@lunora/server 1.0.0-alpha.61 → 1.0.0-alpha.63

package/dist/index.d.mts

@@ -6,8 +6,8 @@ import { LunoraError as LunoraError$1, LunoraErrorCode } from '@lunora/errors';
 export type { LunoraErrorCode } from '@lunora/errors';
 import { Context, Hono } from 'hono';
 import { WhereOperators, QueryArgs as QueryArgs$2 } from "./data-model.mjs";
-import { b as Permission, R as Role, T as TypedDefinePolicyInput, a as Policy, D as DefinePolicyInput, W as WhereInput, c as RlsOptions } from "./packem_shared/types.d-C4CMJK8x.mjs";
-export type { d as PolicyContext, e as PolicyDecision, f as PolicyDecisionOf, P as PolicyOperation } from "./packem_shared/types.d-C4CMJK8x.mjs";
+import { W as WhereInput, a as Policy, b as RlsOptions, c as Permission, R as Role, T as TypedDefinePolicyInput, D as DefinePolicyInput } from "./packem_shared/types.d-B-pIn8rE.mjs";
+export type { d as PolicyContext, e as PolicyDecision, f as PolicyDecisionOf, P as PolicyOperation } from "./packem_shared/types.d-B-pIn8rE.mjs";
 export { type CronJob, type CronJobsBuilder, type CronScheduleKind, type DailySchedule, type IntervalSchedule, type MonthlySchedule, type WeeklySchedule, cronJobs } from '@lunora/scheduler';
 /**
  * Make any resolved storage capability bucket-aware so `ctx.storage.bucket(name)`
@@ -51,7 +51,7 @@ type Middleware<ContextIn, ContextOut> = (options: {
   ctx: ContextIn;
   next: MiddlewareNext<ContextIn>;
 }) => ContextOut | Promise<ContextOut>;
-/** Options accepted by `initLunora.dataModel&lt;DM>().create(...)`. Reserved for transformer/error-formatter wiring. */
+/** Options accepted by `initLunora.dataModel<DM>().create(...)`. Reserved for transformer/error-formatter wiring. */
 type CreateOptions = Record<never, never>;
 /**
  * `Output` carries the type declared by `.output(validator)`. It defaults to
@@ -66,7 +66,7 @@ interface QueryBuilder<Context, Args extends ArgsValidator, Output = undefined>
   readonly __lunoraProcedure: "query";
   /**
    * Publish this query on the opt-in public REST surface (plan 167) — the
-   * runtime mints `GET /_lunora/rest/&lt;namespace>/&lt;fn>` (and `POST`), dispatching
+   * runtime mints `GET /_lunora/rest/<namespace>/<fn>` (and `POST`), dispatching
    * THROUGH the procedure so `ctx.auth` / RLS / validators are enforced, and the
    * generated OpenAPI describes it. Default-closed: omit to keep it RPC-only.
    */
@@ -93,7 +93,7 @@ interface QueryBuilder<Context, Args extends ArgsValidator, Output = undefined>
   }) => Output | Promise<Output>) => RegisteredQuery<Args, Output>;
   /**
    * Terminal: declare this procedure as a streaming query. The handler is an
-   * async generator (or any function returning an `AsyncIterable&lt;R>`) that
+   * async generator (or any function returning an `AsyncIterable<R>`) that
    * yields one chunk per server-pushed frame. The third `signal` argument is
    * tripped when the client cancels — break out of the loop or check
    * `signal.aborted` between yields. `.output()` does not apply: per-chunk
@@ -117,7 +117,7 @@ interface MutationBuilder<Context, Args extends ArgsValidator, Output = undefine
   readonly __lunoraProcedure: "mutation";
   /**
    * Publish this mutation on the opt-in public REST surface (plan 167) — the
-   * runtime mints `POST /_lunora/rest/&lt;namespace>/&lt;fn>`, dispatching THROUGH the
+   * runtime mints `POST /_lunora/rest/<namespace>/<fn>`, dispatching THROUGH the
    * procedure so `ctx.auth` / RLS / validators are enforced, and the generated
    * OpenAPI describes it. Default-closed: omit to keep it RPC-only.
    */
@@ -162,7 +162,7 @@ interface ActionBuilder<Context, Args extends ArgsValidator, Output = undefined>
   }) => Output | Promise<Output>) => RegisteredAction<Args, Output>;
   /**
    * Publish this action on the opt-in public REST surface (plan 167) — the
-   * runtime mints `POST /_lunora/rest/&lt;namespace>/&lt;fn>`, dispatching THROUGH the
+   * runtime mints `POST /_lunora/rest/<namespace>/<fn>`, dispatching THROUGH the
    * procedure so `ctx.auth` / RLS / validators are enforced, and the generated
    * OpenAPI describes it. Default-closed: omit to keep it RPC-only.
    */
@@ -291,7 +291,7 @@ interface DataModelInit<DataModel> {
   create: (options?: CreateOptions) => LunoraBuilders;
 }
 /**
- * Entry point for the procedure builder. `dataModel&lt;DM>()` binds the generated
+ * Entry point for the procedure builder. `dataModel<DM>()` binds the generated
  * `DataModel` (phantom for now), and `.create()` yields the public root builders
  * plus their `internal*` counterparts.
  */
@@ -482,7 +482,7 @@ interface FacadeEntry {
    * Insert many documents into this table in one call. With
    * `{ skipDuplicates: true }`, UNIQUE breaches resolve to `null` for that row
    * instead of failing the batch. The typed facade narrows the return to
-   * `Id&lt;T>[]` when skipDuplicates is not requested.
+   * `Id<T>[]` when skipDuplicates is not requested.
    */
   insertMany: (documents: ReadonlyArray<Record<string, unknown>>, options?: {
     limit?: number;
@@ -556,7 +556,7 @@ interface UpsertManyArgs {
  *
  * The by-id accessors (`get`/`delete`/`patch`/`replace`) forward the bound
  * `tableName` as `expectedTable` so the underlying writer scopes its id lookup
- * to this table. Without it, a branded `Id&lt;"posts">` carrying another table's
+ * to this table. Without it, a branded `Id<"posts">` carrying another table's
  * id would resolve cross-table (the writer probes every table by id), letting
  * `ctx.db.posts.get(foreignId)` read — or `.delete`/`.patch`/`.replace`
  * mutate — a row in an unrelated table (IDOR). Writers that ignore the second
@@ -710,7 +710,7 @@ interface HttpRouteBuilder<SearchParams extends ArgsValidator, Body extends Args
   /**
    * Terminal: declare this route as a streaming Server-Sent Events endpoint.
    * The handler is an async generator (or any function returning an
-   * `AsyncIterable&lt;R>`) that yields one chunk per SSE `data:` frame; on
+   * `AsyncIterable<R>`) that yields one chunk per SSE `data:` frame; on
    * iterator completion the route writes a final `event: complete` frame; on
    * throw, an `event: error` frame is written with `{code, message}` before
    * the stream closes. The chunks are JSON-encoded; `R` is inferred from the
@@ -957,7 +957,7 @@ interface ListArgsSpec<TDocument, F, O extends string> {
    * `limit` clamped into `[1, maxLimit]`, `orderBy` reshaped from
    * `{ field, direction }[]` into `ctx.db`'s `{ column: direction }[]`.
    *
-   * Returns `QueryArgs&lt;Doc>` — bound to the table, not free — so a mismatch
+   * Returns `QueryArgs<Doc>` — bound to the table, not free — so a mismatch
    * between what this helper declares and what the table actually holds is a
    * compile error at the `findMany` call site.
    */
@@ -967,10 +967,10 @@ interface ListArgsSpec<TDocument, F, O extends string> {
 declare const clampLimit: (limit: number | undefined, fallback: number, maxLimit: number) => number;
 /**
  * Declare the filter / sort / page arguments for a list endpoint, plus the
- * translation into `ctx.db.&lt;table>.findMany(...)` options. See the module docs
+ * translation into `ctx.db.<table>.findMany(...)` options. See the module docs
  * for the shape and the reasoning behind it.
  *
- * Curried on the document type: `defineListArgs&lt;Doc&lt;"messages">>()({ … })`. The
+ * Curried on the document type: `defineListArgs<Doc<"messages">>()({ … })`. The
  * extra `()` buys the thing that matters — with `Doc` bound, `filter` keys and
  * `orderBy` entries are checked against the table's real columns, so a typo or a
  * column renamed out from under the endpoint is a COMPILE error instead of a
@@ -1012,6 +1012,248 @@ interface ShardRankPageResultLike {
   hasMore: boolean;
   rows: ReadonlyArray<RankPageRowLike>;
 }
+/**
+ * Structural mirror of `@lunora/do`'s `QueryArgs` and `CountArgs`. The
+ * runtime ORM in `@lunora/do`/`@lunora/d1` reads `baseWhere` /
+ * `restrictsCounts` straight off these option objects, so as long as the
+ * fields here stay name-compatible the wrapper is portable across the two
+ * dialects without an inter-package dependency.
+ */
+interface QueryArgs$1 {
+  baseWhere?: WhereInput;
+  cursor?: null | string;
+  limit?: number;
+  orderBy?: ReadonlyArray<unknown>;
+  /**
+   * Per-target-table read filter the RLS wrapper attaches so a `with` relation
+   * is policy-filtered on its own hop (see `@lunora/do`'s `QueryArgs`). Mirrors
+   * the top-level read: `(table) => readBase(table).baseWhere`.
+   */
+  relationBaseWhere?: (table: string) => undefined | WhereInput;
+  restrictsCounts?: boolean;
+  where?: WhereInput;
+  with?: Record<string, unknown>;
+}
+interface CountArgs {
+  baseWhere?: WhereInput;
+  relationBaseWhere?: (table: string) => undefined | WhereInput;
+  restrictsCounts?: boolean;
+  where?: WhereInput;
+}
+/** Structural mirror of `@lunora/do`'s `AggregateOptions` — only the fields the wrapper touches. */
+interface AggregateArgs$1 {
+  baseWhere?: WhereInput;
+  field?: string;
+  op: string;
+  relationBaseWhere?: (table: string) => undefined | WhereInput;
+  restrictsCounts?: boolean;
+  where?: WhereInput;
+}
+/** Structural mirror of `@lunora/do`'s `GroupByOptions`. */
+interface GroupByArgs$1 {
+  agg?: {
+    field?: string;
+    op: string;
+  };
+  baseWhere?: WhereInput;
+  by: ReadonlyArray<string>;
+  relationBaseWhere?: (table: string) => undefined | WhereInput;
+  restrictsCounts?: boolean;
+  where?: WhereInput;
+}
+/** Structural mirror of `@lunora/do`'s `RankOptions`. */
+interface RankArgs {
+  baseWhere?: WhereInput;
+  restrictsCounts?: boolean;
+  row: Record<string, unknown> | string;
+  where?: WhereInput;
+}
+/** Structural mirror of `@lunora/do`'s `RankBeforeOptions`. */
+interface RankBeforeArgs {
+  partitionKey: string;
+  restrictsCounts?: boolean;
+  rowId: string;
+  sortValues: ReadonlyArray<unknown>;
+}
+/** Structural mirror of `@lunora/do`'s `RankPageOptions`. */
+interface RankPageArgs {
+  baseWhere?: WhereInput;
+  cursor?: null | string;
+  restrictsCounts?: boolean;
+  take?: number;
+  where?: WhereInput;
+}
+interface QueryPage$1 {
+  continueCursor: null | string;
+  isDone: boolean;
+  page: Record<string, unknown>[];
+}
+interface TableReaderLike$1 {
+  collect: () => Promise<Record<string, unknown>[]>;
+  filter: (predicate: (document: Record<string, unknown>) => boolean) => TableReaderLike$1;
+  first: () => Promise<Record<string, unknown> | null>;
+  paginate: (options: {
+    cursor?: null | string;
+    numItems: number;
+  }) => Promise<QueryPage$1>;
+  take: (limit: number) => Promise<Record<string, unknown>[]>;
+  withGeoIndex: (indexName: string, build: (q: unknown) => unknown) => TableReaderLike$1;
+  withIndex: (indexName: string, range?: (q: unknown) => unknown) => TableReaderLike$1;
+  withSearchIndex: (indexName: string, search: (q: unknown) => unknown) => TableReaderLike$1;
+}
+/**
+ * Structural projection of the runtime ORM writer. The wrapper relies only
+ * on these fields, so it's interchangeable between `@lunora/do`'s
+ * `DatabaseWriterLike` and `@lunora/d1`'s `DatabaseWriterLike`.
+ */
+interface DatabaseWriterLike {
+  /**
+   * Reduce matching rows to a scalar. The RLS wrapper AND-merges the read
+   * `baseWhere` into `options` so the reduction only sees policy-visible rows
+   * (safe: an aggregate scoped to `where` never reveals a hidden row — see
+   * `@lunora/do`'s `RestrictableQueryOptions`). Required: the only writer ever
+   * wrapped is `@lunora/do`'s `createShardCtxDb`, which always implements it.
+   */
+  aggregate: (tableName: string, options: AggregateArgs$1) => Promise<null | number>;
+  count: (tableName: string, whereOrArgs?: CountArgs | WhereInput) => Promise<number>;
+  delete: (id: string, expectedTable?: string, options?: {
+    hard?: boolean;
+  }) => Promise<void>;
+  /** Uncapped, chunked erase of a whole table. The RLS wrapper gates each row like a single delete. */
+  deleteAll?: (tableName: string, options?: {
+    chunkSize?: number;
+    hard?: boolean;
+  }) => Promise<{
+    deleted: number;
+  }>;
+  deleteMany: (ids: ReadonlyArray<string>, options?: {
+    limit?: number;
+  }, expectedTable?: string) => Promise<{
+    deleted: number;
+  }>;
+  deleteWhere?: (tableName: string, where: WhereInput, options?: {
+    limit?: number;
+  }) => Promise<{
+    deleted: number;
+  }>;
+  findFirst: (tableName: string, args?: QueryArgs$1) => Promise<Record<string, unknown> | null>;
+  findFirstOrThrow: (tableName: string, args?: QueryArgs$1) => Promise<Record<string, unknown>>;
+  findMany: (tableName: string, args?: QueryArgs$1) => Promise<QueryPage$1>;
+  get: (id: string, expectedTable?: string) => Promise<Record<string, unknown> | null>;
+  /**
+   * Group + reduce. Same `baseWhere` injection as `aggregate`: the per-group
+   * reduction is scoped to policy-visible rows, so a group count tallies only
+   * rows the caller may read. Required for the same reason as `aggregate`.
+   */
+  groupBy: (tableName: string, options: GroupByArgs$1) => Promise<ReadonlyArray<{
+    key: Record<string, unknown>;
+    value: null | number;
+  }>>;
+  insert: (tableName: string, document: Record<string, unknown>) => Promise<string>;
+  insertMany: (tableName: string, documents: ReadonlyArray<Record<string, unknown>>, options?: {
+    limit?: number;
+    skipDuplicates?: boolean;
+  }) => Promise<(string | null)[]>;
+  insertManyUnsafe: (tableName: string, documents: ReadonlyArray<Record<string, unknown>>, options?: {
+    allowExplicitId?: boolean;
+    limit?: number;
+  }) => Promise<string[]>;
+  /**
+   * Optional table-aware lookup. The underlying writer (e.g. `@lunora/do`)
+   * already knows the owning table of an id internally, so it can return
+   * `{ row, tableName }` in a single round-trip. When present, the RLS wrapper
+   * uses it to collapse the per-call membership-probe fan-out (1 `get` + N
+   * `findFirst` across every policy table) down to one lookup. Writers that
+   * don't implement it fall back to the probe path.
+   */
+  lookupById?: (id: string, expectedTable?: string) => Promise<null | {
+    row: Record<string, unknown>;
+    tableName: string;
+  }>;
+  patch: (id: string, patch: Record<string, unknown>, expectedTable?: string) => Promise<void>;
+  patchMany: (patches: ReadonlyArray<{
+    id: string;
+    patch: Record<string, unknown>;
+  }>, options?: {
+    limit?: number;
+  }, expectedTable?: string) => Promise<{
+    patched: number;
+  }>;
+  patchWhere?: (tableName: string, args: {
+    patch: Record<string, unknown>;
+    where: WhereInput;
+  }, options?: {
+    limit?: number;
+  }) => Promise<{
+    patched: number;
+  }>;
+  query: (tableName: string) => TableReaderLike$1;
+  /**
+   * Rank a row within its partition. A position is a count-of-rows-before, so
+   * — exactly like `count()` — it can't be trusted in an RLS-restricted
+   * reader: the wrapper fails it closed with `COUNT_RLS_UNSUPPORTED`. Required
+   * for the same reason as `aggregate`.
+   */
+  rank: (tableName: string, indexName: string, options: RankArgs) => Promise<null | {
+    position: number;
+    total: number;
+  }>;
+  /** Cross-shard rank primitive — same count-of-before RLS hazard as `rank`; failed closed under a read policy. */
+  rankBefore?: (tableName: string, indexName: string, options: RankBeforeArgs) => Promise<{
+    before: number;
+    total: number;
+  }>;
+  /**
+   * Sorted pagination over a rank companion. The companion stores only the
+   * partition + sort keys + id, so an arbitrary read `baseWhere` can't be
+   * enforced against it (and re-filtering the fetched rows would break page
+   * sizing). RLS therefore fails it closed rather than leak hidden rows.
+   * Required for the same reason as `aggregate`.
+   */
+  rankPage: (tableName: string, indexName: string, options?: RankPageArgs) => Promise<QueryPage$1>;
+  /**
+   * Cross-shard companion to `rankPage`: same ranked slice, but each row
+   * keeps its rank-key tuple for the query coordinator's k-way merge. Same
+   * count-of-partition RLS hazard as `rankPage` — failed closed under a read
+   * policy for the identical reason (see `rankPage` above).
+   */
+  rankPageRows?: (tableName: string, indexName: string, options?: RankPageArgs) => Promise<ShardRankPageResultLike>;
+  replace: (id: string, document: Record<string, unknown>, expectedTable?: string) => Promise<void>;
+  restore?: (id: string, expectedTable?: string) => Promise<void>;
+  /**
+   * Whole-shard erase. The RLS wrapper deliberately **fails this closed** rather
+   * than wrapping it — see the wrapper's `wipeShard`.
+   */
+  wipeShard?: (options?: {
+    chunkSize?: number;
+    exclude?: ReadonlyArray<string>;
+    tables?: ReadonlyArray<string>;
+  }) => Promise<{
+    deleted: number;
+    tables: Record<string, number>;
+  }>;
+}
+/**
+ * What a procedure's `ctx.db` must structurally satisfy for the middleware
+ * to wrap it. We deliberately mirror `@lunora/do`'s `DatabaseWriterLike`
+ * rather than `@lunora/server`'s nominal `DatabaseWriter`/`DatabaseReader`:
+ * the runtime adapter that flows in is the `DatabaseWriterLike`-shaped one,
+ * and structural matching keeps this module free of an `@lunora/do`-typed
+ * `ctx`.
+ */
+type RlsDatabase = DatabaseWriterLike;
+/** Roles list source on the context. Tolerant of older auth states. */
+type AuthLike = {
+  getIdentity?: () => Promise<Record<string, unknown> | null>;
+  roles?: ReadonlyArray<string>;
+  userId?: null | string;
+};
+/** Minimal shape the middleware needs on the incoming ctx. */
+interface RlsContextIn {
+  auth?: AuthLike;
+  db: RlsDatabase;
+}
+declare const rls: <Context extends RlsContextIn = RlsContextIn>(policies: ReadonlyArray<Policy<Context>>, options?: RlsOptions) => Middleware<Context, Context>;
 /**
  * The prefixed tables a single plugin `P` contributes, or an empty map when it
  * ships no schema extension. Mirrors {@link PrefixedTables} at the plugin level
@@ -1030,7 +1272,7 @@ type ExtensionTablesOf<P> = P extends {
 type InstalledTables<T extends Record<string, TableDefinition>, Plugins extends ReadonlyArray<unknown>> = Plugins extends readonly [infer Head, ...infer Rest] ? InstalledTables<ExtensionTablesOf<Head> & T, Rest> : T;
 /**
  * Union every plugin's `ContextOut` in a tuple — the type-level mirror of the
- * `ctx.api.&lt;key>` additions {@link composePluginMiddleware} accumulates as each
+ * `ctx.api.<key>` additions {@link composePluginMiddleware} accumulates as each
  * plugin middleware runs. Independent of the incoming context, which the builder
  * infers at the `.use(...)` site.
  */
@@ -1083,7 +1325,7 @@ interface Plugin<TExtension extends Record<string, TableDefinition> = Record<str
   /**
    * Optional middleware. Users attach with `c.query.use(plugin.middleware)`.
    * The middleware can extend `ctx`; convention is to attach helpers under
-   * `ctx.api.&lt;key>`, e.g.
+   * `ctx.api.<key>`, e.g.
    *
    * ```ts
    * middleware: ({ ctx, next }) =>
@@ -1228,7 +1470,7 @@ declare const installPlugins: <T extends Record<string, TableDefinition>, const
  * Compose every plugin's middleware into a single middleware you attach with one
  * `.use(...)`. Plugins without middleware (schema-only) are skipped; the rest run
  * in array order, each seeing the context the previous one widened, so the final
- * `next({ ctx })` the builder receives carries every plugin's `ctx.api.&lt;key>`
+ * `next({ ctx })` the builder receives carries every plugin's `ctx.api.<key>`
  * additions. Equivalent to `.use(a.middleware).use(b.middleware)…` but as one
  * value, the middleware sibling of {@link installPlugins}.
  *
@@ -1388,7 +1630,7 @@ interface TableBuilder<Shape extends Record<string, Validator> = Record<string,
   shardBy: (field: keyof Shape & string) => TableBuilder<Shape>;
   /**
    * Turn on soft delete. Adds a nullable timestamp column (`options.field`,
-   * default `deletedAt`) and changes `ctx.db.&lt;table>.delete()` to **set** it
+   * default `deletedAt`) and changes `ctx.db.<table>.delete()` to **set** it
    * instead of removing the row; `onDelete: "cascade"` children are recursively
    * soft-deleted too. **List reads** (`findMany`/`findFirst`/`query()`/`count`/
    * `aggregate`/relation loads) then hide soft-deleted rows unless they pass
@@ -1677,12 +1919,12 @@ interface MaskOptions<Context = unknown> {
   readonly indexFields?: IndexFieldsByTable;
   readonly roles?: ReadonlyArray<Role>;
 }
-interface QueryPage$1 {
+interface QueryPage {
   continueCursor: null | string;
   isDone: boolean;
   page: Record<string, unknown>[];
 }
-interface QueryArgs$1 {
+interface QueryArgs {
   baseWhere?: unknown;
   cursor?: null | string;
   limit?: number;
@@ -1690,12 +1932,12 @@ interface QueryArgs$1 {
   where?: unknown;
   with?: Record<string, unknown>;
 }
-interface AggregateArgs$1 {
+interface AggregateArgs {
   field?: string;
   op: string;
   where?: unknown;
 }
-interface GroupByArgs$1 {
+interface GroupByArgs {
   agg?: {
     field?: string;
     op: string;
@@ -1717,22 +1959,22 @@ interface SearchScoredDocument {
   document: Record<string, unknown>;
   score: number;
 }
-interface TableReaderLike$1 {
+interface TableReaderLike {
   [Symbol.asyncIterator]: () => AsyncIterator<Record<string, unknown>>;
   collect: () => Promise<Record<string, unknown>[]>;
   collectWithScores: () => Promise<ScoredDocument[]>;
-  filter: (predicate: (document: Record<string, unknown>) => boolean) => TableReaderLike$1;
+  filter: (predicate: (document: Record<string, unknown>) => boolean) => TableReaderLike;
   first: () => Promise<Record<string, unknown> | null>;
-  order: (direction: "asc" | "desc") => TableReaderLike$1;
+  order: (direction: "asc" | "desc") => TableReaderLike;
   paginate: (options: {
     cursor?: null | string;
     numItems: number;
-  }) => Promise<QueryPage$1>;
+  }) => Promise<QueryPage>;
   take: (limit: number) => Promise<Record<string, unknown>[]>;
   unique: () => Promise<Record<string, unknown> | null>;
-  withGeoIndex: (indexName: string, build: (q: unknown) => unknown) => TableReaderLike$1;
-  withIndex: (indexName: string, range?: (q: unknown) => unknown) => TableReaderLike$1;
-  withSearchIndex: (indexName: string, search: (q: unknown) => unknown) => TableReaderLike$1;
+  withGeoIndex: (indexName: string, build: (q: unknown) => unknown) => TableReaderLike;
+  withIndex: (indexName: string, range?: (q: unknown) => unknown) => TableReaderLike;
+  withSearchIndex: (indexName: string, search: (q: unknown) => unknown) => TableReaderLike;
 }
 /**
  * Structural projection of the runtime ORM writer — the same subset
@@ -1741,7 +1983,7 @@ interface TableReaderLike$1 {
  * inter-package dependency. `rankBefore` is optional (the D1 twin omits it).
  */
 interface MaskDatabase {
-  aggregate: (tableName: string, options: AggregateArgs$1) => Promise<null | number>;
+  aggregate: (tableName: string, options: AggregateArgs) => Promise<null | number>;
   count: (tableName: string, whereOrArgs?: unknown) => Promise<number>;
   delete: (id: string, expectedTable?: string) => Promise<void>;
   deleteMany: (ids: ReadonlyArray<string>, options?: {
@@ -1754,11 +1996,11 @@ interface MaskDatabase {
   }) => Promise<{
     deleted: number;
   }>;
-  findFirst: (tableName: string, args?: QueryArgs$1) => Promise<Record<string, unknown> | null>;
-  findFirstOrThrow: (tableName: string, args?: QueryArgs$1) => Promise<Record<string, unknown>>;
-  findMany: (tableName: string, args?: QueryArgs$1) => Promise<QueryPage$1>;
+  findFirst: (tableName: string, args?: QueryArgs) => Promise<Record<string, unknown> | null>;
+  findFirstOrThrow: (tableName: string, args?: QueryArgs) => Promise<Record<string, unknown>>;
+  findMany: (tableName: string, args?: QueryArgs) => Promise<QueryPage>;
   get: (id: string, expectedTable?: string) => Promise<Record<string, unknown> | null>;
-  groupBy: (tableName: string, options: GroupByArgs$1) => Promise<ReadonlyArray<{
+  groupBy: (tableName: string, options: GroupByArgs) => Promise<ReadonlyArray<{
     key: Record<string, unknown>;
     value: null | number;
   }>>;
@@ -1788,7 +2030,7 @@ interface MaskDatabase {
   }) => Promise<{
     patched: number;
   }>;
-  query: (tableName: string) => TableReaderLike$1;
+  query: (tableName: string) => TableReaderLike;
   rank: (tableName: string, indexName: string, options: unknown) => Promise<null | {
     position: number;
     total: number;
@@ -1797,19 +2039,13 @@ interface MaskDatabase {
     before: number;
     total: number;
   }>;
-  rankPage: (tableName: string, indexName: string, options?: unknown) => Promise<QueryPage$1>;
+  rankPage: (tableName: string, indexName: string, options?: unknown) => Promise<QueryPage>;
   /** Cross-shard companion to `rankPage`, gated the same way `rankPage` is masked below. */
   rankPageRows?: (tableName: string, indexName: string, options?: unknown) => Promise<ShardRankPageResultLike>;
   replace: (id: string, document: Record<string, unknown>, expectedTable?: string) => Promise<void>;
 }
-/** Roles list source on the context. Tolerant of older auth states (mirrors RLS's `AuthLike`). */
-type AuthLike$1 = {
-  getIdentity?: () => Promise<Record<string, unknown> | null>;
-  roles?: ReadonlyArray<string>;
-  userId?: null | string;
-};
 interface MaskContextIn {
-  auth?: AuthLike$1;
+  auth?: AuthLike;
   db: MaskDatabase;
 }
 /**
@@ -2114,7 +2350,7 @@ declare const definePolicy: <Context = unknown>(input: DefinePolicyInput<Context
 /**
  * Build a project-bound, relation-aware `definePolicy` typed against the
  * generated `DataModel` (`DM`) + `Relations` (`REL`) maps. Codegen emits a
- * `createPolicyDsl&lt;DataModel, Relations>()` binding into `_generated/server.ts`,
+ * `createPolicyDsl<DataModel, Relations>()` binding into `_generated/server.ts`,
  * so importing `definePolicy` from the generated module constrains `table` to a
  * real table name and type-checks the `when` predicate — including Prisma-style
  * relation predicates (`is`/`some`/…) the `@lunora/do` pre-resolver now resolves
@@ -2148,248 +2384,6 @@ declare const definePermission: (name: string, options?: Omit<Permission, "name"
  */
 declare const definePolicies: <Context = unknown>(policies: ReadonlyArray<Policy<Context>>) => ReadonlyArray<Policy<Context>>;
 declare const defineRole: (name: string, options?: Omit<Role, "name">) => Role;
-/**
- * Structural mirror of `@lunora/do`'s `QueryArgs` and `CountArgs`. The
- * runtime ORM in `@lunora/do`/`@lunora/d1` reads `baseWhere` /
- * `restrictsCounts` straight off these option objects, so as long as the
- * fields here stay name-compatible the wrapper is portable across the two
- * dialects without an inter-package dependency.
- */
-interface QueryArgs {
-  baseWhere?: WhereInput;
-  cursor?: null | string;
-  limit?: number;
-  orderBy?: ReadonlyArray<unknown>;
-  /**
-   * Per-target-table read filter the RLS wrapper attaches so a `with` relation
-   * is policy-filtered on its own hop (see `@lunora/do`'s `QueryArgs`). Mirrors
-   * the top-level read: `(table) => readBase(table).baseWhere`.
-   */
-  relationBaseWhere?: (table: string) => undefined | WhereInput;
-  restrictsCounts?: boolean;
-  where?: WhereInput;
-  with?: Record<string, unknown>;
-}
-interface CountArgs {
-  baseWhere?: WhereInput;
-  relationBaseWhere?: (table: string) => undefined | WhereInput;
-  restrictsCounts?: boolean;
-  where?: WhereInput;
-}
-/** Structural mirror of `@lunora/do`'s `AggregateOptions` — only the fields the wrapper touches. */
-interface AggregateArgs {
-  baseWhere?: WhereInput;
-  field?: string;
-  op: string;
-  relationBaseWhere?: (table: string) => undefined | WhereInput;
-  restrictsCounts?: boolean;
-  where?: WhereInput;
-}
-/** Structural mirror of `@lunora/do`'s `GroupByOptions`. */
-interface GroupByArgs {
-  agg?: {
-    field?: string;
-    op: string;
-  };
-  baseWhere?: WhereInput;
-  by: ReadonlyArray<string>;
-  relationBaseWhere?: (table: string) => undefined | WhereInput;
-  restrictsCounts?: boolean;
-  where?: WhereInput;
-}
-/** Structural mirror of `@lunora/do`'s `RankOptions`. */
-interface RankArgs {
-  baseWhere?: WhereInput;
-  restrictsCounts?: boolean;
-  row: Record<string, unknown> | string;
-  where?: WhereInput;
-}
-/** Structural mirror of `@lunora/do`'s `RankBeforeOptions`. */
-interface RankBeforeArgs {
-  partitionKey: string;
-  restrictsCounts?: boolean;
-  rowId: string;
-  sortValues: ReadonlyArray<unknown>;
-}
-/** Structural mirror of `@lunora/do`'s `RankPageOptions`. */
-interface RankPageArgs {
-  baseWhere?: WhereInput;
-  cursor?: null | string;
-  restrictsCounts?: boolean;
-  take?: number;
-  where?: WhereInput;
-}
-interface QueryPage {
-  continueCursor: null | string;
-  isDone: boolean;
-  page: Record<string, unknown>[];
-}
-interface TableReaderLike {
-  collect: () => Promise<Record<string, unknown>[]>;
-  filter: (predicate: (document: Record<string, unknown>) => boolean) => TableReaderLike;
-  first: () => Promise<Record<string, unknown> | null>;
-  paginate: (options: {
-    cursor?: null | string;
-    numItems: number;
-  }) => Promise<QueryPage>;
-  take: (limit: number) => Promise<Record<string, unknown>[]>;
-  withGeoIndex: (indexName: string, build: (q: unknown) => unknown) => TableReaderLike;
-  withIndex: (indexName: string, range?: (q: unknown) => unknown) => TableReaderLike;
-  withSearchIndex: (indexName: string, search: (q: unknown) => unknown) => TableReaderLike;
-}
-/**
- * Structural projection of the runtime ORM writer. The wrapper relies only
- * on these fields, so it's interchangeable between `@lunora/do`'s
- * `DatabaseWriterLike` and `@lunora/d1`'s `DatabaseWriterLike`.
- */
-interface DatabaseWriterLike {
-  /**
-   * Reduce matching rows to a scalar. The RLS wrapper AND-merges the read
-   * `baseWhere` into `options` so the reduction only sees policy-visible rows
-   * (safe: an aggregate scoped to `where` never reveals a hidden row — see
-   * `@lunora/do`'s `RestrictableQueryOptions`). Required: the only writer ever
-   * wrapped is `@lunora/do`'s `createShardCtxDb`, which always implements it.
-   */
-  aggregate: (tableName: string, options: AggregateArgs) => Promise<null | number>;
-  count: (tableName: string, whereOrArgs?: CountArgs | WhereInput) => Promise<number>;
-  delete: (id: string, expectedTable?: string, options?: {
-    hard?: boolean;
-  }) => Promise<void>;
-  /** Uncapped, chunked erase of a whole table. The RLS wrapper gates each row like a single delete. */
-  deleteAll?: (tableName: string, options?: {
-    chunkSize?: number;
-    hard?: boolean;
-  }) => Promise<{
-    deleted: number;
-  }>;
-  deleteMany: (ids: ReadonlyArray<string>, options?: {
-    limit?: number;
-  }, expectedTable?: string) => Promise<{
-    deleted: number;
-  }>;
-  deleteWhere?: (tableName: string, where: WhereInput, options?: {
-    limit?: number;
-  }) => Promise<{
-    deleted: number;
-  }>;
-  findFirst: (tableName: string, args?: QueryArgs) => Promise<Record<string, unknown> | null>;
-  findFirstOrThrow: (tableName: string, args?: QueryArgs) => Promise<Record<string, unknown>>;
-  findMany: (tableName: string, args?: QueryArgs) => Promise<QueryPage>;
-  get: (id: string, expectedTable?: string) => Promise<Record<string, unknown> | null>;
-  /**
-   * Group + reduce. Same `baseWhere` injection as `aggregate`: the per-group
-   * reduction is scoped to policy-visible rows, so a group count tallies only
-   * rows the caller may read. Required for the same reason as `aggregate`.
-   */
-  groupBy: (tableName: string, options: GroupByArgs) => Promise<ReadonlyArray<{
-    key: Record<string, unknown>;
-    value: null | number;
-  }>>;
-  insert: (tableName: string, document: Record<string, unknown>) => Promise<string>;
-  insertMany: (tableName: string, documents: ReadonlyArray<Record<string, unknown>>, options?: {
-    limit?: number;
-    skipDuplicates?: boolean;
-  }) => Promise<(string | null)[]>;
-  insertManyUnsafe: (tableName: string, documents: ReadonlyArray<Record<string, unknown>>, options?: {
-    allowExplicitId?: boolean;
-    limit?: number;
-  }) => Promise<string[]>;
-  /**
-   * Optional table-aware lookup. The underlying writer (e.g. `@lunora/do`)
-   * already knows the owning table of an id internally, so it can return
-   * `{ row, tableName }` in a single round-trip. When present, the RLS wrapper
-   * uses it to collapse the per-call membership-probe fan-out (1 `get` + N
-   * `findFirst` across every policy table) down to one lookup. Writers that
-   * don't implement it fall back to the probe path.
-   */
-  lookupById?: (id: string, expectedTable?: string) => Promise<null | {
-    row: Record<string, unknown>;
-    tableName: string;
-  }>;
-  patch: (id: string, patch: Record<string, unknown>, expectedTable?: string) => Promise<void>;
-  patchMany: (patches: ReadonlyArray<{
-    id: string;
-    patch: Record<string, unknown>;
-  }>, options?: {
-    limit?: number;
-  }, expectedTable?: string) => Promise<{
-    patched: number;
-  }>;
-  patchWhere?: (tableName: string, args: {
-    patch: Record<string, unknown>;
-    where: WhereInput;
-  }, options?: {
-    limit?: number;
-  }) => Promise<{
-    patched: number;
-  }>;
-  query: (tableName: string) => TableReaderLike;
-  /**
-   * Rank a row within its partition. A position is a count-of-rows-before, so
-   * — exactly like `count()` — it can't be trusted in an RLS-restricted
-   * reader: the wrapper fails it closed with `COUNT_RLS_UNSUPPORTED`. Required
-   * for the same reason as `aggregate`.
-   */
-  rank: (tableName: string, indexName: string, options: RankArgs) => Promise<null | {
-    position: number;
-    total: number;
-  }>;
-  /** Cross-shard rank primitive — same count-of-before RLS hazard as `rank`; failed closed under a read policy. */
-  rankBefore?: (tableName: string, indexName: string, options: RankBeforeArgs) => Promise<{
-    before: number;
-    total: number;
-  }>;
-  /**
-   * Sorted pagination over a rank companion. The companion stores only the
-   * partition + sort keys + id, so an arbitrary read `baseWhere` can't be
-   * enforced against it (and re-filtering the fetched rows would break page
-   * sizing). RLS therefore fails it closed rather than leak hidden rows.
-   * Required for the same reason as `aggregate`.
-   */
-  rankPage: (tableName: string, indexName: string, options?: RankPageArgs) => Promise<QueryPage>;
-  /**
-   * Cross-shard companion to `rankPage`: same ranked slice, but each row
-   * keeps its rank-key tuple for the query coordinator's k-way merge. Same
-   * count-of-partition RLS hazard as `rankPage` — failed closed under a read
-   * policy for the identical reason (see `rankPage` above).
-   */
-  rankPageRows?: (tableName: string, indexName: string, options?: RankPageArgs) => Promise<ShardRankPageResultLike>;
-  replace: (id: string, document: Record<string, unknown>, expectedTable?: string) => Promise<void>;
-  restore?: (id: string, expectedTable?: string) => Promise<void>;
-  /**
-   * Whole-shard erase. The RLS wrapper deliberately **fails this closed** rather
-   * than wrapping it — see the wrapper's `wipeShard`.
-   */
-  wipeShard?: (options?: {
-    chunkSize?: number;
-    exclude?: ReadonlyArray<string>;
-    tables?: ReadonlyArray<string>;
-  }) => Promise<{
-    deleted: number;
-    tables: Record<string, number>;
-  }>;
-}
-/**
- * What a procedure's `ctx.db` must structurally satisfy for the middleware
- * to wrap it. We deliberately mirror `@lunora/do`'s `DatabaseWriterLike`
- * rather than `@lunora/server`'s nominal `DatabaseWriter`/`DatabaseReader`:
- * the runtime adapter that flows in is the `DatabaseWriterLike`-shaped one,
- * and structural matching keeps this module free of an `@lunora/do`-typed
- * `ctx`.
- */
-type RlsDatabase = DatabaseWriterLike;
-/** Roles list source on the context. Tolerant of older auth states. */
-type AuthLike = {
-  getIdentity?: () => Promise<Record<string, unknown> | null>;
-  roles?: ReadonlyArray<string>;
-  userId?: null | string;
-};
-/** Minimal shape the middleware needs on the incoming ctx. */
-interface RlsContextIn {
-  auth?: AuthLike;
-  db: RlsDatabase;
-}
-declare const rls: <Context extends RlsContextIn = RlsContextIn>(policies: ReadonlyArray<Policy<Context>>, options?: RlsOptions) => Middleware<Context, Context>;
 /**
  * A predicate matching **no** rows — the deny decision.
  *
@@ -2623,14 +2617,8 @@ declare const defineStorageRule: <Context = unknown>(input: DefineStorageRuleInp
  * immediately rather than as a silently double-evaluated predicate.
  */
 declare const defineStorageRules: <Context = unknown>(rules: ReadonlyArray<StorageRule<Context>>) => ReadonlyArray<StorageRule<Context>>;
-/** The minimal `ctx.auth` shape the middleware reads — a structural subset that the full AuthState satisfies. Tolerant of older auth states (mirrors RLS's `AuthLike`). */
-type StorageAuthLike = {
-  getIdentity?: () => Promise<Record<string, unknown> | null>;
-  roles?: ReadonlyArray<string>;
-  userId?: null | string;
-};
 interface StorageContextIn {
-  auth?: StorageAuthLike;
+  auth?: AuthLike;
   storage?: unknown;
 }
 declare const storageRules: <Context extends StorageContextIn = StorageContextIn>(rules: ReadonlyArray<StorageRule<Context>>, options?: StorageRulesOptions) => Middleware<Context, Context>;