicts?: number;
+  errors: number;
+  lastCalledAt: number;
+  lastErrorAt: null | number;
+  lastErrorMessage: null | string;
+  maxDurationMs: number;
+  path: string;
+  /** Per-table full-scan attribution, busiest scan first; absent on a pre-1.2 worker. */
+  scannedTables?: FunctionScanAttribution[];
+  /** Total full-table scans across every dispatch; absent on a pre-1.2 worker. */
+  scans?: number;
+  totalDurationMs: number;
+}
+/** Payload of a `__lunora_admin__:getFunctionStats` call, mirroring `@lunora/do`'s `FunctionStatsResult`. */
+interface FunctionStatsResult {
+  functions: FunctionCallStat[];
+  sinceMs: number;
+}
+/**
+ * One declared index on a table, mirroring `@lunora/do`'s `TableIndexInfo`.
+ * `type` is the index kind; `fields` the indexed columns (sort fields for rank,
+ * text + filter fields for search, source field for vector); `unique` is set
+ * only for unique secondary indexes.
+ */
+interface TableIndexInfo {
+  fields: string[];
+  name: string;
+  type: "index" | "rank" | "search" | "vector";
+  unique?: boolean;
+}
+/** Payload of a `__lunora_admin__:listTableIndexes` call, mirroring `@lunora/do`'s `TableIndexesResult`. */
+interface TableIndexesResult {
+  indexes: TableIndexInfo[];
+}
+/**
+ * Severity of a buffered log entry, mirroring `@lunora/do`'s `LogLevel` — the
+ * full seven-tier `ctx.log` ramp (`trace`→`fatal`). A worker predating the
+ * un-folded buffer only ever sends the four console tiers, which are a subset.
+ */
+type LogLevel = "debug" | "error" | "fatal" | "info" | "log" | "trace" | "warn";
+/**
+ * One buffered log line returned by `__lunora_admin__:getLogs`. `functionPath`
+ * is the RPC that produced it (when known); `timestamp` is epoch-ms.
+ * `instance`/`exitCode` are populated for container lifecycle entries
+ * (`instance` = the per-instance Durable Object id, `exitCode` = the process
+ * exit code parsed out of a `stop` event). Mirrors `@lunora/do`'s `LogEntry`.
+ */
+interface LogEntry {
+  exitCode?: number;
+  /** Structured fields from a `ctx.log.<level>(message, fields)` / `ctx.log.with(fields)` call, when present. */
+  fields?: Record<string, unknown>;
+  functionPath?: string;
+  instance?: string;
+  level: LogLevel;
+  message: string;
+  timestamp: number;
+  /** Trace the line was emitted under; absent outside a dispatch (container lifecycle, hibernation-path errors) and on any worker predating the field. The key the Logs panel's Trace link and the Traces panel's correlated logs both join on. */
+  traceId?: string;
+}
+/** Payload of a `__lunora_admin__:getLogs` call: the buffered entries, newest first. */
+interface LogsResult {
+  entries: LogEntry[];
+}
+/**
+ * One recorded admin operation returned by `__lunora_admin__:getAuditLog`,
+ * mirroring `@lunora/do`'s `AuditEntry`. Unlike the in-memory logs, the audit
+ * log is durable and survives hibernation/restart. `seq` is a monotonic
+ * per-shard cursor; `op` the short op name (`writeRow`, `runMigration`,
+ * `importShard`, `applyCdc`); `table`/`id` are present when the op targets one;
+ * `detail` carries op-specific context (notably the acting `userId`).
+ */
+interface AuditEntry {
+  detail?: Record<string, unknown>;
+  id?: string;
+  op: string;
+  seq: number;
+  table?: string;
+  ts: number;
+}
+/** Payload of a `__lunora_admin__:getAuditLog` call: the recorded entries, newest first. */
+interface AuditLogResult {
+  entries: AuditEntry[];
+}
+/**
+ * How a deployment binding/var classifies, mirroring `@lunora/do`'s `SettingKind`.
+ * `var` is a plain Worker var, `secret` a sensitive string (always masked), and
+ * `binding` a non-string binding object (R2/KV/DO/D1/queue/service).
+ */
+type SettingKind = "binding" | "secret" | "var";
+/**
+ * One row of the read-only deployment-settings view, mirroring `@lunora/do`'s
+ * `SettingEntry`. `value` is a masked preview for `var`/`secret` strings (never
+ * the raw secret) and `null` for `binding` entries. The server masks every
+ * string value, so the studio only ever renders the masked text.
+ */
+interface SettingEntry {
+  /** Coarse runtime class for `binding` entries (`r2`, `kv`, `durable-object`, …). */
+  bindingType?: string;
+  kind: SettingKind;
+  name: string;
+  value: null | string;
+}
+/**
+ * Best-effort deploy metadata, mirroring `@lunora/do`'s `DeployInfo`. Every
+ * field is optional: the server reads only what the Worker `env` exposes and
+ * omits the rest.
+ */
+interface DeployInfo {
+  deploymentId?: string;
+  environment?: string;
+  versionTag?: string;
+  workerUrl?: string;
+}
+/** Payload of a `__lunora_admin__:getSettings` call, mirroring `@lunora/do`'s `SettingsResult`. */
+interface SettingsResult {
+  deploy: DeployInfo;
+  settings: SettingEntry[];
+}
+/**
+ * Ordering/visual weight of a {@link SecurityFinding}, mirroring `@lunora/do`'s
+ * `SecurityFindingLevel`. Shares the studio's insight-severity vocabulary so the
+ * Security and Performance advisors render with one badge palette.
+ */
+type SecurityFindingLevel = "error" | "info" | "warning";
+/**
+ * Which deployment-level security heuristic fired, mirroring `@lunora/do`'s
+ * `SecurityFindingKind`. The studio maps each kind to a localized title,
+ * explanation, and remediation hint; the wire payload carries only the kind,
+ * level, and optional `detail`.
+ */
+type SecurityFindingKind = "admin-token-weak" | "auth-secret-weak" | "cookies-insecure" | "cors-wildcard-credentials" | "csrf-disabled" | "dev-args-unredacted" | "security-headers-disabled" | "ws-gate-open";
+/**
+ * One detected security issue from `__lunora_admin__:getSecurityAudit`, mirroring
+ * `@lunora/do`'s `SecurityFinding`. `detail` carries kind-specific context the
+ * studio interpolates into the localized copy (e.g. `{ length, min }` for a weak
+ * admin token); absent when the kind needs none.
+ */
+interface SecurityFinding {
+  detail?: Record<string, unknown>;
+  kind: SecurityFindingKind;
+  level: SecurityFindingLevel;
+}
+/** Payload of a `__lunora_admin__:getSecurityAudit` call, mirroring `@lunora/do`'s `SecurityAuditResult`: every finding, worst-first. */
+interface SecurityAuditResult {
+  findings: SecurityFinding[];
+}
+/** A user table plus its current row count. */
+interface TableInfo {
+  name: string;
+  rowCount: number;
+}
+/** A window of rows from one table, plus the column list and total size. */
+interface TablePage {
+  columns: string[];
+  /** Foreign-key columns (column → target table) for `v.id("target")` fields, so the UI can link those cells. */
+  refs?: Record<string, string>;
+  rows: Record<string, unknown>[];
+  /**
+   * Total rows matching the predicate. Absent when the read passed
+   * `skipCount: true` — the data browser sources the count from a separate,
+   * predicate-keyed read so paging never re-runs the COUNT.
+   */
+  total?: number;
+}
+/** Direction a data migration is run in. Mirrors `@lunora/do`. */
+type MigrationDirection = "down" | "up";
+/** Lifecycle of a data-migration run. Mirrors `@lunora/do`. */
+type MigrationStatus = "completed" | "failed" | "in_progress";
+/**
+ * One persisted migration run-state row, as returned by the
+ * `__lunora_admin__:migrationStatus` RPC (`{ migrations: MigrationStatusRow[] }`).
+ */
+interface MigrationStatusRow {
+  changed: number;
+  cursor: null | string;
+  direction: MigrationDirection;
+  error: null | string;
+  id: string;
+  processed: number;
+  startedAt: null | number;
+  status: MigrationStatus;
+  updatedAt: null | number;
+}
+/** Result of a single `__lunora_admin__:runMigration` invocation against one shard. */
+interface MigrationRunResult {
+  changed: number;
+  cursor: null | string;
+  direction: MigrationDirection;
+  dryRun: boolean;
+  id: string;
+  processed: number;
+  status: MigrationStatus;
+}
+/** Arguments accepted by the `__lunora_admin__:runMigration` RPC. */
+interface RunMigrationArgs {
+  batchSize?: number;
+  direction?: MigrationDirection;
+  dryRun?: boolean;
+  id: string;
+  maxBatches?: number;
+}
+/** One NDJSON line: a row from `table`, shaped per its schema. */
+interface ExportRow {
+  doc: Record<string, unknown>;
+  table: string;
+}
+/** A row that could not be inserted during an import. */
+interface ImportError {
+  code: string;
+  line: number;
+  message: string;
+  table: string;
+}
+/** Result of a single `__lunora_admin__:importShard` invocation against one shard. */
+interface ImportShardResult {
+  conflicts: number;
+  errors: ImportError[];
+  inserted: Record<string, number>;
+}
+/**
+ * One shard's request total from the worker's `POST /_lunora/admin/shard-traffic`
+ * endpoint, mirroring `@lunora/runtime`'s `ShardTrafficEntry`. `requests` is the
+ * shard's lifetime dispatch count (`0` for a shard that failed/timed out);
+ * `shardKey` is the DO id name (`""` for the root shard). The cross-shard feed
+ * the `hot_shard` runtime advisor consumes to compute skew.
+ */
+interface ShardTrafficEntry {
+  requests: number;
+  shardKey: string;
+}
+/**
+ * Payload of a `POST /_lunora/admin/shard-traffic` call, mirroring the runtime
+ * coordinator's shard-traffic fan-out result: one `{ shardKey, requests }` entry
+ * per live shard plus the ok / failed counts. Fanned out on demand (not on the
+ * metrics hot path) so the panel can feed `hot_shard` the whole shard set's
+ * request volumes.
+ */
+interface ShardTrafficResult {
+  failed: number;
+  ok: number;
+  shards: ShardTrafficEntry[];
+}
+/** Visual + ordering weight of a detected issue. */
+type InsightSeverity = "error" | "info" | "warning";
+/**
+ * Which heuristic fired. The panel maps each kind to a localized title/detail,
+ * so the detection stays free of presentation strings (and trivially testable).
+ *
+ * `missing-index` is the causal upgrade of `slow-function`: a slow function
+ * whose latency is explained by a full-table scan. When the scan attribution
+ * pins the cause, the insight names the scanned table(s) (`tables`) and deep-
+ * links to the Schema/Indexes tab to add the index, rather than leaving the
+ * slowness an unattributed symptom.
+ */
+type InsightKind = "high-error-rate" | "high-evictions" | "high-write-contention" | "low-cache-hit-rate" | "missing-index" | "slow-function" | "storage-headroom";
+/**
+ * One detected issue. `value` is the headline number whose meaning depends on
+ * `kind`: a 0–1 rate for cache-hit / error-rate, a millisecond figure for
+ * slow-function / missing-index, an entry count for evictions. `fn` is set only
+ * for per-function insights; `message` carries the last error for
+ * high-error-rate; `tables` carries the full-scanned tables (busiest first) for
+ * the causal `missing-index` kind. For `high-write-contention` it is the OCC
+ * conflict ratio (conflicts / calls). For `storage-headroom` it is the shard's
+ * SQLite size in bytes.
+ */
+interface Insight {
+  fn?: string;
+  kind: InsightKind;
+  message?: string;
+  severity: InsightSeverity;
+  tables?: string[];
+  value: number;
+}
+/** Tunable cut-offs for {@link deriveInsights}. Exposed so a host (or a test) can tighten/loosen them. */
+interface InsightThresholds {
+  /** Flag functions whose error ratio is at or above this (0–1). */
+  highErrorRate: number;
+  /** Flag functions whose OCC write-conflict ratio is at or above this (0–1). */
+  highWriteContention: number;
+  /** Flag a cache whose hit rate is below this (0–1). */
+  lowCacheHitRate: number;
+  /** Require this many cache samples (hits + misses) before judging hit rate, to avoid cold-start noise. */
+  minCacheSamples: number;
+  /** Require this many calls before judging a function's conflict ratio. */
+  minConflictCalls: number;
+  /** Require this many calls before judging a function's error ratio. */
+  minErrorCalls: number;
+  /** Flag functions whose slowest call is at or above this many milliseconds. */
+  slowFunctionMs: number;
+  /** Escalate the storage insight to `error` at or above this many bytes. */
+  storageCriticalBytes: number;
+  /** Flag a shard whose SQLite is at or above this many bytes. */
+  storageWarnBytes: number;
+}
+declare const DEFAULT_INSIGHT_THRESHOLDS: InsightThresholds;
+/**
+ * Derive a prioritised list of issues from the two snapshots the studio
+ * already pulls — the `getMetrics` health snapshot and the `getFunctionStats`
+ * per-function table. Pure and side-effect-free: same inputs, same output, so
+ * the heuristics can be unit-tested without rendering.
+ *
+ * Heuristics: low-cache-hit-rate (cache below the threshold once enough samples
+ * exist — a cold cache isn't a problem); high-evictions (more evictions than
+ * hits, so the cache is too small or churning on invalidation); missing-index (a
+ * slow function whose latency is *explained* by a full-table scan — the causal
+ * upgrade of slow-function, naming the scanned table(s)); slow-function (a
+ * function whose slowest call crosses the threshold with no scan attribution to
+ * blame); high-error-rate (a function failing over a meaningful count);
+ * high-write-contention (a function whose OCC write conflicts make up a
+ * meaningful share of calls — a sharding candidate); storage-headroom (a shard
+ * whose SQLite is closing on the 10 GiB per-DO ceiling).
+ *
+ * A slow function with full-scan attribution emits `missing-index` (causal, with
+ * `tables`) instead of the bare `slow-function`, so the panel can link straight
+ * to the fix rather than restating the symptom.
+ *
+ * `storage-headroom` exists because the runtime's own signal is a one-shot
+ * `console.warn` inside the Durable Object — it fires once per DO instance, into
+ * a log nobody is tailing at 3am months before the wall. The size is already on
+ * the `getMetrics` snapshot the studio pulls, so surfacing it as a finding costs
+ * one comparison and puts the warning where someone will actually meet it.
+ */
+declare const deriveInsights: (metrics: ShardMetrics | null, functions: FunctionCallStat[] | null, thresholds?: InsightThresholds) => Insight[];
+interface InsightsPanelProps {
+  /** Shard key the snapshots target on first load. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+  /**
+   * Fan the cross-shard traffic feed out for `table`, returning each shard's
+   * `{ shardKey, requests }` total — the input the `hot_shard` advisor lint
+   * needs. Defaults to `client.shardTraffic(table)` (the admin-gated
+   * `POST /_lunora/admin/shard-traffic` fan-out). Best-effort: a rejection
+   * leaves `hot_shard` dormant rather than blanking the panel. Injectable so
+   * tests can drive the skew without a worker.
+   */
+  readonly loadShardTraffic?: (table: string) => Promise<ShardTrafficResult>;
+}
+/**
+ * The Performance Advisor — a 1-to-1 of Supabase's Performance Advisor: severity
+ * tabs over a findings table (via {@link AdvisorView}). It pulls the `getMetrics`
+ * health snapshot and `getFunctionStats` per-function table for one shard, then
+ * maps the issues {@link deriveInsights} detects (low cache hit rate, high
+ * eviction, slow functions, missing indexes, error spikes, storage headroom)
+ * into rows. A `missing-index` row carries an inline "add the index" jump to the
+ * Schema tab. Both reads are best-effort — one failing still yields the other's
+ * insights.
+ */
+declare const InsightsPanel: ({ initialShardKey, loadShardTraffic }: InsightsPanelProps) => ReactElement;
+/**
+ * The Security Advisor — a 1-to-1 of Supabase's Security Advisor: severity tabs
+ * (Errors / Warnings / Info) over a findings table. It pulls `getSecurityAudit`
+ * (deployment-wide, so it targets the root shard and needs no shard selector) and
+ * maps each finding the server derived from the Worker `env` — weak admin token,
+ * an open WebSocket gate for user subscriptions, a dev-mode request log keeping
+ * un-redacted args — into a row. These are signals only lunora can surface: Cloudflare's dashboard can't
+ * reason about lunora's admin/WS gates or its log-redaction policy.
+ */
+declare const SecurityAdvisorPanel: () => ReactElement;
+interface ApiDocsPanelProps {
+  /**
+   * Registered functions to document. Mirrors the list the Functions tab's
+   * runner and stats panels receive — a query/mutation/action's `kind` is
+   * compile-time-only, so it must be named here. When omitted the panel still
+   * renders (tables come from the admin RPC) and shows an empty functions list.
+   */
+  readonly functions?: FunctionDescriptor[];
+  /** Shard key the table list is read from. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/**
+ * Per-resource "how to call this from your app" browser, generated from the
+ * registered functions and tables the studio already has — no new endpoints.
+ * The left rail lists functions grouped by file plus a Tables section; the right
+ * pane shows copy-paste snippets (React / Client / CLI for functions; the typed
+ * data-model usage for tables).
+ *
+ * Args are a placeholder: the real argument shape lives in the codegen'd `api`
+ * types this browser never loads, the same way Supabase's usage snippets show
+ * placeholders.
+ */
+declare const ApiDocsPanel: ({ functions, initialShardKey }: ApiDocsPanelProps) => ReactElement;
+interface ApiReferencePanelProps {
+  /**
+   * Inline OpenAPI document. When supplied the panel renders it directly and
+   * skips the fetch — used by the mock harness and by hosts that already hold
+   * the generated spec. When omitted the panel fetches the worker's
+   * admin-gated `GET /_lunora/admin/openapi` endpoint via the client.
+   */
+  readonly spec?: unknown;
+}
+/**
+ * In-studio OpenAPI reference: renders the generated OpenAPI 3.1 document with
+ * the studio-native {@link ReferenceView} — a tag-grouped operation browser,
+ * schema tables, a live "try it" console, and copy-paste request samples, all
+ * themed to the studio. The spec comes from an inline
+ * {@link ApiReferencePanelProps.spec} prop, or — by default — the worker's
+ * admin-gated `GET /_lunora/admin/openapi` endpoint fetched through the client.
+ *
+ * This replaced the embedded Scalar reference (a Vue app in React): Scalar's
+ * portal/overlay layers repeatedly intercepted clicks and froze the tab, and it
+ * shipped a multi-megabyte bundle. The native view is overlay-free and reuses
+ * the studio's own primitives.
+ */
+declare const ApiReferencePanel: ({ spec: inlineSpec }: ApiReferencePanelProps) => ReactElement;
+interface ApiTabProps {
+  /** Registered functions documented by the snippets sub-view. Threaded host → studio. */
+  readonly functions?: FunctionDescriptor[];
+  /** Shard key the snippets view reads its table list from. */
+  readonly initialShardKey?: string;
+  /**
+   * Inline OpenAPI document for the reference sub-view. When omitted the
+   * reference fetches the worker's `GET /_lunora/admin/openapi` endpoint.
+   */
+  readonly openApiSpec?: unknown;
+  /**
+   * Inline OpenRPC document for the reference sub-view's OpenRPC format. When
+   * omitted the OpenRPC view fetches the worker's `GET /_lunora/admin/openrpc`
+   * endpoint. OpenRPC is the RPC-native spec (RPC functions only); OpenAPI
+   * additionally covers `httpRouter()` REST routes.
+   */
+  readonly openRpcSpec?: unknown;
+}
+/**
+ * The studio's API tab. Hosts two complementary surfaces behind a segmented
+ * toggle. The Reference view renders a machine-readable spec — the OpenAPI 3.1
+ * document or the RPC-native OpenRPC document — through the studio-native
+ * reference UI (operation browser, schema tables, a live "try it" console, and a
+ * request-sample rail), with a small format switch between them. The Snippets
+ * view is the per-function React / Client / CLI copy-paste browser
+ * (`api-docs-panel`), the lightweight "how do I call this" DX.
+ *
+ * Reference is the default; OpenAPI is the default format (the richer,
+ * spec-driven view that also covers REST). Each format degrades to a clear
+ * empty state when its spec isn't wired.
+ */
+declare const ApiTab: ({ functions, initialShardKey, openApiSpec, openRpcSpec }: ApiTabProps) => ReactElement;
+interface OpenRpcReferencePanelProps {
+  /**
+   * Inline OpenRPC document. When supplied the panel renders it directly and
+   * skips the fetch — used by the mock harness and by hosts that already hold
+   * the generated spec. When omitted the panel fetches the worker's
+   * admin-gated `GET /_lunora/admin/openrpc` endpoint via the client.
+   */
+  readonly spec?: unknown;
+}
+/**
+ * In-studio OpenRPC reference. OpenRPC is the RPC-native spec (a `methods` array
+ * over the JSON-RPC-shaped `POST /_lunora/rpc` transport), documenting the RPC
+ * functions only. It is parsed into the shared `ApiModel` and rendered by the
+ * same studio-native {@link ReferenceView} the OpenAPI panel uses, so both
+ * formats share one operation browser, schema view, try-it console, and sample
+ * rail.
+ *
+ * The spec comes from an inline {@link OpenRpcReferencePanelProps.spec} prop, or
+ * — by default — the worker's admin-gated `GET /_lunora/admin/openrpc` endpoint.
+ */
+declare const OpenRpcReferencePanel: ({ spec: inlineSpec }: OpenRpcReferencePanelProps) => ReactElement;
+/**
+ * A shareable data-browser view: the table, storage tier, shard, structured
+ * filters, substring search, and sort that together reproduce exactly what the
+ * grid is showing. This is the unit that is serialized into the URL (so the link
+ * IS the query) and persisted by name in {@link loadSavedQueries}. Every field is
+ * optional so a partial/legacy URL still hydrates into a sensible default view.
+ */
+interface DataView {
+  /** Structured `column operator value` clauses, AND-combined with the search. */
+  filters?: FilterClause[];
+  /** Single-column sort, server-side; absent → the table's natural order. */
+  orderBy?: {
+    column: string;
+    direction: "asc" | "desc";
+  };
+  /** Substring search across all columns. */
+  search?: string;
+  /** Shard key the view targets; absent/empty → the root shard. */
+  shard?: string;
+  /** The open table. */
+  table?: string;
+  /** Storage tier the table lives in; absent → the shard (SQLite) tier. */
+  tier?: "global" | "shard";
+}
+/** A user-named, persisted {@link DataView} — the "canned query" the saved-queries panel lists. */
+interface SavedQuery {
+  name: string;
+  view: DataView;
+}
+interface DataBrowserProps {
+  /**
+   * Allow editing: surfaces insert/edit/delete actions that issue
+   * `__lunora_admin__:writeRow` ops through the schema-aware writer. Off by
+   * default — the browser is read-only unless the host opts in.
+   */
+  readonly editable?: boolean;
+  /**
+   * Names of the `.global()` (D1-backed) tables. A `v.id` ref cell whose target
+   * is one of these is followed cross-tier via `onNavigateToGlobal` instead of
+   * being read from this shard (where it doesn't exist). Supplied by the Table
+   * editor; defaults to none when the browser is used standalone.
+   */
+  readonly globalTableNames?: ReadonlySet<string>;
+  /** Structured filters to hydrate from a shared link / saved query. */
+  readonly initialFilters?: FilterClause[];
+  /** Sort to hydrate from a shared link / saved query. */
+  readonly initialOrderBy?: DataView["orderBy"];
+  /** Comma-separated pinned columns from the URL; wins over the per-browser default. */
+  readonly initialPins?: string;
+  /** Substring search to hydrate from a shared link / saved query. */
+  readonly initialSearch?: string;
+  /** Shard key the browser targets on first load. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+  /**
+   * Follow a `v.id` ref whose target is a global table — the Table editor switches
+   * to the global tier and opens that table. When omitted (standalone use), a ref
+   * to a global table falls through to the in-shard read (and surfaces its error).
+   */
+  readonly onNavigateToGlobal?: (table: string, id: string) => void;
+  /**
+   * Navigate the URL to a table (the Table editor pushes `?table=…`), opening it
+   * clean; `options.search` pre-fills the search for an FK-cell traversal.
+   * Omitted in standalone use.
+   */
+  readonly onSelectTable?: (table: string, options?: {
+    search?: string;
+  }) => void;
+  /**
+   * Called whenever the loaded view (shard / search / filters / sort) changes, so
+   * the host can mirror it to the URL — making every view a shareable link.
+   * Omitted in standalone use (view state stays in-component).
+   */
+  readonly onViewChange?: (view: Pick<DataView, "filters" | "orderBy" | "search" | "shard">) => void;
+  /** Rows requested per page. Clamped server-side to `[1, 500]`. */
+  readonly pageSize?: number;
+  /**
+   * The canned-query toolbar's handlers + saved list. Supplied by the Table editor
+   * (it owns the router and the `saved-queries` localStorage helper); omitted in
+   * standalone use, which hides the toolbar entirely. `onSaveQuery` receives the
+   * name plus the current view to persist.
+   */
+  readonly queryBar?: {
+    readonly onApplyQuery: (query: SavedQuery) => void;
+    readonly onCopyLink: () => void;
+    readonly onDeleteQuery: (name: string) => void;
+    readonly onSaveQuery: (name: string, view: DataView) => void;
+    readonly saved: ReadonlyArray<SavedQuery>;
+  };
+  /**
+   * The schema/source selector rendered at the top of the table-list sidebar —
+   * the Table editor's `schema public ▾` switch. Supplied when this browser is
+   * composed into the Table editor; omitted when it's used alone.
+   */
+  readonly schemaSwitch?: ReactNode;
+  /**
+   * The table named in the URL. Drives the selection — a deep link or browser
+   * back/forward to a different `?table=…` re-opens that table. Supplied by the
+   * Table editor; omitted in standalone use (selection stays purely in-component).
+   */
+  readonly tableParam?: string;
+}
+/**
+ * Read-only data browser for a single shard's SQLite database. Lists the user
+ * tables (via the `__lunora_admin__:listTables` RPC), then pages through the
+ * rows of whichever table is selected (`__lunora_admin__:readTablePage`).
+ *
+ * Both calls travel over the ordinary `useLunora` client transport; the
+ * admin RPCs are intercepted inside the Durable Object and are gated by the
+ * server's `LUNORA_ADMIN_TOKEN`. The host is responsible for configuring the
+ * client's auth token — this component issues no credentials of its own.
+ *
+ * The table view is built on a headless `@tanstack/react-table` model: column
+ * defs derive from `page.columns`, sorting and (global) filtering run
+ * page-locally over the loaded rows, and the rendered rows are virtualized with
+ * `@tanstack/react-virtual` so a large page never inflates the DOM. None of this
+ * touches the server — pagination still flows through `readTablePage`. All of
+ * that state lives in {@link useDataBrowser}; this component is just the markup.
+ */
+declare const DataBrowser: ({ editable, globalTableNames, initialFilters, initialOrderBy, initialPins, initialSearch, initialShardKey, onNavigateToGlobal, onSelectTable, onViewChange, pageSize: initialPageSize, queryBar, schemaSwitch, tableParam }: DataBrowserProps) => ReactElement;
+/** A filter row as edited in the UI — the value is always a string until coerced for the wire. */
+interface EditableFilter {
+  column: string;
+  operator: FilterOperator;
+  value: string;
+}
+/**
+ * Convert the UI's string-valued filter rows into wire {@link FilterClause}s:
+ * drops rows with no column, and coerces a canonical numeric string to a number for
+ * every comparison operator (so `age > 18` compares numerically, not lexically, and
+ * an `eq` on a numeric column still matches — see {@link coerceFilterValue} for why a
+ * numeric-looking but non-canonical string like a zip code stays text). `contains`
+ * always stays a string.
+ */
+declare const toFilterClauses: (filters: ReadonlyArray<EditableFilter>) => FilterClause[];
+/**
+ * The data browser's filtering controls: the substring search box plus a stack
+ * of structured `column operator value` rows. All state is owned by the parent
+ * (the data-browser model); this is the control markup, emitting the full
+ * filter array up on every edit. Raw strings (no i18n) to match the surrounding
+ * data-browser controls.
+ *
+ * ## Why these rows are NOT run through the mask preview
+ *
+ * Every other read surface in the shard browser honours the "Mask sensitive
+ * columns" toggle — grid cells, the transposed and JSON views, the row-detail
+ * drawer, all three exports, the facet sidebar — and the `.global()` browser
+ * masks its drill-down chips too. This bar deliberately does not, and the
+ * question has been raised twice, so here is the enumeration it rests on.
+ *
+ * Two of the ways a value reaches these rows are DATA-DERIVED — the operator did
+ * not type it — and those are the ones that could have leaked.
+ *
+ * A FACET-VALUE CLICK (`facetFilter` in `use-data-browser`) is closed at the
+ * source: `DataFacets` withholds both the toggle and any open section for a
+ * mask-covered column while the preview is on, so this can only reach a covered
+ * column after the operator switched the preview OFF — a deliberate reveal of the
+ * same value, from the same screen.
+ *
+ * HYDRATION FROM THE URL or a saved query (`initialFilters` → `toEditableFilters`)
+ * is the shared-link case, and the one that looks like the `.global()` drill-down
+ * chips — but it is not, because of the invariant below.
+ *
+ * (The AI "describe a filter" affordance sends column names and the prompt, never
+ * a row, so it cannot lift a stored secret into a clause. That is enforced by
+ * `@lunora/do`'s `sql-assistant.test.ts` — "sends the caller's columns and prompt
+ * and nothing else" — rather than asserted here, because a claim about another
+ * package that nothing checks is how a comment goes stale.)
+ *
+ * The invariant that makes both harmless: **a filter clause rendered here is
+ * always simultaneously rendered verbatim in the address bar.** `useDataBrowser`
+ * mirrors the loaded view through `onViewChange`, and `table-editor.tsx` writes
+ * it straight into `?filters=<json>` on every change. So masking a row would
+ * blank a value that is legible, unmasked, three inches above the input — while
+ * making the filter impossible to edit. It would cost usability and buy nothing.
+ *
+ * That is exactly what separates this bar from the `.global()` browser's
+ * drill-down chips, which ARE masked: those are read-only (nothing to edit),
+ * they are fed ONLY by a facet click, and `global-data-browser` keeps them in
+ * local state that never reaches the URL — so masking them genuinely removes a
+ * value from the screen.
+ *
+ * **If either half of that stops being true — a filter row that is not mirrored
+ * to `?filters=`, or a read-only filter display — revisit this.** Both halves are
+ * pinned by `__tests__/features/data/data-browser-mask.test.tsx`'s
+ * "dataBrowser masking — filters" block.
+ */
+declare const DataFilters: ({ columns, filters, onAskAi, onFiltersChange, onSearchChange, search }: {
+  columns: ReadonlyArray<string>;
+  filters: ReadonlyArray<EditableFilter>;
+  /** Ask the model for structured clauses. Omitted when no AI binding is available. */
+  onAskAi?: (prompt: string) => void;
+  onFiltersChange: (filters: EditableFilter[]) => void;
+  onSearchChange: (event: ChangeEvent<HTMLInputElement>) => void;
+  search: string;
+}) => ReactElement;
+interface GlobalDataBrowserProps {
+  /**
+   * Table to open automatically on mount (and whenever it changes). Used by the
+   * Table editor when a `v.id` reference in a shard row points at a `.global()`
+   * table: clicking it switches to the global tier and lands here with that table
+   * pre-selected. Each distinct value is applied once, so the operator can still
+   * navigate away afterwards.
+   */
+  readonly initialTable?: string;
+  /**
+   * Called whenever the open table changes, so the host can mirror it to the URL
+   * (the Table editor pushes `?table=…`). Omitted in standalone use.
+   */
+  readonly onSelectTable?: (table: string) => void;
+  /** Rows requested per page. Clamped server-side to `[1, 500]`. */
+  readonly pageSize?: number;
+  /**
+   * The schema/source selector rendered at the top of the table-list sidebar —
+   * the Table editor's `schema public ▾` switch. Supplied when this browser is
+   * composed into the Table editor; omitted when it's used alone.
+   */
+  readonly schemaSwitch?: ReactNode;
+}
+/**
+ * Read-only browser for `.global()` (D1-backed) tables. Twin of `DataBrowser`,
+ * but not shard-scoped: it lists tables via `listGlobalTables()` and pages rows
+ * via `readGlobalTablePage()`. Laid out like Supabase's Table Editor — a left
+ * table sidebar + a bordered grid with a paginated footer — and gated by the
+ * server's `LUNORA_ADMIN_TOKEN`.
+ */
+declare const GlobalDataBrowser: ({ initialTable, onSelectTable, pageSize: initialPageSize, schemaSwitch }?: GlobalDataBrowserProps) => ReactElement;
+interface TableEditorProps {
+  /**
+   * Allow editing the shard-local tables (insert/edit/delete). Forwarded to the
+   * shard {@link DataBrowser}; the global D1 browser is always read-only. Off by
+   * default — see {@link DataBrowser}.
+   */
+  readonly editable?: boolean;
+  /** Shard key the shard browser targets on first load. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/**
+ * The Table editor: browses your application's tables across both storage tiers
+ * from one section. A schema switch in the sidebar header (Supabase's
+ * `schema public ▾`) toggles between the per-shard SQLite browser
+ * (`.shardBy(...)`, editable when the host opts in) and the read-only global D1
+ * browser (`.global()`) — folding what used to be a separate "Global Tables" tab
+ * into a single editor (`STUDIO-REDESIGN-PLAN.md` §2).
+ *
+ * The active tier and open table live in the URL search params (`?schema=global`,
+ * `?table=…`) rather than component state, so every selection is a real, shareable
+ * URL and browser back/forward moves between tables and tiers. The browsers push on
+ * selection and re-open whatever the URL names.
+ */
+declare const TableEditor: ({ editable, initialShardKey }: TableEditorProps) => ReactElement;
+interface ExportImportPanelProps {
+  /** Shard key the panel targets. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/**
+ * Snapshot and restore a single shard's data as NDJSON.
+ *
+ * "Export" reads every shard-local row via `__lunora_admin__:exportShard` and
+ * renders it as NDJSON for download/copy. "Import" parses NDJSON the operator
+ * pastes in and replays it through `__lunora_admin__:importShard`, reporting
+ * inserted counts, id conflicts and per-row errors. Globally-scoped (`.global()`)
+ * tables live in D1 and are intentionally out of scope here.
+ *
+ * Both calls travel over the {@link useLunora} client transport and are gated by
+ * the server's `LUNORA_ADMIN_TOKEN`.
+ */
+declare const ExportImportPanel: ({ initialShardKey }: ExportImportPanelProps) => ReactElement;
+interface MigrationsPanelProps {
+  /** Shard key the panel targets. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/**
+ * Inspect and drive data migrations on a single shard.
+ *
+ * Reads the persisted run-state via the `__lunora_admin__:migrationStatus` RPC
+ * and lets an operator kick off a migration by id (`__lunora_admin__:runMigration`)
+ * with a direction, an optional batch cap and a dry-run toggle. Both calls
+ * travel over the ordinary {@link useLunora} client transport and are gated by
+ * the server's `LUNORA_ADMIN_TOKEN` — this component issues no credentials of
+ * its own.
+ */
+declare const MigrationsPanel: ({ initialShardKey }: MigrationsPanelProps) => ReactElement;
+interface PitrPanelProps {
+  /** Shard key the PITR ops target. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/**
+ * Native Durable-Object point-in-time recovery for one shard — the **Time
+ * Travel** view.
+ *
+ * Reads the shard's current bookmark, previews the bookmark nearest a chosen
+ * time, and (behind a confirm step) restores the shard to a time or an explicit
+ * bookmark via the `__lunora_admin__:pitrRestore` RPC, surfacing the returned
+ * undo bookmark so the restore can be reversed. All ops run over the
+ * {@link useLunora} client and are gated by the server's `LUNORA_ADMIN_TOKEN`.
+ *
+ * In-place recovery covers the last 30 days; for older or off-platform recovery
+ * use the snapshot tier (`lunora backup` / the backup registry item).
+ */
+declare const PitrPanel: ({ initialShardKey }: PitrPanelProps) => ReactElement;
+interface FunctionRunnerProps {
+  /**
+   * Functions to expose. When omitted, the runner auto-discovers them via the
+   * client's `listFunctions()` (the admin-gated `/_lunora/admin/functions`
+   * endpoint), so it works with no wiring when the worker is built with a
+   * `functions` registry. Supply the list to override discovery.
+   */
+  readonly functions?: FunctionDescriptor[];
+  /**
+   * Expose the "Run as identity" control — execute the selected function AS a
+   * chosen authenticated user so an operator can test auth + RLS behavior.
+   * Security-sensitive: the run is forwarded over the admin-gated
+   * `__lunora_admin__:runAs` RPC, which forges the per-request identity. The
+   * host sets this only on a trusted loopback-dev gate (the `Studio` component's
+   * `runAsIdentity` prop); off by default, the runner always runs with the
+   * caller's own (admin) identity.
+   */
+  readonly runAsIdentity?: boolean;
+}
+/**
+ * Interactive runner for the registered functions: pick one, edit its JSON
+ * arguments, optionally target a shard, then invoke it against the live
+ * {@link useLunora} client and inspect the result or error.
+ *
+ * By default the function list is auto-discovered from the worker's
+ * `/_lunora/admin/functions` endpoint; pass an explicit `functions` array to
+ * skip discovery (a query/mutation/action's `kind` is compile-time-only, so it
+ * must be named).
+ */
+declare const FunctionRunner: ({ functions: functionsProp, runAsIdentity }?: FunctionRunnerProps) => ReactElement;
+interface FunctionStatsPanelProps {
+  /** Descriptors from codegen, used to annotate each row with the function's `kind`. */
+  readonly functions?: FunctionDescriptor[];
+  /** Shard key the panel reports on. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/**
+ * Per-function execution metrics for one shard: call count, error count/rate,
+ * mean and slowest handler latency, last-run time, and the most recent error
+ * message. Reads via the `__lunora_admin__:getFunctionStats` RPC through
+ * `useAdminQuery`; gated by the server's `LUNORA_ADMIN_TOKEN`.
+ *
+ * Counters are per-DO-instance and reset on hibernation/restart — this is a
+ * "since this instance woke" readout, mirroring the metrics panel. The panel is
+ * always live: `useAdminQuery`'s `live` subscription re-pushes on every server
+ * write-flush so the table updates as mutations land.
+ */
+declare const FunctionStatsPanel: ({ functions, initialShardKey }: FunctionStatsPanelProps) => ReactElement;
+/** Which of the two endpoints a probe targets. */
+type ProbeKind = "live" | "ready";
+/** The result of one probe fetch — the HTTP status, the parsed body (or `null`), and any transport error. */
+interface ProbeSnapshot {
+  /** The parsed health body, or `null` when the response wasn't JSON (e.g. an auth-gate rejection). */
+  body: HealthBody | null;
+  /** A transport/gate error message (network failure, or a non-JSON body), else `undefined`. */
+  error?: string;
+  /** Whether the HTTP status was 2xx. */
+  ok: boolean;
+  /** The HTTP status code (`0` when the request never completed). */
+  status: number;
+}
+/** Fetch one probe. Injected in tests; the default (see {@link useDefaultProbe}) hits the live deployment. */
+type DeploymentHealthProbe = (kind: ProbeKind) => Promise<ProbeSnapshot>;
+interface DeploymentHealthPanelProps {
+  /**
+   * Injectable probe, used by tests to feed a canned response. When omitted the
+   * panel fetches the connected deployment's `/_lunora/health` (and
+   * `/health/ready`) directly — this is a plain HTTP route, not an admin RPC, so
+   * it doesn't ride the `useAdminQuery` machinery. The admin bearer (when the
+   * studio holds one) is attached so an `"admin"`-posture endpoint still answers.
+   */
+  readonly probe?: DeploymentHealthProbe;
+}
+/**
+ * Deployment-health panel: renders the live liveness/readiness verdict and the
+ * per-binding/subsystem checks from the deployment's `/_lunora/health` and
+ * `/_lunora/health/ready` endpoints (plan 177). This is the operator's at-a-glance
+ * "are the bindings up?" view — distinct from the app-level SLO panel (error
+ * rate, auth failures, scheduler backlog) that shares the "Health" name.
+ *
+ * The endpoints are plain HTTP routes (not admin RPCs), so the panel fetches them
+ * directly rather than through `useAdminQuery`. The body is deliberately
+ * secret-free — only a check name, an up/down status, whether it's critical, and
+ * a runtime-authored message (present only in the `"admin"` posture) — so nothing
+ * rendered here can leak an env value, connection string, or binding secret.
+ */
+declare const DeploymentHealthPanel: ({ probe }: DeploymentHealthPanelProps) => ReactElement;
+/**
+ * The registry of every English source string a call site may pass to `t(...)`.
+ *
+ * English is the source locale, so each id doubles as the rendered text: Lingui
+ * compiles an id verbatim when a catalog has no entry for it. This list is the
+ * single source of known strings — {@link MessageId} is derived from it and
+ * `TFunction` is typed against that union, so `t("Dat")` (or any string absent
+ * here) is a compile error rather than a silently-rendered typo.
+ *
+ * Add a string here the moment a new call site needs it. To translate, create a
+ * sibling catalog (for example `de.ts`) mapping each id to its translation and
+ * register it via `createStudioI18n(locale, { en: enMessages, de: deMessages })`.
+ */
+declare const MESSAGE_IDS: readonly ["Send this link to the invitee. It is shown once and cannot be recovered.", "Only invited addresses can create an account. Nothing is emailed — send the invitee the one-time link yourself.", "Showing the most recent invitations. Query the signUpInvitation table directly to see the rest.", "Sign-up invitations", "Only invited addresses can create an account. Nothing is emailed — send the invitee the sign-up link yourself.", "Email address to invite", "ada@example.com", "Invite", "Nobody has been invited yet.", "Email", "Expires", "Invited by", "Accepted", "Expired", "Pending", "Reactors", "Server-side onQueryChange reactors: what has run, what was suppressed, and what is failing.", "Reactor", "State", "Ran", "Suppressed", "Errors", "Watches", "Last dispatch", "No reactors declared", "No reactor is declared in this deployment. Export an onQueryChange(select, handler) from lunora/ to run server-side logic when a query's result changes.", "A reactor runs after a write flush, but only when the result of the query it watches actually changed — a trigger fires on a row write, a reactor fires on a result changing. Suppressed dispatches are the ones where the read re-ran and nothing had moved.", "last dispatch failed", "Live updates unavailable; showing the last reading.", "Agents", "Agent", "Threads", "Timeline", "Messages", "Tokens", "Updated", "Content", "Tool", "Usage", "Approval", "Score your app's advisor findings: a grade, the coverage split, and every procedure ranked worst-first.", "Health score", "Rules fired", "Procedure", "Score", "Kind", "clean", "warned", "failing", "exempt", "sensitive", "no reason given", "Schema & config", "Inspect agent threads, message timelines, tool calls, and token usage.", "Agents run as durable workflows. Each run persists a thread of assistant and tool messages; select a thread to inspect its timeline, tool calls, approvals, and token usage.", "No @lunora/agent tables found in this deployment. Add lunora/agents.ts with defineAgent(...) and merge the agent schema extension to run durable AI agents.", "No agents configured", "No agent has run yet. Start a run with ctx.agents.<name>.run(...) and its thread appears here.", "No agent threads yet", "This thread has no messages yet.", "Bindings", "KV Namespaces", "R2 Buckets", "Vectorize Indexes", "{count} bindings", "1 binding", "Lunora AI rules aren't installed.", "lets your coding agent use Lunora correctly.", "Dismiss", ", changed", "(no subject)", "(root)", "(none)", "{count} active", "{count} calls", "{count} failed", "{total} total", "No subscriptions yet", "No payments configured", "No @lunora/payment tables found in this deployment. Declare the store tables (subscriptions, events, …) in lunora/schema.ts and wire `payment` on createShardDO() to sync customers and subscriptions.", "Payments", "Plan", "Provider", "Recent webhook events", "Renews", "State", "Subscriptions", "Synced customers, subscriptions, and webhook events.", "{count} messages", "{count} pending changes", "{count} pasted cells were skipped", "{count} running", "{name} ({rowCount})", "{rangeStart}-{rangeEnd} of {total}", "{rate} ({count} entries)", "{reachable} reachable", "{reachable} reachable, {failed} unreachable", "{status} — processed", "{title} failed", "Actions", "Add a widget to chart a saved SQL query on this browser.", "Add index on {table}", "Add row", "Add widget", "admin token", "Aggregating…", "all", "All shards", "API", "API reference unavailable", "API resources", "API usage snippets", "API view", "Arguments", "Auth", "Auth failures", "Auth failures over time", "Cache hit rate", "Call this {kind} from your app.", "Cancel", "Cancel job?", "Cc", "changed", "Chart widgets backed by saved read-only SQL queries.", "Lunora surfaces slow functions, error spikes, and cache problems here.", "Clear", "Clear inbox", "Columns unavailable", "CLI", "Client", "collecting samples…", "Combined cache hit rate", "Commit", "Committing…", "Breadcrumb", "Confirm", "Connect", "Connect to Lunora Studio", "Connected", "Connecting…", "Enter your admin token to access the studio.", "From your worker's LUNORA_ADMIN_TOKEN — your project's .dev.vars in dev, or a deployment secret in production.", "Local", "Not connected", "content-type", "Copy", "Copy link", "Copy-paste snippets for calling your functions and tables.", "created", "Cron triggers", "Dashboards", "Data", "Data migrations you run against this shard will be tracked here.", "Data model", "Database", "Database size", "db size", "Instruments", "Instruments unavailable: {error}", "Counter", "Gauge", "Histogram", "count", "range", "trend", "trace", "{name} trend", "Open the exemplar trace {trace}", "Delete", "Delete saved query {name}", "Delete?", "direction", "Direction", "Discard", "down", "Dry run", "Dry run: ", "Edit", "Edit widget", "email", "Email preview", "Email your app sends in dev is captured here — nothing is delivered.", "Email your app sent, captured in dev.", "Enter a migration id", "error", "Error rate", "errors", "Errors", "Errors over time", "expires", "Export", "PNG", "SVG", "Export / Import", "Exported {count} rows.", "Facets", "file:function", "Files", "Filter messages", "Filter tables", "Find table…", "Foreign key", "From", "function", "Function", "Function path", "Functions", "Functions by error rate", "Graph", "Headers", "Health", "Indexes", "Hide", "HTML", "id", "Idle", "Import", "Import (writes rows)?", "Inserted {inserted}, {conflicts} conflicts, {errors} errors.", "Interactive OpenAPI reference and copy-paste snippets for your functions.", "Invalid JSON args: {message}", "Invalid JSON: {message}", "Invalid NDJSON: {message}", "ip", "Jobs queued with runAfter / runAt will appear here.", "JSON", "key", "Key prefix", "key prefix (optional)", "Level filter", "line {line} ({table}): {message}", "List", "Live", "Live — changes stream in automatically", "Live unavailable", "Live unavailable: {liveError}", "Live: on", "Load", "Load more", "Load tables", "Logic", "Logs", "Mail", "Mask sensitive columns", "Metrics", "migration id", "Migration id", "Migrations", "Missing index", "name", "Next", "no", "No active sessions.", "no cache configured", "No captured email.", "No cron triggers.", "No function activity yet.", "No functions or tables to document yet.", "No global tables.", "No headers.", "No HTML body.", "No logs.", "Archive", "Log archive not configured", "Wire pipelineLogSink to a Cloudflare Pipeline → R2 Data Catalog table and set R2_SQL_ACCOUNT_ID, R2_SQL_TOKEN, R2_SQL_BUCKET to browse the durable log archive here.", "No archived logs.", "No archived logs match these filters. The durable archive fills as pipelineLogSink flushes records to R2.", "Function path prefix", "function path…", "user id…", "Minimum level", "min level", "Time", "Level", "Trace", "User", "No migrations have run on this shard.", "No objects.", "No recent errors.", "No scheduled jobs.", "No tables to graph.", "No tables match your filter.", "No text body.", "No users.", "No widgets yet", "Objects you upload to your R2 buckets will appear here.", "Observability", "of {pages}", "off", "Offline", "ok", "OK", "on", "Open {target} {id}", "Open in new tab", "Outcome filter", "Page", "Plain text", "Prefill", "Previous", "Primary key", "processed", "React", "Read and write this table through the typed data model.", "Move widget down", "Move widget up", "Recent errors", "Recent logs", "Recently visited shards — click to switch", "Refresh", "Reload tables", "Remove widget", "RLS Policies", "Policies", "No policies defined", "No `definePolicy` is wired through `.use(rls(...))` in this deployment. Add one to guard a table's rows.", "Read", "Insert", "Update", "Guarded by", "Guarded", "Roles", "No roles defined", "No `defineRole` is registered via `rls(policies, { roles })`. Roles back `ctx.auth.can(...)` permission checks.", "Permissions", "Run as identity (userId)", "Leave empty to run as admin", "Required — the identity to probe as", "Not run", "Dev only: runs the function as this user so you can test auth and RLS. Forged over the admin gate.", "as {userId}", "No policy", "Covered by {procedure}", "Uncovered — reachable without a policy", "Masked columns", "No tables in this deployment's schema.", "Add a `definePolicy` and wire it through `.use(rls(...))` to populate this matrix.", "Pick a function and an identity, then run it to see the access outcome.", "Probe", "Probe this", "Run as (userId)", "Identity (userId) to run as", "Run probe", "Allowed", "Denied", "Probing…", "Set `runAsIdentity` to forge an identity and probe access.", "Dev only: runs the selected function as this user over the admin gate so you can test auth and RLS.", "Inspect access policies per table, and probe a function as any identity.", "Scaffold access rules", "Writes a new deny-by-default policy file under lunora/, or wires one into a procedure, then reruns codegen. Local dev only.", "New policy file", "Wire into a procedure", "Policy name", "Create policy file", "Procedure file path", "Exported procedure", "Policy set identifier", "Wire RLS", "Creating…", "Wiring…", "Scaffolded {label} and reran codegen. Fill in the `when` predicates before relying on it.", "This change must be made by hand — the scaffolder only adds new, deny-by-default rules.", "requests", "Requests", "Requests / interval", "Requests over time", "Requests per interval over time", "Row actions", "Row document JSON", "Rows per page", "Run", "Run migration", "Run migration?", "Running…", "Query name", "Save", "Save query", "Save widget", "Saved", "schedule", "target", "workflow", "Run now", "Run now?", "Running…", "ran", "attempts", "backlog", "Dead letter", "Drop", "Drop job?", "in flight", "Jobs that exhaust their retry budget are parked here instead of being dropped.", "last tried", "max concurrency", "No dead-letter jobs.", "No workpools.", "pool", "Pools", "pools", "Pools created with createWorkpool appear here once they have activity.", "queued", "Retry", "Schedule view", "Scheduled", "scheduled for", "Scheduled jobs", "Scheduler backlog", "Schema", "Schema graph", "Schema view", "search message", "Search messages", "Search rows", "search table…", "Search…", "Select a function or table to see how to call it from your app.", "Select all rows", "Select row", "Send test", "Sent", "Service level", "Sessions", "Sessions for {userId}", "shard", "Shard", "Shard key", "shard key (optional)", "Shard key (optional)", "Shards", "Shards seen", "Signature", "size", "Snippet flavour", "State-changing admin operations are recorded here.", "status", "Storage", "Storage tier", "Storage tiers", "Studio", "Studio areas", "Studio failed", "Switch to dark theme", "Switch to light theme", "Table", "Table list", "Table touched", "Tables", "To", "Token rides the WebSocket URL — it can surface in browser DevTools and server logs. Use a dev-only token.", "Total database size", "Total errors", "Total requests", "Triggers declared with the cronJobs() builder appear here.", "Try again", "unreachable", "up", "updated", "Uptime", "user agent", "User id", "userId", "Users", "Users who sign up to your app will appear here.", "verified", "Widget title", "yes", "A live stream of recent function logs.", "Browse and edit rows across your shard and global tables.", "Browse auth users and their active sessions.", "Browse objects in your R2 storage buckets.", "Export a shard to NDJSON, or import rows from it.", "At-a-glance connection, error, and shard signals.", "Inspect and cancel scheduled jobs.", "Inspect each table and its columns.", "Inspect row-level-security policies and roles, per table.", "Per-shard health and aggregate metrics.", "Review migration status and run them.", "Run registered queries, mutations, and actions.", "Global tables (D1)", "Shard tables", "{shard} tables", "Tables marked .global() (D1-backed, region-replicated) will appear here.", "Select a table to browse its rows.", "Shared across every tenant, stored once in D1. Includes auth tables.", "Partitioned per shard key into separate Durable Objects — scoped to the shard above.", "avg", "calls", "conflicts", "kind", "last error", "last run", "max", "Most called", "No functions have run on this shard yet.", "Recent", "Slowest", "Insights", "Surface slow functions, error spikes, and cache problems.", "No issues detected.", "Low cache hit rate", "High cache eviction rate", "Slow function", "High error rate", "High write contention", "Storage headroom", "{rate} hit rate over recent traffic.", "{count} entries evicted recently.", "Slowest call took {duration}.", "Slowest call took {duration} — it full-scanned {tables} with no index.", "{rate} of calls failed.", "{rate} of calls hit a write conflict — consider sharding to cut contention.", "{size} of the 10 GiB per-shard ceiling — plan a .shardBy() migration while it still has runway.", "Home", "Reports", "SQL / Functions", "Table editor", "Connection, health, and advisor summary for your deployment.", "Collapse sidebar", "Expand sidebar", "SQL editor", "Run read-only SQL against a shard.", "Run", "SQL query", "SQL problems", "Operation console", "Suggest chart", "Chart type", "Widget type", "Could not suggest a chart for that result.", "Add a chart, a single value, a table, or a note. Everything is saved on this browser.", "Keyboard shortcuts", "Command palette", "Reset", "Stored in this browser. Focus a box and press a key to rebind it.", "Single value", "Text", "Notes for whoever reads this dashboard.", "Charts, values, tables, and notes. Drag a tile to reorder.", "—", "Bar", "Line", "Area", "Suggesting…", "Describe the query you want", "Draft SQL", "Thinking…", "Fix this", "Related", "p50", "p95", "showing a capped set", "Statements executed in the selected window appear here, with throughput and latency over time.", "No queries in this window.", "Throughput", "Mean latency (ms)", "Schema versions", "Data migrations", "{count} pushes", "live", "Show in console", "Every admin call this studio makes is recorded here.", "{count} rows", "Filter", "Each distinct schema shape this shard runs is recorded here, so you can see what changed and when.", "No schema versions recorded yet.", "First recorded version — every table is new.", "{count} change(s)", "change", "Diagram", "Changes", "added", "changed", "removed", "schema", "{count} columns", "changes", "tables", "{count} breaking", "breaking", "safe", "{count} rows", "Showing the first {max} of {count} rows.", "Showing the {n} most common values.", "No rows returned.", "Private", "Reference", "Search queries…", "New query", "Untitled query", "Delete query", "No saved queries yet — they save to this browser as you type.", "Results", "Explain", "Chart", "Split editor and results", "History", "Format", "Clear history", "Keep history on this browser", "No numeric column to chart.", "Click Run to execute your query.", "Untitled", "New tab", "Close tab", "Tab title", "Double-click to rename", "Discard?", "Discard changes", "Keep editing", "Close other tabs", "Close tabs to the right", "Close all tabs", "Discard unsaved tabs?", "column", "keyword", "Columns", "Show all", "Hide all", "Transpose", "Swap rows and columns", "Field", "Row {n}", "Loading…", "No matching row.", "CSV", "SQL", "{count} selected", "Delete {count}", "Delete {count} rows?", "Copy", "Copied", "Cell value", "Close", "Form", "Invalid JSON", "Command palette", "No results.", "Quick links", "Security findings", "Performance issues", "View", "All clear", "No data yet", "Get connected", "No issues found", "No security or performance issues detected.", "Client SDK", "React", "CLI", "Connect an AI agent", "Drive this deployment from an AI agent over the Model Context Protocol — it can list functions and tables, read schemas, and run read-only queries. Writes stay off unless you opt in.", "Copy MCP config", "Copy agent prompt", "Advisors", "Security", "Performance", "Warnings", "Info", "Issue type", "Entity/item", "Description", "{count} errors", "{count} warnings", "{count} suggestions", "No errors detected", "No warnings detected", "No suggestions", "Nothing to report for this deployment.", "Security and performance findings for your deployment.", "Review admin gates, credentials, and log redaction.", "Lunora checks admin-token strength, the live-subscription gate, and request-log redaction here.", "No security issues detected.", "Weak admin token", "Weak auth secret", "Session cookies are not Secure", "Wildcard CORS with credentials", "CSRF/origin guard is off", "Security headers are off", "User subscriptions are ungated", "Request log keeps un-redacted args", "Unknown security finding", "Update your worker to a version of Lunora that describes this finding.", "Your admin token is {length} characters — use at least {min} for a brute-force-resistant secret.", "Your auth secret is {length} characters — use at least {min} (e.g. `openssl rand -hex 32`) to sign sessions safely.", "BETTER_AUTH_URL is a plaintext http:// origin, so session cookies cannot be Secure and ride in cleartext. Serve auth over https:// in production.", "LUNORA_ALLOWED_ORIGINS includes a wildcard while credentials are allowed — browsers reject this and it defeats the allowlist. Name explicit origins instead of *.", "LUNORA_SECURITY_CSRF is off, so cross-origin state-changing cookie requests are not blocked. Re-enable it in production to keep mutations un-forgeable.", "LUNORA_SECURITY_HEADERS is off, so HSTS, CSP, nosniff, and frame-options are not applied. Re-enable the baseline headers in production.", "Copy index declaration for {table}", "Copy?", "Index declaration copied — add it to {table} in lunora/schema.ts.", "Could not reach the clipboard — add this to {table} in lunora/schema.ts:", "LUNORA_WS_BEARER is unset, so the WebSocket upgrade gate is open: anyone who can reach the worker can open a socket and run ordinary user subscriptions. Admin subscriptions are unaffected — they need the admin token. Set it if subscribers should present a shared credential.", "This worker reports a development environment, so the request log stores raw args and identity. Confirm it isn't a mislabeled production deploy.", "Audit", "A durable log of admin state-changing operations.", "Filter audit log", "filter op, table, id", "No audit entries.", "Notifications", "Registered push devices — endpoint, kind, last-send status, and delivery errors.", "Registered Web Push / FCM devices appear here. Configure lunora/notify.ts with defineNotify({ store }) and register a device with ctx.push.register(...).", "No registered devices.", "Filter devices", "filter endpoint, user", "{count} devices", "endpoint", "last seen", "n/a", "time", "op", "table", "detail", "Auth audit", "Authentication and security events — sign-ins, MFA, and session changes.", "Filter security events", "filter event, actor, IP", "Authentication and security events are recorded here.", "No security events.", "event", "actor", "ip / user agent", "outcome", "success", "failure", "Settings", "Deployment", "Read-only deployment config — vars, secrets, and bindings.", "Environment & bindings", "No environment variables or bindings.", "Open in Cloudflare", "Remove filter", "View-only — values are masked. Edit vars, secrets, and bindings in wrangler or the Cloudflare dashboard.", "URL", "Environment", "Version", "value", "Cascade impact", "Delete preview — rows that would cascade or be blocked", "No related rows found.", "Restrict relations will block this delete.", "Generate rows", "Generate dummy rows", "Seed {table} with Faker-generated rows. Existing rows are not affected.", "Row count", "(max {max})", "Columns to seed", "FK: no rows in {ref} — seed it first", "→ {ref}", "No rows generated — all columns were skipped.", "Cannot generate rows: these columns reference tables with no rows: {cols}. Seed those tables first.", "Inserted {count} rows successfully.", "Inserted {inserted} of {total} rows — {conflicts} skipped as id conflicts.", "Generate & insert", "Inserting…", "Time Travel", "Restore a shard to a point in the last 30 days.", "root", "In-place recovery to any moment in the last 30 days. For older or portable recovery, use the snapshot backup tier.", "Current bookmark", "Restore", "Time (ISO or epoch-ms, last 30 days)", "Preview", "Bookmark for that time", "Or an explicit bookmark (wins over time)", "bookmark string", "Restart the shard now so recovery applies immediately", "Restore {shard} to {target}?", "the given bookmark", "restarted now", "on next restart", "Restore armed", "Restored to", "Undo bookmark", "Confirm undo", "Undo restore", "role", "Role", "Role (optional)", "Active", "Banned", "unverified", "Manage", "New user", "Create", "Create user", "Creating…", "Password (optional)", "Search users", "Search by email or name…", "Filter by role", "Set role", "Ban user", "Ban reason (optional)", "Days", "Unban", "New password", "Set password", "Impersonate", "Impersonation token", "Revoke", "Revoke all sessions", "Delete user", "Confirm delete", "User details", "Fields", "Linked accounts", "No linked accounts.", "provider", "Unlink", "Security", "Disable two-factor", "No passkeys.", "Operations", "Toggle operation console", "Organizations", "slug", "Members", "Invitations", "Remove", "No organizations.", "Select an organization to view its members and invitations.", "Organizations are not enabled.", "Enable the organization() plugin in your auth config to manage organizations here.", "Browse and manage organizations, members, and invitations.", "Reload", "Manage auth users — roles, bans, sessions, and identity.", "Auth config", "Configuration", "Enabled plugins and session config (read-only).", "Enabled capabilities", "Loading auth configuration…", "Accounts", "Admin", "Passkeys", "Two-factor", "Enabled", "Disabled", "OAuth providers, email templates, and rate limits are configured at deploy time in the better-auth setup and aren't editable here. See the Mail tab for email output.", "Sessions", "Browse and revoke active sessions across all users.", "user", "impersonated by", "Log drains", "Forward logs to Logpush, Tail Workers, or a webhook collector.", "Cloudflare destinations", "Lunora does not ship logs itself — forwarding is handled by Cloudflare. Configure a destination below, then test your collector.", "Logpush", "Stream every request log to R2, a SIEM, or a third-party log service.", "Tail Workers", "Send logs programmatically to a Worker for custom capture and forwarding.", "Workers Logs", "Retain and query recent request logs directly in Cloudflare's dashboard.", "Webhook test", "POST a sample Lunora request-log envelope to your collector to confirm it is reachable.", "https://example.com/logs", "Send test event", "Delivered — status {status} in {latency}ms", "Failed: {message}", "fetch is unavailable in this environment.", "Realtime", "Active WebSocket subscriptions on this shard.", "{count} connections", "{count} subscriptions", "This Studio session's sync client", "Reading the sync client's state…", "Sync client", "{count} pending writes", "Reads client.debug() for the client running in this page — not your application's client. Call client.debug() in your app to diagnose a specific stuck overlay there.", "No shard connection has been opened yet.", "No shards", "Shard", "Socket", "Confirmed watermark", "(default)", "This client holds no live queries or shapes.", "No subscriptions", "Subscription", "Kind", "Acked", "Cursor", "Pending overlays", "No active subscriptions.", "Connection", "admin", "Folder path", "Grid", "Sort", "Name", "Type", "Modified", "Toggle sort direction", "Thumbnail size", "Link expiry", "15m", "1h", "24h", "7d", "Upload", "Uploading…", "Copy URL", "Download", "Delete object?", "Uploaded {key}", "Deleted {key}", "Summary", "Time range", "All time", "Last 5m", "Last 15m", "Last hour", "filter path", "By level", "By function", "Count", "{count} entries", "Snippets", "Couldn't load the OpenAPI spec: {message}", "No OpenAPI spec configured", "Run `lunora codegen` and wire `_generated/openapi.json` to the worker to render the API reference here.", "API operations", "Filter operations", "No operations match your filter.", "Try it", "Request arguments", "Response body", "Response", "application/json", "Arguments (JSON)", "Send", "Sending…", "Send a request to see the response.", "No example for this response.", "Error", "{ms} ms", "Range", "Value in", "relation", "API spec format", "OpenAPI", "OpenRPC", "Params", "Result", "Field", "Required", "JSON-RPC request", "Couldn't load the OpenRPC spec: {message}", "No OpenRPC spec configured", "Run `lunora codegen --api-spec openrpc` and wire `_generated/openrpc.json` to the worker to render the OpenRPC reference here.", "used by", "Orphan", "1 record", "{count} records", "References shard", "Which shard's records are checked for references to these files. Empty = root shard.", "Orphaned objects", "Find records whose file reference points at an object the bucket no longer has.", "Check for orphans", "Checking…", "No dangling references.", "Every record's file reference points at an object that exists in the bucket.", "Missing object", "→", "Showing the first {count} dangling references — the scan was truncated.", "The bucket is larger than the scan's key limit, so dangling references could not be checked.", "Per-function call counts, error rates, and latency land here after your first request.", "Function and request logs for this shard show up here as your app handles traffic.", "No tables in this shard.", "Browse Vectorize indexes and run similarity searches.", "dimensions", "field", "Indexes declared with .vectorize() or defineVectorIndex() appear here.", "metadata", "metric", "No matches.", "No vector indexes.", "score", "Search", "Search by similarity…", "Searching…", "vectors", "Vectors", "Add a kv_namespaces binding to wrangler.jsonc — it appears here automatically, no wiring needed.", "Browse and edit key-value pairs in your Workers KV namespaces.", "Deleting…", "Expiration", "Filter", "Filter by prefix…", "Filter keys by prefix", "Key is absent or has no value.", "KV", "KV value", "Copy key", "Copy value", "Create key", "Failed to delete {count} keys.", "Format JSON", "Key name", "Expires after", "TTL unit", "TTL must be at least 60 seconds.", "seconds", "minutes", "hours", "days", "Leave blank to keep the current expiration.", "Metadata (JSON)", "Metadata must be valid JSON.", "New key", "No expiration", "Select all", "Select {name}", "Metadata", "Namespace", "No keys.", "No KV namespaces.", "Saving…", "vs. prev.", "Top functions", "No functions called yet.", "Calls", "Avg", "Err", "Avg latency", "cache hit", "cache not enabled", "no cache traffic yet", "Live connections", "sockets", "active subscriptions", "Recent activity", "No recent activity.", "last interval", "{rate} error rate", "cache entries", "Critical", "Degraded", "All systems healthy", "One or more service levels are breached.", "Some service levels need attention.", "All service levels are within target.", "Showing a partial request/error history — one or more shards have more data than the trend chart can display.", "Analytics", "Analytics usage panels are not wired up.", "Hot shards", "Latency p50 / p95 per function", "No data points yet.", "Request volume per function", "Analytics Engine reads need an account-scoped Cloudflare API token, which cannot be shipped to a browser. The host must pass studio.analyticsQuery — a runner that proxies the SQL through your worker — to enable these panels.", "Usage and latency from Analytics Engine — request volume, p50/p95, and hot shards.", "(whole bucket)", "Access Rules", "Bucket", "Inspect storage access rules — per bucket, operation, and key prefix.", "No defineStorageRule is wired through .use(storageRules(...)) in this deployment. Add one to gate object access by key prefix.", "No storage rules defined", "Operation", "Storage rules are declared in code with defineStorageRule and gate ctx.storage access per bucket. This view is read-only.", "Write", "Queues", "Queue", "Mode", "Dead-letter", "No queues defined", "Inspect declared Cloudflare Queues — their producer bindings, consumer mode, and dead-letter queue.", "No defineQueue is declared in lunora/queues.ts in this deployment. Add one to offload async work to a Cloudflare Queue.", "Queues are declared in code with defineQueue. Enqueue from a mutation or action with ctx.queues.<name>.send(...); push consumers process batches in the worker.", "No dead-letter queue on {queues}.", "Exhausted messages are dropped after retries. Add a deadLetterQueue to capture them.", "1 message was recently dead-lettered.", "{count} messages were recently dead-lettered.", "Batch mode needs a JSON array body — each element is enqueued as one message.", "Body", "Body must be valid JSON.", "Captured", "Clear log", "Clear {count} messages?", "Cloudflare Queues have no peek API, so this is what push consumers actually processed — not pending depth.", "Consumed messages appear here once a push consumer processes a batch in dev. Send one from the Send tab to see it captured.", "Declare a queue with defineQueue in lunora/queues.ts to enqueue a test message.", "Declared", "Delay must be a non-negative number of seconds.", "Delay (s)", "Delay (seconds)", "DLQ", "Enqueue a JSON message to a declared producer to exercise its consumer. Nothing is captured until the consumer processes it.", "Message", "Message body (JSON)", "Messages", "No consumed messages yet.", "No queues to send to", "Outcome", "Replay", "Replaying…", "Send as batch (JSON array)", "Send message", "Flags", "Inspect feature flags and their live evaluation under a targeting context.", "Feature flags are read in code with ctx.flags.<type>(\"key\", default). They evaluate through the OpenFeature provider configured in lunora/flags.ts; edit the targeting context below to see how each flag resolves for a given audience.", "Targeting context (JSON)", "Targeting context must be a JSON object.", "Targeting context is not valid JSON.", "Live updates unavailable; showing the last evaluation.", "No @lunora/flags provider is wired in this deployment. Add lunora/flags.ts with defineFlags({ provider }) to gate code paths on feature flags.", "No flags provider configured", "A flags provider is configured, but no handler reads a flag yet. Call ctx.flags.boolean(\"key\", false) in a query, mutation, or action.", "No flags read", "Key", "Value", "Reason", "Variant", "Workflows", "Inspect declared Cloudflare Workflows and their bindings.", "Binding", "Class", "No workflows defined", "No defineWorkflow is declared in lunora/workflows.ts in this deployment. Add one to run a durable, multi-step workflow.", "Workflows are declared in code with defineWorkflow and run as durable Cloudflare Workflows. This view is read-only.", "Workflows are declared in code with defineWorkflow and run as durable Cloudflare Workflows. Start an instance and observe its status below.", "Start instance", "Starting…", "Workflow", "Instance id", "Instance id (optional)", "Params (JSON)", "Params (JSON, optional)", "Params must be valid JSON", "Instances", "Status", "Output", "Refresh", "Refreshing…", "Instance history", "Filter by status", "All statuses", "Workflow inspection not configured", "Set CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN in your .dev.vars to enable workflow instance history.", "No instances", "No instances match this filter for the selected workflow.", "Created", "Ended", "Steps", "Step", "Attempts", "Started", "This instance has no recorded steps yet.", "pause", "resume", "terminate", ">100ms avg execution", "50–100ms avg execution", "<50ms avg execution", "{count} tracked statements", "Avg time", "avg", "avg time", "avgTime", "Critical queries", "Exec count", "exec count", "execCount", "Execution count", "Fast queries", "Full statement", "Moderate queries", "No query insights yet", "Overview", "P90 latency", "P95 latency", "Query insights", "Query insights appear once statements are executed against this shard.", "Query leaderboard", "Rows read", "Rows written", "rowsRead", "Slow queries sorted by {sortField}", "Sort by", "Sort queries by", "Statements", "total", "Total time", "total time", "totalTime", "Edit schema", "Add table", "Add column", "Add index", "Rename / drop / change type…", "Table name", "Column name", "Column type", "Index name", "Index fields (comma-separated)", "Optional", "Unique", "Cancel", "Apply", "Applying…", "This edit changes stored data and must go through a migration. Review the migration before applying.", "Open Migrations", "Schema updated.", "Codegen reported diagnostics:", "Editing the schema is only available in local dev.", "Adds a table, column, or index to lunora/schema.ts and reruns codegen.", "Theme", "Dark theme", "Light theme", "System theme", "Integrity", "Fan-out", "auto-scaled: {relayCount}/{maxRelays} relays", "auto-scaled: {relayCount}/{maxRelays} relays (at ceiling)", "Realtime fan-out cost and per-topic subscriber counts for this shard.", "No fan-out activity yet.", "peak {count} subscribers", "Hot topics", "Topic", "Kind", "Subscribers", "Fan-out cost since this instance woke", "Shape pokes", "Whisper broadcasts", "Passes", "Sockets iterated", "Delivered", "Peak width", "Max time", "Membership probes", "Queries run", "Shared from cache", "Global shape polls", "Global reads", "Pairs skipped", "Containers", "Container", "Instance", "Last event", "Detail", "Exit", "When", "No container activity", "Live Cloudflare Containers — current lifecycle state per instance from the log stream.", "Cloudflare Containers are observed from their lifecycle log stream. This shows the current state per instance — ports and health checks aren't carried in that stream.", "No container lifecycle activity yet. Instances declared with defineContainer show up here once they start, sleep, stop, or error.", "Traces", "Recent ctx.trace waterfalls for this shard — the drill-down from a log line.", "Evals", "Queued", "Scores recorded by recordEvaluation — the latest verdict per eval, its trend, and the graded runs behind it.", "min {min} · mean {mean} · max {max}", "Score trend for {name}", "No durable history yet — pass ctx.metrics to recordEvaluation to chart a trend.", "Open the trace {trace}", "No evals recorded", "Call recordEvaluation from a graded run and its score shows up here.", "Search traces", "search trace, span, or function", "Errors only", "Recent traces", "Trace waterfall", "{count} spans", "{name}, {duration}, starts {offset} in{failure}", ", failed: {message}", "Showing the {shown} most recent of {total} traces in the buffer.", "No traces", "Span ID", "Parent span ID", "— (trace root)", "Started at", "+{offset}", "Duration", "Attributes", "Logs ({count})", "Traces recorded with ctx.trace show up here as your app handles traffic. The span buffer resets when the shard hibernates.", "Issues", "Issue", "Source", "Events", "First seen", "Last seen", "No issues", "Grouped error triage — Worker throws and container crashes folded by fingerprint.", "No grouped errors yet. When a function throws or a container crashes, matching errors fold into a single issue here.", "Severity", "Assignee", "Set severity", "Unassigned", "Resolve", "Ignore", "Reopen", "All", "Open", "Resolved", "Ignored", "—", "Toggle issue details", "Suggested fix", "No known fix for this error yet.", "Explain in plain language", "Explaining…", "AI explanation", "Generated by {model}", "No AI binding is configured. Wire an AI binding to enable plain-language explanations — the suggested fix above is always available.", "The AI model could not explain this error right now. The suggested fix above still applies.", "No catalog fix matched this error, so this explanation is the model's own reading of the message. Verify before acting on it.", "optional", "required", "unique", "Plugin fields", "New organization", "Edit organization", "Delete organization", "Delete this organization? Its members, invitations, teams, and custom roles are removed. This cannot be undone.", "Slug (optional — derived from name)", "Logo URL (optional)", "Owner user id (optional)", "Metadata (JSON, optional)", "Add member", "Invite member", "Send invitation", "Change member role", "Change role", "New team", "Rename team", "Rename", "Delete team", "Delete this team and its memberships? This cannot be undone.", "Add team member", "Team members", "No members.", "No teams.", "No team members.", "Teams", "New role", "Edit role", "Delete role", "Delete this custom role? Members keeping it will lose its grants.", "No custom roles.", "Role name", "Permission", "Permission (JSON, e.g. {\"project\":[\"create\",\"update\"]})", "Plugins", "No plugins enabled.", "Sign-in methods", "Email & password", "Social providers", "None", "Custom roles", "Session policy", "Expires in", "Refresh after", "Fresh window", "Cookie cache", "Rate limit", "Max requests", "Window", "Plugin user fields", "Deployment health", "Live liveness, readiness, and per-binding health from the deployment's /_lunora/health endpoint.", "Live liveness, readiness, and per-binding health from the deployment's /_lunora/health endpoint — wire an uptime monitor or a Cloudflare Health Check at it.", "Liveness", "Readiness", "Ready", "Not ready", "Healthy", "Unhealthy", "Checked", "Subsystem checks", "No checks reported.", "Up", "Down", "Health endpoint unavailable", "The health endpoint is in the admin posture. Paste a valid admin token in the connect popover, or set its auth to public.", "Couldn't reach the health endpoint: {message}", "no response", "Set a column on matching rows", "Writes {total} rows of {table} through the schema-aware writer — validators and indexes apply, exactly like a mutation.", "Column", "Enter a JSON value — for example true, 0, null, or \"done\".", "Set on {total} rows", "Set column on {total} matching", "Shard: root", "Shard: {shardKey} — rows in other shards are not touched.", "{column} has a unique index — the same value cannot be set on {total} rows."];
+/** A known studio message id — one of the entries in {@link MESSAGE_IDS}. */
+type MessageId = (typeof MESSAGE_IDS)[number];
+/** The locale the studio ships with and falls back to. */
+declare const DEFAULT_LOCALE = "en";
+/**
+ * Locale code to catalog. Each catalog maps an English source string (which
+ * doubles as the message id) to its translation. English ships empty: Lingui
+ * compiles the id verbatim when a translation is missing, so the source strings
+ * render as-is. To add a language, register `{ "Some English text": "…" }`.
+ */
+type StudioCatalogs = Readonly<Record<string, Messages>>;
+/**
+ * Translate function: `t("Clear")` or `t("{title} failed", { title })`.
+ *
+ * `id` is constrained to a known {@link MessageId}, so a typo is a compile error.
+ * The interpolation `values` stay loosely typed: mapping each id to its exact
+ * placeholder set isn't worth the machinery for the handful of interpolated
+ * strings, so a wrong or missing value key isn't caught at this boundary.
+ */
+type TFunction = (id: MessageId, values?: Record<string, unknown>) => string;
+/**
+ * Build a studio-scoped Lingui instance. We deliberately use `@lingui/core`'s
+ * `setupI18n` (a fresh instance) rather than the global singleton so the
+ * studio can never clobber — or be clobbered by — a host app that also uses
+ * Lingui.
+ *
+ * The message compiler is installed explicitly. `@lingui/core` only auto-installs
+ * it when `NODE_ENV !== "production"`, but the studio ships as a library and
+ * relies on the compiler at runtime to interpolate uncompiled source strings
+ * (e.g. `t("{title} failed", { title })`). Without this, a consumer's production
+ * build would render `{title}` literally and `console.warn` on every `t(...)`.
+ *
+ * Pass extra `catalogs` to ship more locales; unknown `locale` codes fall back
+ * to `DEFAULT_LOCALE`.
+ */
+declare const createStudioI18n: (locale?: string, catalogs?: StudioCatalogs) => I18n;
+/**
+ * Shared default instance. Backs the i18n context's default value so the
+ * composable studio and individual exported panels resolve their strings even
+ * when rendered without `StudioI18nProvider` (e.g. in tests, or a host's own
+ * admin UI). English-only, so it renders source strings as-is.
+ */
+declare const studioI18n: I18n;
+/**
+ * Hook returning a `t` bound to the nearest `StudioI18nProvider` (or the
+ * shared instance when there's none). This is the runtime stand-in for Lingui's
+ * `t` macro — the studio builds with esbuild and tests under Vite 8/Rolldown,
+ * neither of which runs Lingui's Babel macro transform, so call sites pass the
+ * English string as the id directly.
+ */
+declare const useT: () => TFunction;
+interface HomePanelProps {
+  /** Shard key the health digest targets on first load. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/**
+ * The Home overview — the studio's landing page. It pulls the root shard's
+ * health snapshot, the function stats, the two advisor signals, the live
+ * subscription pulse, and the recent admin audit log, then presents an
+ * at-a-glance digest: a KPI row (requests, errors, latency, database size), a
+ * busiest-functions leaderboard, live connections, recent activity, the advisor
+ * summary, and connect/quick-link shortcuts. Every read is best-effort — a
+ * missing admin token or a cold instance leaves a card showing a muted
+ * placeholder rather than blanking the page.
+ */
+declare const HomePanel: ({ initialShardKey }: HomePanelProps) => ReactElement;
+interface AuditPanelProps {
+  /** Shard key the panel reports on. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/**
+ * Durable audit log for one shard: the admin state-changing operations
+ * (`writeRow`, `runMigration`, `importShard`, `applyCdc`) recorded to the
+ * reserved `__lunora_audit__` table, newest first. Reads via the
+ * `__lunora_admin__:getAuditLog` RPC through `useAdminQuery`; gated by the
+ * server's `LUNORA_ADMIN_TOKEN`.
+ *
+ * Unlike the logs panel (an in-memory ring that resets on hibernation), the
+ * audit log is durable and bounded only by a retention cap. The panel is always
+ * live: `useAdminQuery`'s `live` subscription re-pushes on every server
+ * write-flush so new entries appear without a manual refresh. The op filter is
+ * client-side over the already-fetched buffer — it never triggers a refetch.
+ */
+declare const AuditPanel: ({ initialShardKey }: AuditPanelProps) => ReactElement;
+interface LogsPanelProps {
+  /** Shard key the panel reports on. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/**
+ * The shard's log feed, newest first, over the gated `__lunora_admin__:*` RPC
+ * layer (gated by the server's `LUNORA_ADMIN_TOKEN`). Two views.
+ *
+ * The Requests view (`getRequestLog`) is the durable, structured per-request log
+ * `@lunora/do` writes once per `/rpc` dispatch (PLAN3 §1.1): function path,
+ * shard, acting user/identity, redacted args, outcome, duration, and tables
+ * read/written. It survives hibernation/restart (bounded retention) and is
+ * filtered/correlated SERVER-side on function-path prefix, userId, shard,
+ * outcome, and a touched table.
+ *
+ * The Errors view (`getLogs`) is the legacy in-memory RPC-error buffer, which
+ * only captures dispatch failures (path + message) and resets on hibernation —
+ * kept for the "what's failing on this instance right now" view, filtered
+ * client-side.
+ *
+ * For the raw, un-attributed request firehose (which Lunora deliberately does
+ * NOT re-stream), a deep-link to Cloudflare Workers Observability is provided.
+ */
+declare const LogsPanel: ({ initialShardKey }: LogsPanelProps) => ReactElement;
+interface MailPanelProps {
+  /** Newest-N to load (default 100). */
+  readonly limit?: number;
+}
+/**
+ * Dev mail catcher — a unified inbox of every email the app sent. `@lunora/mail`'s
+ * capture transport (wired in dev) intercepts each send and persists it to the
+ * root-shard mailbox instead of delivering, so verification / forgot-password and
+ * any app mail show up here with nothing leaving the machine. The inbox model —
+ * the `__lunora_admin__:getCapturedMail` read, its poll, the clear / send-test
+ * actions, and the selection state — lives in {@link useMailCapture}; this
+ * component is markup and copy.
+ *
+ * The inbox is a single root-shard table with no write-flush to subscribe to, so
+ * it polls on a fixed interval (paused while the tab is hidden) — new captured
+ * mail appears without a manual refresh. The HTML body is rendered in a fully
+ * sandboxed iframe (no script execution) so captured markup can't run in the studio.
+ */
+declare const MailPanel: ({ limit }: MailPanelProps) => ReactElement;
+/**
+ * The Notifications inspector — the app's registered `@lunora/notify` push
+ * devices, read through the gated `__lunora_admin__:listPushSubscriptions` admin
+ * RPC (`useAdminQuery`; gated by the server's `LUNORA_ADMIN_TOKEN`). Each row is
+ * one registered device: its delivery kind, target endpoint, owning user, last
+ * register/send touch, and the last-send status + any delivery error.
+ *
+ * The subscription store is a WORKER option (built from `env` via
+ * `defineNotify({ store })`), not shard state, so this is a one-shot read with a
+ * manual Refresh — there is no DO write-flush to subscribe to. When the app wires
+ * no `@lunora/notify` store (or none yet registered), the RPC returns an empty
+ * device list and the panel shows an empty state rather than erroring.
+ */
+declare const NotificationsPanel: () => ReactElement;
+interface HealthPanelProps {
+  /** Shard key the metric/log reads target on first load. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/**
+ * App-level health & SLO overview. On top of the original single-shard snapshot
+ * (recent errors, request/error counts, shards seen) it composes the
+ * lunora-attributed SLO signals the studio can already reach — app error
+ * rate, auth-failure rate, scheduler backlog, and migration status — each with a
+ * status badge, plus durable request/error and auth sparklines, and a
+ * worst-first per-function error-rate list. None of this is CF's per-Worker
+ * charting: it is attributed to lunora functions, the auth flow, and the
+ * scheduler/migration subsystems.
+ *
+ * Every read is independent and best-effort (via `Promise.allSettled`): a
+ * missing `LUNORA_ADMIN_TOKEN`, an unconfigured scheduler, or a cold instance
+ * degrades that one tile to `—` without blanking the rest. The overview is always
+ * live: a root-shard `getMetrics` subscription drives a full cross-shard re-pull
+ * on every write-flush (coalesced so a burst yields at most one in-flight pull).
+ */
+declare const HealthPanel: ({ initialShardKey }: HealthPanelProps) => ReactElement;
+/** One shard's metrics fetch outcome: the snapshot, or the error that shard returned. */
+interface ShardMetricsResult {
+  error: null | string;
+  metrics: null | ShardMetrics;
+  shard: string;
+}
+/** Totals rolled up across every successfully-fetched shard. */
+interface AggregateMetrics {
+  /** Shards that returned an error (couldn't be reached / unauthorized). */
+  failed: number;
+  /** Combined reactive-cache hit rate across shards with a cache, or `null` when none has one. */
+  hitRate: null | number;
+  /** Shards that returned a snapshot. */
+  reachable: number;
+  /** Sum of `databaseSize` across reachable shards (skips shards reporting `null`). */
+  totalDatabaseSize: number;
+  totalErrors: number;
+  totalRequests: number;
+}
+/**
+ * Roll up per-shard metrics into repo-wide totals. Errors-per-shard are kept as
+ * `failed` (a shard that's down is data, not a hard failure), and counters are
+ * summed only over reachable shards. The combined cache hit-rate weights by each
+ * shard's hits+misses so a busy shard dominates a quiet one.
+ */
+declare const aggregateMetrics: (results: ReadonlyArray<ShardMetricsResult>) => AggregateMetrics;
+/**
+ * The shard keys to aggregate over. Durable Objects aren't enumerable, so this
+ * is the union of the root shard (`""`), an explicit current shard, and the
+ * recently-visited shards — de-duplicated, order-stable (root first). It's a
+ * best-effort "shards we know about", not every shard that exists.
+ */
+declare const shardsToAggregate: (current: string, recents: ReadonlyArray<string>) => string[];
+interface MetricsPanelProps {
+  /** Shard key the panel reports on. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/**
+ * Health snapshot for a single shard: request / error counts (since the DO last
+ * woke), its live SQLite size, and reactive-cache hit/miss stats when a cache is
+ * configured. Reads via the `__lunora_admin__:getMetrics` RPC over the
+ * {@link useLunora} client; gated by the server's `LUNORA_ADMIN_TOKEN`.
+ *
+ * Counters are per-DO-instance and reset on hibernation/restart — this is a
+ * "since this instance woke" readout, not a durable time series.
+ *
+ * The panel is always live: a `getMetrics` WebSocket subscription opens once the
+ * first one-shot seed commits a shard and re-pushes on every server write-flush,
+ * accumulating a client-side, in-memory series of requests-per-sample (the delta
+ * of `requests` between consecutive samples), rendered as an inline-SVG
+ * sparkline. The series is capped at {@link MAX_HISTORY} points and is lost on
+ * remount.
+ */
+declare const MetricsPanel: ({ initialShardKey }: MetricsPanelProps) => ReactElement;
+interface SchemaViewerProps {
+  /** Shard key the viewer targets. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+  /**
+   * Table to auto-expand once the shard's tables load. Set by the Insights
+   * "add the index" deep-link (`/schema?table=<name>`) so the operator lands
+   * directly on the scanned table's index list instead of hunting for it.
+   * Re-applied whenever the value changes, so following the link a second time
+   * (same tab already open) re-expands the target.
+   */
+  readonly initialTable?: string;
+  /**
+   * Enable the visual schema-editor overlay (add table / column / index). Off by
+   * default so the diagram stays read-only. Set only by the loopback dev hosts
+   * (see `StudioProps.schemaEditable`); when true, the authoring overlay
+   * (plan 024 Item 4) renders above the table lists and applies additive edits
+   * through the dev host's local schema-edit endpoint.
+   */
+  readonly schemaEditable?: boolean;
+}
+/**
+ * Schema overview that shows both storage tiers so the distinction is never a
+ * mystery. The shard section lists every user table in the selected Durable
+ * Object with row counts, and probes a table's columns on expand via a one-row
+ * `__lunora_admin__:readTablePage` (`PRAGMA table_info`). The global section
+ * lists every `.global()` table — including the auth tables (`user`, `session`,
+ * …) — via the client's `listGlobalTables()`, reading columns from a one-row
+ * `readGlobalTablePage` on expand.
+ *
+ * Two presentations: a **Table list** (searchable, expandable cards per tier)
+ * and a **Graph** — a single React Flow relationship diagram showing both tiers
+ * on one canvas, with cross-tier FK edges and its own in-canvas find-table box,
+ * tier filter, and legend.
+ *
+ * Read-only and gated by the server's `LUNORA_ADMIN_TOKEN`, like the rest of the
+ * studio's admin surface. Global discovery is best-effort: if D1 isn't
+ * configured the global section simply reports it, and the shard section still
+ * works.
+ */
+declare const SchemaViewer: ({ initialShardKey, initialTable, schemaEditable }: SchemaViewerProps) => ReactElement;
+interface SettingsPanelProps {
+  /** Shard key the settings read targets on first load. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+declare const SettingsPanel: ({ initialShardKey }: SettingsPanelProps) => ReactElement;
+interface SqlEditorPanelProps {
+  /** Shard key the query runs against on first load. Defaults to the root shard. */
+  readonly initialShardKey?: string;
+}
+/**
+ * A full-height, Supabase-style SQL editor: a left query sidebar (search + new,
+ * a browser-persisted PRIVATE list, and REFERENCE templates), a line-numbered
+ * editor pane, and a Results / Explain pane with a Run control + shard selector.
+ * Read-only — the `__lunora_admin__:runSql` RPC rejects everything but
+ * SELECT / WITH / EXPLAIN, so raw writes can't desync the doc-store's shadow
+ * tables (use the Data grid's inline edit for mutations).
+ */
+declare const SqlEditorPanel: ({ initialShardKey }: SqlEditorPanelProps) => ReactElement;
+interface FileBrowserProps {
+  /** Object-key prefix the browser filters by on first load. */
+  readonly initialPrefix?: string;
+  /** Objects requested per page. Forwarded to the storage `list` limit. */
+  readonly pageSize?: number;
+}
+/**
+ * Browse — and mutate — objects in the storage (R2) bucket. Lists keys under an
+ * optional prefix via the client's `listStorageObjects`, which hits the worker's
+ * admin-gated `GET /_lunora/admin/storage` endpoint — so the worker must be built
+ * with a `storageList` function and `adminToken`. Paginates forward by cursor.
+ *
+ * Each row offers a "Copy URL" (signed/public URL via `signedStorageUrl`) and a
+ * confirm-gated "Delete" (`deleteStorageObject`); the toolbar offers an upload
+ * (`uploadStorageObject`) into the current prefix. Those write paths require the
+ * worker to be built with `storageSignedUrl` / `storageDelete` / `storageUpload`
+ * respectively — when absent, the worker responds with a clear `*_NOT_CONFIGURED`
+ * error that surfaces inline rather than crashing the panel.
+ *
+ * All state + behavior lives in {@link useFileBrowser}; this shell only wires the
+ * view-model into the toolbar, breadcrumbs, selection bar, list/gallery and the
+ * load-more / error / empty affordances.
+ */
+declare const FileBrowser: ({ initialPrefix, pageSize }: FileBrowserProps) => ReactElement;
+/** Default polling cadence for auto-refresh, in milliseconds. */
+declare const DEFAULT_AUTO_REFRESH_MS = 5e3;
+/**
+ * Call `onTick` on a fixed interval while `enabled`, for panels whose backend
+ * has no live subscription channel (the scheduler, R2, D1, the SessionDO — all
+ * HTTP-only). Polling is the honest "live" here: a timer-driven scheduler has no
+ * client-observable write event to push on, so the UI watches jobs count down
+ * and disappear by re-asking.
+ *
+ * Ticks are skipped while the tab is hidden (`document.hidden`) so a backgrounded
+ * studio doesn't keep hammering the worker. `onTick` is held in a ref so a
+ * fresh closure each render doesn't reset the interval; only `enabled`/`intervalMs`
+ * do. The interval is cleared on disable and unmount.
+ */
+declare const useAutoRefresh: (onTick: () => void, enabled: boolean, intervalMs?: number) => void;
+/**
+ * Debounced mirror of `value`: returns the latest value only after it has been
+ * stable for `delayMs`. Used so a per-keystroke search box drives at most one
+ * server round-trip per pause, instead of one request per character.
+ *
+ * `resetKey` is an optional escape hatch from the trailing delay: when it
+ * changes relative to the PREVIOUS call, the mirror snaps to `value`
+ * immediately — no `delayMs` window at all. It exists for callers that key a
+ * debounced input (a search box, a shard key) to a coarser identity (e.g. the
+ * open table): on that identity's change the caller usually re-seeds `value`
+ * itself in the same render, and without `resetKey` the debounced mirror would
+ * still trail the OLD value behind its own timer for up to `delayMs`, ignoring
+ * the reseed. The snap happens render-time (the "adjusting state when a prop
+ * changes" pattern): calling the setters below makes React discard this render
+ * and retry synchronously with the caught-up state, so the returned value is
+ * already correct on the render that reads it — no extra commit, no trailing
+ * window. Omit `resetKey` (the default) to keep the original always-debounced
+ * behavior; every other caller in the codebase does this.
+ */
+declare const useDebounced: <T>(value: T, delayMs?: number, resetKey?: unknown) => T;
+interface StudioI18nProviderProps {
+  /** Catalogs to register in addition to the built-in English one. */
+  readonly catalogs?: StudioCatalogs;
+  readonly children: ReactNode;
+  /** Reuse an existing instance (wins over `locale`/`catalogs`). */
+  readonly i18n?: I18n;
+  /** Active locale; ignored when `i18n` is supplied. Defaults to `en`. */
+  readonly locale?: string;
+}
+/**
+ * Provides a studio-scoped Lingui instance to `useT`. Nesting is safe:
+ * providers sharing the same instance resolve to the same context value.
+ */
+declare const StudioI18nProvider: ({ catalogs, children, i18n, locale }: StudioI18nProviderProps) => ReactElement;
+/** Root class the batteries-included app sets so the studio styles stay scoped. */
+declare const STUDIO_ROOT_CLASS = "lunora-studio-root";
+export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, AdvisorHealthPanel, type AggregateMetrics, ApiDocsPanel, type ApiDocsPanelProps, ApiReferencePanel, type ApiReferencePanelProps, ApiTab, type ApiTabProps, type AuditEntry, type AuditLogResult, AuditPanel, type AuditPanelProps, type CacheStats, type CapturedMailResult, type CommandItem, CommandPalette, type CommandPaletteProps, ConfirmButton, type ConfirmButtonProps, ConnectionBadge, DEFAULT_AUTO_REFRESH_MS, DEFAULT_INSIGHT_THRESHOLDS, DEFAULT_LOCALE, DataBrowser, type DataBrowserProps, DataFilters, type DeployInfo, DeploymentHealthPanel, type DeploymentHealthPanelProps, type DeploymentHealthProbe, type EditableFilter, ErrorBoundary, type ErrorBoundaryProps, ExportImportPanel, type ExportImportPanelProps, type ExportRow, FileBrowser, type FileBrowserProps, type FilterClause, type FilterOperator, type FunctionCallStat, type FunctionDescriptor, FunctionRunner, type FunctionRunnerProps, FunctionStatsPanel, type FunctionStatsPanelProps, type FunctionStatsResult, GlobalDataBrowser, type GlobalDataBrowserProps, HealthPanel, type HealthPanelProps, HomePanel, type HomePanelProps, type ImportError, type ImportShardResult, type Insight, type InsightKind, type InsightSeverity, type InsightThresholds, InsightsPanel, type InsightsPanelProps, type LogEntry, type LogLevel, LogsPanel, type LogsPanelProps, type LogsResult, MailPanel, type MailPanelProps, type MessageId, MetricsPanel, type MetricsPanelProps, type MigrationDirection, type MigrationRunResult, type MigrationStatus, type MigrationStatusRow, MigrationsPanel, type MigrationsPanelProps, NotificationsPanel, OpenRpcReferencePanel, type OpenRpcReferencePanelProps, PitrPanel, type PitrPanelProps, type ProbeSnapshot, type RunMigrationArgs, STUDIO_ROOT_CLASS, SchemaViewer, type SchemaViewerProps, SecurityAdvisorPanel, type SecurityAuditResult, type SecurityFinding, type SecurityFindingKind, type SecurityFindingLevel, type SettingEntry, type SettingKind, SettingsPanel, type SettingsPanelProps, type SettingsResult, ShardInput, type ShardInputProps, type ShardMetrics, type ShardMetricsResult, SqlEditorPanel, type SqlEditorPanelProps, type StudioCatalogs, StudioI18nProvider, type StudioI18nProviderProps, type StudioTab, type TFunction, TableEditor, type TableEditorProps, type TableIndexInfo, type TableIndexesResult, type TableInfo, type TablePage, type WriteRowArgs, type WriteRowOp, type WriteRowResult, aggregateMetrics, createStudioI18n, deriveInsights, openCommandPalette, shardsToAggregate, studioI18n, toFilterClauses, useAutoRefresh, useDebounced, useT };