ts-prorm-orm 2.0.0 → 2.1.0

package/CHANGELOG.md

@@ -5,6 +5,138 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.1.0] - 2026-09-07
+
+### Documentation
+
+- **The documentation is now a guided path rather than a reference dump.** A
+  landing page, a getting-started tutorial that runs as written, a stated
+  reading order with an editorial hand-off at the end of each page, and an
+  overview page for every major section. The dialect and store indexes listed
+  12 of 27 and 12 of 88 pages respectively; both are now complete and generated
+  from the pages themselves so they cannot drift.
+
+- **An API reference generated from the source.** TypeDoc was configured but
+  never ran, leaving 11,098 TSDoc blocks invisible; it now builds in CI and
+  ships at `/reference`. TSDoc coverage of exported declarations rose from
+  81.2% to 86.0%, and 97 usage examples that TypeDoc had been parsing as block
+  tags — rendering as mangled tag soup — are fenced correctly.
+
+- **The viewer gained** collapsible grouped navigation (stores was 89 links in
+  one flat list), breadcrumbs, in-page contents, heading anchors, callouts,
+  mermaid diagrams and Ace syntax highlighting — with eleven Playwright smoke
+  tests covering it, since it is the one component that cannot be verified
+  without a browser.
+
+- **All Vercel content is gone.** The 12 guides under `guides/docker/` were
+  written around Vercel Sandbox despite the directory name; each is rewritten
+  against real Docker using the images and credentials `docker-compose.test.yml`
+  already uses. `runbooks/rollback.md` described three things that no longer
+  exist and now documents the GitLab Pages deploy. What stays is
+  `stores/vercel-kv.md`: Vercel KV is a supported data store, not deployment
+  cruft.
+
+### Security
+
+- **Cleared every HIGH and CRITICAL dependency advisory** (40 issues / 123
+  vulnerable paths at the start, including one Critical). `npm audit` goes from
+  46 findings (19 high, 2 critical) to 16 (0 high, 0 critical); everything left
+  is moderate or low.
+
+  Most of it was lockfile staleness rather than unfixable advisories — the
+  declared ranges already permitted the patched versions. Refreshing within
+  those ranges moved `undici` 7.28.0 → 7.29.1 (the Critical: improper
+  certificate validation), `tar` 6.2.1 → 7.5.22, `mysql2` 3.20.0 → 3.24.3,
+  `mariadb` 3.5.2 → 3.5.4, `@xmldom/xmldom` 0.9.10 → 0.9.12 (11 advisories),
+  `thrift` 0.23.0 → 0.24.0, `protobufjs` 7.6.4 → 7.6.6, `browserslist` 4.28.1 →
+  4.28.9, `fast-xml-parser` 5.9.3 → 5.11.1 and `brace-expansion` to 1.1.18 /
+  2.1.4 / 5.0.9.
+
+  Three `overrides` cover transitives whose parents pin a vulnerable version:
+  `adm-zip` ^0.6.0 (pinned by `ibm_db`), `toml` ^5.0.0 (pinned by
+  `snowflake-sdk` at ^3.0.0) and `node-gyp` ^11.4.2, which pulls modern
+  `cacache` (19.0.1), `make-fetch-happen` (14.0.3) and `tar` 7.x through the
+  native-build toolchain. Note that npm `overrides` apply to this repository's
+  own install and are **not** inherited by packages that depend on
+  ts-prorm-orm.
+
+  npm proposed "fixes" that were actually downgrades — `ibm_db` 4.0.1 → 3.1.0
+  and `snowflake-sdk` 3.0.0 → 1.11.0. Those were rejected; the overrides above
+  address the same advisories without giving up a major version of DB2 or
+  Snowflake support.
+
+- **Two advisories are accepted rather than fixed, in a documented `.snyk`
+  policy.** Both are HIGH, transitive, and have no upgrade available today; the
+  other 38 issues were fixed by moving to patched versions, not ignored. Each
+  entry carries a reason and a 2026-12-06 expiry so it has to be re-argued
+  rather than quietly living forever.
+
+  `adm-zip` (Symlink Attack) has **no fixed version at all** — 0.6.0 is the
+  latest release. It arrives only through `ibm_db`, and only in
+  `installer/driverInstall.js`, which unzips IBM's own CLI driver bundle at
+  install time; nothing in `ibm_db/lib` reaches it, and `allowScripts` does not
+  approve `ibm_db`, so that installer never runs here anyway.
+
+  `@opentelemetry/core` (unbounded resource allocation) *is* fixed in 2.8.0,
+  but that fix is unreachable: `@google-cloud/spanner` depends on the OTel 1.x
+  API, and `@opentelemetry/resources@1.30.1` pins core to exactly 1.30.1, so
+  core cannot move alone. Overriding the whole stack to 2.x was tried and
+  verified to break Spanner outright — `require('@google-cloud/spanner')`
+  throws `ExplicitBucketHistogramAggregation is not a constructor` — so the
+  override was reverted rather than shipping a broken Spanner dialect.
+
+### Removed
+
+- **`sqlite3` is no longer a dependency.** Nothing in the codebase imported it
+  — SQLite runs on `better-sqlite3` (and `bun:sqlite` under Bun), which the
+  driver loader selects at runtime. It was a hard dependency, so every consumer
+  compiled a native addon for a package that was never loaded, and it dragged
+  in the vulnerable `node-gyp` 8.x / `cacache` 15.x / `tar` 6.2.1 toolchain.
+  Installs are smaller and one native build lighter.
+
+- **The CI pipeline drops from 77 jobs to 13.** `db.gitlab-ci.yml` and its 59
+  `mirror:*` jobs are gone: each pulled a multi-gigabyte database image through
+  docker-in-docker and pushed it to this project's registry, purely so the
+  Docker guides could pull from a registry we control — and those guides now
+  pull from Docker Hub directly, so the jobs had no remaining consumer. The 18
+  `db-*` category stages went with them.
+
+  Also removed: the `test` shard matrix, `test:coverage`, `tf:plan` and
+  `tf:drift`. **The test suite no longer runs in CI**; `build:node22` (tsc) and
+  `lint` are the automated gates on a push. The full suite still runs through
+  `prepublishOnly` on the tag-triggered `publish` job — but not on
+  `publish:npm`, which uses `--ignore-scripts`.
+
+### Changed
+
+- **Pinned `@qdrant/js-client-rest` to `~1.18.0`.** 1.19.0 removed `search()`
+  and `searchBatch()` in a *minor* release; their replacements (`query()` /
+  `queryBatch()`) take a different request shape and return `{ points }`
+  instead of an array, so adopting them would change the public signature of
+  `QdrantStore.searchBatch()`. Pinning keeps the API stable and still clears
+  the advisory, because 1.18.0's `undici ^6.24.0` range resolves to the fixed
+  6.28.1. Migrating to the query API is deliberate future work.
+
+### Fixed
+
+- **`allowScripts` no longer silently skips the native build.** It approved
+  `better-sqlite3@12.8.0` by exact version, so refreshing the lockfile to
+  12.11.1 blocked the `node-gyp` install script — leaving no compiled binding
+  and failing 155 suites / 2,283 tests with no obvious cause. npm rejects
+  semver ranges in this field, so the entry now lists exact versions joined by
+  `||`. Note that after changing it you must `npm rebuild`, because npm only
+  runs install scripts when it actually (re)installs a package.
+- **`sbom` no longer fails on peer-dependency noise.** `cyclonedx-npm` shells
+  out to `npm ls`, which exits `ELSPROBLEMS` because the root install uses
+  `--legacy-peer-deps`; `--ignore-npm-errors` tolerates it.
+- **`snyk:code` no longer blocks on a missing entitlement.** Snyk Code is
+  separately licensed and returns `403 Forbidden (SNYK-CLI-0000)` with no
+  findings when the org lacks it — a licensing state, not a security result.
+- **The documentation site can actually deploy.** `pages` had no `needs:`, so
+  it waited on every earlier stage and was silently blocked by unrelated
+  security-scan failures. It is decoupled with `needs: []`; the security jobs
+  still gate the pipeline, just not the docs.
+
 ## [2.0.0]
 
 ### Breaking

package/dist/compliance/data-classifier.d.ts

@@ -10,6 +10,7 @@
  *   PIPL, AI Act EU, GDPR Art 25/30/32, and data classification requirements.
  *
  * Usage:
+ * ```ts
  *   // Tag fields with sensitivity levels:
  *   @Classify('PII')
  *   @FieldClassification('email', 'PII')
@@ -25,6 +26,7 @@
  *
  *   // Auto-discover fields by name patterns:
  *   DataClassifier.autoDiscover(User, ['ssn', 'social', 'dob', 'card', 'password']);
+ * ```
  */
 export type SensitivityLevel = 'PUBLIC' | 'INTERNAL' | 'CONFIDENTIAL' | 'SECRET' | 'TOP_SECRET';
 export type DataCategory = 'PII' | 'PHI' | 'PCI' | 'PCI_PAN' | 'FINANCIAL' | 'HEALTH' | 'BIOMETRIC' | 'CUI' | 'SENSITIVE';
@@ -45,16 +47,20 @@ export interface ClassificationMetadata {
 /**
  * Classify the entire model (applies to all fields, use field-level for specifics).
  *
+ * ```ts
  *   @Classify('CONFIDENTIAL')
  *   class FinancialRecord extends Model { ... }
+ * ```
  */
 export declare function Classify(level: SensitivityLevel): (target: Function) => void;
 /**
  * Classify a specific field.
  *
+ * ```ts
  *   @FieldClassification('email', 'PII')
  *   @FieldClassification('ssn', 'PHI', { level: 'SECRET', regulations: ['HIPAA'] })
  *   @FieldClassification('creditCard', 'PCI_PAN', { level: 'TOP_SECRET' })
+ * ```
  */
 export declare function FieldClassification(field: string, category: DataCategory, options?: Partial<ClassificationMetadata>): (target: Function) => void;
 /**

package/dist/compliance/data-classifier.js

@@ -11,6 +11,7 @@
  *   PIPL, AI Act EU, GDPR Art 25/30/32, and data classification requirements.
  *
  * Usage:
+ * ```ts
  *   // Tag fields with sensitivity levels:
  *   @Classify('PII')
  *   @FieldClassification('email', 'PII')
@@ -26,6 +27,7 @@
  *
  *   // Auto-discover fields by name patterns:
  *   DataClassifier.autoDiscover(User, ['ssn', 'social', 'dob', 'card', 'password']);
+ * ```
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DataClassifier = void 0;
@@ -54,8 +56,10 @@ function getClassifications(target) {
 /**
  * Classify the entire model (applies to all fields, use field-level for specifics).
  *
+ * ```ts
  *   @Classify('CONFIDENTIAL')
  *   class FinancialRecord extends Model { ... }
+ * ```
  */
 function Classify(level) {
     return function (target) {
@@ -68,9 +72,11 @@ function Classify(level) {
 /**
  * Classify a specific field.
  *
+ * ```ts
  *   @FieldClassification('email', 'PII')
  *   @FieldClassification('ssn', 'PHI', { level: 'SECRET', regulations: ['HIPAA'] })
  *   @FieldClassification('creditCard', 'PCI_PAN', { level: 'TOP_SECRET' })
+ * ```
  */
 function FieldClassification(field, category, options = {}) {
     return function (target) {

package/dist/compliance/data-lineage.d.ts

@@ -25,9 +25,11 @@
  *   // Get transformation history:
  *   const transforms = await DataLineage.getTransformations(orderId, 'Orders');
  *
+ * ```ts
  *   // Using the decorator:
  *   @LineageTrack({ fields: ['amount', 'total'] })
  *   class Order extends Model { ... }
+ * ```
  */
 import { ModelStatic, Prorm } from '../prorm';
 /** The origin of data - how it entered the system */
@@ -128,8 +130,10 @@ export interface LineageTrackOptions {
 /**
  * Decorator to mark fields for lineage tracking.
  *
+ * ```ts
  *   @LineageTrack({ fields: ['amount', 'total', 'tax'] })
  *   class Order extends Model { ... }
+ * ```
  */
 export declare function LineageTrack(options?: LineageTrackOptions): (target: Function) => void;
 /**

package/dist/compliance/data-lineage.js

@@ -26,9 +26,11 @@
  *   // Get transformation history:
  *   const transforms = await DataLineage.getTransformations(orderId, 'Orders');
  *
+ * ```ts
  *   // Using the decorator:
  *   @LineageTrack({ fields: ['amount', 'total'] })
  *   class Order extends Model { ... }
+ * ```
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DataLineage = void 0;
@@ -46,8 +48,10 @@ const lineageRegistry = new Map();
 /**
  * Decorator to mark fields for lineage tracking.
  *
+ * ```ts
  *   @LineageTrack({ fields: ['amount', 'total', 'tax'] })
  *   class Order extends Model { ... }
+ * ```
  */
 function LineageTrack(options = {}) {
     return function (target) {

package/dist/compliance/data-masker.d.ts

@@ -15,6 +15,7 @@
  *   DataMasker.maskField(Payment, 'cardNumber', { pattern: 'card-last4', showLast: 4 });
  *   DataMasker.maskField(Customer, 'email', { pattern: 'email' });
  *
+ * ```ts
  *   // Or use the decorator:
  *   @Mask('ssn', { pattern: 'ssn' })
  *   class User extends Model { ... }
@@ -25,6 +26,7 @@
  *
  *   // Or use the automatic hook:
  *   DataMasker.applyHooks(User);
+ * ```
  */
 /** Built-in masking pattern identifiers; see {@link MaskPatternEnum} for the enum form. */
 export type MaskPattern = 'ssn' | 'card-last4' | 'card-first6' | 'email' | 'phone' | 'full' | 'none' | 'custom';
@@ -71,8 +73,10 @@ export declare function getMaskRules(Model: any): MaskRule[];
 /**
  * Decorator to mark a field for masking.
  *
+ * ```ts
  *   @Mask('ssn', { pattern: 'ssn' })
  *   class User extends Model { ... }
+ * ```
  */
 export declare function Mask(field: string, options?: MaskOptions): (target: Function) => void;
 /**

package/dist/compliance/data-masker.js

@@ -16,6 +16,7 @@
  *   DataMasker.maskField(Payment, 'cardNumber', { pattern: 'card-last4', showLast: 4 });
  *   DataMasker.maskField(Customer, 'email', { pattern: 'email' });
  *
+ * ```ts
  *   // Or use the decorator:
  *   @Mask('ssn', { pattern: 'ssn' })
  *   class User extends Model { ... }
@@ -26,6 +27,7 @@
  *
  *   // Or use the automatic hook:
  *   DataMasker.applyHooks(User);
+ * ```
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DataMasker = exports.MaskPatternEnum = void 0;
@@ -197,8 +199,10 @@ function getMaskRules(Model) {
 /**
  * Decorator to mark a field for masking.
  *
+ * ```ts
  *   @Mask('ssn', { pattern: 'ssn' })
  *   class User extends Model { ... }
+ * ```
  */
 function Mask(field, options = {}) {
     return function (target) {

package/dist/compliance/index.d.ts

@@ -15,6 +15,7 @@
  *   import { ComplianceAuditTrail } from './compliance/audit-trail';
  *   ComplianceAuditTrail.enable(prorm, UserModel, { getUserId: () => user.id });
  *
+ * ```ts
  *   // 2. Field-level AES-256-GCM encryption
  *   import { FieldEncryption } from './compliance/field-encryption';
  *   FieldEncryption.configure('32-byte-hex-key');
@@ -65,6 +66,7 @@
  *   import { DataClassifier } from './compliance/data-classifier';
  *   @FieldClassification('email', 'PII') class User extends Model {}
  *   const piiFields = DataClassifier.getPIIFields(User);
+ * ```
  */
 export { ComplianceAuditTrail, AuditTrailOptions } from './audit-trail';
 export { FieldEncryption, configureFieldEncryption, encryptValue, decryptValue, Encrypt, applyEncryptionHooks, getEncryptedFields, } from './field-encryption';

package/dist/compliance/index.js

@@ -16,6 +16,7 @@
  *   import { ComplianceAuditTrail } from './compliance/audit-trail';
  *   ComplianceAuditTrail.enable(prorm, UserModel, { getUserId: () => user.id });
  *
+ * ```ts
  *   // 2. Field-level AES-256-GCM encryption
  *   import { FieldEncryption } from './compliance/field-encryption';
  *   FieldEncryption.configure('32-byte-hex-key');
@@ -66,6 +67,7 @@
  *   import { DataClassifier } from './compliance/data-classifier';
  *   @FieldClassification('email', 'PII') class User extends Model {}
  *   const piiFields = DataClassifier.getPIIFields(User);
+ * ```
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getPIIFields = exports.getClassification = exports.FieldClassification = exports.Classify = exports.DataClassifier = exports.createDSARResponse = exports.exportStream = exports.exportData = exports.DataPortabilityExporter = exports.applyPseudonymizationHooks = exports.Pseudonymize = exports.detokenize = exports.tokenize = exports.configure = exports.PseudonymizationService = exports.isImmutable = exports.enableVersioning = exports.makeImmutable = exports.ImmutableRecord = exports.applyMaskingHooks = exports.maskMany = exports.mask = exports.maskValue = exports.maskField = exports.Mask = exports.MaskPatternEnum = exports.DataMasker = exports.registerHooks = exports.rlsMiddleware = exports.runInContext = exports.getContext = exports.setContext = exports.apply = exports.initRLS = exports.RLS = exports.RowLevelSecurity = exports.ConsentVersioning = exports.LegalBasisEnum = exports.ConsentRecord = exports.RightToErasure = exports.DataRetentionPolicy = exports.TLSEnforcer = exports.getEncryptedFields = exports.applyEncryptionHooks = exports.Encrypt = exports.decryptValue = exports.encryptValue = exports.configureFieldEncryption = exports.FieldEncryption = exports.ComplianceAuditTrail = void 0;

package/dist/compliance/pseudonymization.d.ts

@@ -24,12 +24,14 @@
  *   const original = await PseudonymizationService.detokenize(token);
  *   // original: 'user-123'
  *
+ * ```ts
  *   // Or use the decorator on a model field:
  *   @Pseudonymize('nationalId')
  *   class Patient extends Model { ... }
  *
  *   // Apply hooks to auto-tokenize on write:
  *   PseudonymizationService.applyHooks(Patient, 'nationalId');
+ * ```
  */
 export type StorageMode = 'memory' | 'database';
 export interface PseudonymizationConfig {
@@ -73,8 +75,10 @@ export declare function getPseudonymizedFields(target: Function): string[];
 /**
  * Mark a field for automatic pseudonymization.
  *
+ * ```ts
  *   @Pseudonymize('nationalId')
  *   class Patient extends Model { ... }
+ * ```
  */
 export declare function Pseudonymize(field: string): (target: Function) => void;
 /**

package/dist/compliance/pseudonymization.js

@@ -25,12 +25,14 @@
  *   const original = await PseudonymizationService.detokenize(token);
  *   // original: 'user-123'
  *
+ * ```ts
  *   // Or use the decorator on a model field:
  *   @Pseudonymize('nationalId')
  *   class Patient extends Model { ... }
  *
  *   // Apply hooks to auto-tokenize on write:
  *   PseudonymizationService.applyHooks(Patient, 'nationalId');
+ * ```
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PseudonymizationService = void 0;
@@ -207,8 +209,10 @@ function getPseudonymizedFields(target) {
 /**
  * Mark a field for automatic pseudonymization.
  *
+ * ```ts
  *   @Pseudonymize('nationalId')
  *   class Patient extends Model { ... }
+ * ```
  */
 function Pseudonymize(field) {
     return function (target) {

package/dist/compliance/query-firewall.d.ts

@@ -585,21 +585,21 @@ export interface FirewallRuleDecoratorOptions {
  *
  * @example
  * // Block destructive operations and file operations on a model
- * @FirewallRules({
+ * `@FirewallRules`({
  *   blockDestructive: true,
  *   blockFileOperations: true,
  * })
  * class SensitiveData extends Model { ... }
  *
  * // Apply database-specific rules
- * @FirewallRules({
+ * `@FirewallRules`({
  *   database: 'postgresql',
  *   blockCodeExecution: true,
  * })
  * class UserDefinedFunction extends Model { ... }
  *
  * // Custom rules
- * @FirewallRules({
+ * `@FirewallRules`({
  *   rules: [
  *     { pattern: /^SELECT\s+FROM\s+logs/i, description: 'Block log access' },
  *   ],
@@ -611,7 +611,7 @@ export declare function FirewallRules(options?: FirewallRuleDecoratorOptions): (
  * Decorator for PostgreSQL-specific firewall rules
  *
  * @example
- * @PostgreSQLFirewall()
+ * `@PostgreSQLFirewall`()
  * class PostgresSensitive extends Model { ... }
  */
 export declare function PostgreSQLFirewall(): (target: any) => void;
@@ -619,7 +619,7 @@ export declare function PostgreSQLFirewall(): (target: any) => void;
  * Decorator for MySQL-specific firewall rules
  *
  * @example
- * @MySQLFirewall()
+ * `@MySQLFirewall`()
  * class MySQLSensitive extends Model { ... }
  */
 export declare function MySQLFirewall(): (target: any) => void;
@@ -627,7 +627,7 @@ export declare function MySQLFirewall(): (target: any) => void;
  * Decorator for MariaDB-specific firewall rules
  *
  * @example
- * @MariaDBFirewall()
+ * `@MariaDBFirewall`()
  * class MariaDBSensitive extends Model { ... }
  */
 export declare function MariaDBFirewall(): (target: any) => void;
@@ -635,7 +635,7 @@ export declare function MariaDBFirewall(): (target: any) => void;
  * Decorator for SQL Server-specific firewall rules
  *
  * @example
- * @MSSQLFirewall()
+ * `@MSSQLFirewall`()
  * class MSSQLSensitive extends Model { ... }
  */
 export declare function MSSQLFirewall(): (target: any) => void;
@@ -643,7 +643,7 @@ export declare function MSSQLFirewall(): (target: any) => void;
  * Decorator for Oracle-specific firewall rules
  *
  * @example
- * @OracleFirewall()
+ * `@OracleFirewall`()
  * class OracleSensitive extends Model { ... }
  */
 export declare function OracleFirewall(): (target: any) => void;
@@ -651,7 +651,7 @@ export declare function OracleFirewall(): (target: any) => void;
  * Decorator for SQLite-specific firewall rules
  *
  * @example
- * @SQLiteFirewall()
+ * `@SQLiteFirewall`()
  * class SQLiteSensitive extends Model { ... }
  */
 export declare function SQLiteFirewall(): (target: any) => void;

package/dist/compliance/query-firewall.js

@@ -1009,21 +1009,21 @@ const FIREWALL_DATABASE_KEY = Symbol('__orm_firewall_database__');
  *
  * @example
  * // Block destructive operations and file operations on a model
- * @FirewallRules({
+ * `@FirewallRules`({
  *   blockDestructive: true,
  *   blockFileOperations: true,
  * })
  * class SensitiveData extends Model { ... }
  *
  * // Apply database-specific rules
- * @FirewallRules({
+ * `@FirewallRules`({
  *   database: 'postgresql',
  *   blockCodeExecution: true,
  * })
  * class UserDefinedFunction extends Model { ... }
  *
  * // Custom rules
- * @FirewallRules({
+ * `@FirewallRules`({
  *   rules: [
  *     { pattern: /^SELECT\s+FROM\s+logs/i, description: 'Block log access' },
  *   ],
@@ -1075,7 +1075,7 @@ function FirewallRules(options = {}) {
  * Decorator for PostgreSQL-specific firewall rules
  *
  * @example
- * @PostgreSQLFirewall()
+ * `@PostgreSQLFirewall`()
  * class PostgresSensitive extends Model { ... }
  */
 function PostgreSQLFirewall() {
@@ -1085,7 +1085,7 @@ function PostgreSQLFirewall() {
  * Decorator for MySQL-specific firewall rules
  *
  * @example
- * @MySQLFirewall()
+ * `@MySQLFirewall`()
  * class MySQLSensitive extends Model { ... }
  */
 function MySQLFirewall() {
@@ -1095,7 +1095,7 @@ function MySQLFirewall() {
  * Decorator for MariaDB-specific firewall rules
  *
  * @example
- * @MariaDBFirewall()
+ * `@MariaDBFirewall`()
  * class MariaDBSensitive extends Model { ... }
  */
 function MariaDBFirewall() {
@@ -1105,7 +1105,7 @@ function MariaDBFirewall() {
  * Decorator for SQL Server-specific firewall rules
  *
  * @example
- * @MSSQLFirewall()
+ * `@MSSQLFirewall`()
  * class MSSQLSensitive extends Model { ... }
  */
 function MSSQLFirewall() {
@@ -1115,7 +1115,7 @@ function MSSQLFirewall() {
  * Decorator for Oracle-specific firewall rules
  *
  * @example
- * @OracleFirewall()
+ * `@OracleFirewall`()
  * class OracleSensitive extends Model { ... }
  */
 function OracleFirewall() {
@@ -1125,7 +1125,7 @@ function OracleFirewall() {
  * Decorator for SQLite-specific firewall rules
  *
  * @example
- * @SQLiteFirewall()
+ * `@SQLiteFirewall`()
  * class SQLiteSensitive extends Model { ... }
  */
 function SQLiteFirewall() {

package/dist/compliance/rate-limiter.d.ts

@@ -30,8 +30,10 @@
  *   limiter.reset();
  *
  * Decorator usage:
+ * ```ts
  *   @RateLimit({ perMinute: 100, perHour: 1000 })
  *   class User extends Model { ... }
+ * ```
  */
 import { Prorm } from '../prorm';
 import type { ModelStatic } from '../types';
@@ -173,8 +175,10 @@ export interface RateLimitDecoratorOptions {
  * Rate limit decorator for models
  *
  * Usage:
+ * ```ts
  *   @RateLimit({ perMinute: 100, perHour: 1000 })
  *   class User extends Model { ... }
+ * ```
  */
 export declare function RateLimit(options: RateLimitDecoratorOptions): <T extends ModelStatic<any>>(target: T) => T;
 /**

package/dist/compliance/rate-limiter.js

@@ -31,8 +31,10 @@
  *   limiter.reset();
  *
  * Decorator usage:
+ * ```ts
  *   @RateLimit({ perMinute: 100, perHour: 1000 })
  *   class User extends Model { ... }
+ * ```
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RateLimiter = void 0;
@@ -469,8 +471,10 @@ exports.RateLimiter = RateLimiter;
  * Rate limit decorator for models
  *
  * Usage:
+ * ```ts
  *   @RateLimit({ perMinute: 100, perHour: 1000 })
  *   class User extends Model { ... }
+ * ```
  */
 function RateLimit(options) {
     return function (target) {

package/dist/compliance/row-level-security.d.ts

@@ -96,8 +96,10 @@ export declare function getFilteredQuery(Model: any): {
 /**
  * Decorator to apply RLS to a model class.
  *
+ * ```ts
  *   @RowLevelSecurity((ctx) => ({ where: { tenantId: ctx.tenantId } }))
  *   class Document extends Model { ... }
+ * ```
  */
 export declare function RowLevelSecurity(selector: ScopeSelector): (target: any) => void;
 /**

package/dist/compliance/row-level-security.js

@@ -120,8 +120,10 @@ function getFilteredQuery(Model) {
 /**
  * Decorator to apply RLS to a model class.
  *
+ * ```ts
  *   @RowLevelSecurity((ctx) => ({ where: { tenantId: ctx.tenantId } }))
  *   class Document extends Model { ... }
+ * ```
  */
 function RowLevelSecurity(selector) {
     return function (target) {