@pramen/server 0.0.48 → 0.0.49

package/dist/auth.d.ts

@@ -1,8 +1,9 @@
 import type { Identity } from "./sdk/acl";
+import type { JsonObject } from "./sdk/infer";
 /** Verifies a JWT and returns its claims, or null if invalid. Implementations
  * differ only in how they verify the signature. */
 export interface VerifyStrategy {
-    verify(token: string): Promise<Record<string, unknown> | null>;
+    verify(token: string): Promise<JsonObject | null>;
 }
 /** Optional, opt-in claim validation layered on top of signature + exp/nbf. All
  * default OFF (unset) so existing tokens keep verifying; a deployment turns these on
@@ -22,7 +23,7 @@ export declare class HmacStrategy implements VerifyStrategy {
     private readonly secret;
     private readonly opts;
     constructor(secret: string, opts?: VerifyOptions);
-    verify(token: string): Promise<Record<string, unknown> | null>;
+    verify(token: string): Promise<JsonObject | null>;
 }
 /** RS256 verified against a remote JWKS. Public keys are fetched once and cached
  * (TTL); a token with an unknown `kid` triggers one forced refetch to pick up key
@@ -35,7 +36,7 @@ export declare class JwksStrategy implements VerifyStrategy {
     private fetchedAt;
     private inflight;
     constructor(url: string, ttlMs?: number, opts?: VerifyOptions);
-    verify(token: string): Promise<Record<string, unknown> | null>;
+    verify(token: string): Promise<JsonObject | null>;
     private lookup;
     private keyFor;
     private refresh;

package/dist/cli.js

@@ -20,7 +20,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { createTableSql } from "./runtime/ddl";
 import { schemaHash } from "./runtime/migrate";
-import { diffSchemaShape, schemaShape } from "./runtime/schema-diff";
+import { diffSchemaFingerprint, schemaFingerprint } from "./runtime/schema-diff";
 import { entitiesInPartition, partitionsOf } from "./sdk/schema";
 /** Mint an HS256 JWT — mirrors what a real auth service would issue, for local
  * dev/testing (`pramen token`, and the default token for `schema status`). Signs
@@ -90,7 +90,7 @@ Usage: pramen <command>
   init [dir]                scaffold a new project (app.ts + worker.ts + oblaka.ts)
   schema sql                print CREATE TABLE statements for the schema
   schema hash               print the schema hash
-  schema snapshot           save the schema shape to .pramen/schema.json
+  schema snapshot           save the schema fingerprint to .pramen/schema.json
   schema diff               compare the schema to the snapshot (safe vs unsafe)
   schema status             compare a deployed tenant's schema to the local schema
                             [--tenant t] [--url u] [--token jwt]
@@ -113,20 +113,23 @@ async function schemaCmd(sub) {
     if (sub === "snapshot") {
         const { schema } = await loadApp();
         mkdirSync(dirname(snapshotPath), { recursive: true });
-        const snap = { hash: schemaHash(schema), shape: schemaShape(schema) };
+        const snap = { hash: schemaHash(schema), fingerprint: schemaFingerprint(schema) };
         writeFileSync(snapshotPath, JSON.stringify(snap, null, 2) + "\n");
-        console.log(`wrote ${snapshotPath} (${Object.keys(snap.shape).length} tables)`);
+        console.log(`wrote ${snapshotPath} (${Object.keys(snap.fingerprint).length} tables)`);
         return;
     }
     if (sub === "diff") {
         const { schema } = await loadApp();
-        const next = schemaShape(schema);
+        const next = schemaFingerprint(schema);
         if (!existsSync(snapshotPath)) {
             console.log("no snapshot — run `pramen schema snapshot` to set a baseline.");
             return;
         }
-        const prev = JSON.parse(readFileSync(snapshotPath, "utf8")).shape;
-        const changes = diffSchemaShape(prev, next);
+        // `fingerprint` was called `shape` before; keep reading an existing snapshot so an
+        // upgrade doesn't force a re-baseline.
+        const snap = JSON.parse(readFileSync(snapshotPath, "utf8"));
+        const prev = snap.fingerprint ?? snap["shape"] ?? {};
+        const changes = diffSchemaFingerprint(prev, next);
         if (changes.length === 0) {
             console.log("no changes since snapshot.");
             return;
@@ -181,7 +184,7 @@ async function schemaCmd(sub) {
             console.log(`live:    ${live.hash ?? "(none)"}`);
             console.log(`current: ${current}`);
             console.log(upToDate ? "✓ up to date" : "⚠ BEHIND — migrates on the tenant's next boot");
-            const want = schemaShape(subset);
+            const want = schemaFingerprint(subset);
             for (const table of Object.keys(want)) {
                 const liveCols = new Set(live.tables[table] ?? []);
                 const missing = Object.keys(want[table].columns).filter((col) => !liveCols.has(col));
@@ -202,7 +205,10 @@ async function tokenCmd(args) {
         fail("token: <sub> required");
     const roles = pos.slice(1);
     const tenants = flag("tenant")?.split(",");
-    console.log(await sign({ sub, roles: roles.length ? roles : ["admin"], ...(tenants ? { tenants } : {}) }));
+    const claims = { sub, roles: roles.length ? roles : ["admin"] };
+    if (tenants)
+        claims.tenants = tenants;
+    console.log(await sign(claims));
 }
 function initCmd(args) {
     const dir = resolve(process.cwd(), positionals(args)[0] ?? ".");

package/dist/durable-object.d.ts

@@ -76,6 +76,7 @@ export declare class PramenDOBase extends DurableObject<DoEnv> {
     private handleSchema;
     private handleAdminData;
     private ctxFor;
+    private widenedEnv;
     private get envBag();
     private filesFor;
     private identityOf;

package/dist/durable-object.js

@@ -164,9 +164,10 @@ export class PramenDOBase extends DurableObject {
             return new Response(null, { status: 101, webSocket: client });
         }
         const name = new URL(request.url).pathname.replace(/^\/rpc\//, "");
-        let input;
+        // The RPC body is JSON — parse it into the domain type once, here at the boundary.
+        let input = null;
         if (request.method === "POST") {
-            input = await request.json().catch(() => undefined);
+            input = ((await request.json().catch(() => null)) ?? null);
         }
         try {
             const { result, kind, touched, enqueued } = await dispatch(this.app.handlers, this.app.schema, this.driver, this.kv, this.filesFor(this.tenant), this.envBag, this.ctxFor(identity), name, input);
@@ -291,12 +292,12 @@ export class PramenDOBase extends DurableObject {
         await this.ensureMigrated();
         switch (msg.type) {
             case "subscribe":
-                return this.onSubscribe(ws, msg.id, msg.name, msg.input);
+                return this.onSubscribe(ws, msg.id, msg.name, msg.input ?? null);
             case "unsubscribe":
                 this.setSubs(ws, this.getSubs(ws).filter((s) => s.id !== msg.id));
                 return;
             case "call":
-                return this.onCall(ws, msg.id, msg.name, msg.input);
+                return this.onCall(ws, msg.id, msg.name, msg.input ?? null);
             default:
                 return this.send(ws, { type: "error", id: "", error: "unknown message type" });
         }
@@ -536,8 +537,12 @@ export class PramenDOBase extends DurableObject {
     }
     // The DO env (bindings + vars + secrets) handed to handlers as ctx.env. Loosely
     // typed at the boundary so handlers can read any var/secret without a DoEnv cast.
+    widenedEnv = null;
     get envBag() {
-        return this.env;
+        // `this.env` is fixed for the DO's lifetime, so widen it once. This getter is read
+        // inside the per-subscription live-query loop, where a copy per read would allocate
+        // one whole binding bag per subscription on every write.
+        return (this.widenedEnv ??= { ...this.env });
     }
     // One Files facade per DO (a DO serves one tenant). Backed by the R2 binding;
     // signing uses FILES_SECRET. Handlers mint signed urls; the bytes never enter here.

package/dist/index.d.ts

@@ -4,10 +4,10 @@ export { isValidUuid } from "./sdk/uuid";
 export type { DefaultValue, FieldType, FieldDef, EntityFields, EntityDef, SchemaDef, RelationDef, RelationDefs, BelongsToDef, HasManyDef, ManyToManyDef, OneHasOneDef, OneHasOneInverseDef, OnDelete, } from "./sdk/schema";
 export { createApp } from "./sdk/app";
 export { query, mutation, authorizeHandler } from "./sdk/handlers";
-export type { Handler, HandlerContext, HandlerKind, HandlerMap, HandlerOpts, HandlerAuth, Tasks, TaskHandler, AppTaskMap, BootstrapContext, BootstrapFn } from "./sdk/handlers";
+export type { EnvBag, Handler, HandlerContext, HandlerKind, HandlerMap, HandlerOpts, HandlerAuth, Tasks, TaskHandler, AppTaskMap, BootstrapContext, BootstrapFn } from "./sdk/handlers";
 export { $identity, $input, $now, allow, deny, policy, resolve, role, isAllow, isDeny, isResolver, isIdentityMarker, isInputMarker, isNowMarker } from "./sdk/acl";
 export type { Action, Identity, IdentityMarker, InputMarker, NowMarker, Policy, PolicyRule, PolicyRules, Role, Validator, WhereRule, ConditionalFields, FieldsFn, RelationAclRule, SetValue, ResolverFn, ResolverContext, ResolverDb, } from "./sdk/acl";
-export type { Cell, FieldsOf, InferInsert, InferRow, InferUpdate, JsonValue, ProjectedRow, RelationsOf, RelationsResult, WhereClause, WhereInput, WhereOps, } from "./sdk/infer";
+export type { Cell, FieldsOf, InferInsert, InferRow, InferUpdate, JsonValue, JsonObject, SqlValue, CellValue, Row, ProjectedRow, RelationsOf, RelationsResult, WhereClause, WhereInput, WhereOps, } from "./sdk/infer";
 export { Kv, denySession, allowSession, isSessionDenied } from "./runtime/kv";
 export type { FileRef, Files, SignUploadOpts, SignDownloadOpts, HeadResult } from "./sdk/files";
 export { R2Adapter, MemoryAdapter, createFiles, handleFileRequest } from "./runtime/storage";
@@ -20,4 +20,4 @@ export { routeQueue, dispatchQueueBatch } from "./runtime/queue-consumer";
 export type { QueueContext, QueueHandler, QueueMessage, QueueBatch, AppQueueMap } from "./runtime/queue-consumer";
 export { PramenError, BadRequest, Unauthorized, Forbidden } from "./runtime/errors";
 export { sqliteDialect, postgresDialect, DoSqliteDriver, D1Driver } from "./runtime/driver";
-export type { Driver, Dialect, Row } from "./runtime/driver";
+export type { Driver, Dialect, DriverRow } from "./runtime/driver";

package/dist/pramen.d.ts

@@ -4,13 +4,15 @@ import { type SchemaDef } from "./sdk/schema";
 import type { AppTaskMap, HandlerMap, BootstrapFn } from "./sdk/handlers";
 import type { AppQueueMap, QueueBatch } from "./runtime/queue-consumer";
 import type { Role } from "./sdk/acl";
+import type { EnvBag } from "./sdk/handlers";
+import type { JsonValue } from "./sdk/infer";
 /** Injected into a public route's handler — forward a privileged mutation into the
  * tenant's DO without the handler importing any deploy-side code (so app.ts stays
  * authoring-only). The synthetic identity defaults to the admin role. */
 export interface RouteContext {
     callPrivileged(opts: {
         name: string;
-        input?: unknown;
+        input?: JsonValue;
         tenant?: string;
         roles?: string[];
     }): Promise<Response>;
@@ -25,7 +27,7 @@ export interface PublicRoute {
     method: string;
     /** Exact pathname to match (e.g. "/stripe/webhook"). */
     path: string;
-    handler: (request: Request, env: Readonly<Record<string, unknown>>, ctx: RouteContext) => Response | Promise<Response>;
+    handler: (request: Request, env: EnvBag, ctx: RouteContext) => Response | Promise<Response>;
 }
 /** The user-facing app: a schema, the handler map, ACL roles, and optional public
  * (pre-auth) routes. `example/app.ts` exports this shape. */

package/dist/runtime/acl.d.ts

@@ -1,6 +1,7 @@
-import { type Action, type FieldsFn, type Identity, type PolicyRule, type ResolverDb, type Role, type Validator } from "../sdk/acl";
+import { type Action, type FieldsFn, type Identity, type PolicyRule, type ResolverDb, type Role, type Validator, type WhereRule } from "../sdk/acl";
 import { type SqlExpr } from "./read-engine";
 import { PramenError } from "./errors";
+import type { Row } from "../sdk/infer";
 import type { SchemaDef } from "../sdk/schema";
 export declare class AclDenied extends PramenError {
     readonly entity: string;
@@ -78,15 +79,15 @@ export declare const MAX_REL_DEPTH = 5;
  * `allowRelations` is false for single-table contexts (cell-level `when`, which is
  * evaluated in memory and cannot do a SQL round-trip): a relation key then raises a
  * clear authoring error instead of emitting a `sub` node that throws at read time. */
-export declare function compileScopedWhere(rule: Record<string, unknown>, entity: string, ctx: AclContext, depth?: number, allowRelations?: boolean): SqlExpr;
+export declare function compileScopedWhere(rule: WhereRule, entity: string, ctx: AclContext, depth?: number, allowRelations?: boolean): SqlExpr;
 export declare function resolveScope(ctx: AclContext, entity: string, action: Action, depth?: number): Scope;
 /** Effective visible fields for one row = base ∪ matching-conditional ∪ fn-output.
  * Returns null (all fields) when the base is null or a resolver grants everything. */
-export declare function effectiveFields(scope: Scope, row: Record<string, unknown>, identity: Identity | null): string[] | null;
+export declare function effectiveFields(scope: Scope, row: Row, identity: Identity | null): string[] | null;
 /** Forced values + validators for a write, gathered from matched write policies.
  * `set` values are resolved against the identity; later policies override earlier. */
 export interface WriteRules {
-    set: Record<string, unknown>;
+    set: Row;
     validators: Validator[];
 }
 export declare function resolveWriteRules(ctx: AclContext, entity: string, action: Action): WriteRules;
@@ -94,4 +95,4 @@ export declare function resolveWriteRules(ctx: AclContext, entity: string, actio
  * target's own read scope OR a parent read policy's relation rule with directAccess. */
 export declare function resolveRelationScope(ctx: AclContext, parentEntity: string, relName: string, target: string): Scope;
 /** Project a row to the permitted fields. null = all. */
-export declare function projectRow(row: Record<string, unknown>, fields: string[] | null): Record<string, unknown>;
+export declare function projectRow(row: Row, fields: string[] | null): Row;

package/dist/runtime/acl.js

@@ -85,10 +85,6 @@ function getPath(obj, path) {
     return path.split(".").reduce((acc, seg) => (acc == null ? undefined : acc[seg]), obj ?? undefined);
 }
 const UNRESOLVED = Symbol("unresolved");
-// Resolve a value that may be an $identity marker (against the caller), an
-// $input marker (against the request input — a capability/by-key grant), or a
-// $now marker (the evaluation instant). An unresolvable marker yields UNRESOLVED,
-// which makes its rule match nothing. $now always resolves.
 function resolveValue(v, identity, input) {
     if (isNowMarker(v))
         return new Date().toISOString();
@@ -180,7 +176,7 @@ function pkOf(schema, entity) {
  * are skipped: they're re-scoped against THEIR own target's read scope downstream.
  * Mirrors Db.assertReadableWhere's recursion for the top-level user `where`. */
 function assertReadableRelationWhere(where, target, fields, ctx) {
-    const targetRels = (ctx.schema?.[target]?.relations ?? {});
+    const targetRels = ctx.schema?.[target]?.relations ?? {};
     for (const [k, v] of Object.entries(where)) {
         if (k === "AND" || k === "OR") {
             for (const g of v)

package/dist/runtime/db.d.ts

@@ -1,9 +1,10 @@
 import { type AclContext } from "./acl";
+import type { CellValue, Row as SharedRow } from "../sdk/infer";
 import { type AggFn } from "./read-engine";
 import type { Driver } from "./driver";
 import { type EntityFields, type SchemaDef } from "../sdk/schema";
 import type { Cell, FieldsOf, InferInsert, InferRow, InferUpdate, RelationsOf, RelationsResult, WhereClause } from "../sdk/infer";
-type Row = Record<string, unknown>;
+type Row = SharedRow;
 type Id = string | number | bigint;
 type OrderSpec<S extends SchemaDef, T extends keyof S> = {
     column: keyof FieldsOf<S[T]> & string;
@@ -215,7 +216,7 @@ export declare class Db<S extends SchemaDef = SchemaDef> {
     /** Delete a row by id within scope. Returns whether a row was deleted. */
     delete<T extends keyof S & string>(table: T, id: Id): Promise<boolean>;
     /** Escape hatch — raw SQL, NOT ACL-checked. For system/internal use only. */
-    exec(sql: string, ...params: unknown[]): Promise<Row[]>;
+    exec(sql: string, ...params: CellValue[]): Promise<Row[]>;
     private returningClause;
     private scopeClause;
 }

package/dist/runtime/dispatch.d.ts

@@ -5,6 +5,8 @@ import type { Kv } from "./kv";
 import type { Files } from "../sdk/files";
 import type { SchemaDef } from "../sdk/schema";
 import { type AppTaskMap, type HandlerContext, type HandlerKind, type HandlerMap, type Tasks } from "../sdk/handlers";
+import type { EnvBag } from "../sdk/handlers";
+import type { JsonValue } from "../sdk/infer";
 export interface DispatchResult {
     readonly result: unknown;
     readonly kind: HandlerKind;
@@ -17,4 +19,4 @@ export interface DispatchResult {
 export declare function tasksFacade(driver: Driver, onEnqueue?: () => void): Tasks;
 /** Bind `app.tasks` (which take a ctx) into the ctx-free `TaskMap` the drainer calls. */
 export declare function bindTasks(appTasks: AppTaskMap | undefined, ctx: HandlerContext): TaskMap;
-export declare function dispatch(handlers: HandlerMap, schema: SchemaDef, driver: Driver, kv: Kv, files: Files, env: Readonly<Record<string, unknown>>, acl: AclContext, name: string, input: unknown): Promise<DispatchResult>;
+export declare function dispatch(handlers: HandlerMap, schema: SchemaDef, driver: Driver, kv: Kv, files: Files, env: EnvBag, acl: AclContext, name: string, input: JsonValue): Promise<DispatchResult>;

package/dist/runtime/driver.d.ts

@@ -1,4 +1,7 @@
-export type Row = Record<string, unknown>;
+/** A raw row exactly as the substrate returns it, before pramen's object↔JSON codec.
+ * Distinct from the decoded `Row` handlers see at the `Db` chokepoint. */
+export type DriverRow = Record<string, SqlValue>;
+import type { CellValue, SqlValue } from "../sdk/infer";
 export interface Dialect {
     /** Render an identifier (table/column), quoting as the backend requires. */
     id(name: string): string;
@@ -7,7 +10,7 @@ export interface Dialect {
     /** Whether INSERT/UPDATE/DELETE ... RETURNING is supported (SQLite/Postgres yes; MySQL no). */
     readonly returning: boolean;
     /** Coerce a JS value for binding (e.g. boolean → 0/1 on SQLite). */
-    encode(v: unknown): unknown;
+    encode(v: CellValue): CellValue;
 }
 /** Render an identifier as a standard double-quoted name (`"order"`), guarding its
  * shape first. SQLite (DO SQLite + D1) and Postgres all accept double-quoted
@@ -27,7 +30,7 @@ export interface Driver {
     readonly dialect: Dialect;
     /** Run a parameterized statement and return the result rows (empty for writes
      * without RETURNING). Params are already dialect-encoded by the caller. */
-    exec(sql: string, params: unknown[]): Promise<Row[]>;
+    exec(sql: string, params: CellValue[]): Promise<DriverRow[]>;
     /** Run `fn` inside a transaction: commit on resolve, roll back on throw. */
     transaction<T>(fn: () => Promise<T>): Promise<T>;
     /** Run a fixed sequence of write statements ATOMICALLY with FK checks deferred to the
@@ -46,7 +49,7 @@ export declare class DoSqliteDriver implements Driver {
     private readonly storage;
     readonly dialect: Dialect;
     constructor(storage: DurableObjectStorage);
-    exec(sql: string, params: unknown[]): Promise<Row[]>;
+    exec(sql: string, params: CellValue[]): Promise<DriverRow[]>;
     transaction<T>(fn: () => Promise<T>): Promise<T>;
 }
 /** How a D1Driver's session is anchored (passed to `db.withSession`):
@@ -79,7 +82,7 @@ export declare class D1Driver implements Driver {
     constructor(db: D1Database, opts?: {
         start?: D1SessionStart;
     });
-    exec(sql: string, params: unknown[]): Promise<Row[]>;
+    exec(sql: string, params: CellValue[]): Promise<DriverRow[]>;
     /** The session's latest bookmark (null before any query). Threaded back to the client
      * via the `x-pramen-d1-bookmark` response header so a subsequent request can anchor a
      * fresh session at it and read its own writes. */

package/dist/runtime/mail.d.ts

@@ -1,4 +1,5 @@
 import type { Kv } from "./kv";
+import type { EnvBag } from "../sdk/handlers";
 export interface MailAddress {
     email: string;
     name?: string;
@@ -77,4 +78,4 @@ export declare class UnconfiguredMailAdapter implements MailAdapter {
  *    a synthetic dev sender — an EXPLICIT dev opt-in, never the production default.
  *  - else → fail closed: a `send` throws (so a missing-MAIL_FROM prod doesn't silently
  *    stash security emails in KV). */
-export declare function createMail(env: Readonly<Record<string, unknown>>, kv?: Kv): Mail;
+export declare function createMail(env: EnvBag, kv?: Kv): Mail;

package/dist/runtime/protocol.d.ts

@@ -1,8 +1,9 @@
+import type { JsonValue } from "../sdk/infer";
 export interface SubscribeMsg {
     type: "subscribe";
     id: string;
     name: string;
-    input?: unknown;
+    input?: JsonValue;
 }
 export interface UnsubscribeMsg {
     type: "unsubscribe";
@@ -12,7 +13,7 @@ export interface CallMsg {
     type: "call";
     id: string;
     name: string;
-    input?: unknown;
+    input?: JsonValue;
 }
 export type ClientMsg = SubscribeMsg | UnsubscribeMsg | CallMsg;
 export type ServerMsg = {
@@ -32,7 +33,7 @@ export type ServerMsg = {
 export interface Subscription {
     id: string;
     name: string;
-    input: unknown;
+    input: JsonValue;
     /** Tables the query read — the coarse prefilter for which writes might matter. */
     tables: string[];
     /** Digest of the last result pushed — used to suppress no-op (row-level) pushes. */

package/dist/runtime/queue-consumer.d.ts

@@ -1,6 +1,8 @@
 import type { Mail } from "./mail";
 import type { Queue } from "./queue";
 import type { Kv } from "./kv";
+import type { EnvBag } from "../sdk/handlers";
+import type { JsonValue } from "../sdk/infer";
 /** One received message (the Cloudflare Queues `Message` shape). */
 export interface QueueMessage<Body = unknown> {
     readonly id: string;
@@ -30,7 +32,7 @@ export interface QueueBatch<Body = unknown> {
  * tenant data via `ctx.callPrivileged`. */
 export interface QueueContext {
     /** The Worker environment (bindings + vars + secrets). */
-    readonly env: Readonly<Record<string, unknown>>;
+    readonly env: EnvBag;
     /** Project KV (cross-tenant). */
     readonly kv: Kv;
     /** Send email (the notification path). */
@@ -41,7 +43,7 @@ export interface QueueContext {
      * The message body should carry the `tenant`. */
     callPrivileged(opts: {
         name: string;
-        input?: unknown;
+        input?: JsonValue;
         tenant?: string;
         roles?: string[];
         partition?: string;

package/dist/runtime/queue.d.ts

@@ -1,3 +1,4 @@
+import type { EnvBag } from "../sdk/handlers";
 /** Cloudflare Queues content type for a sent message. Omitted ⇒ the platform default
  * (v8 structured clone). Use "json" for cross-runtime / external consumers. */
 export type QueueContentType = "text" | "bytes" | "json" | "v8";
@@ -64,9 +65,9 @@ export declare class MemoryQueueAdapter implements QueueAdapter {
 /** Discover the Cloudflare Queues producer bindings in an environment: any value that
  * exposes BOTH `send` and `sendBatch` functions (which excludes the email `send`-only
  * binding, KV, R2, D1, the DO namespace, …). Returns name → binding. */
-export declare function discoverQueueBindings(env: Readonly<Record<string, unknown>>): Record<string, QueueProducerBinding>;
+export declare function discoverQueueBindings(env: EnvBag): Record<string, QueueProducerBinding>;
 /** Build `ctx.queue` from the environment: a Cloudflare adapter over the discovered
  * producer bindings. Sending to an undeclared queue fails closed (the adapter throws).
  * There is no silent capture fallback — declare the `Queue` binding and it exists in
  * dev (lopata) and miniflare too. */
-export declare function createQueue(env: Readonly<Record<string, unknown>>): Queue;
+export declare function createQueue(env: EnvBag): Queue;

package/dist/runtime/read-engine.d.ts

@@ -1,3 +1,5 @@
+import type { WhereRule } from "../sdk/acl";
+import type { CellValue, Row } from "../sdk/infer";
 import type { Dialect } from "./driver";
 export type CmpOp = "=" | "!=" | ">" | ">=" | "<" | "<=" | "LIKE";
 /** Substring match mode for the structured string operators (auto-escaping, so the
@@ -11,11 +13,11 @@ export type SqlExpr = {
     t: "cmp";
     op: CmpOp;
     col: string;
-    value: unknown;
+    value: CellValue;
 } | {
     t: "in";
     col: string;
-    values: unknown[];
+    values: CellValue[];
     negate: boolean;
 } | {
     t: "null";
@@ -45,28 +47,28 @@ export type SqlExpr = {
 };
 export declare const TRUE: SqlExpr;
 export declare const FALSE: SqlExpr;
-export declare const cmp: (op: CmpOp, col: string, value: unknown) => SqlExpr;
+export declare const cmp: (op: CmpOp, col: string, value: CellValue) => SqlExpr;
 export declare const isNull: (col: string, negate?: boolean) => SqlExpr;
-export declare const inList: (col: string, values: unknown[], negate?: boolean) => SqlExpr;
+export declare const inList: (col: string, values: CellValue[], negate?: boolean) => SqlExpr;
 export declare const strMatch: (col: string, needle: string, mode: StrMode) => SqlExpr;
 export declare const and: (...parts: SqlExpr[]) => SqlExpr;
 export declare const or: (...parts: SqlExpr[]) => SqlExpr;
 export declare const not: (expr: SqlExpr) => SqlExpr;
 /** Equality (null -> IS NULL). Used by ACL scope building and relation loads. */
-export declare const eq: (col: string, value: unknown) => SqlExpr;
+export declare const eq: (col: string, value: CellValue) => SqlExpr;
 /** Compile a structured user predicate into a SqlExpr.
  * Shapes: { col: value } (eq) | { col: { gt, lt, in, like, isNull, … } } | { AND: [...] } | { OR: [...] } */
-export declare function compileWhere(input: Record<string, unknown>): SqlExpr;
+export declare function compileWhere(input: WhereRule): SqlExpr;
 export interface CompiledSql {
     readonly sql: string;
-    readonly params: unknown[];
+    readonly params: CellValue[];
 }
-export declare function compileExpr(expr: SqlExpr, dialect: Dialect, params?: unknown[]): CompiledSql;
+export declare function compileExpr(expr: SqlExpr, dialect: Dialect, params?: CellValue[]): CompiledSql;
 /** Evaluate a compiled predicate against an in-memory row. Mirrors compileExpr's
  * semantics (bound-boolean coercion, NULL compares false, empty-IN, LIKE) so the
  * declarative cell-ACL `when` path can decide per-row field visibility without a
  * round-trip to SQLite. */
-export declare function evalExpr(expr: SqlExpr, row: Record<string, unknown>): boolean;
+export declare function evalExpr(expr: SqlExpr, row: Row): boolean;
 export interface OrderBy {
     column: string;
     dir?: "asc" | "desc";

package/dist/runtime/read-engine.js

@@ -44,7 +44,10 @@ export function compileWhere(input) {
 function columnPredicate(col, v) {
     if (v !== null && typeof v === "object" && !Array.isArray(v)) {
         const ops = [];
-        for (const [op, val] of Object.entries(v)) {
+        for (const [op, operand] of Object.entries(v)) {
+            // Markers are resolved upstream (runtime/acl.ts), so an operator's operand is a
+            // literal cell value by this point.
+            const val = operand;
             switch (op) {
                 case "eq":
                     ops.push(eq(col, val));

package/dist/runtime/registry.d.ts

@@ -25,4 +25,7 @@ export declare function parseRegistryKey(key: string): DoRef | null;
 /** Enumerate every registered `(tenant, partition)` pair from the registry KV.
  * Paginates over the full listing (cursor / list_complete) — never truncates at the
  * 1000-key page limit. */
-export declare function listDOs(kv: KVNamespace): Promise<DoRef[]>;
+/** The slice of KV that DO enumeration needs — narrower than the whole namespace, so
+ * callers (and test doubles) only have to provide `list`. */
+export type KvLister = Pick<KVNamespace, "list">;
+export declare function listDOs(kv: KvLister): Promise<DoRef[]>;

package/dist/runtime/registry.js

@@ -65,9 +65,6 @@ export function parseRegistryKey(key) {
         return { tenant: rest, partition: DEFAULT_PARTITION };
     return { tenant: rest.slice(0, sep), partition: rest.slice(sep + 1) };
 }
-/** Enumerate every registered `(tenant, partition)` pair from the registry KV.
- * Paginates over the full listing (cursor / list_complete) — never truncates at the
- * 1000-key page limit. */
 export async function listDOs(kv) {
     const out = [];
     let cursor;

package/dist/runtime/schema-diff.d.ts

@@ -1,6 +1,6 @@
 import type { SchemaDef } from "../sdk/schema";
 /** The comparable fingerprint of a single column: type + migration-relevant modifiers. */
-export interface ColumnShape {
+export interface ColumnFingerprint {
     type: string;
     notNull?: boolean;
     unique?: boolean;
@@ -11,13 +11,13 @@ export interface ColumnShape {
     default?: string;
 }
 /** The comparable fingerprint of a table: its partition + each column's shape. */
-export interface TableShape {
+export interface TableFingerprint {
     partition: string;
-    columns: Record<string, ColumnShape>;
+    columns: Record<string, ColumnFingerprint>;
 }
 /** table -> table shape. The comparable surface of a schema. */
-export type SchemaShape = Record<string, TableShape>;
-export declare function schemaShape(schema: SchemaDef): SchemaShape;
+export type SchemaFingerprint = Record<string, TableFingerprint>;
+export declare function schemaFingerprint(schema: SchemaDef): SchemaFingerprint;
 export interface SchemaChange {
     kind: "add-table" | "drop-table" | "add-column" | "drop-column" | "change-type" | "change-column" | "move-partition";
     table: string;
@@ -34,4 +34,4 @@ export interface SchemaChange {
      * cross-DO data migration). Reported for honesty. */
     appliesOnBoot: boolean;
 }
-export declare function diffSchemaShape(prev: SchemaShape, next: SchemaShape): SchemaChange[];
+export declare function diffSchemaFingerprint(prev: SchemaFingerprint, next: SchemaFingerprint): SchemaChange[];

package/dist/runtime/schema-diff.js

@@ -17,7 +17,7 @@
 // still CANNOT be enacted on boot (a partition is a separate Durable Object — it needs a
 // manual cross-DO data migration), so it stays `appliesOnBoot: false`.
 import { partitionOf } from "../sdk/schema";
-function columnShape(f) {
+function columnFingerprint(f) {
     const c = { type: f.type };
     if (f.notNull)
         c.notNull = true;
@@ -35,12 +35,12 @@ function columnShape(f) {
         c.default = JSON.stringify(f.default);
     return c;
 }
-export function schemaShape(schema) {
+export function schemaFingerprint(schema) {
     const out = {};
     for (const [table, def] of Object.entries(schema)) {
         const columns = {};
         for (const [col, f] of Object.entries(def.fields))
-            columns[col] = columnShape(f);
+            columns[col] = columnFingerprint(f);
         out[table] = { partition: partitionOf(schema, table), columns };
     }
     return out;
@@ -64,7 +64,7 @@ function modifierDiff(prev, next) {
 function fmt(v) {
     return v === undefined ? "—" : String(v);
 }
-export function diffSchemaShape(prev, next) {
+export function diffSchemaFingerprint(prev, next) {
     const changes = [];
     for (const table of Object.keys(next)) {
         const pt = prev[table];