@lunora/server 1.0.0-alpha.29 → 1.0.0-alpha.30

package/dist/data-model.d.mts

@@ -279,8 +279,38 @@ interface SearchReader<TDocument> {
   take: (limit: number) => Promise<TDocument[]>;
   unique: () => Promise<TDocument | null>;
 }
+/** A latitude/longitude point (WGS84 decimal degrees) accepted by geo queries. */
+interface GeoPointInput {
+  lat: number;
+  lng: number;
+}
+/** An axis-aligned latitude/longitude bounding box (`sw`/`ne` corners). */
+interface GeoBoundingBox {
+  ne: GeoPointInput;
+  sw: GeoPointInput;
+}
+/**
+ * Builder passed to `.withGeoIndex(name, q => …)`. Call exactly one of
+ * `.near(point, radiusMeters)` (proximity, nearest-first) or `.within(box)`
+ * (bounding-box).
+ */
+interface GeoFilterBuilder {
+  near: (point: GeoPointInput, radiusMeters: number) => GeoFilterBuilder;
+  within: (box: GeoBoundingBox) => GeoFilterBuilder;
+}
+/**
+ * Chainable reader returned by `.withGeoIndex()`. `.near()` results come back
+ * ordered nearest-first; `.within()` results by row creation time. `.paginate()`
+ * is intentionally absent — cap the result set with `.take(n)`.
+ */
+interface GeoReader<TDocument> {
+  collect: () => Promise<TDocument[]>;
+  first: () => Promise<TDocument | null>;
+  take: (limit: number) => Promise<TDocument[]>;
+  unique: () => Promise<TDocument | null>;
+}
 /** Read-only typed table accessor exposed on `QueryCtx.db.&lt;table>`. */
-interface TableReaderFacade<DM, REL extends Record<keyof DM, object>, RANK extends Record<keyof DM, string>, SEARCH extends Record<keyof DM, string>, T extends keyof DM> {
+interface TableReaderFacade<DM, REL extends Record<keyof DM, object>, RANK extends Record<keyof DM, string>, SEARCH extends Record<keyof DM, string>, T extends keyof DM, GEO extends Record<keyof DM, string> = Record<keyof DM, never>> {
   /**
    * Reduce rows in this table to a scalar (`avg`/`max`/`min`/`sum` — `count`
    * lives on its own method). Routes through a declared `aggregateIndex` when
@@ -329,6 +359,13 @@ interface TableReaderFacade<DM, REL extends Record<keyof DM, object>, RANK exten
    * follow the Convex-style keyset shape.
    */
   rankPage: (indexName: RANK[T], options?: TableRankPageOptions<DM[T]>) => Promise<RankPage<DM[T]>>;
+  /**
+   * Restrict the query to a declared `.geoIndex()` and run a proximity /
+   * bounding-box match. `indexName` is constrained to this table's geo indexes
+   * (`never` when it declares none). Returns a distance-ordered reader —
+   * finish with `.take(n)` / `.collect()`.
+   */
+  withGeoIndex: (indexName: GEO[T], build: (q: GeoFilterBuilder) => GeoFilterBuilder) => GeoReader<DM[T]>;
   /**
    * Restrict the query to a declared `.searchIndex()` and run a full-text
    * match. `indexName` is constrained to this table's search indexes
@@ -338,7 +375,7 @@ interface TableReaderFacade<DM, REL extends Record<keyof DM, object>, RANK exten
   withSearchIndex: (indexName: SEARCH[T], search: (q: SearchFilterBuilder<DM[T]>) => SearchFilterBuilder<DM[T]>) => SearchReader<DM[T]>;
 }
 /** Read-write typed table accessor exposed on `MutationCtx.db.&lt;table>` / `ActionCtx.db.&lt;table>`. */
-interface TableWriterFacade<DM, IM extends Record<keyof DM, object>, REL extends Record<keyof DM, object>, RANK extends Record<keyof DM, string>, SEARCH extends Record<keyof DM, string>, T extends keyof DM> extends TableReaderFacade<DM, REL, RANK, SEARCH, T> {
+interface TableWriterFacade<DM, IM extends Record<keyof DM, object>, REL extends Record<keyof DM, object>, RANK extends Record<keyof DM, string>, SEARCH extends Record<keyof DM, string>, T extends keyof DM, GEO extends Record<keyof DM, string> = Record<keyof DM, never>> extends TableReaderFacade<DM, REL, RANK, SEARCH, T, GEO> {
   /**
    * Delete a row by id. On a `.softDelete()` table this flips the marker column
    * (and cascades as a soft delete) instead of removing the row; use
@@ -448,7 +485,7 @@ interface TableWriterFacade<DM, IM extends Record<keyof DM, object>, REL extends
 /** Conflict target for `upsert`/`upsertMany`: one column of table `T`, or a tuple of them. */
 type UpsertTargetOf<DM, T extends keyof DM> = ReadonlyArray<keyof DM[T] & string> | (keyof DM[T] & string);
 /** Per-table read facade — `ctx.db.&lt;table>` on a `QueryCtx`. */
-type DatabaseReaderFacade<DM, REL extends Record<keyof DM, object>, RANK extends Record<keyof DM, string>, SEARCH extends Record<keyof DM, string>> = { readonly [T in keyof DM]: TableReaderFacade<DM, REL, RANK, SEARCH, T>; };
+type DatabaseReaderFacade<DM, REL extends Record<keyof DM, object>, RANK extends Record<keyof DM, string>, SEARCH extends Record<keyof DM, string>, GEO extends Record<keyof DM, string> = Record<keyof DM, never>> = { readonly [T in keyof DM]: TableReaderFacade<DM, REL, RANK, SEARCH, T, GEO>; };
 /** Per-table read-write facade — `ctx.db.&lt;table>` on a `MutationCtx` / `ActionCtx`. */
-type DatabaseWriterFacade<DM, IM extends Record<keyof DM, object>, REL extends Record<keyof DM, object>, RANK extends Record<keyof DM, string>, SEARCH extends Record<keyof DM, string>> = { readonly [T in keyof DM]: TableWriterFacade<DM, IM, REL, RANK, SEARCH, T>; };
-export { AggregateOp, DatabaseReaderFacade, DatabaseWriterFacade, GroupByEntry, Id, LoadWith, ManyRelationWhere, OneRelationWhere, OrderBy, QueryArgs, QueryArgsOf, QueryPage, RankPage, RankResult, RestrictableQueryOptions, RestrictableQueryOptionsOf, SearchFilterBuilder, SearchReader, TableAggregateOptions, TableAggregateOptionsOf, TableGroupByOptions, TableGroupByOptionsOf, TableRankOptions, TableRankPageOptions, TableReaderFacade, TableWriterFacade, UpsertTargetOf, Where, WhereOf, WhereOperators, WithArg };
+type DatabaseWriterFacade<DM, IM extends Record<keyof DM, object>, REL extends Record<keyof DM, object>, RANK extends Record<keyof DM, string>, SEARCH extends Record<keyof DM, string>, GEO extends Record<keyof DM, string> = Record<keyof DM, never>> = { readonly [T in keyof DM]: TableWriterFacade<DM, IM, REL, RANK, SEARCH, T, GEO>; };
+export { AggregateOp, DatabaseReaderFacade, DatabaseWriterFacade, GeoBoundingBox, GeoFilterBuilder, GeoPointInput, GeoReader, GroupByEntry, Id, LoadWith, ManyRelationWhere, OneRelationWhere, OrderBy, QueryArgs, QueryArgsOf, QueryPage, RankPage, RankResult, RestrictableQueryOptions, RestrictableQueryOptionsOf, SearchFilterBuilder, SearchReader, TableAggregateOptions, TableAggregateOptionsOf, TableGroupByOptions, TableGroupByOptionsOf, TableRankOptions, TableRankPageOptions, TableReaderFacade, TableWriterFacade, UpsertTargetOf, Where, WhereOf, WhereOperators, WithArg };

package/dist/data-model.d.ts

@@ -279,8 +279,38 @@ interface SearchReader<TDocument> {
   take: (limit: number) => Promise<TDocument[]>;
   unique: () => Promise<TDocument | null>;
 }
+/** A latitude/longitude point (WGS84 decimal degrees) accepted by geo queries. */
+interface GeoPointInput {
+  lat: number;
+  lng: number;
+}
+/** An axis-aligned latitude/longitude bounding box (`sw`/`ne` corners). */
+interface GeoBoundingBox {
+  ne: GeoPointInput;
+  sw: GeoPointInput;
+}
+/**
+ * Builder passed to `.withGeoIndex(name, q => …)`. Call exactly one of
+ * `.near(point, radiusMeters)` (proximity, nearest-first) or `.within(box)`
+ * (bounding-box).
+ */
+interface GeoFilterBuilder {
+  near: (point: GeoPointInput, radiusMeters: number) => GeoFilterBuilder;
+  within: (box: GeoBoundingBox) => GeoFilterBuilder;
+}
+/**
+ * Chainable reader returned by `.withGeoIndex()`. `.near()` results come back
+ * ordered nearest-first; `.within()` results by row creation time. `.paginate()`
+ * is intentionally absent — cap the result set with `.take(n)`.
+ */
+interface GeoReader<TDocument> {
+  collect: () => Promise<TDocument[]>;
+  first: () => Promise<TDocument | null>;
+  take: (limit: number) => Promise<TDocument[]>;
+  unique: () => Promise<TDocument | null>;
+}
 /** Read-only typed table accessor exposed on `QueryCtx.db.&lt;table>`. */
-interface TableReaderFacade<DM, REL extends Record<keyof DM, object>, RANK extends Record<keyof DM, string>, SEARCH extends Record<keyof DM, string>, T extends keyof DM> {
+interface TableReaderFacade<DM, REL extends Record<keyof DM, object>, RANK extends Record<keyof DM, string>, SEARCH extends Record<keyof DM, string>, T extends keyof DM, GEO extends Record<keyof DM, string> = Record<keyof DM, never>> {
   /**
    * Reduce rows in this table to a scalar (`avg`/`max`/`min`/`sum` — `count`
    * lives on its own method). Routes through a declared `aggregateIndex` when
@@ -329,6 +359,13 @@ interface TableReaderFacade<DM, REL extends Record<keyof DM, object>, RANK exten
    * follow the Convex-style keyset shape.
    */
   rankPage: (indexName: RANK[T], options?: TableRankPageOptions<DM[T]>) => Promise<RankPage<DM[T]>>;
+  /**
+   * Restrict the query to a declared `.geoIndex()` and run a proximity /
+   * bounding-box match. `indexName` is constrained to this table's geo indexes
+   * (`never` when it declares none). Returns a distance-ordered reader —
+   * finish with `.take(n)` / `.collect()`.
+   */
+  withGeoIndex: (indexName: GEO[T], build: (q: GeoFilterBuilder) => GeoFilterBuilder) => GeoReader<DM[T]>;
   /**
    * Restrict the query to a declared `.searchIndex()` and run a full-text
    * match. `indexName` is constrained to this table's search indexes
@@ -338,7 +375,7 @@ interface TableReaderFacade<DM, REL extends Record<keyof DM, object>, RANK exten
   withSearchIndex: (indexName: SEARCH[T], search: (q: SearchFilterBuilder<DM[T]>) => SearchFilterBuilder<DM[T]>) => SearchReader<DM[T]>;
 }
 /** Read-write typed table accessor exposed on `MutationCtx.db.&lt;table>` / `ActionCtx.db.&lt;table>`. */
-interface TableWriterFacade<DM, IM extends Record<keyof DM, object>, REL extends Record<keyof DM, object>, RANK extends Record<keyof DM, string>, SEARCH extends Record<keyof DM, string>, T extends keyof DM> extends TableReaderFacade<DM, REL, RANK, SEARCH, T> {
+interface TableWriterFacade<DM, IM extends Record<keyof DM, object>, REL extends Record<keyof DM, object>, RANK extends Record<keyof DM, string>, SEARCH extends Record<keyof DM, string>, T extends keyof DM, GEO extends Record<keyof DM, string> = Record<keyof DM, never>> extends TableReaderFacade<DM, REL, RANK, SEARCH, T, GEO> {
   /**
    * Delete a row by id. On a `.softDelete()` table this flips the marker column
    * (and cascades as a soft delete) instead of removing the row; use
@@ -448,7 +485,7 @@ interface TableWriterFacade<DM, IM extends Record<keyof DM, object>, REL extends
 /** Conflict target for `upsert`/`upsertMany`: one column of table `T`, or a tuple of them. */
 type UpsertTargetOf<DM, T extends keyof DM> = ReadonlyArray<keyof DM[T] & string> | (keyof DM[T] & string);
 /** Per-table read facade — `ctx.db.&lt;table>` on a `QueryCtx`. */
-type DatabaseReaderFacade<DM, REL extends Record<keyof DM, object>, RANK extends Record<keyof DM, string>, SEARCH extends Record<keyof DM, string>> = { readonly [T in keyof DM]: TableReaderFacade<DM, REL, RANK, SEARCH, T>; };
+type DatabaseReaderFacade<DM, REL extends Record<keyof DM, object>, RANK extends Record<keyof DM, string>, SEARCH extends Record<keyof DM, string>, GEO extends Record<keyof DM, string> = Record<keyof DM, never>> = { readonly [T in keyof DM]: TableReaderFacade<DM, REL, RANK, SEARCH, T, GEO>; };
 /** Per-table read-write facade — `ctx.db.&lt;table>` on a `MutationCtx` / `ActionCtx`. */
-type DatabaseWriterFacade<DM, IM extends Record<keyof DM, object>, REL extends Record<keyof DM, object>, RANK extends Record<keyof DM, string>, SEARCH extends Record<keyof DM, string>> = { readonly [T in keyof DM]: TableWriterFacade<DM, IM, REL, RANK, SEARCH, T>; };
-export { AggregateOp, DatabaseReaderFacade, DatabaseWriterFacade, GroupByEntry, Id, LoadWith, ManyRelationWhere, OneRelationWhere, OrderBy, QueryArgs, QueryArgsOf, QueryPage, RankPage, RankResult, RestrictableQueryOptions, RestrictableQueryOptionsOf, SearchFilterBuilder, SearchReader, TableAggregateOptions, TableAggregateOptionsOf, TableGroupByOptions, TableGroupByOptionsOf, TableRankOptions, TableRankPageOptions, TableReaderFacade, TableWriterFacade, UpsertTargetOf, Where, WhereOf, WhereOperators, WithArg };
+type DatabaseWriterFacade<DM, IM extends Record<keyof DM, object>, REL extends Record<keyof DM, object>, RANK extends Record<keyof DM, string>, SEARCH extends Record<keyof DM, string>, GEO extends Record<keyof DM, string> = Record<keyof DM, never>> = { readonly [T in keyof DM]: TableWriterFacade<DM, IM, REL, RANK, SEARCH, T, GEO>; };
+export { AggregateOp, DatabaseReaderFacade, DatabaseWriterFacade, GeoBoundingBox, GeoFilterBuilder, GeoPointInput, GeoReader, GroupByEntry, Id, LoadWith, ManyRelationWhere, OneRelationWhere, OrderBy, QueryArgs, QueryArgsOf, QueryPage, RankPage, RankResult, RestrictableQueryOptions, RestrictableQueryOptionsOf, SearchFilterBuilder, SearchReader, TableAggregateOptions, TableAggregateOptionsOf, TableGroupByOptions, TableGroupByOptionsOf, TableRankOptions, TableRankPageOptions, TableReaderFacade, TableWriterFacade, UpsertTargetOf, Where, WhereOf, WhereOperators, WithArg };

package/dist/index.d.mts

@@ -1,7 +1,7 @@
 import { Validator, Infer, ValidatorMap, InferValidatorMap, v } from '@lunora/values';
-export { type ColumnValidator, type Id, type Infer, ValidationError, type Validator, type ValidatorKind, v } from '@lunora/values';
-import { ArgsValidator, InferArgs, RegisteredAction, X402ProcedureConfig, ActionCtx, MutationCtx, RegisteredMutation, QueryCtx, RegisteredQuery, RegisteredStream, FunctionKind, Secrets, LifecycleEvent, RegisteredLifecycleHook, TableDefinition, RegisteredFunction, VectorIndexDefinition, Schema, AggregateOp, DurableObjectJurisdiction, RelationDefinition, GlobalBackend, OnDeleteAction, ExternalSourceDefinition, TriggerBuilder, TriggerDefinition, VectorEmbedder, VectorMetric, AggregateIndexDefinition, RankIndexDefinition } from "./types.mjs";
-export { type AnyApi, type AuthState, type CachePurge, type DatabaseReader, type DatabaseWriter, type FunctionVisibility, type IndexDefinition, type IndexRangeBuilder, type LifecycleEventKind, type LogFields, type LunoraLogMethod, type LunoraLogger, type LunoraMetrics, type LunoraTracer, type PaginationOptions, type PaginationResult, type RankSortKey, type ReadOnlyStorage, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type SearchFilterBuilder, type SearchIndexDefinition, type ShardMode, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerCtx, type TriggerDatabase, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type VectorMatch, type VectorMatches, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, anyApi } from "./types.mjs";
+export { type ColumnValidator, type GeoPoint, type Id, type Infer, ValidationError, type Validator, type ValidatorKind, v } from '@lunora/values';
+import { ArgsValidator, InferArgs, RegisteredAction, ExposeConfig, X402ProcedureConfig, ActionCtx, MutationCtx, RegisteredMutation, QueryCtx, RegisteredQuery, RegisteredStream, FunctionKind, Secrets, LifecycleEvent, RegisteredLifecycleHook, TableDefinition, RegisteredFunction, VectorIndexDefinition, Schema, AggregateOp, DurableObjectJurisdiction, RelationDefinition, GlobalBackend, OnDeleteAction, ExternalSourceDefinition, TriggerBuilder, TriggerDefinition, VectorEmbedder, VectorMetric, AggregateIndexDefinition, RankIndexDefinition } from "./types.mjs";
+export { type AnyApi, type AuthState, type CachePurge, type DatabaseReader, type DatabaseWriter, type FunctionVisibility, type GeoBoundingBox, type GeoFilterBuilder, type GeoIndexDefinition, type GeoPointInput, type IndexDefinition, type IndexRangeBuilder, type LifecycleEventKind, type LogFields, type LunoraLogMethod, type LunoraLogger, type LunoraMetrics, type LunoraTracer, type PaginationOptions, type PaginationResult, type RankSortKey, type ReadOnlyStorage, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type SearchFilterBuilder, type SearchIndexDefinition, type ShardMode, type SpanHandle, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerCtx, type TriggerDatabase, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type TtlDefinition, type VectorMatch, type VectorMatches, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, anyApi } from "./types.mjs";
 import { LunoraError as LunoraError$1, LunoraErrorCode } from '@lunora/errors';
 export type { LunoraErrorCode } from '@lunora/errors';
 import { Context, Hono } from 'hono';
@@ -62,6 +62,13 @@ type CreateOptions = Record<never, never>;
  */
 interface QueryBuilder<Context, Args extends ArgsValidator, Output = undefined> {
   readonly __lunoraProcedure: "query";
+  /**
+   * Publish this query on the opt-in public REST surface (plan 167) — the
+   * runtime mints `GET /_lunora/rest/&lt;namespace>/&lt;fn>` (and `POST`), dispatching
+   * THROUGH the procedure so `ctx.auth` / RLS / validators are enforced, and the
+   * generated OpenAPI describes it. Default-closed: omit to keep it RPC-only.
+   */
+  expose: (config: ExposeConfig) => QueryBuilder<Context, Args, Output>;
   input: <A extends ArgsValidator>(validators: A) => QueryBuilder<Context, A & Args, Output>;
   output: <V extends Validator>(validator: V) => QueryBuilder<Context, Args, Infer<V>>;
   query: [Output] extends [undefined] ? <R>(handler: (options: {
@@ -95,6 +102,13 @@ interface QueryBuilder<Context, Args extends ArgsValidator, Output = undefined>
 }
 interface MutationBuilder<Context, Args extends ArgsValidator, Output = undefined> {
   readonly __lunoraProcedure: "mutation";
+  /**
+   * Publish this mutation on the opt-in public REST surface (plan 167) — the
+   * runtime mints `POST /_lunora/rest/&lt;namespace>/&lt;fn>`, dispatching THROUGH the
+   * procedure so `ctx.auth` / RLS / validators are enforced, and the generated
+   * OpenAPI describes it. Default-closed: omit to keep it RPC-only.
+   */
+  expose: (config: ExposeConfig) => MutationBuilder<Context, Args, Output>;
   input: <A extends ArgsValidator>(validators: A) => MutationBuilder<Context, A & Args, Output>;
   mutation: [Output] extends [undefined] ? <R>(handler: (options: {
     args: InferArgs<Args>;
@@ -122,6 +136,13 @@ interface ActionBuilder<Context, Args extends ArgsValidator, Output = undefined>
     args: InferArgs<Args>;
     ctx: Context;
   }) => Output | Promise<Output>) => RegisteredAction<Args, Output>;
+  /**
+   * Publish this action on the opt-in public REST surface (plan 167) — the
+   * runtime mints `POST /_lunora/rest/&lt;namespace>/&lt;fn>`, dispatching THROUGH the
+   * procedure so `ctx.auth` / RLS / validators are enforced, and the generated
+   * OpenAPI describes it. Default-closed: omit to keep it RPC-only.
+   */
+  expose: (config: ExposeConfig) => ActionBuilder<Context, Args, Output>;
   input: <A extends ArgsValidator>(validators: A) => ActionBuilder<Context, A & Args, Output>;
   output: <V extends Validator>(validator: V) => ActionBuilder<Context, Args, Infer<V>>;
   use: <ContextOut>(middleware: Middleware<Context, ContextOut>) => ActionBuilder<ContextOut, Args, Output>;
@@ -353,6 +374,7 @@ interface FacadeWriterLike {
     patched: number;
   }>;
   query(tableName: string): {
+    withGeoIndex(indexName: string, build: (q: unknown) => unknown): unknown;
     withSearchIndex(indexName: string, search: (q: unknown) => unknown): unknown;
   };
   rank(tableName: string, indexName: string, options: unknown): Promise<unknown>;
@@ -425,6 +447,7 @@ interface FacadeEntry {
   upsert: (args: UpsertArgs) => Promise<UpsertResult>;
   /** Sequential `upsert` over many rows sharing one `target`; returns one result per input row in order. */
   upsertMany: (args: UpsertManyArgs) => Promise<UpsertResult[]>;
+  withGeoIndex: (indexName: string, build: (q: unknown) => unknown) => unknown;
   withSearchIndex: (indexName: string, search: (q: unknown) => unknown) => unknown;
 }
 /** Options accepted by the per-table `insert` accessor. */
@@ -893,6 +916,7 @@ interface TableReaderLike$1 {
   }) => Promise<QueryPage$1>;
   take: (limit: number) => Promise<Record<string, unknown>[]>;
   unique: () => Promise<Record<string, unknown> | null>;
+  withGeoIndex: (indexName: string, build: (q: unknown) => unknown) => TableReaderLike$1;
   withIndex: (indexName: string, range?: (q: unknown) => unknown) => TableReaderLike$1;
   withSearchIndex: (indexName: string, search: (q: unknown) => unknown) => TableReaderLike$1;
 }
@@ -1349,6 +1373,16 @@ interface TableBuilder<Shape extends Record<string, Validator> = Record<string,
    * `ctx.db.insert(...)`.
    */
   externallyManaged: () => TableBuilder<Shape>;
+  /**
+   * Declare a geospatial index over a `v.geoPoint()` column. The runtime keeps
+   * a geohash companion so `withGeoIndex(name, q => q.near(point, radius))` and
+   * `.within(bbox)` resolve as a geohash-prefix range scan + Haversine
+   * refine/sort. `options.precision` tunes the geohash length (default 9).
+   */
+  geoIndex: (name: string, options: {
+    field: keyof Shape & string;
+    precision?: number;
+  }) => TableBuilder<Shape>;
   /**
    * Mark this table as global (cross-shard). Backed by **D1** by default;
    * pass `{ backend: "hyperdrive" }` to store it in a Postgres/MySQL database
@@ -1415,6 +1449,17 @@ interface TableBuilder<Shape extends Record<string, Validator> = Record<string,
   source: (definition: ExternalSourceDefinition) => TableBuilder<Shape>;
   /** Declare named lifecycle triggers fired inline within the write path. */
   triggers: (build: (t: TriggerBuilder<Shape>) => Record<string, TriggerDefinition>) => TableBuilder<Shape>;
+  /**
+   * Declare a table-level TTL: a DO alarm-driven sweep auto-deletes rows whose
+   * expiry has passed (or soft-deletes them when the table also
+   * `.softDelete()`s). `field` is an epoch-millisecond column; without
+   * `options.after` its value is the absolute expiry instant, with `after` the
+   * row expires `after` ms past `field` (`field + after`). Coarse, cheap,
+   * table-level — for per-row schedules use `@lunora/scheduler`.
+   */
+  ttl: (field: keyof Shape & string, options?: {
+    after?: number;
+  }) => TableBuilder<Shape>;
   /** Declare a vector index over a single text field on this table. */
   vectorize: (field: keyof Shape & string, options: VectorizeOptions<Shape>) => TableBuilder<Shape>;
 }
@@ -1811,6 +1856,7 @@ interface TableReaderLike {
     numItems: number;
   }) => Promise<QueryPage>;
   take: (limit: number) => Promise<Record<string, unknown>[]>;
+  withGeoIndex: (indexName: string, build: (q: unknown) => unknown) => TableReaderLike;
   withIndex: (indexName: string, range?: (q: unknown) => unknown) => TableReaderLike;
   withSearchIndex: (indexName: string, search: (q: unknown) => unknown) => TableReaderLike;
 }
@@ -2122,4 +2168,4 @@ interface StorageContextIn {
 }
 declare const storageRules: <Context extends StorageContextIn = StorageContextIn>(rules: ReadonlyArray<StorageRule<Context>>, options?: StorageRulesOptions) => Middleware<Context, Context>;
 declare const VERSION = "0.0.0";
-export { type ActionBuilder, type ActionCtx, type AggregateIndexDefinition, type AggregateIndexOptions, type AggregateOp, type ArgsValidator, type Component, type ComponentFunctions, type CreateOptions, type DataModelInit, type DefineComponentOptions, type DefineIdentityOptions, type DefinePluginOptions, type DefinePolicyInput, type DefinePresenceOptions, type DefineStorageRuleInput, type DurableObjectJurisdiction, type EmptyArgs, type EnvAccessor, type EnvKeyFailure, type EnvShape, type ExtendableSchema, type FacadeEntry, type FacadeWriterLike, type FunctionKind, type HttpActionCtx, type HttpActionHandler, type HttpMethod, type HttpRoute, type HttpRouteBuilder, type HttpRouteFactory, type HttpRouteHandlerOptions, type HttpStreamHandlerOptions, type IdentityContract, type IdentityRejectMode, type IdentityValidation, type InferArgs, type InferEnv, type InferIdentity, type InlineAggregateIndexOptions, type InlineRankIndexOptions, type InternalActionBuilder, type InternalMutationBuilder, type InternalQueryBuilder, type LifecycleEvent, type LifecycleHandler, type LunoraBuilders, LunoraEnvError, LunoraError, type LunoraHttpApp, type LunoraHttpEnv, type LunoraRouteHandler, type ManyRelation, type MaskColumns, type MaskContext, type MaskFn, type MaskOptions, type MaskPolicies, type MaskStrategy, type Middleware, type MiddlewareNext, type MigrationDefinition, type MigrationDocument, type MigrationTransform, type MutationBuilder, type MutationCtx, type MutatorDefinition, type OnDeleteAction, type OneRelation, type OrmLike, DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, type Permission, type Plugin, type Policy, type PrefixedTables, type PresenceComponent, type PresenceFunctions, type PresenceMember, type ProtectPublicOptions, type QueryBuilder, type QueryCtx, type RankIndexDefinition, type RankIndexOptions, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMigration, type RegisteredMutation, type RegisteredMutator, type RegisteredQuery, type RegisteredShape, type RegisteredStream, type RelationBuilder, type RelationDefinition, type RlsOptions, type RlsReadRegistry, type Role, type Schema, type SchemaExtension, type ShapeDefinition, type ShapeReadWhereRequest, type StorageOperation, type StorageRule, type StorageRuleContext, type StorageRuleDecision, type StorageRulesOptions, type TableBuilder, type TableDefinition, type TerminalKind, type TriggerBuilder, type TriggerDefinition, type TypedDefinePolicyInput, VERSION, type VectorEmbedder, type VectorIndexDefinition, type VectorIndexOptions, type VectorMetric, type VectorizeOptions, type WhereInput, asBucketStorage, bindOrm, bindTableFacade, buildRlsReadRegistry, composePluginMiddleware, composeShapeReadWhere, createPolicyDsl, createSecrets, defineAggregateIndex, defineComponent, defineEnv, defineIdentity, defineMigration, defineMutator, definePermission, definePlugin, definePolicies, definePolicy, definePresence, defineRankIndex, defineRole, defineSchema, defineSchemaExtension, defineShape, defineStorageRule, defineStorageRules, defineTable, defineVectorIndex, httpAction, httpRoute, httpRouter, initLunora, installPlugins, isSafeHeaderValue, mask, mergeSchemaExtension, onConnect, onDisconnect, presenceExtension, protectPublic, redactSecrets, rls, serveStorageObject, storageRules };
+export { type ActionBuilder, type ActionCtx, type AggregateIndexDefinition, type AggregateIndexOptions, type AggregateOp, type ArgsValidator, type Component, type ComponentFunctions, type CreateOptions, type DataModelInit, type DefineComponentOptions, type DefineIdentityOptions, type DefinePluginOptions, type DefinePolicyInput, type DefinePresenceOptions, type DefineStorageRuleInput, type DurableObjectJurisdiction, type EmptyArgs, type EnvAccessor, type EnvKeyFailure, type EnvShape, type ExposeConfig, type ExtendableSchema, type FacadeEntry, type FacadeWriterLike, type FunctionKind, type HttpActionCtx, type HttpActionHandler, type HttpMethod, type HttpRoute, type HttpRouteBuilder, type HttpRouteFactory, type HttpRouteHandlerOptions, type HttpStreamHandlerOptions, type IdentityContract, type IdentityRejectMode, type IdentityValidation, type InferArgs, type InferEnv, type InferIdentity, type InlineAggregateIndexOptions, type InlineRankIndexOptions, type InternalActionBuilder, type InternalMutationBuilder, type InternalQueryBuilder, type LifecycleEvent, type LifecycleHandler, type LunoraBuilders, LunoraEnvError, LunoraError, type LunoraHttpApp, type LunoraHttpEnv, type LunoraRouteHandler, type ManyRelation, type MaskColumns, type MaskContext, type MaskFn, type MaskOptions, type MaskPolicies, type MaskStrategy, type Middleware, type MiddlewareNext, type MigrationDefinition, type MigrationDocument, type MigrationTransform, type MutationBuilder, type MutationCtx, type MutatorDefinition, type OnDeleteAction, type OneRelation, type OrmLike, DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, type Permission, type Plugin, type Policy, type PrefixedTables, type PresenceComponent, type PresenceFunctions, type PresenceMember, type ProtectPublicOptions, type QueryBuilder, type QueryCtx, type RankIndexDefinition, type RankIndexOptions, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMigration, type RegisteredMutation, type RegisteredMutator, type RegisteredQuery, type RegisteredShape, type RegisteredStream, type RelationBuilder, type RelationDefinition, type RlsOptions, type RlsReadRegistry, type Role, type Schema, type SchemaExtension, type ShapeDefinition, type ShapeReadWhereRequest, type StorageOperation, type StorageRule, type StorageRuleContext, type StorageRuleDecision, type StorageRulesOptions, type TableBuilder, type TableDefinition, type TerminalKind, type TriggerBuilder, type TriggerDefinition, type TypedDefinePolicyInput, VERSION, type VectorEmbedder, type VectorIndexDefinition, type VectorIndexOptions, type VectorMetric, type VectorizeOptions, type WhereInput, asBucketStorage, bindOrm, bindTableFacade, buildRlsReadRegistry, composePluginMiddleware, composeShapeReadWhere, createPolicyDsl, createSecrets, defineAggregateIndex, defineComponent, defineEnv, defineIdentity, defineMigration, defineMutator, definePermission, definePlugin, definePolicies, definePolicy, definePresence, defineRankIndex, defineRole, defineSchema, defineSchemaExtension, defineShape, defineStorageRule, defineStorageRules, defineTable, defineVectorIndex, httpAction, httpRoute, httpRouter, initLunora, installPlugins, isSafeHeaderValue, mask, mergeSchemaExtension, onConnect, onDisconnect, presenceExtension, protectPublic, redactSecrets, rls, serveStorageObject, storageRules };

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { Validator, Infer, ValidatorMap, InferValidatorMap, v } from '@lunora/values';
-export { type ColumnValidator, type Id, type Infer, ValidationError, type Validator, type ValidatorKind, v } from '@lunora/values';
-import { ArgsValidator, InferArgs, RegisteredAction, X402ProcedureConfig, ActionCtx, MutationCtx, RegisteredMutation, QueryCtx, RegisteredQuery, RegisteredStream, FunctionKind, Secrets, LifecycleEvent, RegisteredLifecycleHook, TableDefinition, RegisteredFunction, VectorIndexDefinition, Schema, AggregateOp, DurableObjectJurisdiction, RelationDefinition, GlobalBackend, OnDeleteAction, ExternalSourceDefinition, TriggerBuilder, TriggerDefinition, VectorEmbedder, VectorMetric, AggregateIndexDefinition, RankIndexDefinition } from "./types.js";
-export { type AnyApi, type AuthState, type CachePurge, type DatabaseReader, type DatabaseWriter, type FunctionVisibility, type IndexDefinition, type IndexRangeBuilder, type LifecycleEventKind, type LogFields, type LunoraLogMethod, type LunoraLogger, type LunoraMetrics, type LunoraTracer, type PaginationOptions, type PaginationResult, type RankSortKey, type ReadOnlyStorage, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type SearchFilterBuilder, type SearchIndexDefinition, type ShardMode, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerCtx, type TriggerDatabase, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type VectorMatch, type VectorMatches, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, anyApi } from "./types.js";
+export { type ColumnValidator, type GeoPoint, type Id, type Infer, ValidationError, type Validator, type ValidatorKind, v } from '@lunora/values';
+import { ArgsValidator, InferArgs, RegisteredAction, ExposeConfig, X402ProcedureConfig, ActionCtx, MutationCtx, RegisteredMutation, QueryCtx, RegisteredQuery, RegisteredStream, FunctionKind, Secrets, LifecycleEvent, RegisteredLifecycleHook, TableDefinition, RegisteredFunction, VectorIndexDefinition, Schema, AggregateOp, DurableObjectJurisdiction, RelationDefinition, GlobalBackend, OnDeleteAction, ExternalSourceDefinition, TriggerBuilder, TriggerDefinition, VectorEmbedder, VectorMetric, AggregateIndexDefinition, RankIndexDefinition } from "./types.js";
+export { type AnyApi, type AuthState, type CachePurge, type DatabaseReader, type DatabaseWriter, type FunctionVisibility, type GeoBoundingBox, type GeoFilterBuilder, type GeoIndexDefinition, type GeoPointInput, type IndexDefinition, type IndexRangeBuilder, type LifecycleEventKind, type LogFields, type LunoraLogMethod, type LunoraLogger, type LunoraMetrics, type LunoraTracer, type PaginationOptions, type PaginationResult, type RankSortKey, type ReadOnlyStorage, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type SearchFilterBuilder, type SearchIndexDefinition, type ShardMode, type SpanHandle, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerCtx, type TriggerDatabase, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type TtlDefinition, type VectorMatch, type VectorMatches, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, anyApi } from "./types.js";
 import { LunoraError as LunoraError$1, LunoraErrorCode } from '@lunora/errors';
 export type { LunoraErrorCode } from '@lunora/errors';
 import { Context, Hono } from 'hono';
@@ -62,6 +62,13 @@ type CreateOptions = Record<never, never>;
  */
 interface QueryBuilder<Context, Args extends ArgsValidator, Output = undefined> {
   readonly __lunoraProcedure: "query";
+  /**
+   * Publish this query on the opt-in public REST surface (plan 167) — the
+   * runtime mints `GET /_lunora/rest/&lt;namespace>/&lt;fn>` (and `POST`), dispatching
+   * THROUGH the procedure so `ctx.auth` / RLS / validators are enforced, and the
+   * generated OpenAPI describes it. Default-closed: omit to keep it RPC-only.
+   */
+  expose: (config: ExposeConfig) => QueryBuilder<Context, Args, Output>;
   input: <A extends ArgsValidator>(validators: A) => QueryBuilder<Context, A & Args, Output>;
   output: <V extends Validator>(validator: V) => QueryBuilder<Context, Args, Infer<V>>;
   query: [Output] extends [undefined] ? <R>(handler: (options: {
@@ -95,6 +102,13 @@ interface QueryBuilder<Context, Args extends ArgsValidator, Output = undefined>
 }
 interface MutationBuilder<Context, Args extends ArgsValidator, Output = undefined> {
   readonly __lunoraProcedure: "mutation";
+  /**
+   * Publish this mutation on the opt-in public REST surface (plan 167) — the
+   * runtime mints `POST /_lunora/rest/&lt;namespace>/&lt;fn>`, dispatching THROUGH the
+   * procedure so `ctx.auth` / RLS / validators are enforced, and the generated
+   * OpenAPI describes it. Default-closed: omit to keep it RPC-only.
+   */
+  expose: (config: ExposeConfig) => MutationBuilder<Context, Args, Output>;
   input: <A extends ArgsValidator>(validators: A) => MutationBuilder<Context, A & Args, Output>;
   mutation: [Output] extends [undefined] ? <R>(handler: (options: {
     args: InferArgs<Args>;
@@ -122,6 +136,13 @@ interface ActionBuilder<Context, Args extends ArgsValidator, Output = undefined>
     args: InferArgs<Args>;
     ctx: Context;
   }) => Output | Promise<Output>) => RegisteredAction<Args, Output>;
+  /**
+   * Publish this action on the opt-in public REST surface (plan 167) — the
+   * runtime mints `POST /_lunora/rest/&lt;namespace>/&lt;fn>`, dispatching THROUGH the
+   * procedure so `ctx.auth` / RLS / validators are enforced, and the generated
+   * OpenAPI describes it. Default-closed: omit to keep it RPC-only.
+   */
+  expose: (config: ExposeConfig) => ActionBuilder<Context, Args, Output>;
   input: <A extends ArgsValidator>(validators: A) => ActionBuilder<Context, A & Args, Output>;
   output: <V extends Validator>(validator: V) => ActionBuilder<Context, Args, Infer<V>>;
   use: <ContextOut>(middleware: Middleware<Context, ContextOut>) => ActionBuilder<ContextOut, Args, Output>;
@@ -353,6 +374,7 @@ interface FacadeWriterLike {
     patched: number;
   }>;
   query(tableName: string): {
+    withGeoIndex(indexName: string, build: (q: unknown) => unknown): unknown;
     withSearchIndex(indexName: string, search: (q: unknown) => unknown): unknown;
   };
   rank(tableName: string, indexName: string, options: unknown): Promise<unknown>;
@@ -425,6 +447,7 @@ interface FacadeEntry {
   upsert: (args: UpsertArgs) => Promise<UpsertResult>;
   /** Sequential `upsert` over many rows sharing one `target`; returns one result per input row in order. */
   upsertMany: (args: UpsertManyArgs) => Promise<UpsertResult[]>;
+  withGeoIndex: (indexName: string, build: (q: unknown) => unknown) => unknown;
   withSearchIndex: (indexName: string, search: (q: unknown) => unknown) => unknown;
 }
 /** Options accepted by the per-table `insert` accessor. */
@@ -893,6 +916,7 @@ interface TableReaderLike$1 {
   }) => Promise<QueryPage$1>;
   take: (limit: number) => Promise<Record<string, unknown>[]>;
   unique: () => Promise<Record<string, unknown> | null>;
+  withGeoIndex: (indexName: string, build: (q: unknown) => unknown) => TableReaderLike$1;
   withIndex: (indexName: string, range?: (q: unknown) => unknown) => TableReaderLike$1;
   withSearchIndex: (indexName: string, search: (q: unknown) => unknown) => TableReaderLike$1;
 }
@@ -1349,6 +1373,16 @@ interface TableBuilder<Shape extends Record<string, Validator> = Record<string,
    * `ctx.db.insert(...)`.
    */
   externallyManaged: () => TableBuilder<Shape>;
+  /**
+   * Declare a geospatial index over a `v.geoPoint()` column. The runtime keeps
+   * a geohash companion so `withGeoIndex(name, q => q.near(point, radius))` and
+   * `.within(bbox)` resolve as a geohash-prefix range scan + Haversine
+   * refine/sort. `options.precision` tunes the geohash length (default 9).
+   */
+  geoIndex: (name: string, options: {
+    field: keyof Shape & string;
+    precision?: number;
+  }) => TableBuilder<Shape>;
   /**
    * Mark this table as global (cross-shard). Backed by **D1** by default;
    * pass `{ backend: "hyperdrive" }` to store it in a Postgres/MySQL database
@@ -1415,6 +1449,17 @@ interface TableBuilder<Shape extends Record<string, Validator> = Record<string,
   source: (definition: ExternalSourceDefinition) => TableBuilder<Shape>;
   /** Declare named lifecycle triggers fired inline within the write path. */
   triggers: (build: (t: TriggerBuilder<Shape>) => Record<string, TriggerDefinition>) => TableBuilder<Shape>;
+  /**
+   * Declare a table-level TTL: a DO alarm-driven sweep auto-deletes rows whose
+   * expiry has passed (or soft-deletes them when the table also
+   * `.softDelete()`s). `field` is an epoch-millisecond column; without
+   * `options.after` its value is the absolute expiry instant, with `after` the
+   * row expires `after` ms past `field` (`field + after`). Coarse, cheap,
+   * table-level — for per-row schedules use `@lunora/scheduler`.
+   */
+  ttl: (field: keyof Shape & string, options?: {
+    after?: number;
+  }) => TableBuilder<Shape>;
   /** Declare a vector index over a single text field on this table. */
   vectorize: (field: keyof Shape & string, options: VectorizeOptions<Shape>) => TableBuilder<Shape>;
 }
@@ -1811,6 +1856,7 @@ interface TableReaderLike {
     numItems: number;
   }) => Promise<QueryPage>;
   take: (limit: number) => Promise<Record<string, unknown>[]>;
+  withGeoIndex: (indexName: string, build: (q: unknown) => unknown) => TableReaderLike;
   withIndex: (indexName: string, range?: (q: unknown) => unknown) => TableReaderLike;
   withSearchIndex: (indexName: string, search: (q: unknown) => unknown) => TableReaderLike;
 }
@@ -2122,4 +2168,4 @@ interface StorageContextIn {
 }
 declare const storageRules: <Context extends StorageContextIn = StorageContextIn>(rules: ReadonlyArray<StorageRule<Context>>, options?: StorageRulesOptions) => Middleware<Context, Context>;
 declare const VERSION = "0.0.0";
-export { type ActionBuilder, type ActionCtx, type AggregateIndexDefinition, type AggregateIndexOptions, type AggregateOp, type ArgsValidator, type Component, type ComponentFunctions, type CreateOptions, type DataModelInit, type DefineComponentOptions, type DefineIdentityOptions, type DefinePluginOptions, type DefinePolicyInput, type DefinePresenceOptions, type DefineStorageRuleInput, type DurableObjectJurisdiction, type EmptyArgs, type EnvAccessor, type EnvKeyFailure, type EnvShape, type ExtendableSchema, type FacadeEntry, type FacadeWriterLike, type FunctionKind, type HttpActionCtx, type HttpActionHandler, type HttpMethod, type HttpRoute, type HttpRouteBuilder, type HttpRouteFactory, type HttpRouteHandlerOptions, type HttpStreamHandlerOptions, type IdentityContract, type IdentityRejectMode, type IdentityValidation, type InferArgs, type InferEnv, type InferIdentity, type InlineAggregateIndexOptions, type InlineRankIndexOptions, type InternalActionBuilder, type InternalMutationBuilder, type InternalQueryBuilder, type LifecycleEvent, type LifecycleHandler, type LunoraBuilders, LunoraEnvError, LunoraError, type LunoraHttpApp, type LunoraHttpEnv, type LunoraRouteHandler, type ManyRelation, type MaskColumns, type MaskContext, type MaskFn, type MaskOptions, type MaskPolicies, type MaskStrategy, type Middleware, type MiddlewareNext, type MigrationDefinition, type MigrationDocument, type MigrationTransform, type MutationBuilder, type MutationCtx, type MutatorDefinition, type OnDeleteAction, type OneRelation, type OrmLike, DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, type Permission, type Plugin, type Policy, type PrefixedTables, type PresenceComponent, type PresenceFunctions, type PresenceMember, type ProtectPublicOptions, type QueryBuilder, type QueryCtx, type RankIndexDefinition, type RankIndexOptions, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMigration, type RegisteredMutation, type RegisteredMutator, type RegisteredQuery, type RegisteredShape, type RegisteredStream, type RelationBuilder, type RelationDefinition, type RlsOptions, type RlsReadRegistry, type Role, type Schema, type SchemaExtension, type ShapeDefinition, type ShapeReadWhereRequest, type StorageOperation, type StorageRule, type StorageRuleContext, type StorageRuleDecision, type StorageRulesOptions, type TableBuilder, type TableDefinition, type TerminalKind, type TriggerBuilder, type TriggerDefinition, type TypedDefinePolicyInput, VERSION, type VectorEmbedder, type VectorIndexDefinition, type VectorIndexOptions, type VectorMetric, type VectorizeOptions, type WhereInput, asBucketStorage, bindOrm, bindTableFacade, buildRlsReadRegistry, composePluginMiddleware, composeShapeReadWhere, createPolicyDsl, createSecrets, defineAggregateIndex, defineComponent, defineEnv, defineIdentity, defineMigration, defineMutator, definePermission, definePlugin, definePolicies, definePolicy, definePresence, defineRankIndex, defineRole, defineSchema, defineSchemaExtension, defineShape, defineStorageRule, defineStorageRules, defineTable, defineVectorIndex, httpAction, httpRoute, httpRouter, initLunora, installPlugins, isSafeHeaderValue, mask, mergeSchemaExtension, onConnect, onDisconnect, presenceExtension, protectPublic, redactSecrets, rls, serveStorageObject, storageRules };
+export { type ActionBuilder, type ActionCtx, type AggregateIndexDefinition, type AggregateIndexOptions, type AggregateOp, type ArgsValidator, type Component, type ComponentFunctions, type CreateOptions, type DataModelInit, type DefineComponentOptions, type DefineIdentityOptions, type DefinePluginOptions, type DefinePolicyInput, type DefinePresenceOptions, type DefineStorageRuleInput, type DurableObjectJurisdiction, type EmptyArgs, type EnvAccessor, type EnvKeyFailure, type EnvShape, type ExposeConfig, type ExtendableSchema, type FacadeEntry, type FacadeWriterLike, type FunctionKind, type HttpActionCtx, type HttpActionHandler, type HttpMethod, type HttpRoute, type HttpRouteBuilder, type HttpRouteFactory, type HttpRouteHandlerOptions, type HttpStreamHandlerOptions, type IdentityContract, type IdentityRejectMode, type IdentityValidation, type InferArgs, type InferEnv, type InferIdentity, type InlineAggregateIndexOptions, type InlineRankIndexOptions, type InternalActionBuilder, type InternalMutationBuilder, type InternalQueryBuilder, type LifecycleEvent, type LifecycleHandler, type LunoraBuilders, LunoraEnvError, LunoraError, type LunoraHttpApp, type LunoraHttpEnv, type LunoraRouteHandler, type ManyRelation, type MaskColumns, type MaskContext, type MaskFn, type MaskOptions, type MaskPolicies, type MaskStrategy, type Middleware, type MiddlewareNext, type MigrationDefinition, type MigrationDocument, type MigrationTransform, type MutationBuilder, type MutationCtx, type MutatorDefinition, type OnDeleteAction, type OneRelation, type OrmLike, DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, type Permission, type Plugin, type Policy, type PrefixedTables, type PresenceComponent, type PresenceFunctions, type PresenceMember, type ProtectPublicOptions, type QueryBuilder, type QueryCtx, type RankIndexDefinition, type RankIndexOptions, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMigration, type RegisteredMutation, type RegisteredMutator, type RegisteredQuery, type RegisteredShape, type RegisteredStream, type RelationBuilder, type RelationDefinition, type RlsOptions, type RlsReadRegistry, type Role, type Schema, type SchemaExtension, type ShapeDefinition, type ShapeReadWhereRequest, type StorageOperation, type StorageRule, type StorageRuleContext, type StorageRuleDecision, type StorageRulesOptions, type TableBuilder, type TableDefinition, type TerminalKind, type TriggerBuilder, type TriggerDefinition, type TypedDefinePolicyInput, VERSION, type VectorEmbedder, type VectorIndexDefinition, type VectorIndexOptions, type VectorMetric, type VectorizeOptions, type WhereInput, asBucketStorage, bindOrm, bindTableFacade, buildRlsReadRegistry, composePluginMiddleware, composeShapeReadWhere, createPolicyDsl, createSecrets, defineAggregateIndex, defineComponent, defineEnv, defineIdentity, defineMigration, defineMutator, definePermission, definePlugin, definePolicies, definePolicy, definePresence, defineRankIndex, defineRole, defineSchema, defineSchemaExtension, defineShape, defineStorageRule, defineStorageRules, defineTable, defineVectorIndex, httpAction, httpRoute, httpRouter, initLunora, installPlugins, isSafeHeaderValue, mask, mergeSchemaExtension, onConnect, onDisconnect, presenceExtension, protectPublic, redactSecrets, rls, serveStorageObject, storageRules };

package/dist/index.mjs

@@ -1,27 +1,27 @@
 export { default as asBucketStorage } from './packem_shared/asBucketStorage-Cnxd9y2q.mjs';
-export { initLunora } from './packem_shared/initLunora-CmMVk4i7.mjs';
+export { initLunora } from './packem_shared/initLunora-D0Wuki7S.mjs';
 export { createSecrets } from './packem_shared/createSecrets-DwaR2rNG.mjs';
 export { LunoraEnvError, defineEnv, redactSecrets } from './packem_shared/LunoraEnvError-BGmd1Qs0.mjs';
 export { LunoraError } from './packem_shared/LunoraError-WbxmrpxR.mjs';
-export { bindOrm, bindTableFacade } from './packem_shared/bindOrm-Bfgl7f-Q.mjs';
+export { bindOrm, bindTableFacade } from './packem_shared/bindOrm-CaY7Wq9Z.mjs';
 export { httpAction, httpRoute, httpRouter, isSafeHeaderValue, serveStorageObject } from './packem_shared/httpAction-DCXoYPIk.mjs';
 export { defineIdentity } from './packem_shared/defineIdentity-DiX4zM9x.mjs';
 export { onConnect, onDisconnect } from './packem_shared/onConnect-CIPXKPyw.mjs';
 export { defineMigration } from './packem_shared/defineMigration-Hx01yIht.mjs';
 export { defineMutator } from './packem_shared/defineMutator-EIXAWhs9.mjs';
 export { composePluginMiddleware, defineComponent, definePlugin, defineSchemaExtension, installPlugins, mergeSchemaExtension } from './packem_shared/composePluginMiddleware-z62dttBo.mjs';
-export { PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, definePresence, presenceExtension } from './packem_shared/PRESENCE_DEFAULT_TTL_MS-Cv1UPaJj.mjs';
+export { PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, definePresence, presenceExtension } from './packem_shared/PRESENCE_DEFAULT_TTL_MS-Cr0i4mTv.mjs';
 export { protectPublic } from './packem_shared/protectPublic-BlcGpiRc.mjs';
-export { defineAggregateIndex, defineRankIndex, defineSchema, defineTable, defineVectorIndex } from './packem_shared/defineAggregateIndex-DTULzh09.mjs';
+export { defineAggregateIndex, defineRankIndex, defineSchema, defineTable, defineVectorIndex } from './packem_shared/defineAggregateIndex-cdo0g-un.mjs';
 export { defineShape } from './packem_shared/defineShape-C5scNOrf.mjs';
 export { anyApi } from './types.mjs';
 export { cronJobs } from '@lunora/scheduler';
 export { ValidationError, v } from '@lunora/values';
-export { buildRlsReadRegistry, composeShapeReadWhere } from './packem_shared/buildRlsReadRegistry-D54vUQe4.mjs';
+export { buildRlsReadRegistry, composeShapeReadWhere } from './packem_shared/buildRlsReadRegistry-2uk_GfiH.mjs';
 export { createPolicyDsl, definePermission, definePolicies, definePolicy, defineRole } from './packem_shared/createPolicyDsl-By3QB4he.mjs';
 export { defineStorageRule, defineStorageRules } from './packem_shared/defineStorageRule-B5nL4Z1P.mjs';
-export { mask } from './packem_shared/mask-CZuu9WAF.mjs';
-export { rls } from './packem_shared/rls-B_ZWgslr.mjs';
+export { mask } from './packem_shared/mask-BepaW7YN.mjs';
+export { rls } from './packem_shared/rls-BaDQf7MG.mjs';
 export { storageRules } from './packem_shared/storageRules-6QxzDOcx.mjs';
 
 const VERSION = "0.0.0";

package/dist/packem_shared/{PRESENCE_DEFAULT_TTL_MS-Cv1UPaJj.mjs → PRESENCE_DEFAULT_TTL_MS-Cr0i4mTv.mjs}

@@ -1,9 +1,9 @@
 import { v } from '@lunora/values';
-import { initLunora } from './initLunora-CmMVk4i7.mjs';
+import { initLunora } from './initLunora-D0Wuki7S.mjs';
 import { LunoraError } from './LunoraError-WbxmrpxR.mjs';
 import { onDisconnect } from './onConnect-CIPXKPyw.mjs';
 import { defineSchemaExtension, defineComponent } from './composePluginMiddleware-z62dttBo.mjs';
-import { defineTable } from './defineAggregateIndex-DTULzh09.mjs';
+import { defineTable } from './defineAggregateIndex-cdo0g-un.mjs';
 
 const DEFAULT_TTL_MS = 3e4;
 const MAX_DATA_BYTES = 4096;

package/dist/packem_shared/{bindOrm-Bfgl7f-Q.mjs → bindOrm-CaY7Wq9Z.mjs}

@@ -117,6 +117,7 @@ const bindTableFacade = (writer, tableName) => {
       }
       return results;
     },
+    withGeoIndex: (indexName, build) => writer.query(tableName).withGeoIndex(indexName, build),
     withSearchIndex: (indexName, search) => writer.query(tableName).withSearchIndex(indexName, search)
   };
 };

package/dist/packem_shared/{buildRlsReadRegistry-D54vUQe4.mjs → buildRlsReadRegistry-2uk_GfiH.mjs}

@@ -1,4 +1,4 @@
-import { indexRolePermissions, computeReadBaseWhere, permissionName } from './rls-B_ZWgslr.mjs';
+import { indexRolePermissions, computeReadBaseWhere, permissionName } from './rls-BaDQf7MG.mjs';
 import { r as readRlsTag } from './policy-tag-DvpVH2tv.mjs';
 
 const FALSE_PREDICATE = { OR: [] };

package/dist/packem_shared/{defineAggregateIndex-DTULzh09.mjs → defineAggregateIndex-cdo0g-un.mjs}

@@ -31,6 +31,7 @@ const defineTable = (inputShape) => {
     }
   }
   const aggregateIndexes = [];
+  const geoIndexes = [];
   const indexes = [];
   const rankIndexes = [];
   const relations = {};
@@ -42,6 +43,7 @@ const defineTable = (inputShape) => {
   let isExternallyManaged = false;
   let isPublic = false;
   let softDelete;
+  let ttl;
   let externalSource;
   const builder = {
     aggregateIndex(name, options) {
@@ -72,6 +74,13 @@ const defineTable = (inputShape) => {
       isExternallyManaged = true;
       return builder;
     },
+    geoIndex(name, options) {
+      geoIndexes.push({ field: options.field, name, precision: options.precision });
+      return builder;
+    },
+    get geoIndexes() {
+      return geoIndexes;
+    },
     global(options) {
       shardMode = { backend: options?.backend ?? "d1", kind: "global" };
       return builder;
@@ -168,6 +177,13 @@ const defineTable = (inputShape) => {
       Object.assign(triggers, build(triggerBuilder));
       return builder;
     },
+    ttl(field, options) {
+      ttl = { after: options?.after, field };
+      return builder;
+    },
+    get ttlPolicy() {
+      return ttl;
+    },
     get vectorIndexes() {
       return vectorIndexes;
     },

package/dist/packem_shared/{initLunora-CmMVk4i7.mjs → initLunora-D0Wuki7S.mjs}

@@ -54,6 +54,7 @@ const makeBuilder = (kind, state, visibility) => {
       const rls = collectRls(state.middlewares);
       return {
         args: state.args,
+        ...state.expose ? { expose: state.expose } : {},
         handler: makeHandler(state.args, state.middlewares, userHandler, state.output),
         kind,
         ...rls ? { rls } : {},
@@ -71,6 +72,7 @@ const makeBuilder = (kind, state, visibility) => {
         const rls = collectRls(state.middlewares);
         return {
           args: state.args,
+          ...state.expose ? { expose: state.expose } : {},
           handler: makeStreamHandler(state.args, state.middlewares, userHandler),
           kind: "stream",
           ...rls ? { rls } : {},
@@ -80,6 +82,12 @@ const makeBuilder = (kind, state, visibility) => {
       }
     } : {},
     use: (middleware) => makeBuilder(kind, { ...state, middlewares: [...state.middlewares, middleware] }, visibility),
+    // `.expose({ rest: true })` publishes a PUBLIC procedure on the REST surface
+    // (plan 167). Public-only for the same reason as `.x402`: an internal
+    // function is server-to-server and never reachable over HTTP, so there is
+    // nothing to expose. Default-closed — omitting the modifier keeps the
+    // procedure RPC-only.
+    ...visibility ? {} : { expose: (config) => makeBuilder(kind, { ...state, expose: config }, visibility) },
     // `.x402({ price })` marks a public procedure as paid. It's public-only:
     // internal functions are server-to-server (cron/scheduler/`ctx.run*`) and
     // never reachable via a client RPC, so there's nothing to charge. Omitting

package/dist/packem_shared/{mask-CZuu9WAF.mjs → mask-BepaW7YN.mjs}

@@ -1,5 +1,5 @@
 import { LunoraError } from './LunoraError-WbxmrpxR.mjs';
-import { bindTableFacade, bindOrm } from './bindOrm-Bfgl7f-Q.mjs';
+import { bindTableFacade, bindOrm } from './bindOrm-CaY7Wq9Z.mjs';
 
 const permissionName = (permission) => typeof permission === "string" ? permission : permission.name;
 const indexRolePermissions = (roles) => {
@@ -119,7 +119,10 @@ const wrapDatabase = (base, perTable, context) => {
       withSearchIndex: (indexName, search) => {
         assertIndexFieldsAllowed(search, columns, tableName, "withSearchIndex");
         return wrapReader(reader.withSearchIndex(indexName, search), columns, tableName);
-      }
+      },
+      // A geo query's builder (`.near`/`.within`) exposes no column name, so
+      // there's no masked-column value oracle to guard — just mask the output.
+      withGeoIndex: (indexName, build) => wrapReader(reader.withGeoIndex(indexName, build), columns, tableName)
     };
   };
   const locate = async (id, expectedTable) => {

package/dist/packem_shared/{rls-B_ZWgslr.mjs → rls-BaDQf7MG.mjs}

@@ -1,5 +1,5 @@
 import { LunoraError } from './LunoraError-WbxmrpxR.mjs';
-import { bindTableFacade, bindOrm } from './bindOrm-Bfgl7f-Q.mjs';
+import { bindTableFacade, bindOrm } from './bindOrm-CaY7Wq9Z.mjs';
 import { t as tagRlsMiddleware } from './policy-tag-DvpVH2tv.mjs';
 
 const DEFAULT_BATCH_LIMIT = 500;

package/dist/rls/testing.mjs

@@ -1,4 +1,4 @@
-import { indexRolePermissions, computeReadBaseWhere, matchesWhere, evaluateWrite, permissionName } from '../packem_shared/rls-B_ZWgslr.mjs';
+import { indexRolePermissions, computeReadBaseWhere, matchesWhere, evaluateWrite, permissionName } from '../packem_shared/rls-BaDQf7MG.mjs';
 
 const expectPolicy = (policies, options = {}) => {
   const rolePermissions = indexRolePermissions(options.roles);

package/dist/types.d.mts

@@ -117,6 +117,33 @@ interface SearchIndexDefinition {
   filterFields?: ReadonlyArray<string>;
   name: string;
 }
+/**
+ * A geospatial index declared via `.geoIndex(name, { field })`. The runtime
+ * maintains a geohash companion table over the `v.geoPoint()` column `field` so
+ * `withGeoIndex(name, q => q.near(point, radius) | q.within(bbox))` resolves a
+ * proximity / bounding-box read as a geohash-prefix range scan plus a Haversine
+ * refine/sort on the candidate rows.
+ *
+ * - `field` — the `v.geoPoint()` column whose lat/lng feed the geohash.
+ * - `precision` — geohash character length on the companion (default 9, ~4.8 m cells); higher precision narrows each cell.
+ */
+interface GeoIndexDefinition {
+  field: string;
+  name: string;
+  precision?: number;
+}
+/**
+ * Declarative table-level TTL declared via `.ttl(field, { after? })`. A DO
+ * alarm-driven sweep deletes (or, when the table also `.softDelete()`s,
+ * soft-deletes) rows whose expiry timestamp has passed.
+ *
+ * - `field` — an epoch-millisecond column. Without `after`, its value is the absolute expiry instant; with `after`, `field` is a base timestamp and the row expires `after` milliseconds later (`field + after`).
+ * - `after` — optional millisecond offset added to `field` to derive the expiry.
+ */
+interface TtlDefinition {
+  after?: number;
+  field: string;
+}
 /** Reducer applied by an aggregate index. */
 type AggregateOp = "avg" | "count" | "max" | "min" | "sum";
 /**
@@ -230,6 +257,14 @@ interface TableDefinition<Shape extends Record<string, Validator> = Record<strin
    * loop rather than user mutations. Implies `isExternallyManaged`.
    */
   externalSource?: ExternalSourceDefinition;
+  /**
+   * Geospatial indexes declared via `.geoIndex(name, { field })`. The runtime
+   * maintains a geohash companion over the named `v.geoPoint()` column so
+   * `withGeoIndex(name, q => q.near(point, radius) | q.within(bbox))` resolves
+   * a proximity/bounding-box read as a geohash-prefix range scan plus a
+   * Haversine refine/sort. Empty unless `.geoIndex()` was called.
+   */
+  geoIndexes: ReadonlyArray<GeoIndexDefinition>;
   indexes: ReadonlyArray<IndexDefinition>;
   /**
    * `true` when `.externallyManaged()` was called — the table's rows are
@@ -285,6 +320,15 @@ interface TableDefinition<Shape extends Record<string, Validator> = Record<strin
    * field — same reasoning as {@link TableDefinition.relationMap}.
    */
   triggerMap: Record<string, TriggerDefinition>;
+  /**
+   * Set by `.ttl(field, { after })` — the declarative auto-expiry policy. A DO
+   * alarm-driven sweep deletes rows whose expiry timestamp has passed (or
+   * soft-deletes them when the table also `.softDelete()`s). Named `ttlPolicy`
+   * (a data field) rather than colliding with the fluent `.ttl()` builder
+   * method — same convention as `shardBy()`/`shardMode`. Absent ⇒ rows never
+   * auto-expire.
+   */
+  ttlPolicy?: TtlDefinition;
   vectorIndexes: ReadonlyArray<TableVectorIndex>;
 }
 /**
@@ -339,8 +383,26 @@ interface X402ProcedureConfig {
    */
   readonly price: number | string;
 }
+/**
+ * Opt-in public-surface tag attached by the `.expose({ rest: true })` builder
+ * modifier (plan 167). Marks a procedure as deliberately published over the
+ * public REST surface: the runtime mints a `/_lunora/rest/&lt;namespace>/&lt;fn>` route
+ * that dispatches THROUGH the procedure (so `ctx.auth` / RLS / validators are
+ * enforced), and the generated OpenAPI describes it. Everything is default-closed
+ * — a procedure without this tag is unreachable over REST.
+ */
+interface ExposeConfig {
+  /** Publish this procedure over the public REST surface. */
+  readonly rest?: boolean;
+}
 interface RegisteredFunction<A extends ArgsValidator, R, Kind extends FunctionKind> {
   readonly args: A;
+  /**
+   * Set by the `.expose({ rest: true })` builder modifier. Marks the procedure
+   * as published on the public REST surface (plan 167). Absent on procedures that
+   * are reachable only via typed RPC (the default).
+   */
+  readonly expose?: ExposeConfig;
   readonly handler: (context: unknown, args: InferArgs<A>) => Promise<R> | R;
   readonly kind: Kind;
   /**
@@ -544,6 +606,15 @@ interface TableReader<Row = Record<string, unknown>> {
    * and throws when more than one row matches. Mirrors Convex's `.unique()`.
    */
   unique: () => Promise<Row | null>;
+  /**
+   * Restrict the query to a declared `.geoIndex()`. The builder's
+   * `.near(point, radiusMeters)` returns rows within `radiusMeters` of `point`,
+   * ordered nearest-first; `.within(bbox)` returns rows inside the
+   * latitude/longitude bounding box. Both resolve as a geohash-prefix range
+   * scan over the index's companion followed by a Haversine refine. Pair with
+   * `.take(n)` to cap results (`.paginate()` is not supported on a geo query).
+   */
+  withGeoIndex: (indexName: string, build: (q: GeoFilterBuilder) => GeoFilterBuilder) => TableReader<Row>;
   withIndex: (indexName: string, range?: (q: IndexRangeBuilder) => IndexRangeBuilder) => TableReader<Row>;
   /**
    * Restrict the query to a declared `.searchIndex()`. The builder's
@@ -568,6 +639,30 @@ interface SearchFilterBuilder {
   /** Full-text match `query` against the index's searchable `field`. Call exactly once. */
   search: (field: string, query: string) => SearchFilterBuilder;
 }
+/** A latitude/longitude point (WGS84 decimal degrees) accepted by geo queries. */
+interface GeoPointInput {
+  lat: number;
+  lng: number;
+}
+/**
+ * An axis-aligned latitude/longitude bounding box: `sw` is the south-west
+ * (min lat, min lng) corner, `ne` the north-east (max lat, max lng) corner.
+ */
+interface GeoBoundingBox {
+  ne: GeoPointInput;
+  sw: GeoPointInput;
+}
+/**
+ * Builder passed to {@link TableReader.withGeoIndex}. Call exactly one of
+ * `.near(...)` / `.within(...)` — the two are mutually exclusive proximity vs
+ * bounding-box modes.
+ */
+interface GeoFilterBuilder {
+  /** Rows within `radiusMeters` of `point`, resolved nearest-first. Call exactly once. */
+  near: (point: GeoPointInput, radiusMeters: number) => GeoFilterBuilder;
+  /** Rows whose point falls inside the bounding `box`. Call exactly once. */
+  within: (box: GeoBoundingBox) => GeoFilterBuilder;
+}
 /**
  * Options shared by the batch-write methods (`insertMany`/`deleteMany`/
  * `patchMany`) — a per-call payload cap. The default cap (500) rejects an
@@ -1223,6 +1318,21 @@ interface LunoraLogger {
    */
   readonly with: (fields: LogFields) => LunoraLogger;
 }
+/**
+ * Handle the enclosing `ctx.trace` span hands its body, so the body can attach
+ * attributes only known *after* it resolves (an AI call's token usage / dollar
+ * cost, a downstream status, a computed count). Declared structurally here to
+ * mirror `shared/span-event.ts`'s `SpanHandle` and `@lunora/do`'s implementation;
+ * a cross-package assignability guard in `@lunora/testing` fails the build if the
+ * three drift apart. Start attributes are snapshotted before the body runs;
+ * handle writes are merged over them at record time, post-hoc winning on a clash.
+ */
+interface SpanHandle {
+  /** Set one attribute on the enclosing span (merged at record time; post-hoc wins on key clash). */
+  setAttribute: (key: string, value: LogFields[string]) => void;
+  /** Merge attributes onto the enclosing span (post-hoc wins on key clash). */
+  setAttributes: (fields: LogFields) => void;
+}
 /**
  * Span factory on every function `ctx`. Wraps a sub-operation so it becomes its
  * own **span** nested under the dispatch's RPC span, giving a trace real shape:
@@ -1256,15 +1366,26 @@ interface LunoraLogger {
  * unchanged. A throw is recorded as an error span and then **re-thrown** — this
  * is instrumentation, never flow control. Recording is best-effort: a failing
  * sink can't turn a working handler into a broken one.
+ *
+ * **Post-hoc attributes.** The body also receives a {@link SpanHandle} as its
+ * second argument. The `attributes` passed here are stamped at span start (and
+ * snapshotted, so a later mutation can't rewrite them); anything the body sets
+ * through the handle — `span.setAttribute(k, v)` / `span.setAttributes({…})` — is
+ * merged over that snapshot when the span is recorded, so a value known only once
+ * the body has resolved (an AI call's token usage / dollar cost, a computed
+ * count) still lands on the span. Post-hoc wins on a key clash. The handle is a
+ * trailing parameter, so every existing `(trace) => …` body keeps working
+ * unchanged.
  * @param name Span name, e.g. `"stripe.charge"`. Prefer a low-cardinality name
  * and put the varying part in `attributes` — a name built from an id makes every
  * span its own group in a collector.
  * @param fn The body to time, receiving a tracer bound to this span for any
- * nested spans. May be sync or async; the result is awaited.
- * @param attributes Structured attributes to stamp on the span, normalized like
- * a log line's `fields`.
+ * nested spans and the enclosing span's {@link SpanHandle} for post-hoc
+ * attributes. May be sync or async; the result is awaited.
+ * @param attributes Structured attributes to stamp on the span at start,
+ * normalized like a log line's `fields`.
  */
-type LunoraTracer = <T>(name: string, function_: (trace: LunoraTracer) => Promise<T> | T, attributes?: LogFields) => Promise<T>;
+type LunoraTracer = <T>(name: string, function_: (trace: LunoraTracer, span: SpanHandle) => Promise<T> | T, attributes?: LogFields) => Promise<T>;
 /**
  * Application metrics on every function `ctx` — the third signal alongside
  * `ctx.log` and `ctx.trace`. Each call records one measurement that flows to an
@@ -1465,4 +1586,4 @@ interface ActionCtx {
  */
 type AnyApi = Record<string, Record<string, RegisteredFunction<ArgsValidator, unknown, FunctionKind>>>;
 declare const anyApi: AnyApi;
-export { type ActionCtx, type AggregateIndexDefinition, type AggregateOp, type AnyApi, type ArgsValidator, type AuthState, type CachePurge, type DatabaseReader, type DatabaseWriter, type DurableObjectJurisdiction, type ExternalSourceCursor, type ExternalSourceDefinition, type ExternalSourceMode, type ExternalSourceRefresh, type FunctionKind, type FunctionVisibility, type GlobalBackend, type IndexDefinition, type IndexRangeBuilder, type InferArgs, type LifecycleEvent, type LifecycleEventKind, type LogFields, type LunoraLogMethod, type LunoraLogger, type LunoraMetrics, type LunoraTracer, type MutationCtx, type OnDeleteAction, type PaginationOptions, type PaginationResult, type QueryCtx, type RankIndexDefinition, type RankSortKey, type ReadOnlyStorage, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMutation, type RegisteredQuery, type RegisteredStream, type RelationDefinition, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type Schema, type SearchFilterBuilder, type SearchIndexDefinition, type Secrets, type SecretsStoreSecretLike, type ShardMode, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableDefinition, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerBuilder, type TriggerCtx, type TriggerDatabase, type TriggerDefinition, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type VectorEmbedder, type VectorIndexDefinition, type VectorMatch, type VectorMatches, type VectorMetric, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, type X402ProcedureConfig, anyApi };
+export { type ActionCtx, type AggregateIndexDefinition, type AggregateOp, type AnyApi, type ArgsValidator, type AuthState, type CachePurge, type DatabaseReader, type DatabaseWriter, type DurableObjectJurisdiction, type ExposeConfig, type ExternalSourceCursor, type ExternalSourceDefinition, type ExternalSourceMode, type ExternalSourceRefresh, type FunctionKind, type FunctionVisibility, type GeoBoundingBox, type GeoFilterBuilder, type GeoIndexDefinition, type GeoPointInput, type GlobalBackend, type IndexDefinition, type IndexRangeBuilder, type InferArgs, type LifecycleEvent, type LifecycleEventKind, type LogFields, type LunoraLogMethod, type LunoraLogger, type LunoraMetrics, type LunoraTracer, type MutationCtx, type OnDeleteAction, type PaginationOptions, type PaginationResult, type QueryCtx, type RankIndexDefinition, type RankSortKey, type ReadOnlyStorage, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMutation, type RegisteredQuery, type RegisteredStream, type RelationDefinition, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type Schema, type SearchFilterBuilder, type SearchIndexDefinition, type Secrets, type SecretsStoreSecretLike, type ShardMode, type SpanHandle, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableDefinition, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerBuilder, type TriggerCtx, type TriggerDatabase, type TriggerDefinition, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type TtlDefinition, type VectorEmbedder, type VectorIndexDefinition, type VectorMatch, type VectorMatches, type VectorMetric, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, type X402ProcedureConfig, anyApi };

package/dist/types.d.ts

@@ -117,6 +117,33 @@ interface SearchIndexDefinition {
   filterFields?: ReadonlyArray<string>;
   name: string;
 }
+/**
+ * A geospatial index declared via `.geoIndex(name, { field })`. The runtime
+ * maintains a geohash companion table over the `v.geoPoint()` column `field` so
+ * `withGeoIndex(name, q => q.near(point, radius) | q.within(bbox))` resolves a
+ * proximity / bounding-box read as a geohash-prefix range scan plus a Haversine
+ * refine/sort on the candidate rows.
+ *
+ * - `field` — the `v.geoPoint()` column whose lat/lng feed the geohash.
+ * - `precision` — geohash character length on the companion (default 9, ~4.8 m cells); higher precision narrows each cell.
+ */
+interface GeoIndexDefinition {
+  field: string;
+  name: string;
+  precision?: number;
+}
+/**
+ * Declarative table-level TTL declared via `.ttl(field, { after? })`. A DO
+ * alarm-driven sweep deletes (or, when the table also `.softDelete()`s,
+ * soft-deletes) rows whose expiry timestamp has passed.
+ *
+ * - `field` — an epoch-millisecond column. Without `after`, its value is the absolute expiry instant; with `after`, `field` is a base timestamp and the row expires `after` milliseconds later (`field + after`).
+ * - `after` — optional millisecond offset added to `field` to derive the expiry.
+ */
+interface TtlDefinition {
+  after?: number;
+  field: string;
+}
 /** Reducer applied by an aggregate index. */
 type AggregateOp = "avg" | "count" | "max" | "min" | "sum";
 /**
@@ -230,6 +257,14 @@ interface TableDefinition<Shape extends Record<string, Validator> = Record<strin
    * loop rather than user mutations. Implies `isExternallyManaged`.
    */
   externalSource?: ExternalSourceDefinition;
+  /**
+   * Geospatial indexes declared via `.geoIndex(name, { field })`. The runtime
+   * maintains a geohash companion over the named `v.geoPoint()` column so
+   * `withGeoIndex(name, q => q.near(point, radius) | q.within(bbox))` resolves
+   * a proximity/bounding-box read as a geohash-prefix range scan plus a
+   * Haversine refine/sort. Empty unless `.geoIndex()` was called.
+   */
+  geoIndexes: ReadonlyArray<GeoIndexDefinition>;
   indexes: ReadonlyArray<IndexDefinition>;
   /**
    * `true` when `.externallyManaged()` was called — the table's rows are
@@ -285,6 +320,15 @@ interface TableDefinition<Shape extends Record<string, Validator> = Record<strin
    * field — same reasoning as {@link TableDefinition.relationMap}.
    */
   triggerMap: Record<string, TriggerDefinition>;
+  /**
+   * Set by `.ttl(field, { after })` — the declarative auto-expiry policy. A DO
+   * alarm-driven sweep deletes rows whose expiry timestamp has passed (or
+   * soft-deletes them when the table also `.softDelete()`s). Named `ttlPolicy`
+   * (a data field) rather than colliding with the fluent `.ttl()` builder
+   * method — same convention as `shardBy()`/`shardMode`. Absent ⇒ rows never
+   * auto-expire.
+   */
+  ttlPolicy?: TtlDefinition;
   vectorIndexes: ReadonlyArray<TableVectorIndex>;
 }
 /**
@@ -339,8 +383,26 @@ interface X402ProcedureConfig {
    */
   readonly price: number | string;
 }
+/**
+ * Opt-in public-surface tag attached by the `.expose({ rest: true })` builder
+ * modifier (plan 167). Marks a procedure as deliberately published over the
+ * public REST surface: the runtime mints a `/_lunora/rest/&lt;namespace>/&lt;fn>` route
+ * that dispatches THROUGH the procedure (so `ctx.auth` / RLS / validators are
+ * enforced), and the generated OpenAPI describes it. Everything is default-closed
+ * — a procedure without this tag is unreachable over REST.
+ */
+interface ExposeConfig {
+  /** Publish this procedure over the public REST surface. */
+  readonly rest?: boolean;
+}
 interface RegisteredFunction<A extends ArgsValidator, R, Kind extends FunctionKind> {
   readonly args: A;
+  /**
+   * Set by the `.expose({ rest: true })` builder modifier. Marks the procedure
+   * as published on the public REST surface (plan 167). Absent on procedures that
+   * are reachable only via typed RPC (the default).
+   */
+  readonly expose?: ExposeConfig;
   readonly handler: (context: unknown, args: InferArgs<A>) => Promise<R> | R;
   readonly kind: Kind;
   /**
@@ -544,6 +606,15 @@ interface TableReader<Row = Record<string, unknown>> {
    * and throws when more than one row matches. Mirrors Convex's `.unique()`.
    */
   unique: () => Promise<Row | null>;
+  /**
+   * Restrict the query to a declared `.geoIndex()`. The builder's
+   * `.near(point, radiusMeters)` returns rows within `radiusMeters` of `point`,
+   * ordered nearest-first; `.within(bbox)` returns rows inside the
+   * latitude/longitude bounding box. Both resolve as a geohash-prefix range
+   * scan over the index's companion followed by a Haversine refine. Pair with
+   * `.take(n)` to cap results (`.paginate()` is not supported on a geo query).
+   */
+  withGeoIndex: (indexName: string, build: (q: GeoFilterBuilder) => GeoFilterBuilder) => TableReader<Row>;
   withIndex: (indexName: string, range?: (q: IndexRangeBuilder) => IndexRangeBuilder) => TableReader<Row>;
   /**
    * Restrict the query to a declared `.searchIndex()`. The builder's
@@ -568,6 +639,30 @@ interface SearchFilterBuilder {
   /** Full-text match `query` against the index's searchable `field`. Call exactly once. */
   search: (field: string, query: string) => SearchFilterBuilder;
 }
+/** A latitude/longitude point (WGS84 decimal degrees) accepted by geo queries. */
+interface GeoPointInput {
+  lat: number;
+  lng: number;
+}
+/**
+ * An axis-aligned latitude/longitude bounding box: `sw` is the south-west
+ * (min lat, min lng) corner, `ne` the north-east (max lat, max lng) corner.
+ */
+interface GeoBoundingBox {
+  ne: GeoPointInput;
+  sw: GeoPointInput;
+}
+/**
+ * Builder passed to {@link TableReader.withGeoIndex}. Call exactly one of
+ * `.near(...)` / `.within(...)` — the two are mutually exclusive proximity vs
+ * bounding-box modes.
+ */
+interface GeoFilterBuilder {
+  /** Rows within `radiusMeters` of `point`, resolved nearest-first. Call exactly once. */
+  near: (point: GeoPointInput, radiusMeters: number) => GeoFilterBuilder;
+  /** Rows whose point falls inside the bounding `box`. Call exactly once. */
+  within: (box: GeoBoundingBox) => GeoFilterBuilder;
+}
 /**
  * Options shared by the batch-write methods (`insertMany`/`deleteMany`/
  * `patchMany`) — a per-call payload cap. The default cap (500) rejects an
@@ -1223,6 +1318,21 @@ interface LunoraLogger {
    */
   readonly with: (fields: LogFields) => LunoraLogger;
 }
+/**
+ * Handle the enclosing `ctx.trace` span hands its body, so the body can attach
+ * attributes only known *after* it resolves (an AI call's token usage / dollar
+ * cost, a downstream status, a computed count). Declared structurally here to
+ * mirror `shared/span-event.ts`'s `SpanHandle` and `@lunora/do`'s implementation;
+ * a cross-package assignability guard in `@lunora/testing` fails the build if the
+ * three drift apart. Start attributes are snapshotted before the body runs;
+ * handle writes are merged over them at record time, post-hoc winning on a clash.
+ */
+interface SpanHandle {
+  /** Set one attribute on the enclosing span (merged at record time; post-hoc wins on key clash). */
+  setAttribute: (key: string, value: LogFields[string]) => void;
+  /** Merge attributes onto the enclosing span (post-hoc wins on key clash). */
+  setAttributes: (fields: LogFields) => void;
+}
 /**
  * Span factory on every function `ctx`. Wraps a sub-operation so it becomes its
  * own **span** nested under the dispatch's RPC span, giving a trace real shape:
@@ -1256,15 +1366,26 @@ interface LunoraLogger {
  * unchanged. A throw is recorded as an error span and then **re-thrown** — this
  * is instrumentation, never flow control. Recording is best-effort: a failing
  * sink can't turn a working handler into a broken one.
+ *
+ * **Post-hoc attributes.** The body also receives a {@link SpanHandle} as its
+ * second argument. The `attributes` passed here are stamped at span start (and
+ * snapshotted, so a later mutation can't rewrite them); anything the body sets
+ * through the handle — `span.setAttribute(k, v)` / `span.setAttributes({…})` — is
+ * merged over that snapshot when the span is recorded, so a value known only once
+ * the body has resolved (an AI call's token usage / dollar cost, a computed
+ * count) still lands on the span. Post-hoc wins on a key clash. The handle is a
+ * trailing parameter, so every existing `(trace) => …` body keeps working
+ * unchanged.
  * @param name Span name, e.g. `"stripe.charge"`. Prefer a low-cardinality name
  * and put the varying part in `attributes` — a name built from an id makes every
  * span its own group in a collector.
  * @param fn The body to time, receiving a tracer bound to this span for any
- * nested spans. May be sync or async; the result is awaited.
- * @param attributes Structured attributes to stamp on the span, normalized like
- * a log line's `fields`.
+ * nested spans and the enclosing span's {@link SpanHandle} for post-hoc
+ * attributes. May be sync or async; the result is awaited.
+ * @param attributes Structured attributes to stamp on the span at start,
+ * normalized like a log line's `fields`.
  */
-type LunoraTracer = <T>(name: string, function_: (trace: LunoraTracer) => Promise<T> | T, attributes?: LogFields) => Promise<T>;
+type LunoraTracer = <T>(name: string, function_: (trace: LunoraTracer, span: SpanHandle) => Promise<T> | T, attributes?: LogFields) => Promise<T>;
 /**
  * Application metrics on every function `ctx` — the third signal alongside
  * `ctx.log` and `ctx.trace`. Each call records one measurement that flows to an
@@ -1465,4 +1586,4 @@ interface ActionCtx {
  */
 type AnyApi = Record<string, Record<string, RegisteredFunction<ArgsValidator, unknown, FunctionKind>>>;
 declare const anyApi: AnyApi;
-export { type ActionCtx, type AggregateIndexDefinition, type AggregateOp, type AnyApi, type ArgsValidator, type AuthState, type CachePurge, type DatabaseReader, type DatabaseWriter, type DurableObjectJurisdiction, type ExternalSourceCursor, type ExternalSourceDefinition, type ExternalSourceMode, type ExternalSourceRefresh, type FunctionKind, type FunctionVisibility, type GlobalBackend, type IndexDefinition, type IndexRangeBuilder, type InferArgs, type LifecycleEvent, type LifecycleEventKind, type LogFields, type LunoraLogMethod, type LunoraLogger, type LunoraMetrics, type LunoraTracer, type MutationCtx, type OnDeleteAction, type PaginationOptions, type PaginationResult, type QueryCtx, type RankIndexDefinition, type RankSortKey, type ReadOnlyStorage, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMutation, type RegisteredQuery, type RegisteredStream, type RelationDefinition, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type Schema, type SearchFilterBuilder, type SearchIndexDefinition, type Secrets, type SecretsStoreSecretLike, type ShardMode, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableDefinition, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerBuilder, type TriggerCtx, type TriggerDatabase, type TriggerDefinition, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type VectorEmbedder, type VectorIndexDefinition, type VectorMatch, type VectorMatches, type VectorMetric, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, type X402ProcedureConfig, anyApi };
+export { type ActionCtx, type AggregateIndexDefinition, type AggregateOp, type AnyApi, type ArgsValidator, type AuthState, type CachePurge, type DatabaseReader, type DatabaseWriter, type DurableObjectJurisdiction, type ExposeConfig, type ExternalSourceCursor, type ExternalSourceDefinition, type ExternalSourceMode, type ExternalSourceRefresh, type FunctionKind, type FunctionVisibility, type GeoBoundingBox, type GeoFilterBuilder, type GeoIndexDefinition, type GeoPointInput, type GlobalBackend, type IndexDefinition, type IndexRangeBuilder, type InferArgs, type LifecycleEvent, type LifecycleEventKind, type LogFields, type LunoraLogMethod, type LunoraLogger, type LunoraMetrics, type LunoraTracer, type MutationCtx, type OnDeleteAction, type PaginationOptions, type PaginationResult, type QueryCtx, type RankIndexDefinition, type RankSortKey, type ReadOnlyStorage, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMutation, type RegisteredQuery, type RegisteredStream, type RelationDefinition, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type Schema, type SearchFilterBuilder, type SearchIndexDefinition, type Secrets, type SecretsStoreSecretLike, type ShardMode, type SpanHandle, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableDefinition, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerBuilder, type TriggerCtx, type TriggerDatabase, type TriggerDefinition, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type TtlDefinition, type VectorEmbedder, type VectorIndexDefinition, type VectorMatch, type VectorMatches, type VectorMetric, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, type X402ProcedureConfig, anyApi };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/server",
-  "version": "1.0.0-alpha.29",
+  "version": "1.0.0-alpha.30",
   "description": "Server primitives for Lunora: defineSchema, defineTable, query, mutation, and action",
   "keywords": [
     "backend",
@@ -62,9 +62,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.6",
+    "@lunora/errors": "1.0.0-alpha.7",
     "@lunora/scheduler": "1.0.0-alpha.11",
-    "@lunora/values": "1.0.0-alpha.9",
+    "@lunora/values": "1.0.0-alpha.10",
     "drizzle-orm": "^0.45.2",
     "hono": "^4.12.30"
   },