@lunora/server 1.0.0-alpha.62 → 1.0.0-alpha.63

package/dist/index.d.mts

@@ -6,8 +6,8 @@ import { LunoraError as LunoraError$1, LunoraErrorCode } from '@lunora/errors';
 export type { LunoraErrorCode } from '@lunora/errors';
 import { Context, Hono } from 'hono';
 import { WhereOperators, QueryArgs as QueryArgs$2 } from "./data-model.mjs";
-import { b as Permission, R as Role, T as TypedDefinePolicyInput, a as Policy, D as DefinePolicyInput, W as WhereInput, c as RlsOptions } from "./packem_shared/types.d-BXr-YW9j.mjs";
-export type { d as PolicyContext, e as PolicyDecision, f as PolicyDecisionOf, P as PolicyOperation } from "./packem_shared/types.d-BXr-YW9j.mjs";
+import { W as WhereInput, a as Policy, b as RlsOptions, c as Permission, R as Role, T as TypedDefinePolicyInput, D as DefinePolicyInput } from "./packem_shared/types.d-B-pIn8rE.mjs";
+export type { d as PolicyContext, e as PolicyDecision, f as PolicyDecisionOf, P as PolicyOperation } from "./packem_shared/types.d-B-pIn8rE.mjs";
 export { type CronJob, type CronJobsBuilder, type CronScheduleKind, type DailySchedule, type IntervalSchedule, type MonthlySchedule, type WeeklySchedule, cronJobs } from '@lunora/scheduler';
 /**
  * Make any resolved storage capability bucket-aware so `ctx.storage.bucket(name)`
@@ -1012,6 +1012,248 @@ interface ShardRankPageResultLike {
   hasMore: boolean;
   rows: ReadonlyArray<RankPageRowLike>;
 }
+/**
+ * Structural mirror of `@lunora/do`'s `QueryArgs` and `CountArgs`. The
+ * runtime ORM in `@lunora/do`/`@lunora/d1` reads `baseWhere` /
+ * `restrictsCounts` straight off these option objects, so as long as the
+ * fields here stay name-compatible the wrapper is portable across the two
+ * dialects without an inter-package dependency.
+ */
+interface QueryArgs$1 {
+  baseWhere?: WhereInput;
+  cursor?: null | string;
+  limit?: number;
+  orderBy?: ReadonlyArray<unknown>;
+  /**
+   * Per-target-table read filter the RLS wrapper attaches so a `with` relation
+   * is policy-filtered on its own hop (see `@lunora/do`'s `QueryArgs`). Mirrors
+   * the top-level read: `(table) => readBase(table).baseWhere`.
+   */
+  relationBaseWhere?: (table: string) => undefined | WhereInput;
+  restrictsCounts?: boolean;
+  where?: WhereInput;
+  with?: Record<string, unknown>;
+}
+interface CountArgs {
+  baseWhere?: WhereInput;
+  relationBaseWhere?: (table: string) => undefined | WhereInput;
+  restrictsCounts?: boolean;
+  where?: WhereInput;
+}
+/** Structural mirror of `@lunora/do`'s `AggregateOptions` — only the fields the wrapper touches. */
+interface AggregateArgs$1 {
+  baseWhere?: WhereInput;
+  field?: string;
+  op: string;
+  relationBaseWhere?: (table: string) => undefined | WhereInput;
+  restrictsCounts?: boolean;
+  where?: WhereInput;
+}
+/** Structural mirror of `@lunora/do`'s `GroupByOptions`. */
+interface GroupByArgs$1 {
+  agg?: {
+    field?: string;
+    op: string;
+  };
+  baseWhere?: WhereInput;
+  by: ReadonlyArray<string>;
+  relationBaseWhere?: (table: string) => undefined | WhereInput;
+  restrictsCounts?: boolean;
+  where?: WhereInput;
+}
+/** Structural mirror of `@lunora/do`'s `RankOptions`. */
+interface RankArgs {
+  baseWhere?: WhereInput;
+  restrictsCounts?: boolean;
+  row: Record<string, unknown> | string;
+  where?: WhereInput;
+}
+/** Structural mirror of `@lunora/do`'s `RankBeforeOptions`. */
+interface RankBeforeArgs {
+  partitionKey: string;
+  restrictsCounts?: boolean;
+  rowId: string;
+  sortValues: ReadonlyArray<unknown>;
+}
+/** Structural mirror of `@lunora/do`'s `RankPageOptions`. */
+interface RankPageArgs {
+  baseWhere?: WhereInput;
+  cursor?: null | string;
+  restrictsCounts?: boolean;
+  take?: number;
+  where?: WhereInput;
+}
+interface QueryPage$1 {
+  continueCursor: null | string;
+  isDone: boolean;
+  page: Record<string, unknown>[];
+}
+interface TableReaderLike$1 {
+  collect: () => Promise<Record<string, unknown>[]>;
+  filter: (predicate: (document: Record<string, unknown>) => boolean) => TableReaderLike$1;
+  first: () => Promise<Record<string, unknown> | null>;
+  paginate: (options: {
+    cursor?: null | string;
+    numItems: number;
+  }) => Promise<QueryPage$1>;
+  take: (limit: number) => Promise<Record<string, unknown>[]>;
+  withGeoIndex: (indexName: string, build: (q: unknown) => unknown) => TableReaderLike$1;
+  withIndex: (indexName: string, range?: (q: unknown) => unknown) => TableReaderLike$1;
+  withSearchIndex: (indexName: string, search: (q: unknown) => unknown) => TableReaderLike$1;
+}
+/**
+ * Structural projection of the runtime ORM writer. The wrapper relies only
+ * on these fields, so it's interchangeable between `@lunora/do`'s
+ * `DatabaseWriterLike` and `@lunora/d1`'s `DatabaseWriterLike`.
+ */
+interface DatabaseWriterLike {
+  /**
+   * Reduce matching rows to a scalar. The RLS wrapper AND-merges the read
+   * `baseWhere` into `options` so the reduction only sees policy-visible rows
+   * (safe: an aggregate scoped to `where` never reveals a hidden row — see
+   * `@lunora/do`'s `RestrictableQueryOptions`). Required: the only writer ever
+   * wrapped is `@lunora/do`'s `createShardCtxDb`, which always implements it.
+   */
+  aggregate: (tableName: string, options: AggregateArgs$1) => Promise<null | number>;
+  count: (tableName: string, whereOrArgs?: CountArgs | WhereInput) => Promise<number>;
+  delete: (id: string, expectedTable?: string, options?: {
+    hard?: boolean;
+  }) => Promise<void>;
+  /** Uncapped, chunked erase of a whole table. The RLS wrapper gates each row like a single delete. */
+  deleteAll?: (tableName: string, options?: {
+    chunkSize?: number;
+    hard?: boolean;
+  }) => Promise<{
+    deleted: number;
+  }>;
+  deleteMany: (ids: ReadonlyArray<string>, options?: {
+    limit?: number;
+  }, expectedTable?: string) => Promise<{
+    deleted: number;
+  }>;
+  deleteWhere?: (tableName: string, where: WhereInput, options?: {
+    limit?: number;
+  }) => Promise<{
+    deleted: number;
+  }>;
+  findFirst: (tableName: string, args?: QueryArgs$1) => Promise<Record<string, unknown> | null>;
+  findFirstOrThrow: (tableName: string, args?: QueryArgs$1) => Promise<Record<string, unknown>>;
+  findMany: (tableName: string, args?: QueryArgs$1) => Promise<QueryPage$1>;
+  get: (id: string, expectedTable?: string) => Promise<Record<string, unknown> | null>;
+  /**
+   * Group + reduce. Same `baseWhere` injection as `aggregate`: the per-group
+   * reduction is scoped to policy-visible rows, so a group count tallies only
+   * rows the caller may read. Required for the same reason as `aggregate`.
+   */
+  groupBy: (tableName: string, options: GroupByArgs$1) => Promise<ReadonlyArray<{
+    key: Record<string, unknown>;
+    value: null | number;
+  }>>;
+  insert: (tableName: string, document: Record<string, unknown>) => Promise<string>;
+  insertMany: (tableName: string, documents: ReadonlyArray<Record<string, unknown>>, options?: {
+    limit?: number;
+    skipDuplicates?: boolean;
+  }) => Promise<(string | null)[]>;
+  insertManyUnsafe: (tableName: string, documents: ReadonlyArray<Record<string, unknown>>, options?: {
+    allowExplicitId?: boolean;
+    limit?: number;
+  }) => Promise<string[]>;
+  /**
+   * Optional table-aware lookup. The underlying writer (e.g. `@lunora/do`)
+   * already knows the owning table of an id internally, so it can return
+   * `{ row, tableName }` in a single round-trip. When present, the RLS wrapper
+   * uses it to collapse the per-call membership-probe fan-out (1 `get` + N
+   * `findFirst` across every policy table) down to one lookup. Writers that
+   * don't implement it fall back to the probe path.
+   */
+  lookupById?: (id: string, expectedTable?: string) => Promise<null | {
+    row: Record<string, unknown>;
+    tableName: string;
+  }>;
+  patch: (id: string, patch: Record<string, unknown>, expectedTable?: string) => Promise<void>;
+  patchMany: (patches: ReadonlyArray<{
+    id: string;
+    patch: Record<string, unknown>;
+  }>, options?: {
+    limit?: number;
+  }, expectedTable?: string) => Promise<{
+    patched: number;
+  }>;
+  patchWhere?: (tableName: string, args: {
+    patch: Record<string, unknown>;
+    where: WhereInput;
+  }, options?: {
+    limit?: number;
+  }) => Promise<{
+    patched: number;
+  }>;
+  query: (tableName: string) => TableReaderLike$1;
+  /**
+   * Rank a row within its partition. A position is a count-of-rows-before, so
+   * — exactly like `count()` — it can't be trusted in an RLS-restricted
+   * reader: the wrapper fails it closed with `COUNT_RLS_UNSUPPORTED`. Required
+   * for the same reason as `aggregate`.
+   */
+  rank: (tableName: string, indexName: string, options: RankArgs) => Promise<null | {
+    position: number;
+    total: number;
+  }>;
+  /** Cross-shard rank primitive — same count-of-before RLS hazard as `rank`; failed closed under a read policy. */
+  rankBefore?: (tableName: string, indexName: string, options: RankBeforeArgs) => Promise<{
+    before: number;
+    total: number;
+  }>;
+  /**
+   * Sorted pagination over a rank companion. The companion stores only the
+   * partition + sort keys + id, so an arbitrary read `baseWhere` can't be
+   * enforced against it (and re-filtering the fetched rows would break page
+   * sizing). RLS therefore fails it closed rather than leak hidden rows.
+   * Required for the same reason as `aggregate`.
+   */
+  rankPage: (tableName: string, indexName: string, options?: RankPageArgs) => Promise<QueryPage$1>;
+  /**
+   * Cross-shard companion to `rankPage`: same ranked slice, but each row
+   * keeps its rank-key tuple for the query coordinator's k-way merge. Same
+   * count-of-partition RLS hazard as `rankPage` — failed closed under a read
+   * policy for the identical reason (see `rankPage` above).
+   */
+  rankPageRows?: (tableName: string, indexName: string, options?: RankPageArgs) => Promise<ShardRankPageResultLike>;
+  replace: (id: string, document: Record<string, unknown>, expectedTable?: string) => Promise<void>;
+  restore?: (id: string, expectedTable?: string) => Promise<void>;
+  /**
+   * Whole-shard erase. The RLS wrapper deliberately **fails this closed** rather
+   * than wrapping it — see the wrapper's `wipeShard`.
+   */
+  wipeShard?: (options?: {
+    chunkSize?: number;
+    exclude?: ReadonlyArray<string>;
+    tables?: ReadonlyArray<string>;
+  }) => Promise<{
+    deleted: number;
+    tables: Record<string, number>;
+  }>;
+}
+/**
+ * What a procedure's `ctx.db` must structurally satisfy for the middleware
+ * to wrap it. We deliberately mirror `@lunora/do`'s `DatabaseWriterLike`
+ * rather than `@lunora/server`'s nominal `DatabaseWriter`/`DatabaseReader`:
+ * the runtime adapter that flows in is the `DatabaseWriterLike`-shaped one,
+ * and structural matching keeps this module free of an `@lunora/do`-typed
+ * `ctx`.
+ */
+type RlsDatabase = DatabaseWriterLike;
+/** Roles list source on the context. Tolerant of older auth states. */
+type AuthLike = {
+  getIdentity?: () => Promise<Record<string, unknown> | null>;
+  roles?: ReadonlyArray<string>;
+  userId?: null | string;
+};
+/** Minimal shape the middleware needs on the incoming ctx. */
+interface RlsContextIn {
+  auth?: AuthLike;
+  db: RlsDatabase;
+}
+declare const rls: <Context extends RlsContextIn = RlsContextIn>(policies: ReadonlyArray<Policy<Context>>, options?: RlsOptions) => Middleware<Context, Context>;
 /**
  * The prefixed tables a single plugin `P` contributes, or an empty map when it
  * ships no schema extension. Mirrors {@link PrefixedTables} at the plugin level
@@ -1677,12 +1919,12 @@ interface MaskOptions<Context = unknown> {
   readonly indexFields?: IndexFieldsByTable;
   readonly roles?: ReadonlyArray<Role>;
 }
-interface QueryPage$1 {
+interface QueryPage {
   continueCursor: null | string;
   isDone: boolean;
   page: Record<string, unknown>[];
 }
-interface QueryArgs$1 {
+interface QueryArgs {
   baseWhere?: unknown;
   cursor?: null | string;
   limit?: number;
@@ -1690,12 +1932,12 @@ interface QueryArgs$1 {
   where?: unknown;
   with?: Record<string, unknown>;
 }
-interface AggregateArgs$1 {
+interface AggregateArgs {
   field?: string;
   op: string;
   where?: unknown;
 }
-interface GroupByArgs$1 {
+interface GroupByArgs {
   agg?: {
     field?: string;
     op: string;
@@ -1717,22 +1959,22 @@ interface SearchScoredDocument {
   document: Record<string, unknown>;
   score: number;
 }
-interface TableReaderLike$1 {
+interface TableReaderLike {
   [Symbol.asyncIterator]: () => AsyncIterator<Record<string, unknown>>;
   collect: () => Promise<Record<string, unknown>[]>;
   collectWithScores: () => Promise<ScoredDocument[]>;
-  filter: (predicate: (document: Record<string, unknown>) => boolean) => TableReaderLike$1;
+  filter: (predicate: (document: Record<string, unknown>) => boolean) => TableReaderLike;
   first: () => Promise<Record<string, unknown> | null>;
-  order: (direction: "asc" | "desc") => TableReaderLike$1;
+  order: (direction: "asc" | "desc") => TableReaderLike;
   paginate: (options: {
     cursor?: null | string;
     numItems: number;
-  }) => Promise<QueryPage$1>;
+  }) => Promise<QueryPage>;
   take: (limit: number) => Promise<Record<string, unknown>[]>;
   unique: () => Promise<Record<string, unknown> | null>;
-  withGeoIndex: (indexName: string, build: (q: unknown) => unknown) => TableReaderLike$1;
-  withIndex: (indexName: string, range?: (q: unknown) => unknown) => TableReaderLike$1;
-  withSearchIndex: (indexName: string, search: (q: unknown) => unknown) => TableReaderLike$1;
+  withGeoIndex: (indexName: string, build: (q: unknown) => unknown) => TableReaderLike;
+  withIndex: (indexName: string, range?: (q: unknown) => unknown) => TableReaderLike;
+  withSearchIndex: (indexName: string, search: (q: unknown) => unknown) => TableReaderLike;
 }
 /**
  * Structural projection of the runtime ORM writer — the same subset
@@ -1741,7 +1983,7 @@ interface TableReaderLike$1 {
  * inter-package dependency. `rankBefore` is optional (the D1 twin omits it).
  */
 interface MaskDatabase {
-  aggregate: (tableName: string, options: AggregateArgs$1) => Promise<null | number>;
+  aggregate: (tableName: string, options: AggregateArgs) => Promise<null | number>;
   count: (tableName: string, whereOrArgs?: unknown) => Promise<number>;
   delete: (id: string, expectedTable?: string) => Promise<void>;
   deleteMany: (ids: ReadonlyArray<string>, options?: {
@@ -1754,11 +1996,11 @@ interface MaskDatabase {
   }) => Promise<{
     deleted: number;
   }>;
-  findFirst: (tableName: string, args?: QueryArgs$1) => Promise<Record<string, unknown> | null>;
-  findFirstOrThrow: (tableName: string, args?: QueryArgs$1) => Promise<Record<string, unknown>>;
-  findMany: (tableName: string, args?: QueryArgs$1) => Promise<QueryPage$1>;
+  findFirst: (tableName: string, args?: QueryArgs) => Promise<Record<string, unknown> | null>;
+  findFirstOrThrow: (tableName: string, args?: QueryArgs) => Promise<Record<string, unknown>>;
+  findMany: (tableName: string, args?: QueryArgs) => Promise<QueryPage>;
   get: (id: string, expectedTable?: string) => Promise<Record<string, unknown> | null>;
-  groupBy: (tableName: string, options: GroupByArgs$1) => Promise<ReadonlyArray<{
+  groupBy: (tableName: string, options: GroupByArgs) => Promise<ReadonlyArray<{
     key: Record<string, unknown>;
     value: null | number;
   }>>;
@@ -1788,7 +2030,7 @@ interface MaskDatabase {
   }) => Promise<{
     patched: number;
   }>;
-  query: (tableName: string) => TableReaderLike$1;
+  query: (tableName: string) => TableReaderLike;
   rank: (tableName: string, indexName: string, options: unknown) => Promise<null | {
     position: number;
     total: number;
@@ -1797,19 +2039,13 @@ interface MaskDatabase {
     before: number;
     total: number;
   }>;
-  rankPage: (tableName: string, indexName: string, options?: unknown) => Promise<QueryPage$1>;
+  rankPage: (tableName: string, indexName: string, options?: unknown) => Promise<QueryPage>;
   /** Cross-shard companion to `rankPage`, gated the same way `rankPage` is masked below. */
   rankPageRows?: (tableName: string, indexName: string, options?: unknown) => Promise<ShardRankPageResultLike>;
   replace: (id: string, document: Record<string, unknown>, expectedTable?: string) => Promise<void>;
 }
-/** Roles list source on the context. Tolerant of older auth states (mirrors RLS's `AuthLike`). */
-type AuthLike$1 = {
-  getIdentity?: () => Promise<Record<string, unknown> | null>;
-  roles?: ReadonlyArray<string>;
-  userId?: null | string;
-};
 interface MaskContextIn {
-  auth?: AuthLike$1;
+  auth?: AuthLike;
   db: MaskDatabase;
 }
 /**
@@ -2148,248 +2384,6 @@ declare const definePermission: (name: string, options?: Omit<Permission, "name"
  */
 declare const definePolicies: <Context = unknown>(policies: ReadonlyArray<Policy<Context>>) => ReadonlyArray<Policy<Context>>;
 declare const defineRole: (name: string, options?: Omit<Role, "name">) => Role;
-/**
- * Structural mirror of `@lunora/do`'s `QueryArgs` and `CountArgs`. The
- * runtime ORM in `@lunora/do`/`@lunora/d1` reads `baseWhere` /
- * `restrictsCounts` straight off these option objects, so as long as the
- * fields here stay name-compatible the wrapper is portable across the two
- * dialects without an inter-package dependency.
- */
-interface QueryArgs {
-  baseWhere?: WhereInput;
-  cursor?: null | string;
-  limit?: number;
-  orderBy?: ReadonlyArray<unknown>;
-  /**
-   * Per-target-table read filter the RLS wrapper attaches so a `with` relation
-   * is policy-filtered on its own hop (see `@lunora/do`'s `QueryArgs`). Mirrors
-   * the top-level read: `(table) => readBase(table).baseWhere`.
-   */
-  relationBaseWhere?: (table: string) => undefined | WhereInput;
-  restrictsCounts?: boolean;
-  where?: WhereInput;
-  with?: Record<string, unknown>;
-}
-interface CountArgs {
-  baseWhere?: WhereInput;
-  relationBaseWhere?: (table: string) => undefined | WhereInput;
-  restrictsCounts?: boolean;
-  where?: WhereInput;
-}
-/** Structural mirror of `@lunora/do`'s `AggregateOptions` — only the fields the wrapper touches. */
-interface AggregateArgs {
-  baseWhere?: WhereInput;
-  field?: string;
-  op: string;
-  relationBaseWhere?: (table: string) => undefined | WhereInput;
-  restrictsCounts?: boolean;
-  where?: WhereInput;
-}
-/** Structural mirror of `@lunora/do`'s `GroupByOptions`. */
-interface GroupByArgs {
-  agg?: {
-    field?: string;
-    op: string;
-  };
-  baseWhere?: WhereInput;
-  by: ReadonlyArray<string>;
-  relationBaseWhere?: (table: string) => undefined | WhereInput;
-  restrictsCounts?: boolean;
-  where?: WhereInput;
-}
-/** Structural mirror of `@lunora/do`'s `RankOptions`. */
-interface RankArgs {
-  baseWhere?: WhereInput;
-  restrictsCounts?: boolean;
-  row: Record<string, unknown> | string;
-  where?: WhereInput;
-}
-/** Structural mirror of `@lunora/do`'s `RankBeforeOptions`. */
-interface RankBeforeArgs {
-  partitionKey: string;
-  restrictsCounts?: boolean;
-  rowId: string;
-  sortValues: ReadonlyArray<unknown>;
-}
-/** Structural mirror of `@lunora/do`'s `RankPageOptions`. */
-interface RankPageArgs {
-  baseWhere?: WhereInput;
-  cursor?: null | string;
-  restrictsCounts?: boolean;
-  take?: number;
-  where?: WhereInput;
-}
-interface QueryPage {
-  continueCursor: null | string;
-  isDone: boolean;
-  page: Record<string, unknown>[];
-}
-interface TableReaderLike {
-  collect: () => Promise<Record<string, unknown>[]>;
-  filter: (predicate: (document: Record<string, unknown>) => boolean) => TableReaderLike;
-  first: () => Promise<Record<string, unknown> | null>;
-  paginate: (options: {
-    cursor?: null | string;
-    numItems: number;
-  }) => Promise<QueryPage>;
-  take: (limit: number) => Promise<Record<string, unknown>[]>;
-  withGeoIndex: (indexName: string, build: (q: unknown) => unknown) => TableReaderLike;
-  withIndex: (indexName: string, range?: (q: unknown) => unknown) => TableReaderLike;
-  withSearchIndex: (indexName: string, search: (q: unknown) => unknown) => TableReaderLike;
-}
-/**
- * Structural projection of the runtime ORM writer. The wrapper relies only
- * on these fields, so it's interchangeable between `@lunora/do`'s
- * `DatabaseWriterLike` and `@lunora/d1`'s `DatabaseWriterLike`.
- */
-interface DatabaseWriterLike {
-  /**
-   * Reduce matching rows to a scalar. The RLS wrapper AND-merges the read
-   * `baseWhere` into `options` so the reduction only sees policy-visible rows
-   * (safe: an aggregate scoped to `where` never reveals a hidden row — see
-   * `@lunora/do`'s `RestrictableQueryOptions`). Required: the only writer ever
-   * wrapped is `@lunora/do`'s `createShardCtxDb`, which always implements it.
-   */
-  aggregate: (tableName: string, options: AggregateArgs) => Promise<null | number>;
-  count: (tableName: string, whereOrArgs?: CountArgs | WhereInput) => Promise<number>;
-  delete: (id: string, expectedTable?: string, options?: {
-    hard?: boolean;
-  }) => Promise<void>;
-  /** Uncapped, chunked erase of a whole table. The RLS wrapper gates each row like a single delete. */
-  deleteAll?: (tableName: string, options?: {
-    chunkSize?: number;
-    hard?: boolean;
-  }) => Promise<{
-    deleted: number;
-  }>;
-  deleteMany: (ids: ReadonlyArray<string>, options?: {
-    limit?: number;
-  }, expectedTable?: string) => Promise<{
-    deleted: number;
-  }>;
-  deleteWhere?: (tableName: string, where: WhereInput, options?: {
-    limit?: number;
-  }) => Promise<{
-    deleted: number;
-  }>;
-  findFirst: (tableName: string, args?: QueryArgs) => Promise<Record<string, unknown> | null>;
-  findFirstOrThrow: (tableName: string, args?: QueryArgs) => Promise<Record<string, unknown>>;
-  findMany: (tableName: string, args?: QueryArgs) => Promise<QueryPage>;
-  get: (id: string, expectedTable?: string) => Promise<Record<string, unknown> | null>;
-  /**
-   * Group + reduce. Same `baseWhere` injection as `aggregate`: the per-group
-   * reduction is scoped to policy-visible rows, so a group count tallies only
-   * rows the caller may read. Required for the same reason as `aggregate`.
-   */
-  groupBy: (tableName: string, options: GroupByArgs) => Promise<ReadonlyArray<{
-    key: Record<string, unknown>;
-    value: null | number;
-  }>>;
-  insert: (tableName: string, document: Record<string, unknown>) => Promise<string>;
-  insertMany: (tableName: string, documents: ReadonlyArray<Record<string, unknown>>, options?: {
-    limit?: number;
-    skipDuplicates?: boolean;
-  }) => Promise<(string | null)[]>;
-  insertManyUnsafe: (tableName: string, documents: ReadonlyArray<Record<string, unknown>>, options?: {
-    allowExplicitId?: boolean;
-    limit?: number;
-  }) => Promise<string[]>;
-  /**
-   * Optional table-aware lookup. The underlying writer (e.g. `@lunora/do`)
-   * already knows the owning table of an id internally, so it can return
-   * `{ row, tableName }` in a single round-trip. When present, the RLS wrapper
-   * uses it to collapse the per-call membership-probe fan-out (1 `get` + N
-   * `findFirst` across every policy table) down to one lookup. Writers that
-   * don't implement it fall back to the probe path.
-   */
-  lookupById?: (id: string, expectedTable?: string) => Promise<null | {
-    row: Record<string, unknown>;
-    tableName: string;
-  }>;
-  patch: (id: string, patch: Record<string, unknown>, expectedTable?: string) => Promise<void>;
-  patchMany: (patches: ReadonlyArray<{
-    id: string;
-    patch: Record<string, unknown>;
-  }>, options?: {
-    limit?: number;
-  }, expectedTable?: string) => Promise<{
-    patched: number;
-  }>;
-  patchWhere?: (tableName: string, args: {
-    patch: Record<string, unknown>;
-    where: WhereInput;
-  }, options?: {
-    limit?: number;
-  }) => Promise<{
-    patched: number;
-  }>;
-  query: (tableName: string) => TableReaderLike;
-  /**
-   * Rank a row within its partition. A position is a count-of-rows-before, so
-   * — exactly like `count()` — it can't be trusted in an RLS-restricted
-   * reader: the wrapper fails it closed with `COUNT_RLS_UNSUPPORTED`. Required
-   * for the same reason as `aggregate`.
-   */
-  rank: (tableName: string, indexName: string, options: RankArgs) => Promise<null | {
-    position: number;
-    total: number;
-  }>;
-  /** Cross-shard rank primitive — same count-of-before RLS hazard as `rank`; failed closed under a read policy. */
-  rankBefore?: (tableName: string, indexName: string, options: RankBeforeArgs) => Promise<{
-    before: number;
-    total: number;
-  }>;
-  /**
-   * Sorted pagination over a rank companion. The companion stores only the
-   * partition + sort keys + id, so an arbitrary read `baseWhere` can't be
-   * enforced against it (and re-filtering the fetched rows would break page
-   * sizing). RLS therefore fails it closed rather than leak hidden rows.
-   * Required for the same reason as `aggregate`.
-   */
-  rankPage: (tableName: string, indexName: string, options?: RankPageArgs) => Promise<QueryPage>;
-  /**
-   * Cross-shard companion to `rankPage`: same ranked slice, but each row
-   * keeps its rank-key tuple for the query coordinator's k-way merge. Same
-   * count-of-partition RLS hazard as `rankPage` — failed closed under a read
-   * policy for the identical reason (see `rankPage` above).
-   */
-  rankPageRows?: (tableName: string, indexName: string, options?: RankPageArgs) => Promise<ShardRankPageResultLike>;
-  replace: (id: string, document: Record<string, unknown>, expectedTable?: string) => Promise<void>;
-  restore?: (id: string, expectedTable?: string) => Promise<void>;
-  /**
-   * Whole-shard erase. The RLS wrapper deliberately **fails this closed** rather
-   * than wrapping it — see the wrapper's `wipeShard`.
-   */
-  wipeShard?: (options?: {
-    chunkSize?: number;
-    exclude?: ReadonlyArray<string>;
-    tables?: ReadonlyArray<string>;
-  }) => Promise<{
-    deleted: number;
-    tables: Record<string, number>;
-  }>;
-}
-/**
- * What a procedure's `ctx.db` must structurally satisfy for the middleware
- * to wrap it. We deliberately mirror `@lunora/do`'s `DatabaseWriterLike`
- * rather than `@lunora/server`'s nominal `DatabaseWriter`/`DatabaseReader`:
- * the runtime adapter that flows in is the `DatabaseWriterLike`-shaped one,
- * and structural matching keeps this module free of an `@lunora/do`-typed
- * `ctx`.
- */
-type RlsDatabase = DatabaseWriterLike;
-/** Roles list source on the context. Tolerant of older auth states. */
-type AuthLike = {
-  getIdentity?: () => Promise<Record<string, unknown> | null>;
-  roles?: ReadonlyArray<string>;
-  userId?: null | string;
-};
-/** Minimal shape the middleware needs on the incoming ctx. */
-interface RlsContextIn {
-  auth?: AuthLike;
-  db: RlsDatabase;
-}
-declare const rls: <Context extends RlsContextIn = RlsContextIn>(policies: ReadonlyArray<Policy<Context>>, options?: RlsOptions) => Middleware<Context, Context>;
 /**
  * A predicate matching **no** rows — the deny decision.
  *
@@ -2623,14 +2617,8 @@ declare const defineStorageRule: <Context = unknown>(input: DefineStorageRuleInp
  * immediately rather than as a silently double-evaluated predicate.
  */
 declare const defineStorageRules: <Context = unknown>(rules: ReadonlyArray<StorageRule<Context>>) => ReadonlyArray<StorageRule<Context>>;
-/** The minimal `ctx.auth` shape the middleware reads — a structural subset that the full AuthState satisfies. Tolerant of older auth states (mirrors RLS's `AuthLike`). */
-type StorageAuthLike = {
-  getIdentity?: () => Promise<Record<string, unknown> | null>;
-  roles?: ReadonlyArray<string>;
-  userId?: null | string;
-};
 interface StorageContextIn {
-  auth?: StorageAuthLike;
+  auth?: AuthLike;
   storage?: unknown;
 }
 declare const storageRules: <Context extends StorageContextIn = StorageContextIn>(rules: ReadonlyArray<StorageRule<Context>>, options?: StorageRulesOptions) => Middleware<Context, Context>;