@lunora/codegen 1.0.0-alpha.89 → 1.0.0-alpha.90

package/dist/index.d.mts

@@ -393,7 +393,7 @@ interface FunctionIR {
   /**
    * Set by the `.expose({ rest: true })` builder modifier (plan 167). When
    * `rest` is `true` the function is published on the public REST surface, so the
-   * OpenAPI emitter describes it as a real `/_lunora/rest/<namespace>/<fn>` path
+   * OpenAPI emitter describes it as a real `/_lunora/rest/<namespace>/<fn>` path
    * (the single source of truth the runtime router also derives from). Absent →
    * RPC-only (the default; not on the REST surface).
    *
@@ -406,7 +406,7 @@ interface FunctionIR {
     cache?: ExposeCacheIR;
     rest?: boolean;
   };
-  /** Path relative to `&lt;projectRoot>/lunora/` without extension, e.g. "messages". */
+  /** Path relative to `<projectRoot>/lunora/` without extension, e.g. "messages". */
   filePath: string;
   kind: "action" | "mutation" | "query" | "stream";
   /**
@@ -427,7 +427,7 @@ interface FunctionIR {
    */
   output?: ValidatorIR;
   /**
-   * Serialized TS source for the handler's return type, with `Promise&lt;T>`
+   * Serialized TS source for the handler's return type, with `Promise<T>`
    * unwrapped so callers see `T` directly. Defaults to `"unknown"` when
    * ts-morph cannot resolve the type (typically because the consuming
    * project lacks a tsconfig that can reach `@lunora/server`).
@@ -449,7 +449,7 @@ interface FunctionIR {
 interface MigrationIR {
   /** Export binding name, used to reference the module member in generated imports. */
   exportName: string;
-  /** Path relative to `&lt;projectRoot>/lunora/` without extension, e.g. "migrations". */
+  /** Path relative to `<projectRoot>/lunora/` without extension, e.g. "migrations". */
   filePath: string;
   /** Stable migration id — the registry key and per-shard run-state key. */
   id: string;
@@ -468,12 +468,12 @@ interface ShapeIR {
   /**
    * The shape's `args` validator map — its partition selector. Lifted so
    * `_generated/collections.ts` can type the selector a caller passes instead of
-   * widening it to `Record&lt;string, unknown>`. `{}` for a parameterless shape.
+   * widening it to `Record<string, unknown>`. `{}` for a parameterless shape.
    */
   args: Record<string, ValidatorIR>;
   /** Export binding name — the shape's registry key and import member. */
   exportName: string;
-  /** Path relative to `&lt;projectRoot>/lunora/` without extension — always `"shapes"`. */
+  /** Path relative to `<projectRoot>/lunora/` without extension — always `"shapes"`. */
   filePath: string;
   /**
    * The `table` string literal from the `defineShape({ table })` call, lifted
@@ -519,18 +519,18 @@ interface EnvIR {
 interface MutatorIR {
   /**
    * The mutator's `args` validator map, parsed exactly as a procedure's is, so
-   * the emitted `api.mutators.&lt;name>` reference carries the arg type a client
+   * the emitted `api.mutators.<name>` reference carries the arg type a client
    * `defineMutator` infers instead of restating. `{}` for a parameterless
    * mutator (or one whose `args` isn't an inline object literal).
    */
   args: Record<string, ValidatorIR>;
   /** Export binding name — the mutator's registry key and import member. */
   exportName: string;
-  /** Path relative to `&lt;projectRoot>/lunora/` without extension — always `"mutators"`. */
+  /** Path relative to `<projectRoot>/lunora/` without extension — always `"mutators"`. */
   filePath: string;
   /**
    * Serialized TS source for the authoritative `server` impl's return type,
-   * `Promise&lt;T>` unwrapped. `"unknown"` when ts-morph can't resolve it — same
+   * `Promise<T>` unwrapped. `"unknown"` when ts-morph can't resolve it — same
    * contract as {@link FunctionIR.returnType}.
    */
   returnType: string;
@@ -807,7 +807,7 @@ interface FlagsIR {
 interface WorkflowCallIR {
   /** Export binding name of the function performing the call, e.g. `create`. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension (the api namespace). */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension (the api namespace). */
   file: string;
   /** 1-based line of the `get(...)` call. */
   line: number;
@@ -823,7 +823,7 @@ interface WorkflowCallIR {
 interface QueryReadIR {
   /** Exported procedure the read sits in, or `""` at module scope. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /**
    * True when the chain's `.filter()` predicate compares `_id`
@@ -842,7 +842,7 @@ interface QueryReadIR {
   table: string;
 }
 /**
- * A `ctx.authApi.&lt;method>(...)` call discovered in a function body, attributed
+ * A `ctx.authApi.<method>(...)` call discovered in a function body, attributed
  * to the exported function (and its file = api namespace) that performs it.
  * Structurally identical to `AdvisorAuthApiCall` so it passes straight through
  * to the advisor lint without conversion, exactly as `InsertWriteIR` does for
@@ -851,7 +851,7 @@ interface QueryReadIR {
 interface AuthApiCallIR {
   /** Export binding name of the function performing the call, e.g. "createOrg". */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** True when the call's argument object includes a `headers` property. */
   hasHeaders: boolean;
@@ -870,7 +870,7 @@ interface AuthApiCallIR {
 interface InsertWriteIR {
   /** Export binding name of the function performing the insert, e.g. "send". */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension (the api namespace). */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension (the api namespace). */
   file: string;
   /** 1-based line of the `insert(...)` call. */
   line: number;
@@ -891,7 +891,7 @@ interface NondeterministicCallIR {
   callee: string;
   /** Export binding name of the function performing the call, e.g. `sendMessage`. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension (the api namespace). */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension (the api namespace). */
   file: string;
   /** Which procedure kind the call lives in — only `query`/`mutation` handlers are recorded. */
   kind: "mutation" | "query";
@@ -928,7 +928,7 @@ interface R2sqlCallIR {
 interface RlsProcedureIR {
   /** Export binding name of the procedure (e.g. `listDocuments`). */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /**
    * Table names extracted from the `rls(policies)` array literal. Empty when the
@@ -954,7 +954,7 @@ interface RlsProcedureIR {
 interface MaskProcedureIR {
   /** Export binding name of the procedure (e.g. `listUsers`). */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /**
    * `(table, column)` pairs this procedure's `mask(policies)` object literal
@@ -1015,9 +1015,9 @@ interface MaskMetadataIR {
 interface MaskStrategyIR {
   /** Masked column name. */
   column: string;
-  /** Export binding name of the procedure whose `.use(mask(...))` chain declared this column, or `"&lt;module>"` when declared at file scope. */
+  /** Export binding name of the procedure whose `.use(mask(...))` chain declared this column, or `"<module>"` when declared at file scope. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** 1-based line of the masked column's strategy property. */
   line: number;
@@ -1092,7 +1092,7 @@ interface StorageRulesMetadataIR {
   rules: StorageRuleIR[];
 }
 /**
- * A typed REST route declared with the `httpRoute.&lt;verb>("/path")…` builder in
+ * A typed REST route declared with the `httpRoute.<verb>("/path")…` builder in
  * `@lunora/server` and mounted on `httpRouter()`. Captured statically from the
  * builder chain so the OpenAPI emitter can render a real `paths` entry: the verb
  * + path become the operation's method + URL, and the accumulated validator maps
@@ -1106,13 +1106,13 @@ interface HttpRouteIR {
    * handler yields — inferred from the handler via the type checker. Present
    * only when {@link HttpRouteIR.stream} is `true`; `"unknown"` when the
    * checker can't resolve enough context. Feeds the emitted
-   * `HttpStreamRef&lt;Chunk, …>` so the chunk type flows to the client.
+   * `HttpStreamRef<Chunk, …>` so the chunk type flows to the client.
    * @experimental Part of the HTTP-SSE stream surface (the `httpStreams.*` emission).
    */
   chunkType?: string;
   /** Export binding name of the route handler (used only for diagnostics / dedupe). */
   exportName: string;
-  /** Path relative to `&lt;projectRoot>/lunora/` without extension, e.g. "http". */
+  /** Path relative to `<projectRoot>/lunora/` without extension, e.g. "http". */
   filePath: string;
   /** HTTP verb the route binds to (uppercased), e.g. `"GET"`. */
   method: string;
@@ -1120,7 +1120,7 @@ interface HttpRouteIR {
   output?: ValidatorIR;
   /** `v.*` validators decoding the hono path params (`.params({...})`), keyed by `:name`. */
   params: Record<string, ValidatorIR>;
-  /** The route path passed to `httpRoute.&lt;verb>(path)`, e.g. `/api/todos/:id`. */
+  /** The route path passed to `httpRoute.<verb>(path)`, e.g. `/api/todos/:id`. */
   path: string;
   /** `v.*` validators decoding the URL query string (`.searchParams({...})`), keyed by name. */
   searchParams: Record<string, ValidatorIR>;
@@ -1161,7 +1161,7 @@ interface ProcedureMiddlewareIR {
   exportName: string;
   /** `true` when the handler fans work out to a privileged, cost-bearing dispatch surface (scheduler `runAfter`/`runAt`, a queue producer send, or a workflow create). Feeds the privileged-fanout lint. `undefined` when `analyzableBody` is `false`. */
   fanOut?: boolean;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** `true` when the handler wraps work in `try`/`catch`. */
   handlesErrors?: boolean;
@@ -1215,7 +1215,7 @@ interface ArgumentValidatorIR {
   anyArgs: string[];
   /** Export binding name of the procedure (e.g. `updateProfile`). */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** 1-based line of the registration call, or `0` when unknown. */
   line: number;
@@ -1234,7 +1234,7 @@ interface ConfigCallIR {
   analyzable: boolean;
   /** The factory function or constructor name at the call site, e.g. `createPayment` / `RateLimiter`. */
   callee: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** 1-based line of the call site, or `0` when unknown. */
   line: number;
@@ -1250,7 +1250,7 @@ interface ConfigCallIR {
  * Structurally identical to `AdvisorSecretLiteral`.
  */
 interface SecretLiteralIR {
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** Heuristic that matched, e.g. `stripe_live_key` / `aws_access_key` / `pem_private_key` / `high_entropy`. */
   kind: string;
@@ -1271,7 +1271,7 @@ interface SecretLiteralIR {
 interface SqlInterpolationIR {
   /** Export binding name of the procedure performing the `ctx.sql` call. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** 1-based line of the interpolation, or `0` when unknown. */
   line: number;
@@ -1288,13 +1288,13 @@ interface SqlInterpolationIR {
 interface ArgumentDerivedFetchIR {
   /** Export binding name of the action performing the `ctx.fetch` call. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** 1-based line of the `ctx.fetch` call, or `0` when unknown. */
   line: number;
 }
 /**
- * One `ctx.kv.&lt;method>(key, …)` call whose namespace key is derived from the
+ * One `ctx.kv.<method>(key, …)` call whose namespace key is derived from the
  * handler's `args` with no server-side scoping — the `kv_unscoped_user_key_idor`
  * lint input. Workers KV is a single flat namespace, so a key taken straight from
  * request input lets any caller read, overwrite, or delete another user's entry
@@ -1306,7 +1306,7 @@ interface ArgumentDerivedFetchIR {
 interface KvKeyAccessIR {
   /** Export binding name of the procedure performing the `ctx.kv` access. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** 1-based line of the `ctx.kv` call, or `0` when unknown. */
   line: number;
@@ -1333,7 +1333,7 @@ interface KvKeyAccessIR {
 interface UnrestrictedWhereBranchIR {
   /** Export binding name of the shape / policy the predicate belongs to. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** Which unrestricted form was returned. */
   form: "empty-object" | "undefined";
@@ -1349,7 +1349,7 @@ interface OwnerFieldWriteIR {
   exportName: string;
   /** The identity column being written from `args` (e.g. `userId`). */
   field: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** 1-based line of the `ctx.db` write call, or `0` when unknown. */
   line: number;
@@ -1365,7 +1365,7 @@ interface OwnerFieldWriteIR {
   visibility?: "internal" | "public";
 }
 /**
- * One `ctx.storage.&lt;bucket>.&lt;method>(key, …)` call whose R2 object key is derived
+ * One `ctx.storage.<bucket>.<method>(key, …)` call whose R2 object key is derived
  * from the handler's `args` with no server-side scoping — the
  * `storage_key_from_user_args` lint input. The bucket read/write/URL/delete methods
  * key by their first argument, so an object key taken straight from request input is
@@ -1377,7 +1377,7 @@ interface OwnerFieldWriteIR {
 interface StorageKeyAccessIR {
   /** Export binding name of the procedure performing the storage call. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** 1-based line of the storage call, or `0` when unknown. */
   line: number;
@@ -1393,7 +1393,7 @@ interface StorageKeyAccessIR {
   visibility?: "internal" | "public";
 }
 /**
- * One `ctx.containers.&lt;exportName>.get(name, …)` call whose instance key is derived
+ * One `ctx.containers.<exportName>.get(name, …)` call whose instance key is derived
  * from the handler's `args` with no server-side scoping — the
  * `container_instance_key_from_user_input` lint input. Each container definition's
  * `.get(name)` accessor routes to one instance per `name`, so a key taken straight from
@@ -1406,7 +1406,7 @@ interface StorageKeyAccessIR {
 interface ContainerKeyAccessIR {
   /** Export binding name of the procedure performing the `ctx.containers` access. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** 1-based line of the `ctx.containers.*.get` call, or `0` when unknown. */
   line: number;
@@ -1426,13 +1426,13 @@ interface ContainerKeyAccessIR {
 interface AiRawRunIR {
   /** Export binding name of the procedure performing the `ctx.ai.run` call. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** 1-based line of the `ctx.ai.run` call, or `0` when unknown. */
   line: number;
 }
 /**
- * One `ctx.vectors.&lt;method>(indexName, input)` call whose `input.namespace` is derived
+ * One `ctx.vectors.<method>(indexName, input)` call whose `input.namespace` is derived
  * from the handler's `args` with no server-side scoping — the
  * `vectors_namespace_from_user_input` lint input. A Vectorize namespace partitions one
  * index into isolated sub-collections, so a namespace taken straight from request input
@@ -1444,7 +1444,7 @@ interface AiRawRunIR {
 interface VectorNamespaceAccessIR {
   /** Export binding name of the procedure performing the `ctx.vectors` access. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** 1-based line of the `ctx.vectors` call, or `0` when unknown. */
   line: number;
@@ -1464,7 +1464,7 @@ interface VectorNamespaceAccessIR {
 interface MailRecipientAccessIR {
   /** Export binding name of the procedure performing the `ctx.mail`/`ctx.email` call. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** 1-based line of the `ctx.mail`/`ctx.email` call, or `0` when unknown. */
   line: number;
@@ -1472,7 +1472,7 @@ interface MailRecipientAccessIR {
   method: string;
 }
 /**
- * One `ctx.browser.&lt;method>(url, …)` call whose navigation URL (`arguments[0]`)
+ * One `ctx.browser.<method>(url, …)` call whose navigation URL (`arguments[0]`)
  * is derived from the handler's `args` with no server-side scoping — the
  * `browser_user_url_without_allowlist` lint input. The lint additionally
  * cross-references `createBrowser` config-call evidence to suppress findings
@@ -1482,7 +1482,7 @@ interface MailRecipientAccessIR {
 interface BrowserUrlAccessIR {
   /** Export binding name of the procedure performing the `ctx.browser` call. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** 1-based line of the `ctx.browser` call, or `0` when unknown. */
   line: number;
@@ -1490,8 +1490,8 @@ interface BrowserUrlAccessIR {
   method: string;
 }
 /**
- * One runtime container-override call: a `&lt;handle>.start({ enableInternet: true, … })`
- * launch override, or a `&lt;handle>.egress.&lt;method>(...)` runtime firewall mutation
+ * One runtime container-override call: a `<handle>.start({ enableInternet: true, … })`
+ * launch override, or a `<handle>.egress.<method>(...)` runtime firewall mutation
  * (`allow` / `deny` / `setAllowed`) — the `container_start_enable_internet_override`
  * and `container_runtime_egress_relaxation` lint input. Both shapes re-open network
  * access the static `defineContainer` declaration (and its `container_public_internet`
@@ -1503,7 +1503,7 @@ interface ContainerOverrideIR {
   detail: string;
   /** Export binding name of the procedure performing the call. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** Which override shape matched. */
   kind: "egress_relaxation" | "enable_internet";
@@ -1526,7 +1526,7 @@ interface ContainerOverrideIR {
 interface ImageDeliveryUrlAccessIR {
   /** Export binding name of the procedure performing the `buildImageDeliveryUrl` call. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** 1-based line of the `buildImageDeliveryUrl` call, or `0` when unknown. */
   line: number;
@@ -1552,7 +1552,7 @@ interface AuthConfigIR {
   emailPasswordEnabled: boolean;
   /** Export binding name enclosing the `createAuth(...)` call. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** 1-based line of the `createAuth(...)` call, or `0` when unknown. */
   line: number;
@@ -1584,7 +1584,7 @@ interface RatelimitKeySelectorIR {
   callee: string;
   /** Export binding name of the procedure whose `.use(...)` chain carries the call. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** The rate limit's `name` argument (the second positional argument), or `""` when not a string literal. */
   limitName: string;
@@ -1605,7 +1605,7 @@ interface RatelimitKeySelectorIR {
 interface PrivilegedDispatchIR {
   /** `"queue"` for a `defineQueue` handler, `"workflow"` for a `defineWorkflow` handler. */
   dispatchKind: "queue" | "workflow";
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** Export binding name of the handler performing the dispatch. */
   handlerExport: string;
@@ -1617,7 +1617,7 @@ interface PrivilegedDispatchIR {
   targetFile: string;
 }
 /**
- * One discovered `httpRoute.&lt;verb>("/admin/…")` route on an admin/privileged-looking
+ * One discovered `httpRoute.<verb>("/admin/…")` route on an admin/privileged-looking
  * path, with whether its builder chain references an auth/admin guard — the
  * `admin_route_without_guard` lint input. Structurally identical to
  * `AdvisorAdminRoute`.
@@ -1625,7 +1625,7 @@ interface PrivilegedDispatchIR {
 interface AdminRouteIR {
   /** Export binding name of the route handler. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** HTTP verb the route binds to (uppercased), e.g. `"POST"`. */
   method: string;
@@ -1635,7 +1635,7 @@ interface AdminRouteIR {
   usesGuard: boolean;
 }
 /**
- * One tracked `ctx.storage.&lt;bucket>.&lt;method>(...)` upload/signing call — the
+ * One tracked `ctx.storage.<bucket>.<method>(...)` upload/signing call — the
  * shared input for the storage config-hygiene security lints
  * (`storage_upload_without_content_type_allowlist`, `storage_upload_without_max_size`,
  * `storage_generate_upload_url_no_content_type_pin`, `storage_presigned_url_for_private_content`).
@@ -1653,7 +1653,7 @@ interface StorageUploadIR {
   expiresInSeconds?: number;
   /** Export binding name of the procedure performing the call. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** 1-based line of the call, or `0` when unknown. */
   line: number;
@@ -1674,9 +1674,9 @@ interface StorageUploadIR {
  * `AdvisorHttpActionGuard`.
  */
 interface HttpActionGuardIR {
-  /** Export binding name of the handler (or `"&lt;module>"` when mounted inline / not a named binding). */
+  /** Export binding name of the handler (or `"<module>"` when mounted inline / not a named binding). */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** Which HTTP surface the handler is: a raw `httpAction` or a typed `httpRoute` route. */
   kind: "httpAction" | "httpRoute";
@@ -1686,7 +1686,7 @@ interface HttpActionGuardIR {
   method?: string;
   /** `true` when the handler reads `ctx.auth` (a direct member access or a `const { auth } = ctx` destructure). */
   readsAuth: boolean;
-  /** The first side effect found, as a stable label: `runMutation`, `runAction`, or `db.&lt;method>`. */
+  /** The first side effect found, as a stable label: `runMutation`, `runAction`, or `db.<method>`. */
   sideEffect: string;
 }
 /**
@@ -1704,9 +1704,9 @@ interface HttpActionGuardIR {
  * identical to `AdvisorHttpHeaderWrite`.
  */
 interface HttpHeaderWriteIR {
-  /** Export binding name of the enclosing handler, or `"&lt;module>"` when mounted inline. */
+  /** Export binding name of the enclosing handler, or `"<module>"` when mounted inline. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** The header name being written (`"location"`), or `""` when the key is not a string literal. */
   headerName: string;
@@ -1729,11 +1729,11 @@ interface HttpHeaderWriteIR {
 interface FailOpenGuardIR {
   /** The middleware factory at the call site: `rateLimit` / `dbRateLimit` / `verifyTurnstileMiddleware`. */
   callee: string;
-  /** Export binding name of the procedure the guard is attached to, or `"&lt;module>"` at file scope. */
+  /** Export binding name of the procedure the guard is attached to, or `"<module>"` at file scope. */
   exportName: string;
   /** `true` only when the options literal set `failOpen: true` as a boolean literal; a non-literal or absent option is treated as fail-closed. */
   failOpen: boolean;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** The rate-limit `name` (second string argument) for `rateLimit`/`dbRateLimit`; `""` for `verifyTurnstileMiddleware`. */
   limitName: string;
@@ -1741,7 +1741,7 @@ interface FailOpenGuardIR {
   line: number;
 }
 /**
- * One `ctx.flags.boolean("key", &lt;boolean-literal>)` read in `lunora/` — the
+ * One `ctx.flags.boolean("key", <boolean-literal>)` read in `lunora/` — the
  * `flag_gates_security_with_unsafe_default` lint input. OpenFeature returns the
  * `defaultValue` when the provider errors, so a fail-open default on a
  * security-shaped key silently opens access during an outage. Only reads with a
@@ -1752,9 +1752,9 @@ interface FailOpenGuardIR {
 interface FlagSecurityDefaultIR {
   /** The boolean-literal default returned on a provider outage (fail-open value). */
   defaultValue: boolean;
-  /** Export binding name of the procedure performing the flag read, or `"&lt;module>"` at file scope. */
+  /** Export binding name of the procedure performing the flag read, or `"<module>"` at file scope. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** The flag key — the first string-literal argument of `ctx.flags.boolean`. */
   key: string;
@@ -1772,7 +1772,7 @@ interface FlagSecurityDefaultIR {
 interface AiToolSideEffectIR {
   /** Export binding name of the procedure performing the call. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** 1-based line of the generation call, or `0` when unknown. */
   line: number;
@@ -1784,9 +1784,9 @@ interface AiToolSideEffectIR {
   userInputDerived: boolean;
 }
 /**
- * One `&lt;receiver>.identity.&lt;key>` claim read in `lunora/`, where `&lt;receiver>` is
+ * One `<receiver>.identity.<key>` claim read in `lunora/`, where `<receiver>` is
  * an RLS/mask policy `auth` (or `ctx.auth`/`context.auth`). `declared` records
- * whether `&lt;key>` is in the app's `defineIdentity({ ... })` contract (or the
+ * whether `<key>` is in the app's `defineIdentity({ ... })` contract (or the
  * always-present `userId`); the `identity_undeclared_claim_trusted` lint fires on
  * the undeclared reads. Emitted only when a resolvable identity contract exists.
  * Structurally identical to `AdvisorIdentityClaimRead`.
@@ -1794,9 +1794,9 @@ interface AiToolSideEffectIR {
 interface IdentityClaimReadIR {
   /** `true` when `key` is a declared claim (in the `defineIdentity` contract, or the always-present `userId`). */
   declared: boolean;
-  /** Export binding name of the enclosing declaration (`&lt;module>` at file scope). */
+  /** Export binding name of the enclosing declaration (`<module>` at file scope). */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** The claim key read off the identity bag. */
   key: string;
@@ -1814,9 +1814,9 @@ interface IdentityClaimReadIR {
 interface PaymentWebhookIR {
   /** The adapter factory invoked. */
   callee: "createAutumnAdapter" | "createDodoPaymentsAdapter" | "createPolarAdapter" | "createStripeAdapter";
-  /** Export binding name of the enclosing declaration (`&lt;module>` at file scope). */
+  /** Export binding name of the enclosing declaration (`<module>` at file scope). */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** 1-based line of the construction, or `0` when unknown. */
   line: number;
@@ -1824,7 +1824,7 @@ interface PaymentWebhookIR {
   toleranceSeconds?: number;
 }
 /**
- * One `ctx.db.&lt;table>.findMany({ includeDeleted })` list read whose
+ * One `ctx.db.<table>.findMany({ includeDeleted })` list read whose
  * `includeDeleted` is either a hardcoded `true` or derived from the handler's
  * `args` — the `soft_delete_include_deleted_from_args` lint input. The lint joins
  * `table` against the schema's soft-delete tables and `visibility` against
@@ -1834,7 +1834,7 @@ interface PaymentWebhookIR {
 interface SoftDeleteReadIR {
   /** Export binding name of the procedure performing the read. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** `true` when `includeDeleted` was derived from the handler's `args` (any caller can flip it). */
   fromArgs: boolean;
@@ -1848,7 +1848,7 @@ interface SoftDeleteReadIR {
   visibility: "internal" | "public";
 }
 /**
- * One `ctx.db.&lt;table>.findMany({ with: { &lt;rel> } })` relation-hydrating list read
+ * One `ctx.db.<table>.findMany({ with: { <rel> } })` relation-hydrating list read
  * — the `masked_relation_leak_via_with` lint input. Column masking does not
  * descend into `with`-hydrated relations, so a masked table surfaced only through
  * a `with` on an unprotected parent read is returned in the clear. The lint
@@ -1859,7 +1859,7 @@ interface SoftDeleteReadIR {
 interface RelationLoadIR {
   /** Export binding name of the procedure performing the read. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** 1-based line of the read call. */
   line: number;
@@ -1872,8 +1872,8 @@ interface RelationLoadIR {
 }
 /**
  * One `query` handler whose `return` hands back the raw rows of a table — the
- * result of a `ctx.db.&lt;table>.findMany()` / `.findFirst()` / `.get()` read, or a
- * `ctx.db.query("&lt;table>")…collect()` fluent chain — returned directly (or through
+ * result of a `ctx.db.<table>.findMany()` / `.findFirst()` / `.get()` read, or a
+ * `ctx.db.query("<table>")…collect()` fluent chain — returned directly (or through
  * one local `const` hop) with no hand-built projection. The
  * `output_projection_missing_on_public_read` lint keeps only `visibility ===
  * "public"` rows with no `.output(...)` / `.use(mask(...))` on the chain, then
@@ -1884,7 +1884,7 @@ interface RelationLoadIR {
 interface RawRowReturnIR {
   /** Export binding name of the query returning the raw rows. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** 1-based line of the `return` (or concise-body) expression. */
   line: number;
@@ -1911,7 +1911,7 @@ interface RawRowReturnIR {
 interface NormalizeIdAuthorizationIR {
   /** Export binding name of the procedure performing the normalize-then-access. */
   exportName: string;
-  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
   /** 1-based line of the `ctx.db.normalizeId(...)` call the access is gated on. */
   line: number;
@@ -1948,7 +1948,7 @@ interface WranglerVariableIR {
 interface ProjectIR {
   crons: ReadonlyArray<CronJobIR>;
   functions: ReadonlyArray<FunctionIR>;
-  /** Typed REST routes discovered from `httpRoute.&lt;verb>(...)` builder chains. */
+  /** Typed REST routes discovered from `httpRoute.<verb>(...)` builder chains. */
   httpRoutes: ReadonlyArray<HttpRouteIR>;
   migrations: ReadonlyArray<MigrationIR>;
   schema: SchemaIR;
@@ -2223,7 +2223,7 @@ type CapabilityKey = (typeof CAPABILITY_ROWS)[number]["key"];
 /** The default codegen target — today's behavior, byte-identical goldens. */
 declare const DEFAULT_TARGET = "cloudflare";
 /**
- * Read `target` from `&lt;projectRoot>/lunora.json`.
+ * Read `target` from `<projectRoot>/lunora.json`.
  *
  * This lives in `@lunora/codegen` rather than `@lunora/config` — where the rest
  * of the `lunora.json` reading lives — because `@lunora/config` depends on
@@ -2317,8 +2317,8 @@ declare const createCodegenProject: (lunoraDirectory: string) => Project;
  */
 declare const refreshCodegenProject: (project: Project, lunoraDirectory: string) => void;
 /**
- * Top-level codegen entry. Parses `&lt;projectRoot>/lunora/schema.ts` and every
- * function file under `&lt;projectRoot>/lunora/`, then writes
+ * Top-level codegen entry. Parses `<projectRoot>/lunora/schema.ts` and every
+ * function file under `<projectRoot>/lunora/`, then writes
  * `_generated/{api,server,dataModel}.ts` next to them.
  *
  * When `LUNORA_CODEGEN_TIMING` is set (truthy), a single diagnostic summary
@@ -2545,7 +2545,7 @@ declare class CodegenDiagnosticError extends LunoraError {
  * location and whose `file`/`line`/`column` properties are set from the
  * ts-morph `Node`'s position in its source file.
  *
- * Message format: `@lunora/codegen: &lt;detail> (&lt;file>:&lt;line>:&lt;column>)`
+ * Message format: `@lunora/codegen: <detail> (<file>:<line>:<column>)`
  *
  * `meta` is merged onto the returned error for callers that also carry the
  * project-wide `LunoraError` envelope (`code`/`name`/`status`) — it never
@@ -2568,7 +2568,7 @@ declare const AGENTS_FILENAME = "agents.ts";
  */
 declare const discoverAgents: (project: Project, lunoraDirectory: string) => AgentIR[];
 /**
- * Discover `ctx.authApi.&lt;method>(...)` (and bare `authApi.&lt;method>(...)`) calls
+ * Discover `ctx.authApi.<method>(...)` (and bare `authApi.<method>(...)`) calls
  * under the lunora source directory and attribute each to the exported function
  * (and file) performing it. Calls outside an exported declaration are dropped.
  */
@@ -2613,7 +2613,7 @@ declare const discoverFlags: (project: Project, lunoraDirectory: string) => Flag
 declare const discoverFunctions: (project: Project, lunoraDirectory: string) => FunctionIR[];
 /**
  * Scan all `.ts` files under `lunoraDir` (skipping `_generated/` and `schema.ts`)
- * for `export const x = httpRoute.&lt;verb>(...)…handler(...)` typed REST routes.
+ * for `export const x = httpRoute.<verb>(...)…handler(...)` typed REST routes.
  * These are the headline OpenAPI target: each becomes a real `paths` entry.
  */
 declare const discoverHttpRoutes: (project: Project, lunoraDirectory: string) => HttpRouteIR[];
@@ -2645,7 +2645,7 @@ declare const MUTATORS_FILENAME = "mutators.ts";
  * Discover every custom mutator the project declares: exported
  * `defineMutator()` calls in `lunora/mutators.ts`. Returns `[]` when the file
  * doesn't exist. The export binding plus the declared `args` / `server` return
- * type are lifted — enough to emit a typed `api.mutators.&lt;name>` reference —
+ * type are lifted — enough to emit a typed `api.mutators.<name>` reference —
  * while the runtime object still carries the authoritative `server` impl +
  * `handler`, so codegen never evaluates the body. The client `client` impl is
  * split into the browser bundle separately.
@@ -2761,7 +2761,7 @@ interface SandboxUsage {
 }
 declare const discoverSandboxUsage: (project: Project, lunoraDirectory: string) => SandboxUsage;
 /**
- * Load `&lt;projectRoot>/lunora/schema.ts`, find `defineSchema({...})`, and
+ * Load `<projectRoot>/lunora/schema.ts`, find `defineSchema({...})`, and
  * return a structural IR. Throws if the file or call cannot be found.
  */
 declare const discoverSchema: (project: Project, schemaPath: string, projectRoot?: string) => SchemaIR;
@@ -2792,7 +2792,7 @@ declare const WORKFLOWS_FILENAME = "workflows.ts";
  */
 declare const discoverWorkflows: (project: Project, lunoraDirectory: string) => WorkflowIR[];
 declare const GENERATED_HEADER = "// GENERATED by @lunora/codegen — do not edit.\n// Run `lunora codegen` to regenerate.\n\n";
-/** Emit `_generated/dataModel.ts` — `Doc&lt;"name">` + `Id&lt;"name">` for every table. */
+/** Emit `_generated/dataModel.ts` — `Doc<"name">` + `Id<"name">` for every table. */
 declare const emitDataModel: (schema: SchemaIR) => string;
 /**
  * Emit `_generated/api.ts` — the typed `api.*` registry (public functions), the
@@ -2819,19 +2819,19 @@ declare const emitApi: (options: EmitApiOptions) => string;
  *
  * Each shape emits **two** entry points.
  *
- * `&lt;shape>CollectionOptions(options)` is the composable form: it returns the full
+ * `<shape>CollectionOptions(options)` is the composable form: it returns the full
  * `LunoraCollectionOptions` — `config` for `createCollection`, plus `checkpoints`
  * (which `bindMutators` gates optimistic overlays on) and `scope`. This is what an app
  * with custom mutators needs, and what the old single-factory form made impossible: it
  * built the collection internally and dropped `checkpoints` on the floor, so there was
  * no way to wire mutators to the collection codegen produced.
  *
- * `&lt;shape>Collection(options)` is the convenience form for a read-only collection: it
+ * `<shape>Collection(options)` is the convenience form for a read-only collection: it
  * returns `{ checkpoints, collection, scope }` rather than a bare `Collection`, so the
  * sync controls stay reachable even from the short path.
  *
  * Both are typed: `args` comes from the shape's own validators (a parameterless
- * shape takes none), rows resolve to `Doc&lt;"table">` when the shape names its table
+ * shape takes none), rows resolve to `Doc<"table">` when the shape names its table
  * with a literal, and `shardKey` / `getKey` / `load` / `onError` / `checkpoints` are
  * all threadable — a sharded table needs `shardKey` for its watermark to land in the
  * right bucket, and a server-minted `_id` that differs from the app's natural key
@@ -2951,7 +2951,7 @@ interface EmitShardOptions {
   containers?: ReadonlyArray<ContainerIR>;
   /** The single `defineEnv(...)` contract declared in `lunora/env.ts` — applies the accessor to the worker `env` to populate `ctx.env`. */
   env?: EnvIR;
-  /** Statically-discovered `ctx.flags.&lt;type>("key")` reads — the studio Flags page + reactive evaluation iterate these. */
+  /** Statically-discovered `ctx.flags.<type>("key")` reads — the studio Flags page + reactive evaluation iterate these. */
   flagKeys?: ReadonlyArray<{
     key: string;
     type: "boolean" | "number" | "object" | "string";
@@ -3123,7 +3123,7 @@ interface EmitAppOptions {
    * Voice-enabled agents (`defineAgent({ voice: … })`) → wire
    * `options.voiceAgents`, mapping each agent's export name to its `VOICE_*`
    * Durable Object namespace binding so the runtime exposes
-   * `/_lunora/voice/&lt;exportName>`. Empty/absent ⇒ no wiring, byte-identical
+   * `/_lunora/voice/<exportName>`. Empty/absent ⇒ no wiring, byte-identical
    * output for voice-free (and agent-free) projects.
    */
   voiceAgents?: ReadonlyArray<{