@lunora/server 1.0.0-alpha.61 → 1.0.0-alpha.62

package/dist/data-model.d.mts

@@ -93,7 +93,7 @@ type RelationWhere<DM, REL extends Record<keyof DM, object>, T extends keyof DM>
 /**
  * Relation-aware `where` tree — the column predicates of {@link Where} plus
  * Prisma-style relation predicates resolved by the `@lunora/do` pre-resolver.
- * `Where&lt;DM[T]>` stays the column-only structural mirror for back-compat; the
+ * `Where<DM[T]>` stays the column-only structural mirror for back-compat; the
  * table facade threads `REL` through this richer form.
  */
 type WhereOf<DM, REL extends Record<keyof DM, object>, T extends keyof DM> = RelationWhere<DM, REL, T> & { [K in keyof DM[T]]?: DM[T][K] | WhereOperators<DM[T][K]>; } & {
@@ -176,7 +176,7 @@ type SelectAlwaysKeep<DM, T extends keyof DM> = ("_creationTime" | "_id") & keyo
  */
 type ProjectDoc<DM, T extends keyof DM, S> = S extends ReadonlyArray<infer K> ? (K extends keyof DM[T] ? Pick<DM[T], (K & keyof DM[T]) | SelectAlwaysKeep<DM, T>> : DM[T]) : DM[T];
 /**
- * `Doc&lt;T>` narrowed to exactly the relations requested in the with-arg `W` and,
+ * `Doc<T>` narrowed to exactly the relations requested in the with-arg `W` and,
  * when a `select` tuple `S` is supplied, to its projected columns. `S` defaults
  * to `undefined` so the 4-argument form (the codegen-emitted callers) keeps the
  * full document.
@@ -207,7 +207,7 @@ interface RestrictableQueryOptionsOf<DM, REL extends Record<keyof DM, object>, T
   restrictsCounts?: boolean;
   where?: WhereOf<DM, REL, T>;
 }
-/** Args for `ctx.db.&lt;table>.aggregate({ op, field?, where? })`. */
+/** Args for `ctx.db.<table>.aggregate({ op, field?, where? })`. */
 interface TableAggregateOptions<TDocument> extends RestrictableQueryOptions<TDocument> {
   field?: keyof TDocument & string;
   op: AggregateOp;
@@ -217,7 +217,7 @@ interface TableAggregateOptionsOf<DM, REL extends Record<keyof DM, object>, T ex
   field?: keyof DM[T] & string;
   op: AggregateOp;
 }
-/** Args for `ctx.db.&lt;table>.groupBy({ by, agg?, where? })`. */
+/** Args for `ctx.db.<table>.groupBy({ by, agg?, where? })`. */
 interface TableGroupByOptions<TDocument> extends RestrictableQueryOptions<TDocument> {
   agg?: {
     field?: keyof TDocument & string;
@@ -238,7 +238,7 @@ interface GroupByEntry<TDocument> {
   key: Partial<TDocument>;
   value: null | number;
 }
-/** Args for `ctx.db.&lt;table>.rank(name, args)`. `row` is either an id or a row doc. */
+/** Args for `ctx.db.<table>.rank(name, args)`. `row` is either an id or a row doc. */
 interface TableRankOptions<TDocument> extends RestrictableQueryOptions<TDocument> {
   row: string | TDocument;
 }
@@ -247,7 +247,7 @@ interface RankResult {
   position: number;
   total: number;
 }
-/** Args for `ctx.db.&lt;table>.rankPage(name, args)`. */
+/** Args for `ctx.db.<table>.rankPage(name, args)`. */
 interface TableRankPageOptions<TDocument> extends RestrictableQueryOptions<TDocument> {
   cursor?: null | string;
   take?: number;
@@ -330,7 +330,7 @@ interface GeoReader<TDocument> {
   take: (limit: number) => Promise<TDocument[]>;
   unique: () => Promise<TDocument | null>;
 }
-/** Read-only typed table accessor exposed on `QueryCtx.db.&lt;table>`. */
+/** Read-only typed table accessor exposed on `QueryCtx.db.<table>`. */
 interface TableReaderFacade<DM, REL extends Record<keyof DM, object>, RANK extends Record<keyof DM, string>, SEARCH extends Record<keyof DM, string>, T extends keyof DM, GEO extends Record<keyof DM, string> = Record<keyof DM, never>> {
   /**
    * Reduce rows in this table to a scalar (`avg`/`max`/`min`/`sum` — `count`
@@ -395,7 +395,7 @@ interface TableReaderFacade<DM, REL extends Record<keyof DM, object>, RANK exten
    */
   withSearchIndex: (indexName: SEARCH[T], search: (q: SearchFilterBuilder<DM[T]>) => SearchFilterBuilder<DM[T]>) => SearchReader<DM[T]>;
 }
-/** Read-write typed table accessor exposed on `MutationCtx.db.&lt;table>` / `ActionCtx.db.&lt;table>`. */
+/** Read-write typed table accessor exposed on `MutationCtx.db.<table>` / `ActionCtx.db.<table>`. */
 interface TableWriterFacade<DM, IM extends Record<keyof DM, object>, REL extends Record<keyof DM, object>, RANK extends Record<keyof DM, string>, SEARCH extends Record<keyof DM, string>, T extends keyof DM, GEO extends Record<keyof DM, string> = Record<keyof DM, never>> extends TableReaderFacade<DM, REL, RANK, SEARCH, T, GEO> {
   /**
    * Delete a row by id. On a `.softDelete()` table this flips the marker column
@@ -505,8 +505,8 @@ interface TableWriterFacade<DM, IM extends Record<keyof DM, object>, REL extends
 }
 /** Conflict target for `upsert`/`upsertMany`: one column of table `T`, or a tuple of them. */
 type UpsertTargetOf<DM, T extends keyof DM> = ReadonlyArray<keyof DM[T] & string> | (keyof DM[T] & string);
-/** Per-table read facade — `ctx.db.&lt;table>` on a `QueryCtx`. */
+/** Per-table read facade — `ctx.db.<table>` on a `QueryCtx`. */
 type DatabaseReaderFacade<DM, REL extends Record<keyof DM, object>, RANK extends Record<keyof DM, string>, SEARCH extends Record<keyof DM, string>, GEO extends Record<keyof DM, string> = Record<keyof DM, never>> = { readonly [T in keyof DM]: TableReaderFacade<DM, REL, RANK, SEARCH, T, GEO>; };
-/** Per-table read-write facade — `ctx.db.&lt;table>` on a `MutationCtx` / `ActionCtx`. */
+/** Per-table read-write facade — `ctx.db.<table>` on a `MutationCtx` / `ActionCtx`. */
 type DatabaseWriterFacade<DM, IM extends Record<keyof DM, object>, REL extends Record<keyof DM, object>, RANK extends Record<keyof DM, string>, SEARCH extends Record<keyof DM, string>, GEO extends Record<keyof DM, string> = Record<keyof DM, never>> = { readonly [T in keyof DM]: TableWriterFacade<DM, IM, REL, RANK, SEARCH, T, GEO>; };
 export { AggregateOp, DatabaseReaderFacade, DatabaseWriterFacade, GeoBoundingBox, GeoFilterBuilder, GeoPointInput, GeoReader, GroupByEntry, Id, LoadWith, ManyRelationWhere, OneRelationWhere, OrderBy, QueryArgs, QueryArgsOf, QueryPage, RankPage, RankResult, RestrictableQueryOptions, RestrictableQueryOptionsOf, SearchFilterBuilder, SearchReader, TableAggregateOptions, TableAggregateOptionsOf, TableGroupByOptions, TableGroupByOptionsOf, TableRankOptions, TableRankPageOptions, TableReaderFacade, TableWriterFacade, UpsertTargetOf, Where, WhereOf, WhereOperators, WithArg };

package/dist/data-model.d.ts

@@ -93,7 +93,7 @@ type RelationWhere<DM, REL extends Record<keyof DM, object>, T extends keyof DM>
 /**
  * Relation-aware `where` tree — the column predicates of {@link Where} plus
  * Prisma-style relation predicates resolved by the `@lunora/do` pre-resolver.
- * `Where&lt;DM[T]>` stays the column-only structural mirror for back-compat; the
+ * `Where<DM[T]>` stays the column-only structural mirror for back-compat; the
  * table facade threads `REL` through this richer form.
  */
 type WhereOf<DM, REL extends Record<keyof DM, object>, T extends keyof DM> = RelationWhere<DM, REL, T> & { [K in keyof DM[T]]?: DM[T][K] | WhereOperators<DM[T][K]>; } & {
@@ -176,7 +176,7 @@ type SelectAlwaysKeep<DM, T extends keyof DM> = ("_creationTime" | "_id") & keyo
  */
 type ProjectDoc<DM, T extends keyof DM, S> = S extends ReadonlyArray<infer K> ? (K extends keyof DM[T] ? Pick<DM[T], (K & keyof DM[T]) | SelectAlwaysKeep<DM, T>> : DM[T]) : DM[T];
 /**
- * `Doc&lt;T>` narrowed to exactly the relations requested in the with-arg `W` and,
+ * `Doc<T>` narrowed to exactly the relations requested in the with-arg `W` and,
  * when a `select` tuple `S` is supplied, to its projected columns. `S` defaults
  * to `undefined` so the 4-argument form (the codegen-emitted callers) keeps the
  * full document.
@@ -207,7 +207,7 @@ interface RestrictableQueryOptionsOf<DM, REL extends Record<keyof DM, object>, T
   restrictsCounts?: boolean;
   where?: WhereOf<DM, REL, T>;
 }
-/** Args for `ctx.db.&lt;table>.aggregate({ op, field?, where? })`. */
+/** Args for `ctx.db.<table>.aggregate({ op, field?, where? })`. */
 interface TableAggregateOptions<TDocument> extends RestrictableQueryOptions<TDocument> {
   field?: keyof TDocument & string;
   op: AggregateOp;
@@ -217,7 +217,7 @@ interface TableAggregateOptionsOf<DM, REL extends Record<keyof DM, object>, T ex
   field?: keyof DM[T] & string;
   op: AggregateOp;
 }
-/** Args for `ctx.db.&lt;table>.groupBy({ by, agg?, where? })`. */
+/** Args for `ctx.db.<table>.groupBy({ by, agg?, where? })`. */
 interface TableGroupByOptions<TDocument> extends RestrictableQueryOptions<TDocument> {
   agg?: {
     field?: keyof TDocument & string;
@@ -238,7 +238,7 @@ interface GroupByEntry<TDocument> {
   key: Partial<TDocument>;
   value: null | number;
 }
-/** Args for `ctx.db.&lt;table>.rank(name, args)`. `row` is either an id or a row doc. */
+/** Args for `ctx.db.<table>.rank(name, args)`. `row` is either an id or a row doc. */
 interface TableRankOptions<TDocument> extends RestrictableQueryOptions<TDocument> {
   row: string | TDocument;
 }
@@ -247,7 +247,7 @@ interface RankResult {
   position: number;
   total: number;
 }
-/** Args for `ctx.db.&lt;table>.rankPage(name, args)`. */
+/** Args for `ctx.db.<table>.rankPage(name, args)`. */
 interface TableRankPageOptions<TDocument> extends RestrictableQueryOptions<TDocument> {
   cursor?: null | string;
   take?: number;
@@ -330,7 +330,7 @@ interface GeoReader<TDocument> {
   take: (limit: number) => Promise<TDocument[]>;
   unique: () => Promise<TDocument | null>;
 }
-/** Read-only typed table accessor exposed on `QueryCtx.db.&lt;table>`. */
+/** Read-only typed table accessor exposed on `QueryCtx.db.<table>`. */
 interface TableReaderFacade<DM, REL extends Record<keyof DM, object>, RANK extends Record<keyof DM, string>, SEARCH extends Record<keyof DM, string>, T extends keyof DM, GEO extends Record<keyof DM, string> = Record<keyof DM, never>> {
   /**
    * Reduce rows in this table to a scalar (`avg`/`max`/`min`/`sum` — `count`
@@ -395,7 +395,7 @@ interface TableReaderFacade<DM, REL extends Record<keyof DM, object>, RANK exten
    */
   withSearchIndex: (indexName: SEARCH[T], search: (q: SearchFilterBuilder<DM[T]>) => SearchFilterBuilder<DM[T]>) => SearchReader<DM[T]>;
 }
-/** Read-write typed table accessor exposed on `MutationCtx.db.&lt;table>` / `ActionCtx.db.&lt;table>`. */
+/** Read-write typed table accessor exposed on `MutationCtx.db.<table>` / `ActionCtx.db.<table>`. */
 interface TableWriterFacade<DM, IM extends Record<keyof DM, object>, REL extends Record<keyof DM, object>, RANK extends Record<keyof DM, string>, SEARCH extends Record<keyof DM, string>, T extends keyof DM, GEO extends Record<keyof DM, string> = Record<keyof DM, never>> extends TableReaderFacade<DM, REL, RANK, SEARCH, T, GEO> {
   /**
    * Delete a row by id. On a `.softDelete()` table this flips the marker column
@@ -505,8 +505,8 @@ interface TableWriterFacade<DM, IM extends Record<keyof DM, object>, REL extends
 }
 /** Conflict target for `upsert`/`upsertMany`: one column of table `T`, or a tuple of them. */
 type UpsertTargetOf<DM, T extends keyof DM> = ReadonlyArray<keyof DM[T] & string> | (keyof DM[T] & string);
-/** Per-table read facade — `ctx.db.&lt;table>` on a `QueryCtx`. */
+/** Per-table read facade — `ctx.db.<table>` on a `QueryCtx`. */
 type DatabaseReaderFacade<DM, REL extends Record<keyof DM, object>, RANK extends Record<keyof DM, string>, SEARCH extends Record<keyof DM, string>, GEO extends Record<keyof DM, string> = Record<keyof DM, never>> = { readonly [T in keyof DM]: TableReaderFacade<DM, REL, RANK, SEARCH, T, GEO>; };
-/** Per-table read-write facade — `ctx.db.&lt;table>` on a `MutationCtx` / `ActionCtx`. */
+/** Per-table read-write facade — `ctx.db.<table>` on a `MutationCtx` / `ActionCtx`. */
 type DatabaseWriterFacade<DM, IM extends Record<keyof DM, object>, REL extends Record<keyof DM, object>, RANK extends Record<keyof DM, string>, SEARCH extends Record<keyof DM, string>, GEO extends Record<keyof DM, string> = Record<keyof DM, never>> = { readonly [T in keyof DM]: TableWriterFacade<DM, IM, REL, RANK, SEARCH, T, GEO>; };
 export { AggregateOp, DatabaseReaderFacade, DatabaseWriterFacade, GeoBoundingBox, GeoFilterBuilder, GeoPointInput, GeoReader, GroupByEntry, Id, LoadWith, ManyRelationWhere, OneRelationWhere, OrderBy, QueryArgs, QueryArgsOf, QueryPage, RankPage, RankResult, RestrictableQueryOptions, RestrictableQueryOptionsOf, SearchFilterBuilder, SearchReader, TableAggregateOptions, TableAggregateOptionsOf, TableGroupByOptions, TableGroupByOptionsOf, TableRankOptions, TableRankPageOptions, TableReaderFacade, TableWriterFacade, UpsertTargetOf, Where, WhereOf, WhereOperators, WithArg };

package/dist/index.d.mts

@@ -6,8 +6,8 @@ import { LunoraError as LunoraError$1, LunoraErrorCode } from '@lunora/errors';
 export type { LunoraErrorCode } from '@lunora/errors';
 import { Context, Hono } from 'hono';
 import { WhereOperators, QueryArgs as QueryArgs$2 } from "./data-model.mjs";
-import { b as Permission, R as Role, T as TypedDefinePolicyInput, a as Policy, D as DefinePolicyInput, W as WhereInput, c as RlsOptions } from "./packem_shared/types.d-C4CMJK8x.mjs";
-export type { d as PolicyContext, e as PolicyDecision, f as PolicyDecisionOf, P as PolicyOperation } from "./packem_shared/types.d-C4CMJK8x.mjs";
+import { b as Permission, R as Role, T as TypedDefinePolicyInput, a as Policy, D as DefinePolicyInput, W as WhereInput, c as RlsOptions } from "./packem_shared/types.d-BXr-YW9j.mjs";
+export type { d as PolicyContext, e as PolicyDecision, f as PolicyDecisionOf, P as PolicyOperation } from "./packem_shared/types.d-BXr-YW9j.mjs";
 export { type CronJob, type CronJobsBuilder, type CronScheduleKind, type DailySchedule, type IntervalSchedule, type MonthlySchedule, type WeeklySchedule, cronJobs } from '@lunora/scheduler';
 /**
  * Make any resolved storage capability bucket-aware so `ctx.storage.bucket(name)`
@@ -51,7 +51,7 @@ type Middleware<ContextIn, ContextOut> = (options: {
   ctx: ContextIn;
   next: MiddlewareNext<ContextIn>;
 }) => ContextOut | Promise<ContextOut>;
-/** Options accepted by `initLunora.dataModel&lt;DM>().create(...)`. Reserved for transformer/error-formatter wiring. */
+/** Options accepted by `initLunora.dataModel<DM>().create(...)`. Reserved for transformer/error-formatter wiring. */
 type CreateOptions = Record<never, never>;
 /**
  * `Output` carries the type declared by `.output(validator)`. It defaults to
@@ -66,7 +66,7 @@ interface QueryBuilder<Context, Args extends ArgsValidator, Output = undefined>
   readonly __lunoraProcedure: "query";
   /**
    * Publish this query on the opt-in public REST surface (plan 167) — the
-   * runtime mints `GET /_lunora/rest/&lt;namespace>/&lt;fn>` (and `POST`), dispatching
+   * runtime mints `GET /_lunora/rest/<namespace>/<fn>` (and `POST`), dispatching
    * THROUGH the procedure so `ctx.auth` / RLS / validators are enforced, and the
    * generated OpenAPI describes it. Default-closed: omit to keep it RPC-only.
    */
@@ -93,7 +93,7 @@ interface QueryBuilder<Context, Args extends ArgsValidator, Output = undefined>
   }) => Output | Promise<Output>) => RegisteredQuery<Args, Output>;
   /**
    * Terminal: declare this procedure as a streaming query. The handler is an
-   * async generator (or any function returning an `AsyncIterable&lt;R>`) that
+   * async generator (or any function returning an `AsyncIterable<R>`) that
    * yields one chunk per server-pushed frame. The third `signal` argument is
    * tripped when the client cancels — break out of the loop or check
    * `signal.aborted` between yields. `.output()` does not apply: per-chunk
@@ -117,7 +117,7 @@ interface MutationBuilder<Context, Args extends ArgsValidator, Output = undefine
   readonly __lunoraProcedure: "mutation";
   /**
    * Publish this mutation on the opt-in public REST surface (plan 167) — the
-   * runtime mints `POST /_lunora/rest/&lt;namespace>/&lt;fn>`, dispatching THROUGH the
+   * runtime mints `POST /_lunora/rest/<namespace>/<fn>`, dispatching THROUGH the
    * procedure so `ctx.auth` / RLS / validators are enforced, and the generated
    * OpenAPI describes it. Default-closed: omit to keep it RPC-only.
    */
@@ -162,7 +162,7 @@ interface ActionBuilder<Context, Args extends ArgsValidator, Output = undefined>
   }) => Output | Promise<Output>) => RegisteredAction<Args, Output>;
   /**
    * Publish this action on the opt-in public REST surface (plan 167) — the
-   * runtime mints `POST /_lunora/rest/&lt;namespace>/&lt;fn>`, dispatching THROUGH the
+   * runtime mints `POST /_lunora/rest/<namespace>/<fn>`, dispatching THROUGH the
    * procedure so `ctx.auth` / RLS / validators are enforced, and the generated
    * OpenAPI describes it. Default-closed: omit to keep it RPC-only.
    */
@@ -291,7 +291,7 @@ interface DataModelInit<DataModel> {
   create: (options?: CreateOptions) => LunoraBuilders;
 }
 /**
- * Entry point for the procedure builder. `dataModel&lt;DM>()` binds the generated
+ * Entry point for the procedure builder. `dataModel<DM>()` binds the generated
  * `DataModel` (phantom for now), and `.create()` yields the public root builders
  * plus their `internal*` counterparts.
  */
@@ -482,7 +482,7 @@ interface FacadeEntry {
    * Insert many documents into this table in one call. With
    * `{ skipDuplicates: true }`, UNIQUE breaches resolve to `null` for that row
    * instead of failing the batch. The typed facade narrows the return to
-   * `Id&lt;T>[]` when skipDuplicates is not requested.
+   * `Id<T>[]` when skipDuplicates is not requested.
    */
   insertMany: (documents: ReadonlyArray<Record<string, unknown>>, options?: {
     limit?: number;
@@ -556,7 +556,7 @@ interface UpsertManyArgs {
  *
  * The by-id accessors (`get`/`delete`/`patch`/`replace`) forward the bound
  * `tableName` as `expectedTable` so the underlying writer scopes its id lookup
- * to this table. Without it, a branded `Id&lt;"posts">` carrying another table's
+ * to this table. Without it, a branded `Id<"posts">` carrying another table's
  * id would resolve cross-table (the writer probes every table by id), letting
  * `ctx.db.posts.get(foreignId)` read — or `.delete`/`.patch`/`.replace`
  * mutate — a row in an unrelated table (IDOR). Writers that ignore the second
@@ -710,7 +710,7 @@ interface HttpRouteBuilder<SearchParams extends ArgsValidator, Body extends Args
   /**
    * Terminal: declare this route as a streaming Server-Sent Events endpoint.
    * The handler is an async generator (or any function returning an
-   * `AsyncIterable&lt;R>`) that yields one chunk per SSE `data:` frame; on
+   * `AsyncIterable<R>`) that yields one chunk per SSE `data:` frame; on
    * iterator completion the route writes a final `event: complete` frame; on
    * throw, an `event: error` frame is written with `{code, message}` before
    * the stream closes. The chunks are JSON-encoded; `R` is inferred from the
@@ -957,7 +957,7 @@ interface ListArgsSpec<TDocument, F, O extends string> {
    * `limit` clamped into `[1, maxLimit]`, `orderBy` reshaped from
    * `{ field, direction }[]` into `ctx.db`'s `{ column: direction }[]`.
    *
-   * Returns `QueryArgs&lt;Doc>` — bound to the table, not free — so a mismatch
+   * Returns `QueryArgs<Doc>` — bound to the table, not free — so a mismatch
    * between what this helper declares and what the table actually holds is a
    * compile error at the `findMany` call site.
    */
@@ -967,10 +967,10 @@ interface ListArgsSpec<TDocument, F, O extends string> {
 declare const clampLimit: (limit: number | undefined, fallback: number, maxLimit: number) => number;
 /**
  * Declare the filter / sort / page arguments for a list endpoint, plus the
- * translation into `ctx.db.&lt;table>.findMany(...)` options. See the module docs
+ * translation into `ctx.db.<table>.findMany(...)` options. See the module docs
  * for the shape and the reasoning behind it.
  *
- * Curried on the document type: `defineListArgs&lt;Doc&lt;"messages">>()({ … })`. The
+ * Curried on the document type: `defineListArgs<Doc<"messages">>()({ … })`. The
  * extra `()` buys the thing that matters — with `Doc` bound, `filter` keys and
  * `orderBy` entries are checked against the table's real columns, so a typo or a
  * column renamed out from under the endpoint is a COMPILE error instead of a
@@ -1030,7 +1030,7 @@ type ExtensionTablesOf<P> = P extends {
 type InstalledTables<T extends Record<string, TableDefinition>, Plugins extends ReadonlyArray<unknown>> = Plugins extends readonly [infer Head, ...infer Rest] ? InstalledTables<ExtensionTablesOf<Head> & T, Rest> : T;
 /**
  * Union every plugin's `ContextOut` in a tuple — the type-level mirror of the
- * `ctx.api.&lt;key>` additions {@link composePluginMiddleware} accumulates as each
+ * `ctx.api.<key>` additions {@link composePluginMiddleware} accumulates as each
  * plugin middleware runs. Independent of the incoming context, which the builder
  * infers at the `.use(...)` site.
  */
@@ -1083,7 +1083,7 @@ interface Plugin<TExtension extends Record<string, TableDefinition> = Record<str
   /**
    * Optional middleware. Users attach with `c.query.use(plugin.middleware)`.
    * The middleware can extend `ctx`; convention is to attach helpers under
-   * `ctx.api.&lt;key>`, e.g.
+   * `ctx.api.<key>`, e.g.
    *
    * ```ts
    * middleware: ({ ctx, next }) =>
@@ -1228,7 +1228,7 @@ declare const installPlugins: <T extends Record<string, TableDefinition>, const
  * Compose every plugin's middleware into a single middleware you attach with one
  * `.use(...)`. Plugins without middleware (schema-only) are skipped; the rest run
  * in array order, each seeing the context the previous one widened, so the final
- * `next({ ctx })` the builder receives carries every plugin's `ctx.api.&lt;key>`
+ * `next({ ctx })` the builder receives carries every plugin's `ctx.api.<key>`
  * additions. Equivalent to `.use(a.middleware).use(b.middleware)…` but as one
  * value, the middleware sibling of {@link installPlugins}.
  *
@@ -1388,7 +1388,7 @@ interface TableBuilder<Shape extends Record<string, Validator> = Record<string,
   shardBy: (field: keyof Shape & string) => TableBuilder<Shape>;
   /**
    * Turn on soft delete. Adds a nullable timestamp column (`options.field`,
-   * default `deletedAt`) and changes `ctx.db.&lt;table>.delete()` to **set** it
+   * default `deletedAt`) and changes `ctx.db.<table>.delete()` to **set** it
    * instead of removing the row; `onDelete: "cascade"` children are recursively
    * soft-deleted too. **List reads** (`findMany`/`findFirst`/`query()`/`count`/
    * `aggregate`/relation loads) then hide soft-deleted rows unless they pass
@@ -2114,7 +2114,7 @@ declare const definePolicy: <Context = unknown>(input: DefinePolicyInput<Context
 /**
  * Build a project-bound, relation-aware `definePolicy` typed against the
  * generated `DataModel` (`DM`) + `Relations` (`REL`) maps. Codegen emits a
- * `createPolicyDsl&lt;DataModel, Relations>()` binding into `_generated/server.ts`,
+ * `createPolicyDsl<DataModel, Relations>()` binding into `_generated/server.ts`,
  * so importing `definePolicy` from the generated module constrains `table` to a
  * real table name and type-checks the `when` predicate — including Prisma-style
  * relation predicates (`is`/`some`/…) the `@lunora/do` pre-resolver now resolves

package/dist/index.d.ts

@@ -6,8 +6,8 @@ import { LunoraError as LunoraError$1, LunoraErrorCode } from '@lunora/errors';
 export type { LunoraErrorCode } from '@lunora/errors';
 import { Context, Hono } from 'hono';
 import { WhereOperators, QueryArgs as QueryArgs$2 } from "./data-model.js";
-import { b as Permission, R as Role, T as TypedDefinePolicyInput, a as Policy, D as DefinePolicyInput, W as WhereInput, c as RlsOptions } from "./packem_shared/types.d-DdYF8E18.js";
-export type { d as PolicyContext, e as PolicyDecision, f as PolicyDecisionOf, P as PolicyOperation } from "./packem_shared/types.d-DdYF8E18.js";
+import { b as Permission, R as Role, T as TypedDefinePolicyInput, a as Policy, D as DefinePolicyInput, W as WhereInput, c as RlsOptions } from "./packem_shared/types.d-D6Lv3h_-.js";
+export type { d as PolicyContext, e as PolicyDecision, f as PolicyDecisionOf, P as PolicyOperation } from "./packem_shared/types.d-D6Lv3h_-.js";
 export { type CronJob, type CronJobsBuilder, type CronScheduleKind, type DailySchedule, type IntervalSchedule, type MonthlySchedule, type WeeklySchedule, cronJobs } from '@lunora/scheduler';
 /**
  * Make any resolved storage capability bucket-aware so `ctx.storage.bucket(name)`
@@ -51,7 +51,7 @@ type Middleware<ContextIn, ContextOut> = (options: {
   ctx: ContextIn;
   next: MiddlewareNext<ContextIn>;
 }) => ContextOut | Promise<ContextOut>;
-/** Options accepted by `initLunora.dataModel&lt;DM>().create(...)`. Reserved for transformer/error-formatter wiring. */
+/** Options accepted by `initLunora.dataModel<DM>().create(...)`. Reserved for transformer/error-formatter wiring. */
 type CreateOptions = Record<never, never>;
 /**
  * `Output` carries the type declared by `.output(validator)`. It defaults to
@@ -66,7 +66,7 @@ interface QueryBuilder<Context, Args extends ArgsValidator, Output = undefined>
   readonly __lunoraProcedure: "query";
   /**
    * Publish this query on the opt-in public REST surface (plan 167) — the
-   * runtime mints `GET /_lunora/rest/&lt;namespace>/&lt;fn>` (and `POST`), dispatching
+   * runtime mints `GET /_lunora/rest/<namespace>/<fn>` (and `POST`), dispatching
    * THROUGH the procedure so `ctx.auth` / RLS / validators are enforced, and the
    * generated OpenAPI describes it. Default-closed: omit to keep it RPC-only.
    */
@@ -93,7 +93,7 @@ interface QueryBuilder<Context, Args extends ArgsValidator, Output = undefined>
   }) => Output | Promise<Output>) => RegisteredQuery<Args, Output>;
   /**
    * Terminal: declare this procedure as a streaming query. The handler is an
-   * async generator (or any function returning an `AsyncIterable&lt;R>`) that
+   * async generator (or any function returning an `AsyncIterable<R>`) that
    * yields one chunk per server-pushed frame. The third `signal` argument is
    * tripped when the client cancels — break out of the loop or check
    * `signal.aborted` between yields. `.output()` does not apply: per-chunk
@@ -117,7 +117,7 @@ interface MutationBuilder<Context, Args extends ArgsValidator, Output = undefine
   readonly __lunoraProcedure: "mutation";
   /**
    * Publish this mutation on the opt-in public REST surface (plan 167) — the
-   * runtime mints `POST /_lunora/rest/&lt;namespace>/&lt;fn>`, dispatching THROUGH the
+   * runtime mints `POST /_lunora/rest/<namespace>/<fn>`, dispatching THROUGH the
    * procedure so `ctx.auth` / RLS / validators are enforced, and the generated
    * OpenAPI describes it. Default-closed: omit to keep it RPC-only.
    */
@@ -162,7 +162,7 @@ interface ActionBuilder<Context, Args extends ArgsValidator, Output = undefined>
   }) => Output | Promise<Output>) => RegisteredAction<Args, Output>;
   /**
    * Publish this action on the opt-in public REST surface (plan 167) — the
-   * runtime mints `POST /_lunora/rest/&lt;namespace>/&lt;fn>`, dispatching THROUGH the
+   * runtime mints `POST /_lunora/rest/<namespace>/<fn>`, dispatching THROUGH the
    * procedure so `ctx.auth` / RLS / validators are enforced, and the generated
    * OpenAPI describes it. Default-closed: omit to keep it RPC-only.
    */
@@ -291,7 +291,7 @@ interface DataModelInit<DataModel> {
   create: (options?: CreateOptions) => LunoraBuilders;
 }
 /**
- * Entry point for the procedure builder. `dataModel&lt;DM>()` binds the generated
+ * Entry point for the procedure builder. `dataModel<DM>()` binds the generated
  * `DataModel` (phantom for now), and `.create()` yields the public root builders
  * plus their `internal*` counterparts.
  */
@@ -482,7 +482,7 @@ interface FacadeEntry {
    * Insert many documents into this table in one call. With
    * `{ skipDuplicates: true }`, UNIQUE breaches resolve to `null` for that row
    * instead of failing the batch. The typed facade narrows the return to
-   * `Id&lt;T>[]` when skipDuplicates is not requested.
+   * `Id<T>[]` when skipDuplicates is not requested.
    */
   insertMany: (documents: ReadonlyArray<Record<string, unknown>>, options?: {
     limit?: number;
@@ -556,7 +556,7 @@ interface UpsertManyArgs {
  *
  * The by-id accessors (`get`/`delete`/`patch`/`replace`) forward the bound
  * `tableName` as `expectedTable` so the underlying writer scopes its id lookup
- * to this table. Without it, a branded `Id&lt;"posts">` carrying another table's
+ * to this table. Without it, a branded `Id<"posts">` carrying another table's
  * id would resolve cross-table (the writer probes every table by id), letting
  * `ctx.db.posts.get(foreignId)` read — or `.delete`/`.patch`/`.replace`
  * mutate — a row in an unrelated table (IDOR). Writers that ignore the second
@@ -710,7 +710,7 @@ interface HttpRouteBuilder<SearchParams extends ArgsValidator, Body extends Args
   /**
    * Terminal: declare this route as a streaming Server-Sent Events endpoint.
    * The handler is an async generator (or any function returning an
-   * `AsyncIterable&lt;R>`) that yields one chunk per SSE `data:` frame; on
+   * `AsyncIterable<R>`) that yields one chunk per SSE `data:` frame; on
    * iterator completion the route writes a final `event: complete` frame; on
    * throw, an `event: error` frame is written with `{code, message}` before
    * the stream closes. The chunks are JSON-encoded; `R` is inferred from the
@@ -957,7 +957,7 @@ interface ListArgsSpec<TDocument, F, O extends string> {
    * `limit` clamped into `[1, maxLimit]`, `orderBy` reshaped from
    * `{ field, direction }[]` into `ctx.db`'s `{ column: direction }[]`.
    *
-   * Returns `QueryArgs&lt;Doc>` — bound to the table, not free — so a mismatch
+   * Returns `QueryArgs<Doc>` — bound to the table, not free — so a mismatch
    * between what this helper declares and what the table actually holds is a
    * compile error at the `findMany` call site.
    */
@@ -967,10 +967,10 @@ interface ListArgsSpec<TDocument, F, O extends string> {
 declare const clampLimit: (limit: number | undefined, fallback: number, maxLimit: number) => number;
 /**
  * Declare the filter / sort / page arguments for a list endpoint, plus the
- * translation into `ctx.db.&lt;table>.findMany(...)` options. See the module docs
+ * translation into `ctx.db.<table>.findMany(...)` options. See the module docs
  * for the shape and the reasoning behind it.
  *
- * Curried on the document type: `defineListArgs&lt;Doc&lt;"messages">>()({ … })`. The
+ * Curried on the document type: `defineListArgs<Doc<"messages">>()({ … })`. The
  * extra `()` buys the thing that matters — with `Doc` bound, `filter` keys and
  * `orderBy` entries are checked against the table's real columns, so a typo or a
  * column renamed out from under the endpoint is a COMPILE error instead of a
@@ -1030,7 +1030,7 @@ type ExtensionTablesOf<P> = P extends {
 type InstalledTables<T extends Record<string, TableDefinition>, Plugins extends ReadonlyArray<unknown>> = Plugins extends readonly [infer Head, ...infer Rest] ? InstalledTables<ExtensionTablesOf<Head> & T, Rest> : T;
 /**
  * Union every plugin's `ContextOut` in a tuple — the type-level mirror of the
- * `ctx.api.&lt;key>` additions {@link composePluginMiddleware} accumulates as each
+ * `ctx.api.<key>` additions {@link composePluginMiddleware} accumulates as each
  * plugin middleware runs. Independent of the incoming context, which the builder
  * infers at the `.use(...)` site.
  */
@@ -1083,7 +1083,7 @@ interface Plugin<TExtension extends Record<string, TableDefinition> = Record<str
   /**
    * Optional middleware. Users attach with `c.query.use(plugin.middleware)`.
    * The middleware can extend `ctx`; convention is to attach helpers under
-   * `ctx.api.&lt;key>`, e.g.
+   * `ctx.api.<key>`, e.g.
    *
    * ```ts
    * middleware: ({ ctx, next }) =>
@@ -1228,7 +1228,7 @@ declare const installPlugins: <T extends Record<string, TableDefinition>, const
  * Compose every plugin's middleware into a single middleware you attach with one
  * `.use(...)`. Plugins without middleware (schema-only) are skipped; the rest run
  * in array order, each seeing the context the previous one widened, so the final
- * `next({ ctx })` the builder receives carries every plugin's `ctx.api.&lt;key>`
+ * `next({ ctx })` the builder receives carries every plugin's `ctx.api.<key>`
  * additions. Equivalent to `.use(a.middleware).use(b.middleware)…` but as one
  * value, the middleware sibling of {@link installPlugins}.
  *
@@ -1388,7 +1388,7 @@ interface TableBuilder<Shape extends Record<string, Validator> = Record<string,
   shardBy: (field: keyof Shape & string) => TableBuilder<Shape>;
   /**
    * Turn on soft delete. Adds a nullable timestamp column (`options.field`,
-   * default `deletedAt`) and changes `ctx.db.&lt;table>.delete()` to **set** it
+   * default `deletedAt`) and changes `ctx.db.<table>.delete()` to **set** it
    * instead of removing the row; `onDelete: "cascade"` children are recursively
    * soft-deleted too. **List reads** (`findMany`/`findFirst`/`query()`/`count`/
    * `aggregate`/relation loads) then hide soft-deleted rows unless they pass
@@ -2114,7 +2114,7 @@ declare const definePolicy: <Context = unknown>(input: DefinePolicyInput<Context
 /**
  * Build a project-bound, relation-aware `definePolicy` typed against the
  * generated `DataModel` (`DM`) + `Relations` (`REL`) maps. Codegen emits a
- * `createPolicyDsl&lt;DataModel, Relations>()` binding into `_generated/server.ts`,
+ * `createPolicyDsl<DataModel, Relations>()` binding into `_generated/server.ts`,
  * so importing `definePolicy` from the generated module constrains `table` to a
  * real table name and type-checks the `when` predicate — including Prisma-style
  * relation predicates (`is`/`some`/…) the `@lunora/do` pre-resolver now resolves

package/dist/packem_shared/{types.d-C4CMJK8x.d.mts → types.d-BXr-YW9j.d.mts}

@@ -32,7 +32,7 @@ type PolicyDecision = WhereInput | boolean | undefined;
  * generated `DataModel` (`DM`) + `Relations` (`REL`) maps and a table `T`. A
  * read policy may now return a Prisma-style relation predicate (the
  * `@lunora/do` pre-resolver resolves it via a semijoin), so the typed
- * authoring surface accepts `WhereOf<DM, REL, T>` — column predicates **and**
+ * authoring surface accepts `WhereOf<DM, REL, T>` — column predicates **and**
  * `is`/`isNot`/`some`/`none`/`every` over `T`'s declared relations — in
  * addition to the `boolean`/`undefined` decisions. Used by the project-bound
  * `definePolicy` from `createPolicyDsl`.

package/dist/packem_shared/{types.d-DdYF8E18.d.ts → types.d-D6Lv3h_-.d.ts}

@@ -32,7 +32,7 @@ type PolicyDecision = WhereInput | boolean | undefined;
  * generated `DataModel` (`DM`) + `Relations` (`REL`) maps and a table `T`. A
  * read policy may now return a Prisma-style relation predicate (the
  * `@lunora/do` pre-resolver resolves it via a semijoin), so the typed
- * authoring surface accepts `WhereOf<DM, REL, T>` — column predicates **and**
+ * authoring surface accepts `WhereOf<DM, REL, T>` — column predicates **and**
  * `is`/`isNot`/`some`/`none`/`every` over `T`'s declared relations — in
  * addition to the `boolean`/`undefined` decisions. Used by the project-bound
  * `definePolicy` from `createPolicyDsl`.

package/dist/rls/testing.d.mts

@@ -1,4 +1,4 @@
-import { P as PolicyOperation, R as Role, a as Policy } from "../packem_shared/types.d-C4CMJK8x.mjs";
+import { P as PolicyOperation, R as Role, a as Policy } from "../packem_shared/types.d-BXr-YW9j.mjs";
 import "../data-model.mjs";
 /**
  * The slice of a request identity a policy reads. Mirrors the

package/dist/rls/testing.d.ts

@@ -1,4 +1,4 @@
-import { P as PolicyOperation, R as Role, a as Policy } from "../packem_shared/types.d-DdYF8E18.js";
+import { P as PolicyOperation, R as Role, a as Policy } from "../packem_shared/types.d-D6Lv3h_-.js";
 import "../data-model.js";
 /**
  * The slice of a request identity a policy reads. Mirrors the

package/dist/types.d.mts

@@ -418,7 +418,7 @@ interface TableDefinition<Shape extends Record<string, Validator> = Record<strin
    * data field doesn't collide with the fluent `.softDelete()` builder method —
    * same convention as `shardBy()`/`shardMode`). When present, the table carries
    * a nullable timestamp column (`field`, default `deletedAt`):
-   * `ctx.db.&lt;table>.delete()` flips it instead of physically removing the row,
+   * `ctx.db.<table>.delete()` flips it instead of physically removing the row,
    * and **list reads** (`findMany`/`findFirst`/`query()`/`count`/`aggregate`/
    * relation loads) hide rows whose `field` is set unless
    * `includeDeleted: true` is passed. By-id `get`/`patch`/`replace` and
@@ -524,7 +524,7 @@ type RestCacheConfig = RestCachePolicy;
 /**
  * Opt-in public-surface tag attached by the `.expose({ rest: true })` builder
  * modifier (plan 167). Marks a procedure as deliberately published over the
- * public REST surface: the runtime mints a `/_lunora/rest/&lt;namespace>/&lt;fn>` route
+ * public REST surface: the runtime mints a `/_lunora/rest/<namespace>/<fn>` route
  * that dispatches THROUGH the procedure (so `ctx.auth` / RLS / validators are
  * enforced), and the generated OpenAPI describes it. Everything is default-closed
  * — a procedure without this tag is unreachable over REST.
@@ -571,7 +571,7 @@ type RegisteredMutation<A extends ArgsValidator, R> = RegisteredFunction<A, R, "
 type RegisteredAction<A extends ArgsValidator, R> = RegisteredFunction<A, R, "action">;
 /**
  * Structural mirror of `@lunora/client`'s `FunctionReference` — the handle the
- * generated `api` / `internal` objects hand you, carrying `&lt;file>:&lt;function>`
+ * generated `api` / `internal` objects hand you, carrying `<file>:<function>`
  * in `__lunoraRef`. Redeclared here so `@lunora/server` needs no dependency on
  * the client package, exactly as {@link Scheduler} avoids one on
  * `@lunora/scheduler`. `RegisteredFunction` has no `__lunoraRef`, so the two
@@ -593,8 +593,8 @@ interface FunctionHandle<Kind extends "action" | "mutation" | "query" | "stream"
  * contextually type a parameter against a multi-signature type, so a hand-built
  * ctx object must annotate its `(reference, args)` explicitly — see
  * `@lunora/testing`'s harness). It does not work: a concrete
- * `RegisteredQuery&lt;{…}, number>` is not assignable to a
- * `RegisteredFunction&lt;ArgsValidator, …>` constraint, because `handler`'s args
+ * `RegisteredQuery<{…}, number>` is not assignable to a
+ * `RegisteredFunction<ArgsValidator, …>` constraint, because `handler`'s args
  * are in a contravariant position. Two inference sites it is.
  */
 interface RunQuery {
@@ -638,7 +638,7 @@ type RegisteredLifecycleHook = RegisteredFunction<Record<string, never>, void, "
 };
 /**
  * A streaming query registration. Unlike {@link RegisteredFunction} the handler
- * returns an `AsyncIterable&lt;R>` synchronously (it does NOT `Promise&lt;R>`); the
+ * returns an `AsyncIterable<R>` synchronously (it does NOT `Promise<R>`); the
  * runtime drives it frame by frame and forwards each chunk to the caller. The
  * third `signal` argument is wired to the caller's cancel signal so the handler
  * can stop early — break out of the loop or check `signal.aborted` between
@@ -689,7 +689,7 @@ interface SystemQuery<T extends SystemTableName> {
  * Read-only reader over Lunora's system tables (`_scheduled_functions`,
  * `_storage`), exposed as `ctx.db.system`. Mirrors Convex's `ctx.db.system`.
  *
- * **Best-effort and eventually consistent.** Unlike `ctx.db.&lt;table>` — which
+ * **Best-effort and eventually consistent.** Unlike `ctx.db.<table>` — which
  * reads the shard's transactional SQLite snapshot — the data behind these tables
  * lives OUTSIDE the shard (scheduled functions in the `SchedulerDO`, storage
  * objects in R2). Every `collect()` / `get()` reaches across to that source.
@@ -728,7 +728,7 @@ interface DatabaseReader {
    *
    * This is the **parse boundary** for an id that arrived as a plain `string`: a
    * wire payload, a mutator's args, a change plan computed on the client. The
-   * alternative is `value as Id&lt;"table">` at every such call site — an assertion,
+   * alternative is `value as Id<"table">` at every such call site — an assertion,
    * not a check, and one that has to be repeated for every table a helper is
    * generic over:
    *
@@ -794,8 +794,8 @@ interface PaginationResult<T = Record<string, unknown>> {
 }
 /**
  * The fluent `ctx.db.query(table)` reader. Generic over the document type
- * `Row` so the generated `ctx.db` can bind it to `Doc&lt;table>` (the chain and
- * every terminal then resolve typed rows — no `as unknown as Doc&lt;...>` casts),
+ * `Row` so the generated `ctx.db` can bind it to `Doc<table>` (the chain and
+ * every terminal then resolve typed rows — no `as unknown as Doc<...>` casts),
  * and over the table's declared index names so `.withIndex()` / `.withSearchIndex()`
  * / `.withGeoIndex()` reject a name the table does not declare.
  *
@@ -815,9 +815,9 @@ interface PaginationResult<T = Record<string, unknown>> {
  * **Why `with*` are method signatures and everything else is a property.**
  * Narrowing a parameter makes the enclosing type contravariant in it, so as
  * function properties these would make a BOUND reader
- * (`TableReader&lt;Doc, "by_x">`, what `ctx.db.query(t)` returns) unassignable to
- * the unbound `TableReader&lt;Doc>` — quietly breaking every helper factored as
- * `(reader: TableReader&lt;Doc&lt;"users">>) => …`, which is the obvious way to share
+ * (`TableReader<Doc, "by_x">`, what `ctx.db.query(t)` returns) unassignable to
+ * the unbound `TableReader<Doc>` — quietly breaking every helper factored as
+ * `(reader: TableReader<Doc<"users">>) => …`, which is the obvious way to share
  * query logic. A method signature is bivariant in its parameters, which keeps
  * that direction working while the narrow parameter still rejects an undeclared
  * name at the call site. Both directions are pinned in `types.test-d.ts`.
@@ -1122,8 +1122,8 @@ interface ScheduledJob {
   shardKey?: string;
 }
 /**
- * A schedulable durable-workflow reference — the generated `workflows.&lt;name>` /
- * `agents.&lt;name>` object, which carries its `WORKFLOW_*`/`AGENT_*` binding and
+ * A schedulable durable-workflow reference — the generated `workflows.<name>` /
+ * `agents.<name>` object, which carries its `WORKFLOW_*`/`AGENT_*` binding and
  * stable name. Structural mirror of `@lunora/scheduler`'s `WorkflowReference` so
  * `ctx.scheduler` can target a workflow/agent without a dependency on
  * `@lunora/scheduler` / `@lunora/workflow`. A scheduled workflow target starts a
@@ -1147,8 +1147,8 @@ interface Scheduler {
   list: () => Promise<ScheduledJob[]>;
   /**
    * Schedule a one-shot run `delayMs` from now. `target` is a function path
-   * (`"ns:fn"`) dispatched as a one-shot, or a generated `workflows.&lt;name>` /
-   * `agents.&lt;name>` reference which starts a fresh durable instance on fire
+   * (`"ns:fn"`) dispatched as a one-shot, or a generated `workflows.<name>` /
+   * `agents.<name>` reference which starts a fresh durable instance on fire
    * (the args become its `params`).
    */
   runAfter: (delayMs: number, target: SchedulableWorkflowReference | string, args?: Record<string, unknown>) => Promise<string>;
@@ -1370,12 +1370,12 @@ interface TriggerRankPageOptions {
 /**
  * Portable, table/id-addressed ORM writer handed to trigger handlers via
  * `ctx.db`. Mirrors `@lunora/do`'s runtime `DatabaseWriterLike` surface — it is
- * **not** the generated per-table `ctx.db.&lt;table>` facade (which can't be typed
+ * **not** the generated per-table `ctx.db.<table>` facade (which can't be typed
  * from inside `defineTable`, where the full schema isn't known).
  *
  * `aggregate`/`groupBy`/`count`/`rank`/`rankPage` route through the same
  * trigger-maintained counter and rank tables the user-facing reader uses, so
- * a handler's `ctx.db.&lt;table>.aggregate(...)` observes the just-staged write
+ * a handler's `ctx.db.<table>.aggregate(...)` observes the just-staged write
  * within the same DO transaction (the counter step happens before the trigger
  * fires).
  */
@@ -1562,7 +1562,7 @@ interface VectorSearch<IndexName extends string = string> extends VectorSearchRe
 }
 /**
  * Structured, filterable key/value fields attached to a log line — the second
- * argument of a `ctx.log.&lt;level>(message, fields)` call, or the fields bound by
+ * argument of a `ctx.log.<level>(message, fields)` call, or the fields bound by
  * `ctx.log.with(fields)`. They travel to an `ObservabilitySink`'s `onLog` and,
  * for a network sink, become OTLP log-record attributes a log pipeline (or the
  * Cloud log viewer) can filter and index on. Primitive values pass through;
@@ -1682,7 +1682,7 @@ interface SpanHandle {
   addLink: (link: SpanLink) => void;
   /**
    * Attach an AI **evaluation** verdict to this (generation) span as the
-   * `gen_ai.evaluation.&lt;name>.score` / `.label` OpenTelemetry attributes, so a
+   * `gen_ai.evaluation.<name>.score` / `.label` OpenTelemetry attributes, so a
    * scorer's grade rides the same trace as the generation it graded. Convenience
    * over {@link SpanHandle.setAttributes} that owns the key format; privacy-safe —
    * only the name, score, and optional label are emitted. Throws on an empty name

package/dist/types.d.ts

@@ -418,7 +418,7 @@ interface TableDefinition<Shape extends Record<string, Validator> = Record<strin
    * data field doesn't collide with the fluent `.softDelete()` builder method —
    * same convention as `shardBy()`/`shardMode`). When present, the table carries
    * a nullable timestamp column (`field`, default `deletedAt`):
-   * `ctx.db.&lt;table>.delete()` flips it instead of physically removing the row,
+   * `ctx.db.<table>.delete()` flips it instead of physically removing the row,
    * and **list reads** (`findMany`/`findFirst`/`query()`/`count`/`aggregate`/
    * relation loads) hide rows whose `field` is set unless
    * `includeDeleted: true` is passed. By-id `get`/`patch`/`replace` and
@@ -524,7 +524,7 @@ type RestCacheConfig = RestCachePolicy;
 /**
  * Opt-in public-surface tag attached by the `.expose({ rest: true })` builder
  * modifier (plan 167). Marks a procedure as deliberately published over the
- * public REST surface: the runtime mints a `/_lunora/rest/&lt;namespace>/&lt;fn>` route
+ * public REST surface: the runtime mints a `/_lunora/rest/<namespace>/<fn>` route
  * that dispatches THROUGH the procedure (so `ctx.auth` / RLS / validators are
  * enforced), and the generated OpenAPI describes it. Everything is default-closed
  * — a procedure without this tag is unreachable over REST.
@@ -571,7 +571,7 @@ type RegisteredMutation<A extends ArgsValidator, R> = RegisteredFunction<A, R, "
 type RegisteredAction<A extends ArgsValidator, R> = RegisteredFunction<A, R, "action">;
 /**
  * Structural mirror of `@lunora/client`'s `FunctionReference` — the handle the
- * generated `api` / `internal` objects hand you, carrying `&lt;file>:&lt;function>`
+ * generated `api` / `internal` objects hand you, carrying `<file>:<function>`
  * in `__lunoraRef`. Redeclared here so `@lunora/server` needs no dependency on
  * the client package, exactly as {@link Scheduler} avoids one on
  * `@lunora/scheduler`. `RegisteredFunction` has no `__lunoraRef`, so the two
@@ -593,8 +593,8 @@ interface FunctionHandle<Kind extends "action" | "mutation" | "query" | "stream"
  * contextually type a parameter against a multi-signature type, so a hand-built
  * ctx object must annotate its `(reference, args)` explicitly — see
  * `@lunora/testing`'s harness). It does not work: a concrete
- * `RegisteredQuery&lt;{…}, number>` is not assignable to a
- * `RegisteredFunction&lt;ArgsValidator, …>` constraint, because `handler`'s args
+ * `RegisteredQuery<{…}, number>` is not assignable to a
+ * `RegisteredFunction<ArgsValidator, …>` constraint, because `handler`'s args
  * are in a contravariant position. Two inference sites it is.
  */
 interface RunQuery {
@@ -638,7 +638,7 @@ type RegisteredLifecycleHook = RegisteredFunction<Record<string, never>, void, "
 };
 /**
  * A streaming query registration. Unlike {@link RegisteredFunction} the handler
- * returns an `AsyncIterable&lt;R>` synchronously (it does NOT `Promise&lt;R>`); the
+ * returns an `AsyncIterable<R>` synchronously (it does NOT `Promise<R>`); the
  * runtime drives it frame by frame and forwards each chunk to the caller. The
  * third `signal` argument is wired to the caller's cancel signal so the handler
  * can stop early — break out of the loop or check `signal.aborted` between
@@ -689,7 +689,7 @@ interface SystemQuery<T extends SystemTableName> {
  * Read-only reader over Lunora's system tables (`_scheduled_functions`,
  * `_storage`), exposed as `ctx.db.system`. Mirrors Convex's `ctx.db.system`.
  *
- * **Best-effort and eventually consistent.** Unlike `ctx.db.&lt;table>` — which
+ * **Best-effort and eventually consistent.** Unlike `ctx.db.<table>` — which
  * reads the shard's transactional SQLite snapshot — the data behind these tables
  * lives OUTSIDE the shard (scheduled functions in the `SchedulerDO`, storage
  * objects in R2). Every `collect()` / `get()` reaches across to that source.
@@ -728,7 +728,7 @@ interface DatabaseReader {
    *
    * This is the **parse boundary** for an id that arrived as a plain `string`: a
    * wire payload, a mutator's args, a change plan computed on the client. The
-   * alternative is `value as Id&lt;"table">` at every such call site — an assertion,
+   * alternative is `value as Id<"table">` at every such call site — an assertion,
    * not a check, and one that has to be repeated for every table a helper is
    * generic over:
    *
@@ -794,8 +794,8 @@ interface PaginationResult<T = Record<string, unknown>> {
 }
 /**
  * The fluent `ctx.db.query(table)` reader. Generic over the document type
- * `Row` so the generated `ctx.db` can bind it to `Doc&lt;table>` (the chain and
- * every terminal then resolve typed rows — no `as unknown as Doc&lt;...>` casts),
+ * `Row` so the generated `ctx.db` can bind it to `Doc<table>` (the chain and
+ * every terminal then resolve typed rows — no `as unknown as Doc<...>` casts),
  * and over the table's declared index names so `.withIndex()` / `.withSearchIndex()`
  * / `.withGeoIndex()` reject a name the table does not declare.
  *
@@ -815,9 +815,9 @@ interface PaginationResult<T = Record<string, unknown>> {
  * **Why `with*` are method signatures and everything else is a property.**
  * Narrowing a parameter makes the enclosing type contravariant in it, so as
  * function properties these would make a BOUND reader
- * (`TableReader&lt;Doc, "by_x">`, what `ctx.db.query(t)` returns) unassignable to
- * the unbound `TableReader&lt;Doc>` — quietly breaking every helper factored as
- * `(reader: TableReader&lt;Doc&lt;"users">>) => …`, which is the obvious way to share
+ * (`TableReader<Doc, "by_x">`, what `ctx.db.query(t)` returns) unassignable to
+ * the unbound `TableReader<Doc>` — quietly breaking every helper factored as
+ * `(reader: TableReader<Doc<"users">>) => …`, which is the obvious way to share
  * query logic. A method signature is bivariant in its parameters, which keeps
  * that direction working while the narrow parameter still rejects an undeclared
  * name at the call site. Both directions are pinned in `types.test-d.ts`.
@@ -1122,8 +1122,8 @@ interface ScheduledJob {
   shardKey?: string;
 }
 /**
- * A schedulable durable-workflow reference — the generated `workflows.&lt;name>` /
- * `agents.&lt;name>` object, which carries its `WORKFLOW_*`/`AGENT_*` binding and
+ * A schedulable durable-workflow reference — the generated `workflows.<name>` /
+ * `agents.<name>` object, which carries its `WORKFLOW_*`/`AGENT_*` binding and
  * stable name. Structural mirror of `@lunora/scheduler`'s `WorkflowReference` so
  * `ctx.scheduler` can target a workflow/agent without a dependency on
  * `@lunora/scheduler` / `@lunora/workflow`. A scheduled workflow target starts a
@@ -1147,8 +1147,8 @@ interface Scheduler {
   list: () => Promise<ScheduledJob[]>;
   /**
    * Schedule a one-shot run `delayMs` from now. `target` is a function path
-   * (`"ns:fn"`) dispatched as a one-shot, or a generated `workflows.&lt;name>` /
-   * `agents.&lt;name>` reference which starts a fresh durable instance on fire
+   * (`"ns:fn"`) dispatched as a one-shot, or a generated `workflows.<name>` /
+   * `agents.<name>` reference which starts a fresh durable instance on fire
    * (the args become its `params`).
    */
   runAfter: (delayMs: number, target: SchedulableWorkflowReference | string, args?: Record<string, unknown>) => Promise<string>;
@@ -1370,12 +1370,12 @@ interface TriggerRankPageOptions {
 /**
  * Portable, table/id-addressed ORM writer handed to trigger handlers via
  * `ctx.db`. Mirrors `@lunora/do`'s runtime `DatabaseWriterLike` surface — it is
- * **not** the generated per-table `ctx.db.&lt;table>` facade (which can't be typed
+ * **not** the generated per-table `ctx.db.<table>` facade (which can't be typed
  * from inside `defineTable`, where the full schema isn't known).
  *
  * `aggregate`/`groupBy`/`count`/`rank`/`rankPage` route through the same
  * trigger-maintained counter and rank tables the user-facing reader uses, so
- * a handler's `ctx.db.&lt;table>.aggregate(...)` observes the just-staged write
+ * a handler's `ctx.db.<table>.aggregate(...)` observes the just-staged write
  * within the same DO transaction (the counter step happens before the trigger
  * fires).
  */
@@ -1562,7 +1562,7 @@ interface VectorSearch<IndexName extends string = string> extends VectorSearchRe
 }
 /**
  * Structured, filterable key/value fields attached to a log line — the second
- * argument of a `ctx.log.&lt;level>(message, fields)` call, or the fields bound by
+ * argument of a `ctx.log.<level>(message, fields)` call, or the fields bound by
  * `ctx.log.with(fields)`. They travel to an `ObservabilitySink`'s `onLog` and,
  * for a network sink, become OTLP log-record attributes a log pipeline (or the
  * Cloud log viewer) can filter and index on. Primitive values pass through;
@@ -1682,7 +1682,7 @@ interface SpanHandle {
   addLink: (link: SpanLink) => void;
   /**
    * Attach an AI **evaluation** verdict to this (generation) span as the
-   * `gen_ai.evaluation.&lt;name>.score` / `.label` OpenTelemetry attributes, so a
+   * `gen_ai.evaluation.<name>.score` / `.label` OpenTelemetry attributes, so a
    * scorer's grade rides the same trace as the generation it graded. Convenience
    * over {@link SpanHandle.setAttributes} that owns the key format; privacy-safe —
    * only the name, score, and optional label are emitted. Throws on an empty name

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/server",
-  "version": "1.0.0-alpha.61",
+  "version": "1.0.0-alpha.62",
   "description": "Server primitives for Lunora: defineSchema, defineTable, query, mutation, and action",
   "keywords": [
     "backend",
@@ -66,9 +66,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.13",
-    "@lunora/scheduler": "1.0.0-alpha.20",
-    "@lunora/values": "1.0.0-alpha.18",
+    "@lunora/errors": "1.0.0-alpha.14",
+    "@lunora/scheduler": "1.0.0-alpha.21",
+    "@lunora/values": "1.0.0-alpha.19",
     "drizzle-orm": "^0.45.2",
     "hono": "^4.12.32"
   },