@lunora/advisor 1.0.0-alpha.2 → 1.0.0-alpha.20

package/dist/index.d.ts

@@ -18,6 +18,69 @@ interface AdvisorAdminRoute {
   usesGuard: boolean;
 }
 /**
+* One `ctx.ai.run(model, …)` call whose model-id argument is derived from the
+* handler's `args` with no server-side scoping — the input the
+* `ai_raw_run_escape_hatch` lint consumes. `ctx.ai.run` is the raw Workers AI
+* binding passthrough, bypassing the typed `ctx.ai.model(...)` + AI-SDK layer
+* (`generateText`/`streamText`/…) that caps output and enforces a schema. When
+* the model id comes straight from request input, any caller can select an
+* arbitrary model. A fixed literal model, or one scoped by a server-trusted
+* `ctx.*` value, is *not* recorded; only an arg-derived, unscoped model id
+* reaches here — an arg-derived `inputs` argument is normal usage and is never
+* inspected. Produced by the codegen feeder; runtime callers don't supply it,
+* so the lint finds nothing there.
+*/
+interface AdvisorAiRawRun {
+  /** The exported binding name of the procedure performing the `ctx.ai.run` call. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the `ctx.ai.run` call, or `0` when unknown. */
+  line: number;
+}
+/**
+* One `generateText` / `streamText` call whose `tools` reach a privileged side
+* effect — the shared input for the `ai_tool_side_effect_prompt_injection` lint.
+* A model-callable `tool({ execute })` that writes to the database, dispatches
+* another function, or sends outbound (fetch / mail / queue) hands the LLM the
+* trigger for a real-world action; `userInputDerived` records whether the model
+* input (`prompt`/`messages`/`system`) flows from the handler's `args`, the
+* channel a prompt injection rides in on. Produced by the codegen feeder; runtime
+* callers don't supply it, so the lint finds nothing there.
+*/
+interface AdvisorAiToolSideEffect {
+  /** The exported binding name of the procedure performing the call. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the generation call, or `0` when unknown. */
+  line: number;
+  /** The generation entrypoint invoked. */
+  method: "generateText" | "streamText";
+  /** The privileged side-effect sink a model-callable tool reaches (`ctx.db.insert`, `ctx.run`, `ctx.fetch`, …). */
+  sideEffect: string;
+  /** `true` when a model-input option is derived from the handler's `args` (a bare `args.x`, or a name destructured from `args`). */
+  userInputDerived: boolean;
+}
+/**
+* One `ctx.fetch(url, …)` call inside an action whose URL argument is derived
+* from the handler's `args` — the input the `action_fetch_ssrf` lint consumes.
+* `ctx.fetch` is the action-only outbound-request escape hatch with no host
+* allowlist, so a URL assembled from request input is a server-side request
+* forgery vector (cloud metadata endpoints, internal services). A fixed literal
+* URL, or one built from config/`ctx.*`, is *not* recorded; only an arg-derived
+* URL reaches here. Produced by the codegen feeder; runtime callers don't supply
+* it, so the lint finds nothing there.
+*/
+interface AdvisorArgumentDerivedFetch {
+  /** The exported binding name of the action performing the `ctx.fetch` call. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the `ctx.fetch` call, or `0` when unknown. */
+  line: number;
+}
+/**
 * One public procedure's argument validators reduced to the input-safety facts
 * the `public_arg_uses_any` and `unbounded_string_arg` lints consume: which args
 * are declared `v.any()` (unvalidated input) and which `v.string()` args carry no
@@ -38,6 +101,46 @@ interface AdvisorArgumentValidator {
   unboundedStringArgs: ReadonlyArray<string>;
 }
 /**
+* One `createAuth({...})` call's configuration snapshot — the shared input for
+* the five `auth_*` security lints (`auth_trusted_origins_wildcard`,
+* `auth_csrf_check_disabled`, `auth_secure_cookies_disabled`,
+* `auth_email_verification_disabled`, `auth_session_freshage_zero`).
+*
+* The feeder matches the `createAuth` call by callee name and, when its config
+* argument is a static object literal, reads the handful of nested facts each
+* lint cares about. An opaque config (a top-level spread, or a non-object-literal
+* argument) is recorded with `analyzable: false` and every boolean fact left at
+* its SAFE (not-flagged) value, so a config assembled elsewhere can't be flagged
+* on a key it may or may not set. Produced by the codegen feeder; runtime
+* callers don't supply it, so the auth-config lints find nothing there.
+*/
+interface AdvisorAuthConfig {
+  /**
+  * `true` when the call's config argument was a static object literal the
+  * feeder could read. `false` when the config was opaque (a variable, spread,
+  * call result, or missing argument) — every lint below skips such a config.
+  */
+  analyzable: boolean;
+  /** `advanced.disableCSRFCheck === true`. */
+  disableCsrfCheck: boolean;
+  /** `emailAndPassword.enabled === true`. */
+  emailPasswordEnabled: boolean;
+  /** The exported binding name enclosing the `createAuth(...)` call. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the `createAuth(...)` call, or `0` when unknown. */
+  line: number;
+  /** `emailAndPassword.requireEmailVerification === true` present. */
+  requireEmailVerification: boolean;
+  /** `advanced.useSecureCookies === false`. */
+  secureCookiesDisabled: boolean;
+  /** `session.freshAge === 0` (explicit literal). */
+  sessionFreshAgeZero: boolean;
+  /** `trustedOrigins` array literal contains a `"*"` element. */
+  trustedOriginsWildcard: boolean;
+}
+/**
 * One `ctx.authApi.&lt;method>(...)` call discovered in a function body — the input
 * the `auth_api_call_without_headers` lint consumes. Produced by the codegen
 * feeder; runtime callers don't supply it, so the lint finds nothing there.
@@ -55,6 +158,100 @@ interface AdvisorAuthApiCall {
   method: string;
 }
 /**
+* One `ctx.browser.&lt;method>(url, …)` call whose navigation URL (`arguments[0]`)
+* is derived from the handler's `args` with no server-side scoping — the input
+* the `browser_user_url_without_allowlist` lint consumes. `@lunora/browser`
+* blocks private/internal targets by default, but a request-supplied *public*
+* URL can still turn the headless browser into an open-proxy / SSRF tool
+* (fetching arbitrary third-party URLs, DNS-rebinding to internal hosts). A
+* fixed literal URL, or one scoped by a server-trusted `ctx.*` value, is not
+* recorded; only an arg-derived, unscoped URL reaches here. Produced by the
+* codegen feeder; runtime callers don't supply it, so the lint finds nothing
+* there.
+*/
+interface AdvisorBrowserUrlAccess {
+  /** The exported binding name of the procedure performing the `ctx.browser` call. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the `ctx.browser` call, or `0` when unknown. */
+  line: number;
+  /** The browser method invoked: `content` / `pdf` / `scrape` / `screenshot`. */
+  method: string;
+}
+/**
+* One factory/constructor call in `lunora/` whose configuration object literal a
+* security lint inspects for a present-or-absent key — the shared input for the
+* config-call security lints (payment authorize, inbound-mail verify, rate-limit
+* store, browser private-targets).
+*
+* The feeder records the callee name and, when the config argument is a static
+* object literal it could read, the set of keys present and the subset assigned
+* the literal `true`. Produced by the codegen feeder; runtime callers don't
+* supply it, so the config-call lints find nothing there.
+*/
+interface AdvisorConfigCall {
+  /**
+  * `true` when the call's config argument was a static object literal the
+  * feeder could read. `false` when the config was opaque (a variable, spread,
+  * call result, or missing argument) — key-presence lints skip such calls so
+  * a config assembled elsewhere can't be flagged on a key it may well set.
+  */
+  analyzable: boolean;
+  /** The factory function or constructor name at the call site, e.g. `createPayment` / `RateLimiter`. */
+  callee: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the call site, or `0` when unknown. */
+  line: number;
+  /** Keys present in the config object literal (empty when not `analyzable`). */
+  presentKeys: ReadonlyArray<string>;
+  /** Keys in the config object literal explicitly assigned the literal `true`. */
+  trueKeys: ReadonlyArray<string>;
+}
+/**
+* One `ctx.containers.&lt;exportName>.get(name, …)` call whose instance key is
+* derived from the handler's `args` with no server-side scoping — the input
+* the `container_instance_key_from_user_input` lint consumes. A container
+* definition's `.get(name)` accessor routes to one instance per `name`, so a
+* key taken straight from request input lets any caller reach any other
+* tenant's container (a cross-tenant IDOR). A fixed literal key, or one
+* derived from a server-trusted identity (`` `${ctx.auth.userId}` `` —
+* references `ctx`, so treated as scoped), is not recorded; only an
+* arg-derived, unscoped key reaches here. Produced by the codegen feeder;
+* runtime callers don't supply it, so the lint finds nothing there.
+*/
+interface AdvisorContainerKeyAccess {
+  /** The exported binding name of the procedure performing the `ctx.containers` access. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the `ctx.containers.*.get` call, or `0` when unknown. */
+  line: number;
+  /** The container accessor method invoked — always `get` (the only per-instance-key sink). */
+  method: string;
+}
+/**
+* One runtime container-override call: a `&lt;handle>.start({ enableInternet: true, … })`
+* launch override, or a `&lt;handle>.egress.&lt;method>(...)` runtime firewall mutation
+* (`allow` / `deny` / `setAllowed`) — the `container_start_enable_internet_override`
+* and `container_runtime_egress_relaxation` lint input. Both shapes re-open network
+* access the static `defineContainer` declaration (and its `container_public_internet`
+* lint) assumes is locked down. Structurally identical to `ContainerOverrideIR`.
+*/
+interface AdvisorContainerOverride {
+  /** e.g. the egress method name, or `"enableInternet: true"`. */
+  detail: string;
+  /** Export binding name of the procedure performing the call. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** Which override shape matched. */
+  kind: "egress_relaxation" | "enable_internet";
+  /** 1-based line of the call, or `0` when unknown. */
+  line: number;
+}
+/**
 * One container declaration discovered in `lunora/containers.ts` — the input
 * the `container_*` lints consume. Produced by the codegen feeder (which lifts
 * the static fields of each `defineContainer({...})` export); runtime callers
@@ -84,6 +281,108 @@ interface AdvisorContainer {
   sleepAfter?: number | string;
 }
 /**
+* One rate-limit / Turnstile middleware call — the `ratelimit_middleware_fail_open`
+* lint input. `rateLimit`/`dbRateLimit` (`@lunora/ratelimit`) and
+* `verifyTurnstileMiddleware` (`@lunora/auth`) each accept a `failOpen` escape
+* hatch that admits every request when the limiter/siteverify is unavailable;
+* `failOpen` is `true` only when the options literal set it to the boolean
+* literal `true` (anything else is fail-closed). The lint escalates a fail-open
+* guard to a finding when the guarded procedure (`exportName`/`limitName`) looks
+* auth/payment-sensitive. Produced by the codegen feeder; runtime callers don't
+* supply it, so the lint finds nothing there.
+*/
+interface AdvisorFailOpenGuard {
+  /** The middleware factory at the call site: `rateLimit` / `dbRateLimit` / `verifyTurnstileMiddleware`. */
+  callee: string;
+  /** The exported binding name of the procedure the guard is attached to, or `"&lt;module>"` at file scope. */
+  exportName: string;
+  /** `true` only when the options literal set `failOpen: true` as a boolean literal; a non-literal or absent option is treated as fail-closed. */
+  failOpen: boolean;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** The rate-limit `name` (second string argument) for `rateLimit`/`dbRateLimit`; `""` for `verifyTurnstileMiddleware`. */
+  limitName: string;
+  /** 1-based line of the middleware call, or `0` when unknown. */
+  line: number;
+}
+/**
+* One `ctx.flags.boolean("key", &lt;boolean-literal>)` read — the
+* `flag_gates_security_with_unsafe_default` lint input. OpenFeature returns the
+* `defaultValue` when the provider errors, so a fail-open default on a
+* security-shaped key (an `enforce`/`rls`/`gate`/`lockdown` protection
+* defaulting `false`, or an `allow`/`permit`/`bypass` permission defaulting
+* `true`) silently opens access during an outage. Only reads with a
+* statically-known string key and boolean-literal default are recorded; the lint
+* owns the security-shape + polarity judgment. Produced by the codegen feeder;
+* runtime callers don't supply it, so the lint finds nothing there.
+*/
+interface AdvisorFlagSecurityDefault {
+  /** The boolean-literal default returned on a provider outage (fail-open value). */
+  defaultValue: boolean;
+  /** The exported binding name of the procedure performing the flag read, or `"&lt;module>"` at file scope. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** The flag key — the first string-literal argument of `ctx.flags.boolean`. */
+  key: string;
+  /** 1-based line of the `ctx.flags.boolean` call, or `0` when unknown. */
+  line: number;
+}
+/**
+* One discovered `httpAction`/`httpRoute` handler that performs a side effect
+* (`ctx.runMutation` / `ctx.runAction` / a `ctx.db.{insert,patch,replace,delete,
+* insertManyUnsafe}` write) from the HTTP edge, with whether it reads `ctx.auth`
+* — the `http_action_missing_auth_guard` lint input. A handler that mutates state
+* or dispatches an action without ever consulting the request identity is an
+* unauthenticated write bypassing identity/RLS (distinct from
+* `admin_route_without_guard`, which covers Studio/admin paths). Only handlers
+* with a statically-resolvable inline body and `ctx` binding are recorded
+* (fail-safe under-report); read-only handlers are never recorded. Produced by
+* the codegen feeder; runtime callers don't supply it, so the lint finds nothing
+* there.
+*/
+interface AdvisorHttpActionGuard {
+  /** The exported binding name of the handler (or `"&lt;module>"` when mounted inline / not a named binding). */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** Which HTTP surface the handler is: a raw `httpAction` or a typed `httpRoute` route. */
+  kind: "httpAction" | "httpRoute";
+  /** 1-based line of the handler call, or `0` when unknown. */
+  line: number;
+  /** For an `httpRoute`, the uppercased verb (`"POST"`); absent for a raw `httpAction`. */
+  method?: string;
+  /** `true` when the handler reads `ctx.auth` (a direct member access or a `const { auth } = ctx` destructure). */
+  readsAuth: boolean;
+  /** The first side effect found, as a stable label: `runMutation`, `runAction`, or `db.&lt;method>`. */
+  sideEffect: string;
+}
+/**
+* One response-header write, inside an `httpAction` handler, whose value is derived
+* from raw request input (`request.headers`, `request.url`/query, `await
+* request.json()`) with no CR/LF sanitizer — the
+* `http_action_response_header_injection` lint input. A `Request`-derived string
+* placed verbatim into a response header lets a caller smuggle `\r\n` and inject
+* extra headers or split the response. Only request-tainted, unguarded sites are
+* recorded — a value routed through `isSafeHeaderValue`, `encodeURIComponent`/
+* `encodeURI`, a numeric coercion, or `btoa` is treated as safe (`String(...)` /
+* `.toString()` are NOT sanitizers). Produced by the codegen feeder; runtime
+* callers don't supply it, so the lint finds nothing there. Structurally identical
+* to `HttpHeaderWriteIR`.
+*/
+interface AdvisorHttpHeaderWrite {
+  /** The exported binding name of the enclosing handler, or `"&lt;module>"` when mounted inline. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** The header name being written (`"location"`), or `""` when the key is not a string literal. */
+  headerName: string;
+  /** 1-based line of the request-tainted header value. */
+  line: number;
+  /** How the header was written. */
+  via: "headers-append" | "headers-ctor" | "headers-set" | "response-init";
+}
+/**
 * One `ctx.sql` access discovered lexically inside a `query(...)` or
 * `mutation(...)` handler body — the input the `hyperdrive_outside_action` lint
 * consumes. Produced by the codegen feeder, which walks each exported function's
@@ -110,6 +409,41 @@ interface AdvisorHyperdriveCall {
   line: number;
 }
 /**
+* One `&lt;receiver>.identity.&lt;key>` claim read (where `&lt;receiver>` is an RLS/mask
+* policy `auth`, or `ctx.auth`/`context.auth`) — the shared input for the
+* `identity_undeclared_claim_trusted` lint. `defineIdentity` validates only its
+* declared claims at the trust boundary and forwards undeclared claims
+* verbatim, so a read of a claim outside the declared contract trusts an
+* unvalidated, forgeable value. `declared` records whether `key` is in the
+* contract (or the always-present `userId`); the lint flags the undeclared reads.
+* Produced by the codegen feeder — and only when a resolvable `defineIdentity`
+* contract exists — so runtime callers supply nothing and the lint finds nothing
+* there.
+*/
+interface AdvisorIdentityClaimRead {
+  /** `true` when `key` is a declared claim (in the `defineIdentity` contract, or the always-present `userId`). */
+  declared: boolean;
+  /** The exported binding name of the enclosing declaration (`&lt;module>` at file scope). */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** The claim key read off the identity bag. */
+  key: string;
+  /** 1-based line of the read, or `0` when unknown. */
+  line: number;
+}
+/**
+* One `buildImageDeliveryUrl({ key, … })` call (`@lunora/bindings/images`) whose
+* `key` — the CDN transform's source image, an absolute URL or an
+* origin-relative key — is derived from the handler's `args` with no
+* server-side scoping — the `images_url_source_from_user_input` lint input.
+*/
+interface AdvisorImageDeliveryUrlAccess {
+  exportName: string;
+  file: string;
+  line: number;
+}
+/**
 * Observed read signal over a table — the input the `index_utilization` runtime
 * lint consumes. Produced by the studio backend from each shard's recorded
 * metrics.
@@ -177,6 +511,49 @@ interface AdvisorInsertWrite {
   table: string;
 }
 /**
+* One `ctx.kv.&lt;method>(key, …)` call whose namespace key is derived from the
+* handler's `args` with no server-side scoping — the input the
+* `kv_unscoped_user_key_idor` lint consumes. Workers KV is a single flat
+* namespace, so a key taken straight from request input lets any caller read,
+* overwrite, or delete another user's entry (an insecure direct object
+* reference). A fixed literal key, or one prefixed with a server-trusted identity
+* (`` `${ctx.auth.userId}:…` `` — references `ctx`, so treated as scoped), is not
+* recorded; only an arg-derived, unscoped key reaches here. Produced by the
+* codegen feeder; runtime callers don't supply it, so the lint finds nothing
+* there.
+*/
+interface AdvisorKvKeyAccess {
+  /** The exported binding name of the procedure performing the `ctx.kv` access. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the `ctx.kv` call, or `0` when unknown. */
+  line: number;
+  /** The `ctx.kv` method invoked: `get` / `getRaw` / `getWithMetadata` / `put` / `delete`. */
+  method: string;
+}
+/**
+* One `ctx.mail`/`ctx.email` `send`/`queue` call whose recipient field
+* (`to`/`cc`/`bcc`) is derived from the handler's `args` with no server-side
+* scoping — the input the `mail_recipient_from_request_input` lint consumes. A
+* recipient taken straight from request input turns the deployment into an
+* open relay / spam amplifier: any caller can direct mail to an arbitrary
+* address. A fixed literal recipient, or one scoped by a server-trusted
+* `ctx.*` value (e.g. `ctx.auth.user.email`), is not recorded; only an
+* arg-derived, unscoped recipient reaches here. Produced by the codegen
+* feeder; runtime callers don't supply it, so the lint finds nothing there.
+*/
+interface AdvisorMailRecipientAccess {
+  /** The exported binding name of the procedure performing the `ctx.mail`/`ctx.email` call. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the `ctx.mail`/`ctx.email` call, or `0` when unknown. */
+  line: number;
+  /** The mailer method invoked: `send` / `queue`. */
+  method: string;
+}
+/**
 * One procedure (query / mutation / action) discovered in the lunora source,
 * reduced to the facts the `mask_uncovered_pii_column` lint needs: whether the
 * procedure's builder chain includes `.use(mask(...))`, which `(table, column)`
@@ -214,6 +591,52 @@ interface AdvisorMaskProcedure {
   visibility: "internal" | "public";
 }
 /**
+* One masked column whose `mask(policies)` strategy is a statically-known
+* literal (`"hash"` or `"redact"`) — the `mask_weak_hash_strategy_on_pii` lint
+* input. Unlike `AdvisorMaskProcedure` (one row per procedure, `maskColumns`
+* without a strategy), this is one row per masked column with its strategy
+* literal attached, so the lint can flag `"hash"` applied to a PII-named
+* column. A `MaskFn` (custom, non-literal) strategy carries no lint-relevant
+* signal and is never recorded here. Produced by the codegen feeder; runtime
+* callers don't supply it, so the lint finds nothing there.
+*/
+interface AdvisorMaskStrategy {
+  /** Masked column name. */
+  column: string;
+  /** The exported binding name of the procedure whose `.use(mask(...))` chain declared this column, or `"&lt;module>"` when declared at file scope. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the masked column's strategy property. */
+  line: number;
+  /** The statically-known strategy literal: `"hash"` or `"redact"`. */
+  strategy: string;
+  /** Logical table the masked column belongs to. */
+  table: string;
+}
+/**
+* One whole-row `ctx.db.replace(id, document)` write discovered inside a custom
+* mutator's authoritative `server` impl (`lunora/mutators.ts`) — the input the
+* `mutator_full_row_replace` lint consumes.
+*
+* In the local-first sync engine a `replace` overwrites the entire row, so a
+* concurrent edit to a *different* column (committed between this mutator's read
+* and its write) is silently clobbered. `patch(id, { onlyTheField })` merges at
+* the column level instead, letting independent field edits coexist — the
+* blessed pattern for mutators on a synced (poke-live) table. Produced by the
+* codegen feeder, which attributes each `replace` to the mutator export
+* performing it; runtime callers don't supply it, so the lint finds nothing
+* there.
+*/
+interface AdvisorMutatorWrite {
+  /** The mutator export whose `server` impl performs the replace (e.g. `renameChannel`). */
+  exportName: string;
+  /** Openable source path the replace appears in — always `lunora/mutators.ts`. */
+  file: string;
+  /** 1-based line of the `replace(...)` call, or `0` when unknown. */
+  line: number;
+}
+/**
 * One non-deterministic API call discovered lexically inside a `query(...)` or
 * `mutation(...)` handler body — the input the `nondeterministic_query_mutation`
 * lint consumes. Produced by the codegen feeder, which walks each exported
@@ -236,6 +659,109 @@ interface AdvisorNondeterministicCall {
   line: number;
 }
 /**
+* One `query`/`mutation` handler that gates a `ctx.db.get`/`patch`/`delete` on a
+* null-checked `ctx.db.normalizeId(table, id)` result — the shared input for the
+* `normalize_id_used_as_authorization` lint. `normalizeId` validates an id's
+* structural shape only (it never reads the database), so a non-null result proves
+* the id is well-formed, never that the caller owns the row; gating access on it is
+* an IDOR. The lint keeps only public procedures with no `.use(rls(...))` and no
+* ownership/identity mention (`mentionsOwnership`), then joins `table` against the
+* schema's RLS mode before flagging. Produced by the codegen feeder; runtime callers
+* don't supply it, so the lint finds nothing there. Structurally identical to
+* `@lunora/codegen`'s `NormalizeIdAuthorizationIR`.
+*/
+interface AdvisorNormalizeIdAuthorization {
+  /** The exported binding name of the procedure performing the normalize-then-access. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the `ctx.db.normalizeId(...)` call the access is gated on. */
+  line: number;
+  /** `true` when the handler anywhere reads an ownership-named identifier or `ctx.auth`/`ctx.identity`/… — an intervening ownership signal. */
+  mentionsOwnership: boolean;
+  /** The id-first `ctx.db` sink the normalized id reaches. */
+  sinkMethod: "delete" | "get" | "patch";
+  /** Table named in the `normalizeId` call, or `""` when its table argument wasn't a string literal. */
+  table: string;
+  /** `true` when the procedure's builder chain carries a `.use(rls(...))` step. */
+  usesRls: boolean;
+  /** `"internal"` for `internalQuery`/`internalMutation`; `"public"` for `query`/`mutation`. */
+  visibility: "internal" | "public";
+}
+/**
+* One `ctx.db` write (`insert` / `replace` / `patch` / `insertManyUnsafe`) that
+* sets an ownership / identity column — `userId`, `ownerId`, `tenantId`, and the
+* like — from the handler's `args` instead of the server-trusted identity. This
+* is the `owner_field_from_args_not_auth` lint input: the ownership column decides
+* who a row belongs to, so a value taken from request input lets any caller write
+* rows owned by another user or tenant (the act-as-any-user / cross-tenant IDOR
+* vector). A column stamped from `ctx.auth` / `ctx.identity`, or set to a fixed
+* literal, is *not* recorded; only an arg-derived identity write reaches here.
+* Produced by the codegen feeder; runtime callers don't supply it, so the lint
+* finds nothing there. Structurally identical to `OwnerFieldWriteIR`.
+*/
+interface AdvisorOwnerFieldWrite {
+  /** The exported binding name of the procedure performing the write. */
+  exportName: string;
+  /** The identity column being written from `args` (e.g. `userId`). */
+  field: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the `ctx.db` write call, or `0` when unknown. */
+  line: number;
+  /** The `ctx.db` write method (`insert` / `replace` / `patch` / `insertManyUnsafe`). */
+  method: string;
+}
+/**
+* One payment webhook-adapter construction (`createStripeAdapter` /
+* `createPolarAdapter`) — the shared input for the
+* `payment_webhook_wide_tolerance` lint. The adapters verify a webhook's signed
+* timestamp against a `webhookToleranceSeconds` replay window (default 300s); an
+* implausibly wide window leaves the endpoint accepting stale, replayable signed
+* payloads long after capture. `toleranceSeconds` carries the statically-known
+* literal (when present and a plain numeric literal); the lint fires only above a
+* conservative ceiling. Produced by the codegen feeder; runtime callers don't
+* supply it, so the lint finds nothing there.
+*/
+interface AdvisorPaymentWebhook {
+  /** The adapter factory invoked. */
+  callee: "createPolarAdapter" | "createStripeAdapter";
+  /** The exported binding name of the enclosing declaration (`&lt;module>` at file scope). */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the construction, or `0` when unknown. */
+  line: number;
+  /** Statically-known `webhookToleranceSeconds` literal, when present and a plain numeric literal. */
+  toleranceSeconds?: number;
+}
+/**
+* One payload-derived privileged dispatch — a `ctx.run`/`context.run` back into a
+* Lunora function from inside a `defineQueue` push handler or a `defineWorkflow`
+* handler, whose args reference the handler's untrusted payload (`context.params`
+* for a workflow, a `for (… of batch.messages)` body for a queue) — the input the
+* `privileged_dispatch_unvalidated_payload` lint consumes. Both handler kinds run
+* under the **system identity** (RLS disabled), so forwarding attacker-influenced
+* payload into the dispatch skips the target's row policy. The lint joins the
+* resolved `targetFile`/`targetExport` against the RLS-procedure evidence and
+* fires only when the target enforces RLS. Produced by the codegen feeder;
+* runtime callers don't supply it, so the lint finds nothing there.
+*/
+interface AdvisorPrivilegedDispatch {
+  /** `"queue"` for a `defineQueue` handler, `"workflow"` for a `defineWorkflow` handler. */
+  dispatchKind: "queue" | "workflow";
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** The exported handler binding performing the dispatch. */
+  handlerExport: string;
+  /** 1-based line of the dispatch call, or `0` when unknown. */
+  line: number;
+  /** Export name of the dispatched target (`send` in `api.messages.send`). */
+  targetExport: string;
+  /** File path of the dispatched target relative to the lunora dir (`messages` in `api.messages.send`). */
+  targetFile: string;
+}
+/**
 * One procedure (query / mutation / action) reduced to the protective middlewares
 * its builder chain installs plus the behavioural facts that decide whether a
 * guard is expected — the input the `public_mutation_without_ratelimit` and
@@ -249,12 +775,18 @@ interface AdvisorProcedureProtection {
   callsMail: boolean;
   /** The exported binding name of the procedure (e.g. `signUp`). */
   exportName: string;
+  /** `true` when the handler fans work out to a privileged, cost-bearing dispatch surface (scheduler `runAfter`/`runAt`, a queue producer send, or a workflow create). Read by the privileged-fanout lint, paired with public visibility and no rate limit. */
+  fanOut: boolean;
   /** Source file relative to the lunora dir, no extension. */
   file: string;
   /** Registration kind — `query` is read-only; `mutation`/`action` are write-shaped. */
   kind: "action" | "mutation" | "query";
+  /** `true` when the handler runs an AI generation (`generateText`/`streamText`/`generateObject`/`streamObject`) with no `maxOutputTokens` bound. Read by the `ai_unbounded_generation_public` lint (paired with public visibility). */
+  unboundedAiGeneration: boolean;
   /** `true` when the chain carries `.use(verifyTurnstile(...))` or a `protectPublic({ captcha })` bundle. */
   usesCaptcha: boolean;
+  /** `true` when the handler calls `ctx.db.insertManyUnsafe(...)`, which bypasses validators and triggers. Read by the `insert_many_unsafe_user_data` lint (paired with public visibility). */
+  usesInsertManyUnsafe: boolean;
   /** `true` when the chain carries `.use(mask(...))`. */
   usesMask: boolean;
   /** `true` when the chain carries `.use(rateLimit(...))` or a `protectPublic({ rateLimit })` bundle. */
@@ -285,6 +817,45 @@ interface AdvisorQueryRead {
   table: string;
 }
 /**
+* The queue-shaped input the `queue_*` lints consume, produced by the codegen
+* feeder — one per `defineQueue` export in `lunora/queues.ts`. Runtime callers
+* don't supply it, so the queue lints simply find nothing there.
+*
+* A structural subset of codegen's `QueueIR`, so the feeder passes the IR array
+* straight through without conversion (mirrors how `AdvisorWorkflow` tracks
+* `WorkflowIR` and `AdvisorContainer` tracks `ContainerIR`).
+*/
+/**
+* The push-consumer batch/retry tuning a queue lint inspects — the subset of
+* `QueueIR["tuning"]` mirrored onto the wrangler `queues.consumers[]` entry.
+*/
+interface AdvisorQueueTuning {
+  /**
+  * The wrangler name of the dead-letter queue exhausted messages are routed
+  * to. `undefined` when none is declared — a message that exhausts its
+  * retries is then dropped and permanently lost.
+  */
+  deadLetterQueue?: string;
+  /** Max delivery retries before a message is dead-lettered/dropped (Cloudflare default 3). */
+  maxRetries?: number;
+}
+/** One queue declared via a `defineQueue()` export in `lunora/queues.ts`. */
+interface AdvisorQueue {
+  /** The `lunora/queues.ts` export name, e.g. `notifications`. */
+  exportName: string;
+  /** How the queue is consumed: `"push"` (a worker `queue()` handler) or `"pull"` (external HTTP). */
+  mode: "pull" | "push";
+  /**
+  * The stable wrangler queue name (kebab-cased export name unless a `name:`
+  * literal overrides it). Used to recognise a queue that is itself another
+  * queue's `deadLetterQueue` target — a terminal sink that must not be
+  * flagged for lacking its own DLQ.
+  */
+  name: string;
+  /** Push-consumer batch/retry tuning; the `deadLetterQueue`/`maxRetries` the queue lints read. */
+  tuning: AdvisorQueueTuning;
+}
+/**
 * One `ctx.r2sql` access discovered lexically inside a `query(...)` or
 * `mutation(...)` handler body — the input the `r2sql_outside_action` lint
 * consumes. Produced by the codegen feeder, which walks each exported function's
@@ -312,6 +883,70 @@ interface AdvisorR2sqlCall {
   line: number;
 }
 /**
+* One `rateLimit`/`dbRateLimit` middleware call (`@lunora/ratelimit`) whose
+* `key` selector is derived from the handler's `args` with no server-side
+* scoping — the `ratelimit_key_spoofable_or_global` lint input.
+*/
+interface AdvisorRatelimitKeySelector {
+  callee: string;
+  exportName: string;
+  file: string;
+  limitName: string;
+  line: number;
+}
+/**
+* One `query` handler whose `return` hands back the raw rows of a table — the
+* result of a `ctx.db.&lt;table>.findMany()` / `.findFirst()` / `.get()` read, or a
+* `ctx.db.query("&lt;table>")…collect()` fluent chain — returned directly (or through
+* one local `const` hop) with no hand-built projection. The shared input for the
+* `output_projection_missing_on_public_read` lint, which keeps only `visibility
+* === "public"` rows with no `.output(...)` / `.use(mask(...))` on the chain and
+* joins `table` against the schema's PII-named columns before flagging. Produced by
+* the codegen feeder; runtime callers don't supply it, so the lint finds nothing
+* there. Structurally identical to `@lunora/codegen`'s `RawRowReturnIR`.
+*/
+interface AdvisorRawRowReturn {
+  /** The exported binding name of the query returning the raw rows. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the `return` (or concise-body) expression. */
+  line: number;
+  /** Table whose raw rows are returned, or `""` when the read's table couldn't be statically resolved. */
+  table: string;
+  /** `true` when the procedure's builder chain carries a `.use(mask(...))` step. */
+  usesMask: boolean;
+  /** `true` when the procedure's builder chain carries an `.output(...)` return-shape projection. */
+  usesOutput: boolean;
+  /** `"internal"` for `internalQuery`; `"public"` for `query`. */
+  visibility: "internal" | "public";
+}
+/**
+* One `ctx.db.&lt;table>.findMany({ with: { &lt;rel> } })` relation-hydrating list read
+* — the shared input for the `masked_relation_leak_via_with` lint. Column
+* masking is applied per-procedure to the top-level rows of the table named in
+* the read; it does **not** descend into `with`-hydrated relations, so a masked
+* table surfaced only through a `with` on an unprotected parent read is returned
+* in the clear. The lint resolves each relation accessor to its target table and
+* joins it against the discovered mask evidence before flagging. Produced by the
+* codegen feeder; runtime callers don't supply it, so the lint finds nothing
+* there. Structurally identical to `@lunora/codegen`'s `RelationLoadIR`.
+*/
+interface AdvisorRelationLoad {
+  /** The exported binding name of the procedure performing the read. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the read call. */
+  line: number;
+  /** Parent table the read targets, or `""` when it couldn't be statically resolved. */
+  parentTable: string;
+  /** Relation accessor names named in the read's `with: { … }` map — matched against the parent table's declared relations. */
+  relations: ReadonlyArray<string>;
+  /** `"internal"` for `internalQuery` / `internalMutation` / `internalAction`. */
+  visibility: "internal" | "public";
+}
+/**
 * One procedure (query / mutation / action) discovered in the lunora source,
 * reduced to the facts the `rls_uncovered_table` lint needs: whether the
 * procedure's builder chain includes `.use(rls(...))`, and which tables the
@@ -351,6 +986,15 @@ interface AdvisorRlsProcedure {
 * read — tables, their columns, indexes, and relations.
 */
 interface AdvisorSchema {
+  /**
+  * Set when the schema opted into `.rls("required")` — every table's `ctx.db`
+  * write path is denied without an RLS-covering procedure UNLESS the table
+  * itself is `.public()` (see {@link AdvisorTable.isPublic}). `undefined` when
+  * the schema never called `.rls("required")`. Read by the
+  * `public_table_rls_optout_confusion` and `allow_unauthenticated_shard_access_enabled`
+  * lints.
+  */
+  rlsMode?: "required";
   tables: ReadonlyArray<AdvisorTable>;
 }
 /** A table plus the column/index/relation metadata lints inspect. */
@@ -363,6 +1007,14 @@ interface AdvisorTable {
   */
   externallyManaged?: boolean;
   /**
+  * Set when the table was declared with `.source(...)` (plan 077) —
+  * materialized from an external Hyperdrive-backed database. Read by the
+  * `external_source_*` lints to enforce the tenant-scope boundary (mandatory
+  * `tenantBy` under `.shardBy()`) and reject sourcing a `.global()` table.
+  * Optional — feeders that don't know about sourced tables omit it.
+  */
+  externalSource?: AdvisorExternalSource;
+  /**
   * Declared column names (the `defineTable({...})` keys). Excludes the
   * framework-managed system fields `_id` / `_creationTime`, which every table
   * has implicitly — lints that resolve a column treat those as always valid.
@@ -370,6 +1022,15 @@ interface AdvisorTable {
   fields: ReadonlyArray<string>;
   /** Every declared index, across all kinds (secondary / search / rank / vector). */
   indexes: ReadonlyArray<AdvisorIndex>;
+  /**
+  * `true` when the table was declared with `.public()` — an explicit opt-OUT
+  * of the schema's `.rls("required")` enforcement for this one table (the
+  * name is misleading: it means "unprotected by RLS", not "safe to read
+  * publicly"). Has no effect when the schema itself never required RLS.
+  * Defaults to `false`. Read by `public_table_rls_optout_confusion` and
+  * `allow_unauthenticated_shard_access_enabled`.
+  */
+  isPublic?: boolean;
   /** Table name. */
   name: string;
   /**
@@ -384,6 +1045,27 @@ interface AdvisorTable {
   optionalFields?: ReadonlySet<string>;
   /** Declared relations (`.relations((r) => …)`). */
   relations: ReadonlyArray<AdvisorRelation>;
+  /**
+  * Storage tier the table is declared in: `"global"` (a `.global()` table,
+  * lives in D1 — the cross-shard tier), `"shardBy"` (partitioned across
+  * shard DOs by a key), or `"root"` (the default single-DO table). Read by
+  * the `shape_*` lints to flag replication shapes targeting a `.global()`
+  * table (poll-refreshed/latency-tiered, not poke-live). Optional — the
+  * codegen feeder always supplies it, the runtime feeder derives it; a feeder
+  * that omits it leaves tier-sensitive lints to treat the table as local.
+  */
+  shardKind?: "global" | "root" | "shardBy";
+  /**
+  * Set when the table opted into `.softDelete()` — the marker column
+  * (`field`, default `deletedAt`) whose presence excludes a row from list
+  * reads unless `includeDeleted: true` is passed. Read by
+  * `soft_delete_include_deleted_from_args` to confirm a read's target actually
+  * soft-deletes before flagging an `includeDeleted` toggle on a public read.
+  * Optional — a feeder that doesn't track soft-delete omits it.
+  */
+  softDelete?: {
+    field: string;
+  };
 }
 /**
 * One declared index, flattened across Lunora's index kinds so a single lint can
@@ -400,6 +1082,21 @@ interface AdvisorIndex {
   name: string;
   unique?: boolean;
 }
+/** The statically-knowable `.source(...)` bits the `external_source_*` lints read. */
+interface AdvisorExternalSource {
+  /** `true` when a `reconcileEveryMs` was given (the incremental-mode delete-visibility companion). */
+  hasReconcile?: boolean;
+  /** `true` when a `tenantBy` mapper was given — the tenant-isolation boundary. */
+  hasTenantBy: boolean;
+  /** Delete-detection mode literal, when given (`"full-pull"` | `"incremental"`). */
+  mode?: string;
+  /**
+  * `true` when `.source(...)` was declared but its config wasn't a static object
+  * literal, so `hasTenantBy` (and the rest) couldn't be read. Only the codegen
+  * feeder can hit this; the runtime feeder always holds the real config.
+  */
+  unanalyzable?: boolean;
+}
 /**
 * One declared relation. For a `one` relation the FK column `field` lives on
 * the holding table; for `many` it lives on the target. `name` is the accessor
@@ -440,6 +1137,28 @@ interface AdvisorSecretLiteral {
   preview: string;
 }
 /**
+* A replication shape declared via `defineShape({ table, where, columns? })` in
+* `lunora/shapes.ts` (the local-first sync engine's partial-replication unit).
+* The `shape_*` lints cross-reference each shape's {@link AdvisorShape.table}
+* against the declared schema to flag a shape targeting an unknown table or a
+* `.global()` table (which replicates through the latency-tiered D1 poll path,
+* not the poke-live op-log). Supplied by the codegen feeder, which lifts only
+* the export name + the static `table` literal; absent for runtime callers,
+* where the shape lints find nothing.
+*/
+interface AdvisorShape {
+  /** Export binding name — the shape's registry key (e.g. `channelMessages`). */
+  exportName: string;
+  /** File the shape is declared in (relative, for the operator to open). */
+  file: string;
+  /**
+  * The `table` string literal the shape replicates from, or `undefined` when
+  * the feeder could not read it as a plain string literal — tier-sensitive
+  * lints skip a shape with no resolvable table rather than guessing.
+  */
+  table?: string;
+}
+/**
 * One shard's observed traffic share — the input the `hot_shard` runtime lint
 * consumes. Produced by the studio backend, which fans out over a sharded
 * function's shards and reads each shard's recorded request volume from the
@@ -469,6 +1188,32 @@ interface AdvisorShardTraffic {
   shardKey: string;
 }
 /**
+* One `ctx.db.&lt;table>.findMany({ includeDeleted })` list read whose
+* `includeDeleted` is either a hardcoded `true` or derived from the handler's
+* `args` — the shared input for the `soft_delete_include_deleted_from_args`
+* lint. `includeDeleted` resurfaces rows a `.softDelete()` table would otherwise
+* hide from list reads; on a public read that means any caller (arg-derived) or
+* every caller (hardcoded `true`) can see soft-deleted rows. Produced by the
+* codegen feeder; runtime callers don't supply it, so the lint finds nothing
+* there. Structurally identical to `@lunora/codegen`'s `SoftDeleteReadIR`.
+*/
+interface AdvisorSoftDeleteRead {
+  /** The exported binding name of the procedure performing the read. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** `true` when `includeDeleted` was derived from the handler's `args` (any caller can flip it). */
+  fromArgs: boolean;
+  /** `true` when `includeDeleted` was a hardcoded `true` literal (always resurfaces soft-deleted rows). */
+  hardcodedTrue: boolean;
+  /** 1-based line of the read call. */
+  line: number;
+  /** Table read, or `""` when the table couldn't be statically resolved. */
+  table: string;
+  /** `"internal"` for `internalQuery` / `internalMutation` / `internalAction`. */
+  visibility: "internal" | "public";
+}
+/**
 * One `ctx.sql` tagged-template interpolation that splices an unparameterized
 * string-building expression into the query — the input the `sql_injection_risk`
 * lint consumes. A `${…}` placeholder that simply names a value is bound as a
@@ -486,6 +1231,55 @@ interface AdvisorSqlInterpolation {
   line: number;
 }
 /**
+* One `ctx.storage.&lt;bucket>.&lt;method>(key, …)` call whose R2 object key is derived
+* from the handler's `args` with no server-side scoping — the input the
+* `storage_key_from_user_args` lint consumes. An object key taken straight from
+* request input lets any caller read, overwrite, or delete another user's object
+* (object-level IDOR). A key prefixed with a server-trusted identity (a `ctx.*`
+* value such as `` `${ctx.auth.userId}/…` ``) is treated as scoped and is *not*
+* recorded; only an arg-derived, `ctx`-free key reaches here. Produced by the
+* codegen feeder; runtime callers don't supply it, so the lint finds nothing there.
+*/
+interface AdvisorStorageKeyAccess {
+  /** The exported binding name of the procedure performing the storage call. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the storage call, or `0` when unknown. */
+  line: number;
+  /** The bucket method invoked with the arg-derived key, e.g. `get` / `put` / `delete` / `download`. */
+  method: string;
+}
+/**
+* One tracked `ctx.storage.&lt;bucket>.&lt;method>(...)` upload/signing call — the
+* shared input for the storage config-hygiene security lints
+* (`storage_upload_without_content_type_allowlist`, `storage_upload_without_max_size`,
+* `storage_generate_upload_url_no_content_type_pin`, `storage_presigned_url_for_private_content`).
+* `upload`/`store` carry the `UploadOptions` guards (`allowedContentTypes` /
+* `maxSize`); `generateUploadUrl` carries the signed-PUT `contentType` pin;
+* `getPresignedUrl`/`getSignedUrl` carry a statically-known `expiresInSeconds`
+* literal. `presentKeys` is empty (and `expiresInSeconds` unset) when the
+* options argument was absent, a non-literal, or a spread — see `analyzable`.
+* Produced by the codegen feeder; runtime callers don't supply it, so the
+* lints find nothing there.
+*/
+interface AdvisorStorageUpload {
+  /** `true` when the call's options-object argument (or its deliberate absence) was statically resolvable. */
+  analyzable: boolean;
+  /** Numeric literal value of an `expiresInSeconds` option, when statically known (`getSignedUrl` / `getPresignedUrl` only). */
+  expiresInSeconds?: number;
+  /** The exported binding name of the procedure performing the call. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the call, or `0` when unknown. */
+  line: number;
+  /** The `ctx.storage` method invoked. */
+  method: "generateUploadUrl" | "getPresignedUrl" | "getSignedUrl" | "store" | "upload";
+  /** Options-object keys present at the call site (empty when not `analyzable`, or when no options argument was passed). */
+  presentKeys: string[];
+}
+/**
 * A bounded sample of rows from one table, fed into the constraint-validator
 * lint by the studio backend (via `readTablePage`). The cap prevents unbounded
 * scans while still catching obvious violations on small-to-medium tables.
@@ -511,6 +1305,28 @@ interface AdvisorTableSample {
   readonly truncated: boolean;
 }
 /**
+* One `ctx.vectors.&lt;method>(indexName, input)` call whose `input.namespace` is
+* derived from the handler's `args` with no server-side scoping — the input the
+* `vectors_namespace_from_user_input` lint consumes. A Vectorize namespace
+* partitions one index into isolated sub-collections, so a namespace taken
+* straight from request input lets any caller read or poison another tenant's
+* vectors. A fixed literal namespace, or one prefixed with a server-trusted
+* identity (`` `${ctx.auth.orgId}` `` — references `ctx`, so treated as
+* scoped), is not recorded; only an arg-derived, unscoped namespace reaches
+* here. Produced by the codegen feeder; runtime callers don't supply it, so
+* the lint finds nothing there.
+*/
+interface AdvisorVectorNamespaceAccess {
+  /** The exported binding name of the procedure performing the `ctx.vectors` access. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the `ctx.vectors` call, or `0` when unknown. */
+  line: number;
+  /** The `ctx.vectors` method invoked: `query` / `upsert` / `upsertMany`. */
+  method: string;
+}
+/**
 * The two workflow-shaped inputs the `workflow_*` lints consume, produced by the
 * codegen feeder. {@link AdvisorWorkflow} is the declaration side (one per
 * `defineWorkflow` export in `lunora/workflows.ts`); {@link AdvisorWorkflowCall}
@@ -523,10 +1339,27 @@ interface AdvisorTableSample {
 * how `AdvisorContainer` tracks `ContainerIR` and `AdvisorInsertWrite` tracks
 * `InsertWriteIR`).
 */
+/** One durable step call lifted from a workflow handler body — the input the duplicate-step-name lint compares. Structural subset of codegen's `WorkflowStepIR`. */
+interface AdvisorWorkflowStep {
+  /** 1-based line of the durable step call, or `0` when unknown. */
+  line: number;
+  /** The native step method invoked: `do` / `sleep` / `sleepUntil` / `waitForEvent`. */
+  method: string;
+  /** The step's static label (the first string-literal argument). */
+  name: string;
+}
 /** One workflow declared via a `defineWorkflow()` export in `lunora/workflows.ts`. */
 interface AdvisorWorkflow {
   /** The `lunora/workflows.ts` export name, e.g. `orderPipeline`. */
   exportName: string;
+  /**
+  * The durable step labels discovered in the handler body, in source order —
+  * the duplicate-step-name input. Cloudflare memoizes a step by its name, so a
+  * name used twice makes the second call silently return the first's cached
+  * result. Supplied by the codegen feeder; `undefined` for runtime callers,
+  * where the lint finds nothing.
+  */
+  steps?: ReadonlyArray<AdvisorWorkflowStep>;
 }
 /** One `ctx.workflows.get("name")` call discovered in a function body. */
 interface AdvisorWorkflowCall {
@@ -540,6 +1373,23 @@ interface AdvisorWorkflowCall {
   workflow: string;
 }
 /**
+* One committed `wrangler.jsonc` `vars` entry whose value is a plaintext secret —
+* the input the `plaintext_secret_in_wrangler_vars` lint consumes. The full value
+* is never carried; only a redacted {@link AdvisorWranglerVariable.preview}.
+* Produced by `@lunora/config` (which reads `wrangler.jsonc`) and threaded through
+* codegen; runtime callers don't supply it, so the lint finds nothing there.
+*/
+interface AdvisorWranglerVariable {
+  /** The `wrangler.jsonc` file the var was read from, relative to the project root. */
+  file: string;
+  /** The offending `vars` key (e.g. `STRIPE_SECRET_KEY`). */
+  key: string;
+  /** Heuristic that matched, e.g. `stripe_live_key` / `private_key` / `secret_named_var`. */
+  kind: string;
+  /** Redacted preview (first few chars + length) — never the full secret. */
+  preview: string;
+}
+/**
 * Severity of a finding, mirroring splinter's `level`. `ERROR` is a definite
 * problem, `WARN` a likely one, `INFO` an advisory nudge.
 */
@@ -610,6 +1460,33 @@ interface LintContext {
   */
   adminRoutes?: ReadonlyArray<AdvisorAdminRoute>;
   /**
+  * `ctx.ai.run(model, …)` calls whose model-id argument is derived from the
+  * handler's `args` with no server-side scoping — the `ai_raw_run_escape_hatch`
+  * input. `ctx.ai.run` is the raw Workers AI passthrough, so an arg-derived model
+  * id lets any caller select an arbitrary model, bypassing the typed
+  * `ctx.ai.model(...)` + AI-SDK layer's cap/schema (an arg-derived `inputs`
+  * argument is normal usage and is not recorded). Supplied by the codegen feeder;
+  * absent for runtime callers, where the lint finds nothing.
+  */
+  aiRawRuns?: ReadonlyArray<AdvisorAiRawRun>;
+  /**
+  * `generateText` / `streamText` calls whose model-callable `tools` reach a
+  * privileged side effect (DB write / function dispatch / outbound
+  * fetch/mail/queue) — the `ai_tool_side_effect_prompt_injection` input. Each
+  * row's `userInputDerived` says whether the model input flows from `args`; the
+  * lint fires only when it does. Supplied by the codegen feeder; absent for
+  * runtime callers, where the lint finds nothing.
+  */
+  aiToolSideEffects?: ReadonlyArray<AdvisorAiToolSideEffect>;
+  /**
+  * `ctx.fetch(url, …)` calls inside actions whose URL argument is derived from
+  * the handler's `args` — the `action_fetch_ssrf` input. `ctx.fetch` has no
+  * host allowlist, so a URL built from request input is a server-side request
+  * forgery vector. Supplied by the codegen feeder; absent for runtime callers,
+  * where the lint finds nothing.
+  */
+  argumentDerivedFetches?: ReadonlyArray<AdvisorArgumentDerivedFetch>;
+  /**
   * Per-public-procedure argument validators that weaken input safety — the
   * `public_arg_uses_any` (`v.any()` args) and `unbounded_string_arg` (length-less
   * `v.string()` args) input. Supplied by the codegen feeder for public procedures
@@ -623,12 +1500,98 @@ interface LintContext {
   */
   authApiCalls?: ReadonlyArray<AdvisorAuthApiCall>;
   /**
+  * Per-`createAuth({...})`-call configuration snapshots — the shared input for
+  * the five `auth_*` security lints (`auth_trusted_origins_wildcard`,
+  * `auth_csrf_check_disabled`, `auth_secure_cookies_disabled`,
+  * `auth_email_verification_disabled`, `auth_session_freshage_zero`). Each
+  * carries whether the call's config object literal was statically analyzable
+  * and, when it was, the handful of nested facts the lints check (a
+  * `trustedOrigins` wildcard, `advanced.disableCSRFCheck`/`useSecureCookies`,
+  * `emailAndPassword.enabled`/`requireEmailVerification`,
+  * `session.freshAge === 0`). Supplied by the codegen feeder; absent for
+  * runtime callers, where the auth-config lints find nothing.
+  */
+  authConfigs?: ReadonlyArray<AdvisorAuthConfig>;
+  /**
+  * `ctx.browser.&lt;method>(url, …)` calls whose navigation URL is derived from the
+  * handler's `args` with no server-side scoping — the
+  * `browser_user_url_without_allowlist` input. `@lunora/browser` blocks
+  * private/internal targets by default, but a request-supplied public URL can
+  * still be an open-proxy / SSRF vector; the lint suppresses findings when a
+  * `createBrowser` config-call is hardened with `allowedHosts` or `resolveDns`.
+  * Supplied by the codegen feeder; absent for runtime callers, where the lint
+  * finds nothing.
+  */
+  browserUrlAccesses?: ReadonlyArray<AdvisorBrowserUrlAccess>;
+  /**
+  * Factory/constructor calls in `lunora/` whose config object literal a
+  * security lint inspects for a present-or-absent key — the shared input for
+  * the config-call security lints (payment authorize, inbound-mail verify,
+  * rate-limit store, browser private-targets). Supplied by the codegen feeder;
+  * absent for runtime callers, where the config-call lints find nothing.
+  */
+  configCalls?: ReadonlyArray<AdvisorConfigCall>;
+  /**
+  * `ctx.containers.&lt;name>.get(key, …)` calls whose instance key is derived from
+  * the handler's `args` with no server-side scoping — the
+  * `container_instance_key_from_user_input` input. Each container definition's
+  * `.get(name)` accessor routes to one instance per key, so an arg-derived key lets
+  * any caller reach another tenant's container (cross-tenant IDOR). A key scoped by
+  * a server-trusted `ctx.*` value, or a fixed literal, is not recorded. Supplied by
+  * the codegen feeder; absent for runtime callers, where the lint finds nothing.
+  */
+  containerKeyAccesses?: ReadonlyArray<AdvisorContainerKeyAccess>;
+  /**
+  * Runtime container-override calls — a `.start({ enableInternet: true, … })`
+  * launch override, or a `.egress.&lt;method>(...)` runtime firewall mutation — the
+  * `container_start_enable_internet_override` and `container_runtime_egress_relaxation`
+  * lint input. Supplied by the codegen feeder; absent for runtime callers, where
+  * those lints find nothing.
+  */
+  containerOverrides?: ReadonlyArray<AdvisorContainerOverride>;
+  /**
   * Containers declared in `lunora/containers.ts` — the `container_*` lint
   * input. Supplied by the codegen feeder; absent for runtime callers, where
   * the container lints find nothing.
   */
   containers?: ReadonlyArray<AdvisorContainer>;
   /**
+  * `rateLimit`/`dbRateLimit` (`@lunora/ratelimit`) and `verifyTurnstileMiddleware`
+  * (`@lunora/auth`) middleware calls, each with whether its options literal set
+  * `failOpen: true` and the rate-limit `name` — the
+  * `ratelimit_middleware_fail_open` input. These guards fail closed by default; a
+  * `failOpen: true` admits every request during a limiter/siteverify outage, so
+  * the lint fires when a fail-open guard protects an auth/payment-sensitive
+  * procedure. Supplied by the codegen feeder; absent for runtime callers, where
+  * the lint finds nothing.
+  */
+  failOpenGuards?: ReadonlyArray<AdvisorFailOpenGuard>;
+  /**
+  * `ctx.flags.boolean(key, default)` reads with a statically-known string key and
+  * boolean-literal default — the `flag_gates_security_with_unsafe_default` input.
+  * OpenFeature returns the default when the provider errors, so a fail-open
+  * default on a security-shaped key (an `enforce`/`rls`/`gate`/`lockdown`
+  * protection defaulting `false`, or an `allow`/`permit`/`bypass` permission
+  * defaulting `true`) silently opens access during an outage. Supplied by the
+  * codegen feeder; absent for runtime callers, where the lint finds nothing.
+  */
+  flagSecurityDefaults?: ReadonlyArray<AdvisorFlagSecurityDefault>;
+  /**
+  * `httpAction`/`httpRoute` handlers that perform a side effect
+  * (`ctx.runMutation` / `ctx.runAction` / a `ctx.db` write) from the HTTP edge,
+  * with whether each reads `ctx.auth` — the `http_action_missing_auth_guard`
+  * input. Supplied by the codegen feeder; absent for runtime callers, where the
+  * lint finds nothing.
+  */
+  httpActionGuards?: ReadonlyArray<AdvisorHttpActionGuard>;
+  /**
+  * Response-header writes, inside `httpAction` handlers, whose value is derived
+  * from raw request input (`request.headers`/URL/query/body) with no CR/LF
+  * sanitizer — the `http_action_response_header_injection` input. Supplied by the
+  * codegen feeder; absent for runtime callers, where the lint finds nothing.
+  */
+  httpHeaderWrites?: ReadonlyArray<AdvisorHttpHeaderWrite>;
+  /**
   * Hyperdrive `ctx.sql` accesses discovered lexically inside `query`/`mutation`
   * handler bodies — the `hyperdrive_outside_action` input. Supplied by the
   * codegen feeder, which omits `action` handlers (where `ctx.sql` is the typed,
@@ -636,6 +1599,30 @@ interface LintContext {
   */
   hyperdriveCalls?: ReadonlyArray<AdvisorHyperdriveCall>;
   /**
+  * `&lt;receiver>.identity.&lt;key>` claim reads (RLS/mask policy `auth`, or
+  * `ctx.auth`/`context.auth`) — the `identity_undeclared_claim_trusted` input.
+  * `defineIdentity` validates only declared claims and forwards undeclared ones
+  * verbatim, so each row's `declared` flag says whether `key` is in the contract
+  * (or the always-present `userId`); the lint fires on the undeclared reads.
+  * Supplied by the codegen feeder — and only when a resolvable `defineIdentity`
+  * contract exists; absent for runtime callers, where the lint finds nothing.
+  */
+  identityClaimReads?: ReadonlyArray<AdvisorIdentityClaimRead>;
+  /**
+  * `buildImageDeliveryUrl({ key, … })` calls (`@lunora/bindings/images`) whose
+  * `key` — the CDN transform's source image, an absolute URL or an
+  * origin-relative key — is derived from the handler's `args` with no
+  * server-side scoping — the `images_url_source_from_user_input` input.
+  * `ctx.images.transform`/`info` take image bytes, never a URL, so they are
+  * not sinks; only the `key` of `buildImageDeliveryUrl` accepts a URL-or-key
+  * source and is inspected. An arg-derived key lets any caller point the
+  * CDN's `/cdn-cgi/image/` transform at an attacker-chosen origin (SSRF /
+  * open proxy). A fixed literal, or a key scoped by a server-trusted `ctx.*`
+  * value, is not recorded. Supplied by the codegen feeder; absent for
+  * runtime callers, where the lint finds nothing.
+  */
+  imageDeliveryUrlAccesses?: ReadonlyArray<AdvisorImageDeliveryUrlAccess>;
+  /**
   * Per-declared-index hit counts observed at runtime (the dead-index half of
   * the `index_utilization` lint input). Supplied by the studio backend, which
   * sums the per-`(table, index)` reads each shard records in the durable
@@ -651,6 +1638,26 @@ interface LintContext {
   */
   inserts?: ReadonlyArray<AdvisorInsertWrite>;
   /**
+  * `ctx.kv.&lt;method>(key, …)` calls whose namespace key is derived from the
+  * handler's `args` with no server-side scoping — the `kv_unscoped_user_key_idor`
+  * input. Workers KV is one flat namespace, so a key taken straight from request
+  * input lets any caller read/overwrite/delete another user's entry (IDOR). Only
+  * arg-derived, unscoped keys are recorded (a fixed literal or a
+  * `${ctx.auth.userId}:…` prefix is not). Supplied by the codegen feeder; absent
+  * for runtime callers, where the lint finds nothing.
+  */
+  kvKeyAccesses?: ReadonlyArray<AdvisorKvKeyAccess>;
+  /**
+  * `ctx.mail`/`ctx.email` `send`/`queue` calls whose `to`/`cc`/`bcc` recipient is
+  * derived from the handler's `args` with no server-side scoping — the
+  * `mail_recipient_from_request_input` input. A recipient taken straight from
+  * request input turns the deployment into an open relay / spam amplifier (any
+  * caller can direct mail to an arbitrary address). A recipient scoped by a
+  * server-trusted `ctx.*` value, or a fixed literal, is not recorded. Supplied by
+  * the codegen feeder; absent for runtime callers, where the lint finds nothing.
+  */
+  mailRecipientAccesses?: ReadonlyArray<AdvisorMailRecipientAccess>;
+  /**
   * Per-procedure column-masking usage discovered in function bodies (the
   * `mask_uncovered_pii_column` input). Carries whether each procedure's builder
   * chain includes `.use(mask(...))`, which `(table, column)` pairs its mask
@@ -660,6 +1667,23 @@ interface LintContext {
   */
   maskProcedures?: ReadonlyArray<AdvisorMaskProcedure>;
   /**
+  * Masked columns whose `mask(policies)` strategy is a statically-known
+  * literal (the `mask_weak_hash_strategy_on_pii` input). One row per masked
+  * column, with the `"hash"` / `"redact"` strategy literal attached; a
+  * `MaskFn` (custom, non-literal) strategy is never recorded. Supplied by
+  * the codegen feeder; absent for runtime callers, where the lint finds
+  * nothing.
+  */
+  maskStrategies?: ReadonlyArray<AdvisorMaskStrategy>;
+  /**
+  * Whole-row `ctx.db.replace(id, document)` writes lifted from custom
+  * mutators' authoritative `server` impls (the `mutator_full_row_replace`
+  * input). Each `replace` overwrites the entire row, clobbering a concurrent
+  * edit to a different column on a synced table. Supplied by the codegen
+  * feeder; absent for runtime callers, where the lint finds nothing.
+  */
+  mutatorWrites?: ReadonlyArray<AdvisorMutatorWrite>;
+  /**
   * Non-deterministic API calls (`Date.now`, `Math.random`,
   * `crypto.randomUUID`, `crypto.getRandomValues`, `fetch`) discovered lexically
   * inside `query`/`mutation` handler bodies — the `nondeterministic_query_mutation`
@@ -669,6 +1693,48 @@ interface LintContext {
   */
   nondeterministicCalls?: ReadonlyArray<AdvisorNondeterministicCall>;
   /**
+  * `query`/`mutation` handlers that gate a `ctx.db.get`/`patch`/`delete` on a
+  * null-checked `ctx.db.normalizeId(table, id)` result — the
+  * `normalize_id_used_as_authorization` input. `normalizeId` validates an id's
+  * structural shape only (it never reads the database), so gating access on a
+  * non-null result is an IDOR. The lint keeps only public procedures with no
+  * `.use(rls(...))` and no ownership/identity mention, then joins `table` against
+  * the schema's RLS mode before flagging. Supplied by the codegen feeder; absent
+  * for runtime callers, where the lint finds nothing.
+  */
+  normalizeIdAuthorizations?: ReadonlyArray<AdvisorNormalizeIdAuthorization>;
+  /**
+  * `ctx.db` writes (`insert` / `replace` / `patch` / `insertManyUnsafe`) that set
+  * an ownership / identity column (`userId`, `ownerId`, `tenantId`, …) from the
+  * handler's `args` instead of the server-trusted identity — the
+  * `owner_field_from_args_not_auth` input. The ownership column decides who a row
+  * belongs to, so an arg-derived value lets any caller write rows owned by another
+  * user or tenant (act-as-any-user / cross-tenant IDOR). A column stamped from
+  * `ctx.*`, or a fixed literal, is not recorded. Supplied by the codegen feeder;
+  * absent for runtime callers, where the lint finds nothing.
+  */
+  ownerFieldWrites?: ReadonlyArray<AdvisorOwnerFieldWrite>;
+  /**
+  * Payment webhook-adapter constructions (`createStripeAdapter` /
+  * `createPolarAdapter`) — the payment-webhook wide-tolerance lint's input. Each row's
+  * `toleranceSeconds` is the statically-known `webhookToleranceSeconds` replay
+  * window (default 300s); the lint fires only above a conservative ceiling, where
+  * the endpoint would accept stale, replayable signed payloads. Supplied by the
+  * codegen feeder; absent for runtime callers, where the lint finds nothing.
+  */
+  paymentWebhooks?: ReadonlyArray<AdvisorPaymentWebhook>;
+  /**
+  * Payload-derived privileged dispatches — the `privileged_dispatch_unvalidated_payload`
+  * input. Each is a `ctx.run`/`context.run` back into a Lunora function from inside a
+  * `defineQueue` push handler or a `defineWorkflow` handler, whose args reference the
+  * handler's untrusted payload (`context.params` for a workflow, a `for (… of
+  * batch.messages)` body for a queue). Both handler kinds run under the system identity
+  * (RLS disabled), so the lint joins the resolved target against `rlsProcedures` and
+  * fires only when the target enforces a row policy. Supplied by the codegen feeder;
+  * absent for runtime callers, where the lint finds nothing.
+  */
+  privilegedDispatches?: ReadonlyArray<AdvisorPrivilegedDispatch>;
+  /**
   * Per-procedure protective-middleware snapshots — the
   * `public_mutation_without_ratelimit` and `user_creating_mutation_without_captcha`
   * input. Records which `.use(...)` guards (`rateLimit`, captcha, `rls`, `mask`,
@@ -684,6 +1750,13 @@ interface LintContext {
   */
   queries?: ReadonlyArray<AdvisorQueryRead>;
   /**
+  * Queues declared via `defineQueue` exports in `lunora/queues.ts` — the
+  * declaration-side input for the `queue_*` lints (`queue_without_dlq`).
+  * Supplied by the codegen feeder; absent for runtime callers, where the
+  * queue lints find nothing.
+  */
+  queues?: ReadonlyArray<AdvisorQueue>;
+  /**
   * R2 SQL `ctx.r2sql` accesses discovered lexically inside `query`/`mutation`
   * handler bodies — the `r2sql_outside_action` input. Supplied by the codegen
   * feeder, which omits `action` handlers (where `ctx.r2sql` is the typed,
@@ -691,6 +1764,36 @@ interface LintContext {
   */
   r2sqlCalls?: ReadonlyArray<AdvisorR2sqlCall>;
   /**
+  * `rateLimit`/`dbRateLimit` middleware calls (`@lunora/ratelimit`) whose
+  * `key` selector is derived from the handler's `args` with no server-side
+  * scoping — the `ratelimit_key_spoofable_or_global` input. A key an
+  * attacker controls lets them rotate it per request and bypass the limit
+  * entirely, defeating its purpose. A selector scoped by `ctx` (e.g.
+  * `ctx.auth.userId`, `ctx.ip`), or one with no `args` reference at all (a
+  * fixed/global bucket), is not recorded. Supplied by the codegen feeder;
+  * absent for runtime callers, where the lint finds nothing.
+  */
+  ratelimitKeySelectors?: ReadonlyArray<AdvisorRatelimitKeySelector>;
+  /**
+  * `query` handlers that `return` the raw rows of a table (a `ctx.db` row read
+  * or `ctx.db.query(...)` fluent chain, returned directly or through one local
+  * `const` hop, with no hand-built projection) — the
+  * `output_projection_missing_on_public_read` input. The lint keeps only public
+  * queries with no `.output(...)`/mask on the chain, then joins `table` against
+  * the schema's PII-named columns before nudging. Supplied by the codegen
+  * feeder; absent for runtime callers, where the lint finds nothing.
+  */
+  rawRowReturns?: ReadonlyArray<AdvisorRawRowReturn>;
+  /**
+  * `ctx.db.&lt;table>.findMany({ with: { &lt;rel> } })` relation-hydrating list reads
+  * — the `masked_relation_leak_via_with` input. Column masking is applied to a
+  * read's top-level rows but does not descend into `with`-hydrated relations,
+  * so a masked table surfaced only through a `with` on an unprotected public
+  * read is returned in the clear. Supplied by the codegen feeder; absent for
+  * runtime callers, where the lint finds nothing.
+  */
+  relationLoads?: ReadonlyArray<AdvisorRelationLoad>;
+  /**
   * Per-procedure RLS usage discovered in function bodies (the
   * `rls_uncovered_table` input). Carries whether each procedure's builder chain
   * includes `.use(rls(...))`, which tables the procedure reads/writes, and which
@@ -708,6 +1811,14 @@ interface LintContext {
   */
   secretLiterals?: ReadonlyArray<AdvisorSecretLiteral>;
   /**
+  * Replication shapes declared via `defineShape` in `lunora/shapes.ts` — the
+  * `shape_unknown_table` and `shape_targets_global_table` lint input. Each
+  * carries the export name and its static `table` literal, cross-referenced
+  * against {@link LintContext.schema}. Supplied by the codegen feeder; absent
+  * for runtime callers, where the shape lints find nothing.
+  */
+  shapes?: ReadonlyArray<AdvisorShape>;
+  /**
   * Per-shard observed traffic — the `hot_shard` lint input. Supplied by the
   * studio backend, which fans out over a sharded function's shards and reads
   * each shard's recorded request volume from the durable `__lunora_metrics`
@@ -715,6 +1826,15 @@ interface LintContext {
   */
   shardTraffic?: ReadonlyArray<AdvisorShardTraffic>;
   /**
+  * `ctx.db.&lt;table>.findMany({ includeDeleted })` list reads whose
+  * `includeDeleted` is a hardcoded `true` or derived from the handler's
+  * `args` — the `soft_delete_include_deleted_from_args` input. On a public
+  * read of a `.softDelete()` table this resurfaces soft-deleted rows to any
+  * caller (arg-derived) or every caller (hardcoded). Supplied by the codegen
+  * feeder; absent for runtime callers, where the lint finds nothing.
+  */
+  softDeleteReads?: ReadonlyArray<AdvisorSoftDeleteRead>;
+  /**
   * `ctx.sql` tagged-template interpolations that splice an unparameterized
   * string-building expression into the query — the `sql_injection_risk` input.
   * Supplied by the codegen feeder; absent for runtime callers, where the lint
@@ -722,6 +1842,29 @@ interface LintContext {
   */
   sqlInterpolations?: ReadonlyArray<AdvisorSqlInterpolation>;
   /**
+  * `ctx.storage.&lt;bucket>.&lt;method>(key, …)` calls whose R2 object key is derived
+  * from the handler's `args` with no server-side scoping — the
+  * `storage_key_from_user_args` input. The bucket read/write/URL/delete methods
+  * key by their first argument, so an arg-derived key is object-level IDOR
+  * (read/overwrite/delete anyone's object). A key referencing a server-trusted
+  * `ctx.*` value (e.g. `${ctx.auth.userId}/…`) is treated as scoped and not
+  * recorded. Supplied by the codegen feeder; absent for runtime callers, where
+  * the lint finds nothing.
+  */
+  storageKeyAccesses?: ReadonlyArray<AdvisorStorageKeyAccess>;
+  /**
+  * Tracked `ctx.storage.&lt;bucket>.&lt;method>(...)` upload/signing calls — the
+  * shared input for the storage config-hygiene lints
+  * (`storage_upload_without_content_type_allowlist`, `storage_upload_without_max_size`,
+  * `storage_generate_upload_url_no_content_type_pin`,
+  * `storage_presigned_url_for_private_content`). Each row carries the method
+  * invoked, which options-object keys were present, and (for the two URL
+  * signers) a statically-known `expiresInSeconds` literal. Supplied by the
+  * codegen feeder; absent for runtime callers, where these lints find
+  * nothing.
+  */
+  storageUploads?: ReadonlyArray<AdvisorStorageUpload>;
+  /**
   * Bounded row samples per table — the `constraint_validator` lint input.
   * Supplied by the studio backend, which reads up to the configured row cap
   * from each table via `readTablePage` and assembles the existing-id set for
@@ -744,6 +1887,16 @@ interface LintContext {
   */
   tableScans?: ReadonlyArray<AdvisorTableScan>;
   /**
+  * `ctx.vectors.&lt;method>(index, { namespace, … })` calls whose `namespace` is
+  * derived from the handler's `args` with no server-side scoping — the
+  * `vectors_namespace_from_user_input` input. A Vectorize namespace partitions one
+  * index into isolated sub-collections, so an arg-derived namespace lets any caller
+  * read or poison another tenant's vectors. A namespace scoped by a server-trusted
+  * `ctx.*` value, or a fixed literal, is not recorded. Supplied by the codegen
+  * feeder; absent for runtime callers, where the lint finds nothing.
+  */
+  vectorNamespaceAccesses?: ReadonlyArray<AdvisorVectorNamespaceAccess>;
+  /**
   * `ctx.workflows.get("name")` call sites discovered in function bodies — the
   * use-side input the `workflow_unused` and `workflow_unknown_target` lints
   * cross-reference against {@link LintContext.workflows}. Supplied by the
@@ -758,6 +1911,13 @@ interface LintContext {
   * nothing.
   */
   workflows?: ReadonlyArray<AdvisorWorkflow>;
+  /**
+  * Committed `wrangler.jsonc` `vars` entries holding plaintext secrets — the
+  * input for the `plaintext_secret_in_wrangler_vars` lint. Supplied by
+  * `@lunora/config` (which reads `wrangler.jsonc`) via the codegen pass-through;
+  * absent for runtime callers, where the lint finds nothing.
+  */
+  wranglerVariables?: ReadonlyArray<AdvisorWranglerVariable>;
 }
 /**
 * A single advisory rule. `run` is pure over its {@link LintContext} so lints are
@@ -786,9 +1946,9 @@ interface Lint {
   title: string;
 }
 /**
-* Minimal structural view of the `@lunora/analytics` SQL client — just its
+* Minimal structural view of the `@lunora/bindings/analytics` SQL client — just its
 * `query(sql)` method. Kept structural (not an `import type` from
-* `@lunora/analytics`) so the advisor needn't depend on the analytics package;
+* `@lunora/bindings/analytics`) so the advisor needn't depend on the analytics package;
 * the real `AnalyticsSqlClient` satisfies it, as does a plain test double.
 */
 interface AnalyticsMetricsSource {
@@ -926,6 +2086,23 @@ declare const hotShard: Lint;
 */
 declare const indexUtilization: Lint;
 /**
+* Flags an action's `ctx.fetch(url, …)` whose URL is derived from the handler's
+* `args` — a server-side request forgery (SSRF) vector.
+*
+* `ctx.fetch` is the action-only outbound-request escape hatch, and it applies no
+* host allowlist: whatever URL it is handed, it fetches. When that URL comes from
+* request input (`ctx.fetch(args.url)`, a template embedding `args.*`, or a URL
+* built one hop earlier from `args`), a caller can point the worker at the cloud
+* metadata endpoint (`169.254.169.254`) or an internal service and read the
+* response — classic SSRF. The fix is to validate the URL against an allowlist of
+* expected hosts before fetching, and to reject private / link-local targets.
+*
+* Runs only when the codegen feeder supplies fetch-taint evidence
+* (`context.argumentDerivedFetches`); a runtime caller flags nothing. One finding per
+* arg-derived `ctx.fetch` call.
+*/
+declare const actionFetchSsrf: Lint;
+/**
 * Flags an `httpRoute` on an admin/privileged-looking path whose handler shows no
 * auth/admin guard.
 *
@@ -942,6 +2119,91 @@ declare const indexUtilization: Lint;
 */
 declare const adminRouteWithoutGuard: Lint;
 /**
+* Flags a `ctx.ai.run(model, …)` call whose model-id argument is derived from
+* the handler's `args` with no server-side scoping — arbitrary model
+* selection that bypasses the typed AI-SDK layer.
+*
+* `ctx.ai.run` is the raw Workers AI binding passthrough (void-style
+* `ai.run`), bypassing `ctx.ai.model(...)` plus the AI SDK functions
+* (`generateText`, `streamText`, …) entirely — no output cap, no schema. When
+* the model id comes straight from request input (`ctx.ai.run(args.model,
+* …)`, or one built one hop earlier from `args`), any caller can pick which
+* model runs, sidestepping whatever the typed path would have enforced. Only
+* the model argument (`arguments[0]`) is inspected; an arg-derived `inputs`
+* (`arguments[1]`) is normal, expected usage and is never flagged. A model
+* scoped by a server-trusted `ctx.*` value is treated as scoped and not
+* flagged.
+*
+* Runs only when the codegen feeder supplies raw-run evidence
+* (`context.aiRawRuns`); a runtime caller flags nothing. One finding per
+* arg-derived, unscoped `ctx.ai.run` call.
+*/
+declare const aiRawRunEscapeHatch: Lint;
+/**
+* Flags a `generateText` / `streamText` call whose model input is user-derived
+* **and** whose model-callable `tools` reach a privileged side effect.
+*
+* The AI SDK lets the model call a `tool({ execute })` to take an action. When
+* that tool's `execute` performs a real side effect — a DB write, a function
+* dispatch (`ctx.run`), or an outbound send (fetch / mail / queue) — and the
+* model's prompt / messages carry user-supplied text, an injected instruction in
+* that text can steer the model into firing the side effect. The model becomes a
+* confused deputy: attacker-authored words drive privileged actions. This is the
+* canonical LLM prompt-injection-to-tool-call hazard.
+*
+* Runs only when the codegen feeder supplies generation evidence
+* (`context.aiToolSideEffects`); a runtime caller flags nothing. Fires only when
+* the model input is derived from the handler's `args` — a fully server-authored
+* prompt driving a side-effecting tool is not flagged. Deliberately narrow (an
+* inherently heuristic rule): one finding per matching call.
+*/
+declare const aiToolSideEffectPromptInjection: Lint;
+/**
+* Flags a public procedure that runs an AI text/object generation
+* (`generateText` / `streamText` / `generateObject` / `streamObject`) with no
+* `maxOutputTokens` bound in its config.
+*
+* Each generation call bills against the account's Workers AI / provider budget
+* in proportion to the tokens produced. Left unbounded and reachable from a
+* `.public()` procedure, an anonymous caller can request arbitrarily long
+* completions in a loop — a denial-of-wallet vector — and can also tie up worker
+* CPU/time on long streams. The fix is to cap output with `maxOutputTokens` (and
+* ideally rate-limit the entry point).
+*
+* Only a call whose config is a visible object literal is judged; a hoisted or
+* spread config is statically opaque and left un-flagged (fail-open) to avoid a
+* false positive. Runs only when the codegen feeder supplies procedure-protection
+* evidence (`context.procedureProtections`); a runtime caller flags nothing.
+*/
+declare const aiUnboundedGenerationPublic: Lint;
+/**
+* Flags an app that opts into `allowUnauthenticatedShardAccess: true` while its
+* schema has an RLS gap (no `.rls("required")`, or a `.public()` table).
+*
+* `allowUnauthenticatedShardAccess` (a `WorkerOptions` field consumed by
+* `createWorker(...)`) turns off the fail-closed default that denies a shard
+* lookup for a request with no verified identity. That is a deliberate, opt-in
+* posture switch — appropriate for a public/anonymous-first shard resolver — but
+* combined with a schema that never enforces `.rls("required")` (or that leaves
+* a table `.public()`, i.e. exempt from it), an unauthenticated caller can shard-hop
+* and read another tenant's rows with no row-security guard behind the door.
+*
+* **Evidence and coverage gap**: this reads `context.configCalls`, fed by the
+* codegen `discover-config-calls.ts` feeder's `.extend(fn)` callback-shape
+* support — it only sees the setting when a `lunora/`-local file calls the
+* generated `defineApp()...extend(() => ({ allowUnauthenticatedShardAccess:
+* true }))` escape hatch (the pattern the `nuxt` / `analog` templates use in
+* `lunora/server.ts`). An app that sets the same field via `@lunora/vite`'s
+* `LunoraPluginOptions` (`vite.config.ts`) or a hand-authored worker entry
+* outside `lunora/` (the `sveltekit` / `astro` / `react-router` /
+* `tanstack-start` template style) is invisible to this lint — a coverage gap,
+* not a false negative this lint claims to catch.
+*
+* Runs only when the codegen feeder supplies config-call evidence; a runtime
+* caller flags nothing. One finding per opted-in `.extend(...)` call site.
+*/
+declare const allowUnauthenticatedShardAccessEnabled: Lint;
+/**
 * Flags a `ctx.authApi.&lt;method>(...)` call whose argument object omits `headers`.
 *
 * `@lunora/auth`'s `withAuthPlugins` middleware attaches the full privileged
@@ -959,6 +2221,135 @@ declare const adminRouteWithoutGuard: Lint;
 */
 declare const authApiCallWithoutHeaders: Lint;
 /**
+* Flags a `createAuth({...})` call whose `advanced.disableCSRFCheck` is
+* explicitly `true`.
+*
+* better-auth's CSRF check validates the request's origin against
+* `trustedOrigins` before applying a state-changing auth mutation (sign-in,
+* sign-up, session revocation, …). `disableCSRFCheck: true` turns that check
+* off outright, so a cross-site request riding the browser's ambient auth
+* cookie is processed the same as a same-origin one — the standard CSRF
+* exposure.
+*
+* Runs only when the codegen feeder supplies auth-config evidence
+* (`context.authConfigs`), and only for an analyzable config (a static,
+* spread-free object literal); an opaque config could set the key elsewhere
+* and is skipped rather than guessed at. One finding per matching `createAuth`
+* call.
+*/
+declare const authCsrfCheckDisabled: Lint;
+/**
+* Flags a `createAuth({...})` call with `emailAndPassword.enabled: true` and no
+* `emailAndPassword.requireEmailVerification: true`.
+*
+* better-auth defaults `requireEmailVerification` off, so an email/password
+* account is usable — signed in, able to act — the moment it's created, before
+* the caller has proven ownership of the email address. That lets an attacker
+* sign up with a victim's email (or an address they don't control) and operate
+* the account immediately, and it weakens any downstream flow (password reset,
+* account recovery) that assumes a verified address.
+*
+* Runs only when the codegen feeder supplies auth-config evidence
+* (`context.authConfigs`), and only for an analyzable config (a static,
+* spread-free object literal); an opaque config could set the key elsewhere
+* and is skipped rather than guessed at. One finding per matching `createAuth`
+* call.
+*/
+declare const authEmailVerificationDisabled: Lint;
+/**
+* Flags a `createAuth({...})` call whose `advanced.useSecureCookies` is
+* explicitly `false`.
+*
+* `@lunora/auth` defaults `useSecureCookies` ON unless the deployment's
+* `baseURL` is provably plain `http://` (a local dev origin) — see
+* `hardenAuthOptions` in `packages/auth/src/create-auth.ts`. An explicit
+* `useSecureCookies: false` overrides that secure-by-default posture, so the
+* session cookie ships without the `Secure` attribute even on an HTTPS
+* deployment — it is then sent over any plaintext connection an attacker can
+* coerce (mixed-content requests, a downgraded subdomain), exposing the
+* session.
+*
+* Runs only when the codegen feeder supplies auth-config evidence
+* (`context.authConfigs`), and only for an analyzable config (a static,
+* spread-free object literal); an opaque config could set the key elsewhere
+* and is skipped rather than guessed at. One finding per matching `createAuth`
+* call.
+*/
+declare const authSecureCookiesDisabled: Lint;
+/**
+* Flags a `createAuth({...})` call whose `session.freshAge` is explicitly the
+* literal `0`.
+*
+* `freshAge` is the window better-auth treats a session as "recently
+* re-authenticated" for sensitive operations (changing the password, adding a
+* passkey, revoking other sessions, …) that gate on a fresh session rather than
+* merely a valid one. Setting it to `0` disables that recent-reauth check
+* entirely — every sensitive operation is treated as fresh regardless of how
+* old the session is, so a long-lived stolen session (or token) can perform
+* them without ever proving the caller still controls the credentials.
+*
+* Runs only when the codegen feeder supplies auth-config evidence
+* (`context.authConfigs`), and only for an analyzable config (a static,
+* spread-free object literal); an opaque config could set the key elsewhere
+* and is skipped rather than guessed at. One finding per matching `createAuth`
+* call.
+*/
+declare const authSessionFreshageZero: Lint;
+/**
+* Flags a `createAuth({...})` call whose `trustedOrigins` array literal
+* contains a `"*"` entry.
+*
+* better-auth's `trustedOrigins` is the allowlist its CSRF/origin validation
+* checks every state-changing request against. A `"*"` entry disables that
+* check entirely — any origin is accepted, which is exactly the protection
+* Lunora leans on to keep cross-site requests from riding an authenticated
+* cookie.
+*
+* Runs only when the codegen feeder supplies auth-config evidence
+* (`context.authConfigs`), and only for an analyzable config (a static,
+* spread-free object literal); an opaque config could set `trustedOrigins`
+* elsewhere and is skipped rather than guessed at. One finding per matching
+* `createAuth` call.
+*/
+declare const authTrustedOriginsWildcard: Lint;
+/**
+* Flags a `createBrowser({ allowPrivateTargets: true })`.
+*
+* `@lunora/browser` blocks navigation to private / internal / loopback addresses
+* by default — that guard is what stops a browser action from being turned into a
+* server-side request forgery (SSRF) tool that reaches cloud metadata endpoints
+* (`169.254.169.254`), internal services, or `localhost`. Setting
+* `allowPrivateTargets: true` disables it wholesale. Combined with a
+* request-supplied URL that is the classic SSRF-to-metadata exfiltration path.
+*
+* Runs only when the codegen feeder supplies config-call evidence
+* (`context.configCalls`); a runtime caller flags nothing. One finding per
+* opted-out browser.
+*/
+declare const browserAllowPrivateTargets: Lint;
+/**
+* Flags a `ctx.browser.&lt;method>(url, …)` call whose navigation URL is derived
+* from the handler's `args` with no server-side scoping — and no hardened
+* `createBrowser` allowlist to contain it.
+*
+* `@lunora/browser` blocks navigation to private/internal/loopback addresses by
+* default, but that guard only stops SSRF to *internal* targets. A
+* request-supplied *public* URL still turns the headless browser into an
+* open-proxy / request-forgery tool: any caller can make the deployment fetch
+* an arbitrary third-party URL (SSRF to public cloud APIs that trust the egress
+* IP, data exfiltration through the fetched URL), and — without pinned DNS — a
+* public hostname can rebind to an internal address after the guard's check.
+* The containment is an `allowedHosts` allowlist on `createBrowser`, or a
+* pinned `resolveDns`. This lint therefore suppresses all findings when the
+* config-call evidence shows a `createBrowser` hardened with either key; only
+* an unhardened browser reaching an arg-derived URL is flagged.
+*
+* Runs only when the codegen feeder supplies browser URL-access evidence
+* (`context.browserUrlAccesses`); a runtime caller flags nothing. One finding
+* per arg-derived, unscoped `ctx.browser` navigation.
+*/
+declare const browserUserUrlWithoutAllowlist: Lint;
+/**
 * Detect FK cycles in the declared relation graph via a DFS.
 *
 * A "circular FK" exists when a chain of `one` relations forms a loop — for
@@ -986,6 +2377,26 @@ declare const authApiCallWithoutHeaders: Lint;
 */
 declare const circularFk: Lint;
 /**
+* Flags a `ctx.containers.&lt;exportName>.get(name, …)` call whose instance key
+* is derived from the handler's `args` with no server-side scoping — a
+* cross-tenant container IDOR.
+*
+* A container definition's `.get(name)` accessor routes to one Durable
+* Object-backed container instance per `name` — one container per entity
+* (user, room, job…). When the key comes straight from request input
+* (`ctx.containers.app.get(args.id)`, a template embedding `args.*`, or a key
+* built one hop earlier from `args`), any caller can hand in another tenant's
+* key and reach that tenant's container instance. The fix is to derive the
+* key from a server-trusted identity (`` `${ctx.auth.userId}` ``) or a record
+* the caller owns — a key that references `ctx` is treated as scoped and is
+* not flagged. `.any()`/`.pool()` are not sinks (they take no key).
+*
+* Runs only when the codegen feeder supplies container key-access evidence
+* (`context.containerKeyAccesses`); a runtime caller flags nothing. One
+* finding per arg-derived, unscoped `ctx.containers.*.get` call.
+*/
+declare const containerInstanceKeyFromUserInput: Lint;
+/**
 * Flags a container declared on a large instance type. The big `standard-3` /
 * `standard-4` sizes (and large custom shapes) are billed on their provisioned
 * memory + disk for the whole time an instance runs, so an over-provisioned
@@ -1006,6 +2417,8 @@ declare const containerOversizedInstance: Lint;
 * alone.
 */
 declare const containerPublicInternet: Lint;
+declare const containerRuntimeEgressRelaxation: Lint;
+declare const containerStartEnableInternetOverride: Lint;
 /**
 * Lunora port of splinter's `0009_duplicate_index`.
 *
@@ -1031,6 +2444,40 @@ declare const duplicateIndex: Lint;
 */
 declare const emptyIndex: Lint;
 /**
+* Flags a table that is both `.source(...)` and `.global()`.
+*
+* The two are contradictory. `.global()` already places a table in an external
+* store (D1, or a Hyperdrive-fronted Postgres/MySQL) that Lunora owns the schema
+* for and reads through the global backend. `.source(...)` declares the table as
+* **materialized from** an external database into a shard DO's SQLite by the
+* ingest poll loop. A table cannot simultaneously live in the global tier and be
+* polled into per-shard SQLite — the ingest loop has no DO-local table to write,
+* and the global backend has no poll loop. This is a definite misconfiguration,
+* so it is an `ERROR`.
+*
+* **Evidence supply**: reads `table.externalSource` + `table.shardKind`. Skipped
+* unless both a sourced declaration and the `global` tier are present.
+*/
+declare const externalSourceOnGlobal: Lint;
+/**
+* Flags a `.source(...)` + `.shardBy(...)` table that has no `tenantBy` mapper.
+*
+* Per-shard SQLite isolation only controls *where* materialized rows land — not
+* what* the ingest query pulls. A sourced + sharded table whose `tenantBy` is
+* absent runs the same unscoped membership query on every tenant's Durable
+* Object, so each agent replicates the **entire** multitenant table into its own
+* SQLite (and then to its clients via `defineShape`). That is a cross-tenant data
+* leak, not a performance nit — so it is an `ERROR` that fails the build.
+*
+* `tenantBy(shardKey)` is the boundary: it binds this DO's shard key into the
+* query's parameters so the tenant can only ever pull its own rows.
+*
+* **Evidence supply**: reads `table.externalSource` (the codegen feeder captures
+* it from `.source({...})`; the runtime feeder derives it). A table without a
+* sourced declaration, or one not sharded, is skipped.
+*/
+declare const externalSourceUnscoped: Lint;
+/**
 * Flags a query read that calls `.filter()` without first narrowing with
 * `.withIndex()` / `.withSearchIndex()`. Such a read loads *every* row of the
 * table and applies the predicate in memory — a full table scan that degrades
@@ -1044,6 +2491,25 @@ declare const emptyIndex: Lint;
 */
 declare const filterWithoutIndex: Lint;
 /**
+* Flags a `ctx.flags.boolean(key, default)` read on a security-shaped key whose
+* fail-open default selects the *permissive* branch.
+*
+* OpenFeature returns the caller-supplied default when the provider errors, so a
+* flag read is a security decision that fails to its default. When the key names
+* a protection (`enforce*`/`rls*`/`gate*`/`lockdown*`) and defaults `false`, or
+* names a permission/bypass (`allow*`/`permit*`/`bypass*`) and defaults `true`,
+* a flag-backend outage silently disables the protection or grants the
+* permission for every request.
+*
+* Runs only when the codegen feeder supplies flag-default evidence
+* (`context.flagSecurityDefaults`); a runtime caller flags nothing. Deliberately
+* narrow — matched on security-shaped key tokens with an unambiguous polarity
+* plus a boolean-literal default; keys whose polarity is indeterminate (a bare
+* `auth`/`admin`) or contradictory are skipped to keep the false-positive rate
+* low. One finding per read.
+*/
+declare const flagGatesSecurityWithUnsafeDefault: Lint;
+/**
 * Flags a secret-shaped string literal checked into the lunora source.
 *
 * A live API key, access key, private key, or high-entropy token committed to the
@@ -1059,6 +2525,50 @@ declare const filterWithoutIndex: Lint;
 */
 declare const hardcodedSecret: Lint;
 /**
+* Flags an `httpAction`/`httpRoute` handler that performs a side effect
+* (`ctx.runMutation` / `ctx.runAction` / a `ctx.db` write) but never reads
+* `ctx.auth`.
+*
+* Unlike `query`/`mutation`/`action` procedures — which run under a resolved
+* identity and RLS — a raw HTTP handler is reached directly from the public
+* internet with no framework-supplied auth step. `HttpActionCtx` still exposes
+* `ctx.auth` (`getIdentity()` / `userId`), but nothing forces the handler to
+* consult it. A handler that mutates state or dispatches an action without ever
+* touching `ctx.auth` is an unauthenticated write endpoint: any anonymous caller
+* can drive the side effect, and the downstream `runMutation`/`runAction`/`db`
+* write runs with whatever ambient authority the handler carries — bypassing the
+* identity/RLS checks the rest of the app relies on. Distinct from
+* `admin_route_without_guard`, which covers Studio/admin-path routes.
+*
+* Runs only when the codegen feeder supplies HTTP-handler evidence
+* (`context.httpActionGuards`); a runtime caller flags nothing. The feeder only
+* records handlers that already perform a side effect and whose `ctx` binding was
+* statically resolvable (a named-function or wrapped handler is skipped,
+* fail-safe), so this lint just filters to those that never read `ctx.auth`. One
+* finding per handler.
+*/
+declare const httpActionMissingAuthGuard: Lint;
+/**
+* Flags an `httpAction` handler that writes a response-header value derived from
+* raw request input (`request.headers`, `request.url`/query, `await
+* request.json()`) with no CR/LF sanitizer.
+*
+* A `Request`-derived string placed verbatim into a response header lets a caller
+* smuggle carriage-return/line-feed sequences (`\r\n`) into the response — injecting
+* additional headers (`Set-Cookie`, `Location`, CORS) or splitting the response body
+* (HTTP response splitting / header injection). Unlike `query`/`mutation` handlers,
+* a raw `httpAction` builds its own `Response`, so nothing forces the value through
+* the framework's `isSafeHeaderValue` CR/LF guard.
+*
+* Runs only when the codegen feeder supplies header-write evidence
+* (`context.httpHeaderWrites`); a runtime caller flags nothing. The feeder records
+* a site only when its value is request-tainted AND unguarded — a value routed
+* through `isSafeHeaderValue`, `encodeURIComponent`/`encodeURI`, a numeric coercion
+* (`Number`/`parseInt`/`parseFloat`), or `btoa` is treated as safe and never
+* recorded. One finding per unsafe header write.
+*/
+declare const httpActionResponseHeaderInjection: Lint;
+/**
 * Flags a Hyperdrive `ctx.sql` access inside a `query(...)` or `mutation(...)`
 * handler body.
 *
@@ -1083,6 +2593,42 @@ declare const hardcodedSecret: Lint;
 */
 declare const hyperdriveOutsideAction: Lint;
 /**
+* Flags an authorization read of an identity claim that is **not** in the app's
+* declared `defineIdentity({ ... })` contract.
+*
+* `defineIdentity` is the trust boundary for `ctx.auth.identity`: the worker
+* validates a resolver's returned claims against the *declared* validators, but
+* — by design — forwards any **undeclared** claims through verbatim, unchecked.
+* So a policy predicate or authorize hook that reads `auth.identity.&lt;key>` for a
+* `&lt;key>` the contract never declares is trusting a value the runtime never
+* validated — a claim an attacker's token can carry with an arbitrary value.
+* Reading `userId` (always declared) or any declared claim is fine.
+*
+* Runs only when the codegen feeder supplies claim-read evidence
+* (`context.identityClaimReads`) — which it does only when a resolvable
+* `defineIdentity` contract exists — so an app with no typed identity contract,
+* or a runtime caller, flags nothing. One finding per undeclared read.
+*/
+declare const identityUndeclaredClaimTrusted: Lint;
+/**
+* Flags a `buildImageDeliveryUrl({ key, … })` call (`@lunora/bindings/images`)
+* whose `key` is derived from the handler's `args` with no server-side scoping.
+*
+* `key` is the CDN transform's source image — an absolute URL, or an
+* origin-relative key under the account's own store — that `buildImageDeliveryUrl`
+* splices into the `/cdn-cgi/image/…` delivery URL. `ctx.images.transform`/`info`
+* take image *bytes*, never a URL, so they carry no equivalent risk and are not
+* flagged. An arg-derived `key` lets any caller point the CDN's on-the-fly
+* transform at an attacker-chosen origin (SSRF / open proxy against whatever
+* that origin trusts the CDN's egress IP for) or at an arbitrary key under the
+* account's own store.
+*
+* Runs only when the codegen feeder supplies image-delivery-URL evidence
+* (`context.imageDeliveryUrlAccesses`); a runtime caller flags nothing. One
+* finding per arg-derived, unscoped `key`.
+*/
+declare const imagesUrlSourceFromUserInput: Lint;
+/**
 * A correctness lint with no splinter analogue — it exploits Lunora's static
 * edge: the schema is fully declared, so a typo'd index column is catchable at
 * codegen time rather than surfacing as a runtime error or a silently
@@ -1095,6 +2641,77 @@ declare const hyperdriveOutsideAction: Lint;
 */
 declare const indexReferencesUnknownField: Lint;
 /**
+* Flags a public procedure whose handler calls `ctx.db.insertManyUnsafe(...)`.
+*
+* `insertManyUnsafe` is the bulk-insert escape hatch: it writes rows straight to
+* storage, bypassing the per-row argument validators AND the schema's insert
+* triggers (which is where server-trusted columns, ownership stamping, and RLS
+* write checks live). That is acceptable for a seed script or an internal import
+* fed server-trusted rows — but on a `.public()` procedure the rows are shaped
+* from request input, so the bypass lets a caller write columns they should never
+* control and skip every trigger-enforced invariant. The fix is to use the
+* validated `ctx.db.insert(...)` path, or keep the unsafe bulk write in an
+* internal function fed only server-built rows.
+*
+* Runs only when the codegen feeder supplies procedure-protection evidence
+* (`context.procedureProtections`); a runtime caller flags nothing. One finding
+* per public procedure using the unsafe bulk insert.
+*/
+declare const insertManyUnsafeUserData: Lint;
+/**
+* Flags a `ctx.kv` read/write whose namespace key is derived from the handler's
+* `args` with no server-side scoping — a namespace-level insecure direct object
+* reference (IDOR).
+*
+* Workers KV is a single flat namespace with no per-caller isolation. When a key
+* comes straight from request input (`ctx.kv.get(args.key)`, a template embedding
+* `args.*`, or a key built one hop earlier from `args`), any caller can hand in
+* another user's key and read, overwrite, or delete that user's entry. The fix is
+* to prefix every key with a server-trusted identity (`` `${ctx.auth.userId}:…` ``)
+* so a caller can only ever address their own entries — a key that references
+* `ctx` is treated as scoped and is not flagged. `list` is not a sink (it takes a
+* prefix, not a per-entry key).
+*
+* Runs only when the codegen feeder supplies KV key-access evidence
+* (`context.kvKeyAccesses`); a runtime caller flags nothing. One finding per
+* arg-derived, unscoped `ctx.kv` call.
+*/
+declare const kvUnscopedUserKeyIdor: Lint;
+/**
+* Flags a `createInboundEmailHandler({...})` built without a `verify` hook.
+*
+* An inbound email handler receives mail from the public internet, where the
+* `from` address is trivially spoofable and the DKIM/SPF/DMARC verdicts are only
+* meaningful if the handler actually checks them. The `verify` hook is where that
+* check belongs. Omit it and the handler trusts every message it receives — and
+* when the handler dispatches into a Lunora function (which runs under the admin
+* bearer, with RLS disabled), a forged sender can drive privileged writes: a
+* confused-deputy escalation reachable by anyone who can send an email.
+*
+* Runs only when the codegen feeder supplies config-call evidence
+* (`context.configCalls`); a runtime caller flags nothing. Skips calls whose
+* config wasn't a static object literal. One finding per unverified handler.
+*/
+declare const mailInboundDispatchWithoutVerify: Lint;
+/**
+* Flags a `ctx.mail`/`ctx.email` `send`/`queue` call whose recipient field
+* (to/cc/bcc) is derived from the handler's `args` with no server-side
+* scoping.
+*
+* A recipient derived straight from request input turns the deployment into
+* an open relay / spam amplifier — any caller can direct mail to an arbitrary
+* address just by supplying it as an argument. The fix is to derive
+* recipients from server-trusted state (e.g. the authenticated user's own
+* record via `ctx.auth`), never straight from `args`; if user-chosen
+* recipients are a genuine product requirement, gate the path behind
+* authentication and rate limiting rather than leaving it open to any caller.
+*
+* Runs only when the codegen feeder supplies mail recipient-access evidence
+* (`context.mailRecipientAccesses`); a runtime caller flags nothing. One
+* finding per offending `ctx.mail`/`ctx.email` call — not per recipient field.
+*/
+declare const mailRecipientFromRequestInput: Lint;
+/**
 * Flags a public procedure that reads a table for which at least one other
 * procedure declares a column mask (evidence the developer decided that table
 * carries sensitive columns), but whose own builder chain does NOT include
@@ -1133,6 +2750,69 @@ declare const indexReferencesUnknownField: Lint;
 */
 declare const maskUncoveredPiiColumn: Lint;
 /**
+* Flags a `mask(policies)` column whose strategy is the literal `"hash"` and
+* whose column name matches a PII heuristic (`email`, `ssn`, `phone`, …).
+*
+* Lunora's `"hash"` mask strategy is an unsalted 32-bit FNV-1a digest — a
+* stable pseudonym for grouping/joining, deliberately **not** a confidentiality
+* control. Its narrow (~2^32) output space makes it brute-force-recoverable by
+* the very caller it is meant to mask from, and identical inputs always
+* produce identical tokens, so it also leaks cross-row/cross-tenant equality.
+* Applying it to a PII column reads as protection but isn't; `"redact"` (drop
+* to `null`) is the strategy that actually hides the value.
+*
+* Runs only when the codegen feeder supplies strategy evidence
+* (`context.maskStrategies`); a runtime caller with no evidence flags nothing.
+* A `MaskFn` (custom, non-literal) strategy carries no static signal and is
+* never recorded by the feeder, so it never reaches this lint either.
+*/
+declare const maskWeakHashStrategyOnPii: Lint;
+/**
+* Flags a public read that hydrates a masked table's rows in the clear through a
+* `with` relation.
+*
+* Column masking (`.use(mask(...))`) is applied per-procedure to the *top-level*
+* rows of the table named in a read. It does **not** descend into relations
+* hydrated via `with` — `ctx.db.posts.findMany({ with: { author: true } })`
+* returns each `author` fully unmasked even when the `users` table is masked
+* elsewhere. So a table whose columns you carefully mask on its own reads is
+* still served in the clear whenever an unprotected parent read pulls it in as a
+* relation.
+*
+* INFO, near-zero false positives by construction: it fires only when all of
+* (1) the enclosing read is public, (2) the read declares `with: { &lt;rel> }`,
+* (3) `&lt;rel>` resolves through the schema to a real target table, and (4) that
+* target table actually has masked columns (per the discovered mask evidence).
+* Absent any mask usage the lint is a no-op. Runs only when the codegen feeder
+* supplies `context.relationLoads`; a runtime caller flags nothing. One finding
+* per `(read, masked relation)` pair.
+*/
+declare const maskedRelationLeakViaWith: Lint;
+/**
+* Flags a custom mutator whose authoritative `server` impl writes a row with
+* `ctx.db.replace(id, document)` — a whole-document overwrite.
+*
+* The local-first sync engine serializes mutators in the shard DO, so two
+* mutators that touch the *same row* but *different columns* both run to
+* completion — but only if each writes its own column. A `replace` overwrites
+* the entire row from the document the mutator assembled, so a concurrent edit
+* to another column (committed between this mutator's read and its write, or
+* carried as a pending optimistic overlay on a client) is silently clobbered:
+* the kind of "two offline edits to different fields fight each other" data loss
+* a column-level merge avoids. `ctx.db.patch(id, { onlyTheChangedField })`
+* merges at the column level instead, so independent field edits coexist.
+*
+* `WARN`, not `ERROR`: `replace` is legitimate when the mutator genuinely owns
+* the whole row (a full-form save, a state-machine transition that rewrites
+* every field). The lint just surfaces the column-clobber risk so a developer
+* reaches for `patch` by default on a synced table.
+*
+* **Evidence supply**: runs only when the codegen feeder supplies
+* `context.mutatorWrites` (each a `replace` call lifted from a mutator's inline
+* `server` body); absent for runtime callers, where the lint finds nothing.
+*/
+declare const mutatorFullRowReplace: Lint;
+/**
 * Flags a non-deterministic API call inside a `query(...)` or `mutation(...)`
 * handler body.
 *
@@ -1153,6 +2833,132 @@ declare const maskUncoveredPiiColumn: Lint;
 */
 declare const nondeterministicQueryMutation: Lint;
 /**
+* Flags a public `query`/`mutation` whose handler gates a `ctx.db.get`/`patch`/`delete`
+* on a null-checked `ctx.db.normalizeId(table, id)` result, with no intervening
+* ownership predicate and no RLS coverage.
+*
+* `normalizeId` performs pure structural validation — it checks that a string is
+* shaped like a valid id for `table` and returns the branded id, but it **never reads
+* the database**. A non-null result therefore proves only that the id is well-formed,
+* never that the row exists or that the caller owns it. Treating "normalizeId returned
+* non-null" as authorization is an IDOR: any caller who supplies a syntactically valid
+* id of another user's row reaches it. This is an INFO-level nudge — the handler may be
+* intentionally public — it flags a place where the shape check is doing load-bearing
+* work it can't actually do.
+*
+* **Negative-proof gates** (bias toward silence — a false negative is cheaper than a
+* false positive that trains users to ignore the advisor): the feeder records a row
+* only when a null-gated normalized id reaches an id-first sink, and this lint
+* additionally requires (1) `visibility === "public"` (an internal procedure trusts
+* its server caller for authorization), (2) no `.use(rls(...))` on the builder chain,
+* (3) no ownership/identity mention anywhere in the handler (`mentionsOwnership` — any
+* `ctx.auth`/`ctx.identity` read or ownership-named identifier suppresses), and (4) the
+* table not covered by schema-required RLS. A handler that compares the loaded row's
+* `userId` to `ctx.auth.userId`, or a schema in `.rls("required")` mode, is never
+* flagged.
+*
+* Runs only when the codegen feeder supplies `context.normalizeIdAuthorizations`; a
+* runtime caller flags nothing.
+*/
+declare const normalizeIdUsedAsAuthorization: Lint;
+/**
+* Nudges a `.public()` `query` whose handler returns raw table rows — with no
+* `.output(...)` projection and no `.use(mask(...))` — when that table carries
+* PII-named columns (`email`, `phone`, `ssn`, …).
+*
+* A public query is reachable by any client. Returning a table row verbatim ships
+* every column it holds — including PII the caller never needed — and silently
+* widens the exposed surface every time a column is added to the table later. An
+* explicit `.output(v.object({ … }))` projection (or a `.use(mask(...))` policy)
+* makes the exposed shape intentional and stops the next-added column from leaking
+* by default. This is an INFO-level nudge, not a defect: the query may be perfectly
+* fine — it flags a place worth a deliberate projection decision.
+*
+* **Low-FP gates**: the feeder records a row only when the handler returns the raw
+* read result itself (a hand-built object / array / `.map(...)` projection is not
+* recorded), and this lint additionally requires (1) `visibility === "public"`,
+* (2) no `.output(...)` and no `.use(mask(...))` on the builder chain, and (3) the
+* returned table to declare at least one PII-named column. A public query returning
+* a non-PII lookup table (`emojis`, `countries`) is never flagged.
+*
+* Runs only when the codegen feeder supplies `context.rawRowReturns`; a runtime
+* caller flags nothing.
+*/
+declare const outputProjectionMissingOnPublicRead: Lint;
+/**
+* Flags a `ctx.db` write (`insert` / `replace` / `patch` / `insertManyUnsafe`)
+* that sets an ownership / identity column — `userId`, `ownerId`, `tenantId`, and
+* the like — from the handler's `args` instead of the server-trusted identity.
+*
+* The ownership column decides *who a row belongs to*. When its value comes from
+* request input (`ctx.db.insert("posts", { userId: args.userId })`), any caller
+* can claim to be anyone: pass a different `userId` / `tenantId` and the write
+* lands a row owned by another user or tenant — the classic act-as-any-user /
+* cross-tenant IDOR. The fix is to stamp the ownership column from `ctx.auth` /
+* `ctx.identity` on the server and never read it from `args`. A column set from
+* `ctx.*`, or to a fixed literal, is correct and not flagged.
+*
+* Runs only when the codegen feeder supplies owner-write evidence
+* (`context.ownerFieldWrites`); a runtime caller flags nothing. One finding per
+* offending identity-column write.
+*/
+declare const ownerFieldFromArgsNotAuth: Lint;
+/**
+* Flags a `createPayment({...})` constructed without an `authorize` callback.
+*
+* The `authorize(referenceId)` hook is `@lunora/payment`'s access-control gate: it
+* runs before every charge/refund/subscription operation and decides whether the
+* current caller may act on that payment reference. Omit it and the guard is
+* effectively open — any caller who can reach a reference id (often a
+* client-supplied string) can drive money movement against someone else's
+* payment, a broken-access-control (IDOR) escalation on the most sensitive
+* surface an app has.
+*
+* The context accessor `ctx.payments` is authorization-scoped by default; this
+* lint targets the direct `createPayment(...)` factory, where the gate is
+* opt-in. Runs only when the codegen feeder supplies config-call evidence
+* (`context.configCalls`); a runtime caller flags nothing. Skips calls whose
+* config wasn't a static object literal (the key may be set on a config built
+* elsewhere). One finding per unguarded call.
+*/
+declare const paymentCreateWithoutAuthorize: Lint;
+/**
+* Flags a payment webhook adapter (`createStripeAdapter` / `createPolarAdapter`)
+* configured with an implausibly wide `webhookToleranceSeconds` replay window.
+*
+* The adapters reject a webhook whose signed timestamp is more than
+* `webhookToleranceSeconds` from now, so a captured-then-replayed signed payload
+* is refused once it ages past the window. The default (300s) is the recommended
+* clock-skew allowance; widening it to hours or days keeps stale, replayable
+* signed events valid long after capture, defeating the timestamp check and
+* re-opening the replay window the signature scheme exists to close.
+*
+* Runs only when the codegen feeder supplies adapter evidence
+* (`context.paymentWebhooks`); a runtime caller flags nothing. Fires only on a
+* statically-known numeric `webhookToleranceSeconds` literal above the ceiling —
+* a computed or env-sourced value is not evaluated, to keep the false-positive
+* rate low. One finding per matching adapter.
+*/
+declare const paymentWebhookWideTolerance: Lint;
+/**
+* Flags a plaintext secret committed to `wrangler.jsonc`'s `vars` block.
+*
+* `vars` are **plaintext environment variables**: Wrangler bakes them into the
+* deployed Worker's bundle in cleartext, and `wrangler.jsonc` is checked into
+* source control — so a real API key, access key, private key, or token placed
+* there leaks two ways at once (every reader of the repo and the deployed bundle)
+* and rotating it means editing tracked config plus a redeploy. Secrets belong in
+* a Secrets Store binding (`ctx.secrets.get(name)`) or `wrangler secret put`, never
+* `vars`. The evidence comes from `@lunora/config`, which reads `wrangler.jsonc`
+* and applies the same secret-shape heuristics as `hardcoded_secret`, plus a
+* secret-suggestive key-name rule (`*_KEY` / `*_SECRET` / `*_TOKEN` / `*_PASSWORD`
+* / `*_DSN`), while skipping placeholders and public/publishable keys.
+*
+* Runs only when the config feeder supplies wrangler-variable evidence
+* (`context.wranglerVariables`); a runtime caller flags nothing. One finding per var.
+*/
+declare const plaintextSecretInWranglerVariables: Lint;
+/**
 * Flags an RLS policy whose `table` names a table that does not exist in the
 * schema.
 *
@@ -1176,6 +2982,50 @@ declare const nondeterministicQueryMutation: Lint;
 */
 declare const policyReferencesUnknownTable: Lint;
 /**
+* Flags a `ctx.run`/`context.run` back into a Lunora function from inside a
+* `defineQueue` push handler or a `defineWorkflow` handler, when the dispatch's
+* args reference the handler's untrusted payload (`context.params` for a
+* workflow, a `for (… of batch.messages)` body for a queue) **and** the target
+* enforces row-level security.
+*
+* A queue/workflow handler runs under the deployment's **system identity** with
+* end-user RLS disabled — that is by design, so the handler can touch any row.
+* But the payload it receives is attacker-influenced: a queue body is whatever
+* was enqueued (often straight from a public mutation's `args`), and a
+* workflow's `params` are set by the `.create({ params })` caller. Forwarding
+* that payload into a function whose own protection is a *row policy* is a
+* confused-deputy: the policy that would have rejected the caller's request is
+* skipped because the handler, not the user, is now the principal. Any field
+* the payload controls that the target's RLS keys on (owner id, tenant id, row
+* id) becomes an act-as-any-user / cross-tenant write.
+*
+* The lint is deliberately narrow to stay false-positive-free: it fires **only**
+* when the resolved target (`api.&lt;file>.&lt;export>`) is found in the
+* RLS-procedure evidence with `usesRls: true`. A dispatch into a function that
+* does its own arg validation and carries no row policy (the common, correct
+* case — e.g. a welcome-message mutation with no `rls`) is not flagged. Runs
+* only when the codegen feeder supplies dispatch evidence
+* (`context.privilegedDispatches`); a runtime caller flags nothing.
+*/
+declare const privilegedDispatchUnvalidatedPayload: Lint;
+/**
+* Flags a public procedure whose handler fans work out to a privileged,
+* cost-bearing dispatch surface without a rate-limit guard.
+*
+* `ctx.scheduler.runAfter` / `runAt`, a `ctx.queues.&lt;name>` producer send, and
+* `ctx.workflows.&lt;name>.create` all enqueue work that runs later under the
+* system identity (RLS disabled) and bills against the account. Triggered from a
+* `.public()` procedure with no rate limit, an anonymous caller can drive that
+* dispatch in a loop — a cost-amplification / denial-of-wallet vector, and a way
+* to flood a privileged async surface. The fix is to gate the public entry point
+* with a rate limit (or make it internal and trigger it from a guarded path).
+*
+* Runs only when the codegen feeder supplies procedure-protection evidence
+* (`context.procedureProtections`); a runtime caller flags nothing. One finding
+* per unguarded public fan-out procedure.
+*/
+declare const privilegedFanoutFromPublicProcedure: Lint;
+/**
 * Flags a `v.any()` argument on a public procedure.
 *
 * `v.any()` disables validation: the field accepts arbitrary, untyped,
@@ -1206,10 +3056,55 @@ declare const publicArgumentUsesAny: Lint;
 */
 declare const publicMutationWithoutRatelimit: Lint;
 /**
+* Flags a `.public()` table that carries ownership/tenancy- or PII-named
+* columns, on a schema that requires RLS (`.rls("required")`).
+*
+* `.public()`'s name is misleading: it does NOT mean "this table holds public
+* data" — it means the OPPOSITE of that from an enforcement standpoint. It opts
+* one table OUT of the schema-wide `.rls("required")` enforcement, so its
+* `ctx.db` write path is never denied for missing RLS coverage. A table named
+* `.public()` that also carries `userId` / `email` / `ssn`-shaped columns reads
+* as "safe to expose" but is actually "exempt from the row-security guard" —
+* exactly the confusion the method name invites.
+*
+* **Low-FP gate**: only flagged when (1) the schema opted into
+* `.rls("required")` at all (`.public()` is a documented no-op otherwise — see
+* {@link https://lunora.sh}'s `.public()` docs), and (2) the table's declared
+* columns match the ownership/PII heuristic ({@link ownershipOrPiiColumns}). A
+* genuinely public lookup table (e.g. `emojis`, `countries`) with no such
+* columns is not flagged.
+*
+* **Pure schema evidence**: reads only `context.schema` — both `isPublic` and
+* `rlsMode` are forwarded by the runtime `fromServerSchema` and the codegen
+* `toAdvisorSchema` paths, so this lint runs identically from a live shard and
+* from codegen, with no feeder required.
+*/
+declare const publicTableRlsOptoutConfusion: Lint;
+/**
+* Flags a declared queue — push or pull — that has no dead-letter queue.
+*
+* A Cloudflare Queues consumer retries a failing message up to `maxRetries`
+* times (default 3 — roughly four total delivery attempts); once that budget is
+* exhausted, a message with no `deadLetterQueue` is **deleted permanently** with
+* no record an operator can inspect. Routing exhausted messages to a DLQ turns
+* silent data loss into a backlog you can inspect, alert on, and replay. Hence
+* `WARN`/`INTERNAL`: an operator-facing reliability nudge, not a hard error — a
+* genuinely fire-and-forget queue may accept the loss.
+*
+* A queue that is itself some other queue's `deadLetterQueue` target is skipped:
+* a DLQ is a terminal sink and requiring it to have its own DLQ would recurse
+* forever (and mis-flag the best-practice scaffold, which pairs a queue with a
+* dedicated DLQ consumer).
+*
+* Only runs when the declaration feeder supplied evidence (`context.queues`
+* present); a runtime caller flags nothing.
+*/
+declare const queueWithoutDlq: Lint;
+/**
 * Flags an R2 SQL `ctx.r2sql` access inside a `query(...)` or `mutation(...)`
 * handler body.
 *
-* R2 SQL (`@lunora/r2sql`) queries Apache Iceberg tables over an **external**
+* R2 SQL (`@lunora/bindings/r2sql`) queries Apache Iceberg tables over an **external**
 * REST endpoint Lunora does not own — there is no Workers binding, every query
 * is an HTTPS round-trip. A `ctx.r2sql` query is therefore non-deterministic
 * (exactly like `fetch`), which breaks the determinism the coordinator relies on
@@ -1231,6 +3126,62 @@ declare const publicMutationWithoutRatelimit: Lint;
 */
 declare const r2sqlOutsideAction: Lint;
 /**
+* Flags a `new RateLimiter({...})` constructed without an explicit `store`.
+*
+* The default store is per-instance in-memory. On Cloudflare Workers each request
+* can land on a different isolate, so an in-memory counter never sums across
+* them: the limiter silently under-counts and, under real traffic, is close to a
+* no-op. A rate limit that doesn't actually limit gives a false sense of
+* protection against brute-force, enumeration, and cost-abuse — exactly the
+* attacks it was added to stop. The fix is a shared, durable store (a Durable
+* Object or KV-backed one) so every isolate reads and writes the same bucket.
+*
+* Runs only when the codegen feeder supplies config-call evidence
+* (`context.configCalls`); a runtime caller flags nothing. Skips calls whose
+* config wasn't a static object literal. One finding per limiter.
+*/
+declare const ratelimitDefaultMemoryStore: Lint;
+/**
+* Flags a `rateLimit`/`dbRateLimit` middleware call (`@lunora/ratelimit`) whose
+* `key` selector is derived from the handler's `args` with no server-side
+* scoping.
+*
+* The middleware's `key` is `(ctx) => string | undefined` — a sub-key that
+* isolates the limit per caller. When the selector reads straight from `args`
+* (an email, a client-supplied id, …) instead of a server-trusted identity
+* (`ctx.auth.userId`) or the server-trusted `ctx.ip`, an attacker can rotate the
+* key on every request and never share a bucket with themselves, defeating the
+* limit entirely. A selector with no `args` reference at all — a fixed/global
+* bucket, including simply omitting `key` — is a *different*, fuzzier problem
+* (one caller can still exhaust a shared global bucket for everyone) and is
+* deliberately **not** flagged here, to keep this lint's false-positive rate
+* low: a global bucket is a legitimate choice for some limits (e.g. a
+* deployment-wide cost cap), so its absence alone is not a reliable signal.
+*
+* Runs only when the codegen feeder supplies rate-limit key-selector evidence
+* (`context.ratelimitKeySelectors`); a runtime caller flags nothing. One finding
+* per arg-derived, unscoped selector.
+*/
+declare const ratelimitKeySpoofableOrGlobal: Lint;
+/**
+* Flags a `rateLimit`/`dbRateLimit`/`verifyTurnstileMiddleware` guard configured
+* `failOpen: true` on an auth/payment-sensitive procedure.
+*
+* `@lunora/ratelimit`'s `rateLimit`/`dbRateLimit` and `@lunora/auth`'s
+* `verifyTurnstileMiddleware` fail **closed** by default — a store outage or a
+* failed Turnstile siteverify rejects the request (503). Passing `failOpen: true`
+* inverts that: the middleware swallows the failure and admits the request. On a
+* sign-in / account-creation / password-reset / OTP / payment endpoint that turns
+* a transient limiter outage into an unthrottled brute-force / abuse window.
+*
+* Runs only when the codegen feeder supplies fail-open-guard evidence
+* (`context.failOpenGuards`); a runtime caller flags nothing. Deliberately narrow
+* — fires only when the options literal provably set `failOpen: true` AND the
+* guarded procedure's export name or rate-limit `name` matches an auth/payment
+* token, keeping the false-positive rate low. One finding per guard.
+*/
+declare const ratelimitMiddlewareFailOpen: Lint;
+/**
 * A correctness lint covering the columns a relation wires together: the FK
 * `field` and the `references` column must each exist on their respective
 * tables, or the join can never resolve. Caught here at codegen time rather
@@ -1285,6 +3236,70 @@ declare const relationReferencesUnknownTable: Lint;
 */
 declare const rlsUncoveredTable: Lint;
 /**
+* Flags a replication shape whose `table` is a `.global()` table.
+*
+* Poke-live replication is a per-shard-DO property: the shard owns its SQLite
+* and a monotonic `__cdc_log`, so a write produces an ordered op the DO pokes to
+* every subscriber at the next flush. A `.global()` table lives outside the
+* shard DO's SQLite op-log (in a global backend — D1, or Hyperdrive-fronted
+* Postgres/MySQL) — so a shape over a global table cannot be poke-live. It is
+* served through the cross-shard tier: **coordinator/poll-refreshed, latency-
+* tiered**, not live. That is a real and supported tier (it is the recommended
+* answer for cross-shard reads — denormalize, or move the joined table to
+* `.global()` and read through the global backend), but its freshness semantics
+* differ from a sharded shape's, so the boundary is surfaced rather than hidden.
+*
+* `WARN`, not `ERROR`: a global-table shape is a legitimate design once you
+* accept the poll-refresh latency; the lint just makes the tier explicit so a
+* developer does not assume poke-live freshness.
+*
+* **Evidence supply**: runs only when the codegen feeder supplies
+* `context.shapes`; the table's tier comes from the schema's `shardKind`. A
+* shape whose table is unknown (caught by `shape_unknown_table`) or whose tier
+* the feeder didn't supply is skipped.
+*/
+declare const shapeTargetsGlobalTable: Lint;
+/**
+* Flags a replication shape whose `table` names a table that does not exist in
+* the schema.
+*
+* `defineShape({ table: "messages", … })` binds a shape to a table by a plain
+* string. A live `subscribeShape("…")` resolves that shape server-side and runs
+* its membership query against the named table — so a typo, a stale name after a
+* rename, or a copy-paste mistake produces a shape that can never resolve a
+* rowset: the subscription seeds empty and then errors at the first flush
+* (`no such table`). This is a definite, build-time-detectable break, so it is
+* an `ERROR` — surfaced before the broken shape ever ships.
+*
+* **Evidence supply**: runs only when the codegen feeder supplies
+* `context.shapes`. A shape whose `table` wasn't a static string literal (no
+* resolvable name) is skipped rather than guessed at, so the lint under-reports
+* rather than raising false alarms.
+*/
+declare const shapeUnknownTable: Lint;
+/**
+* Flags a public read that resurfaces soft-deleted rows via `includeDeleted` —
+* either hardcoded `true` or wired from the handler's `args`.
+*
+* A `.softDelete()` table hides deleted rows from list reads (`findMany` /
+* `findFirst`) unless the call passes `includeDeleted: true`. That opt-out is a
+* deliberate, privileged escape hatch (an admin trash view, a restore flow). On
+* a `.public()` read it becomes a leak: `includeDeleted: true` returns
+* soft-deleted rows to *every* caller, and `includeDeleted: args.showDeleted`
+* lets *any* caller flip the toggle per request — either way the "deleted" rows
+* a user believes are gone (and that your UI hides) are served straight back.
+*
+* INFO, near-zero false positives by construction: it fires only when all of
+* (1) the enclosing procedure is public, (2) the read's target is a schema table
+* that actually declares `.softDelete()`, and (3) `includeDeleted` is a hardcoded
+* `true` or arg-derived. A literal `false`, or an `includeDeleted` gated by a
+* server-trusted `ctx.*` value, is never recorded by the feeder, so a correct
+* admin-gated read is not flagged. Runs only when the codegen feeder supplies
+* `context.softDeleteReads`; a runtime caller flags nothing. One finding per
+* matching read.
+*/
+declare const softDeleteIncludeDeletedFromArgs: Lint;
+/**
 * Flags a `ctx.sql` tagged-template that splices an unparameterized
 * string-building expression into the query.
 *
@@ -1301,6 +3316,107 @@ declare const rlsUncoveredTable: Lint;
 */
 declare const sqlInjectionRisk: Lint;
 /**
+* Flags a `ctx.storage.generateUploadUrl(key, …)` call whose options argument
+* omits `contentType`.
+*
+* `generateUploadUrl` mints a signed `PUT` URL the *client* uploads directly
+* to R2, bypassing `upload()`/`store()` entirely — including their
+* `allowedContentTypes`/`maxSize` guards, which this alias never sees. The one
+* guard `generateUploadUrl` itself offers is `contentType`: passing it pins
+* the `Content-Type` into the signature, so the signed URL only authorizes a
+* PUT with exactly that content-type. Omit it and the minted URL accepts any
+* content-type/size the client chooses, entirely unchecked server-side.
+*
+* Runs only when the codegen feeder supplies storage-upload evidence
+* (`context.storageUploads`); a runtime caller flags nothing. Skips calls
+* whose options argument wasn't statically analyzable (a variable, call
+* result, or a spread) — the key may be set on an object built elsewhere. One
+* finding per unpinned call.
+*/
+declare const storageGenerateUploadUrlNoContentTypePin: Lint;
+/**
+* Flags a `ctx.storage.&lt;bucket>.&lt;method>(key, …)` whose R2 object key is derived
+* from the handler's `args` with no server-side scoping — an object-level IDOR.
+*
+* The bucket read/write/URL/delete methods (`get`, `put`, `delete`, `download`,
+* `store`, `getSignedUrl`, …) take the object key as their first argument. When
+* that key comes straight from request input (`ctx.storage.docs.get(args.key)`, or
+* a key built one hop earlier from `args`), any caller can name any object — reading,
+* overwriting, or deleting another user's file. The fix is to prefix the key with a
+* server-trusted identity (`` `${ctx.auth.userId}/…` ``) or to resolve the object
+* through a record the caller is known to own; a key that references `ctx` is treated
+* as scoped and is not flagged.
+*
+* Runs only when the codegen feeder supplies storage-key evidence
+* (`context.storageKeyAccesses`); a runtime caller flags nothing. One finding per
+* offending call.
+*/
+declare const storageKeyFromUserArgs: Lint;
+/**
+* Flags a `ctx.storage.getPresignedUrl(...)` call, or a `getPresignedUrl`/
+* `getSignedUrl` call whose `expiresInSeconds` sits near the shared 7-day
+* signing ceiling.
+*
+* `getPresignedUrl` mints a native S3 SigV4 URL that resolves directly
+* against R2's S3 endpoint — the holder reaches the object straight off R2,
+* **bypassing the Worker entirely**, so any auth/RLS/rate-limit gate the app
+* enforces in its own handlers never runs for that request. That's the right
+* trade for genuinely public or bulk content where the app has no per-request
+* gating to apply; it's the wrong choice for private, per-user, or
+* policy-gated content, where `getSignedUrl` (worker-signed, resolves back
+* through the app) is the fit. Separately, either signer minting a long TTL
+* near the shared 7-day ceiling hands out a bearer credential that stays
+* valid almost as long as the platform allows — a leaked link (referrer,
+* logs, browser history) then grants access for nearly a week.
+*
+* Runs only when the codegen feeder supplies storage-upload evidence
+* (`context.storageUploads`); a runtime caller flags nothing. The
+* near-ceiling check only fires on a statically-known numeric
+* `expiresInSeconds` literal — a variable or computed expression is not
+* evaluated, to keep the false-positive rate low. One finding per matching
+* call.
+*/
+declare const storagePresignedUrlForPrivateContent: Lint;
+/**
+* Flags a `ctx.storage.upload`/`store` call whose options argument omits
+* `allowedContentTypes`.
+*
+* `@lunora/storage`'s `upload`/`store` accept an `allowedContentTypes`
+* allowlist that, when set, rejects a mismatched (or missing) `contentType` —
+* the control that stops an uploader from storing `text/html` or
+* `image/svg+xml` and having it served back from `publicBaseUrl`, a classic
+* stored-XSS path against your own origin. Omitting the option leaves any
+* content-type acceptable. `generateUploadUrl`'s signed PUT has no
+* `allowedContentTypes` option at all (it bypasses `upload()`'s guards
+* entirely) — that gap is `storage_generate_upload_url_no_content_type_pin`'s
+* concern, not this lint's.
+*
+* Runs only when the codegen feeder supplies storage-upload evidence
+* (`context.storageUploads`); a runtime caller flags nothing. Skips calls
+* whose options argument wasn't statically analyzable (a variable, call
+* result, or a spread) — the key may be set on an object built elsewhere. One
+* finding per unguarded call.
+*/
+declare const storageUploadWithoutContentTypeAllowlist: Lint;
+/**
+* Flags a `ctx.storage.upload`/`store` call whose options argument omits
+* `maxSize`.
+*
+* `@lunora/storage`'s `upload`/`store` accept a `maxSize` byte ceiling that
+* rejects an oversized `ArrayBuffer`/`Blob` up front, and pipes a
+* `ReadableStream` through a counting `TransformStream` that aborts once the
+* limit is exceeded — without it, a caller can push an unbounded body through
+* the Worker straight into R2, exhausting storage/billing (and, for a
+* streamed body, worker CPU/time) with no cap.
+*
+* Runs only when the codegen feeder supplies storage-upload evidence
+* (`context.storageUploads`); a runtime caller flags nothing. Skips calls
+* whose options argument wasn't statically analyzable (a variable, call
+* result, or a spread) — the key may be set on an object built elsewhere. One
+* finding per unbounded call.
+*/
+declare const storageUploadWithoutMaxSize: Lint;
+/**
 * Flags a declared table that no function inserts into.
 *
 * Using `@lunora/codegen`'s write-side discovery (the analog of the read
@@ -1387,6 +3503,44 @@ declare const unindexedRelationTarget: Lint;
 */
 declare const userCreatingMutationWithoutCaptcha: Lint;
 /**
+* Flags a `ctx.vectors.query`/`upsert`/`upsertMany` call whose `namespace`
+* input is derived from the handler's `args` with no server-side scoping — a
+* tenant-partition escape.
+*
+* Vectorize namespaces partition a single index into isolated sub-collections
+* (typically one per tenant/user). When a namespace comes straight from
+* request input (`ctx.vectors.query(idx, { namespace: args.tenant })`, or a
+* value built one hop earlier from `args`), any caller can hand in another
+* tenant's namespace and read or poison that tenant's vectors. The fix is to
+* derive the namespace from a server-trusted identity (`` `${ctx.auth.orgId}` ``)
+* so a caller can only ever address their own partition — a namespace that
+* references `ctx` is treated as scoped and is not flagged.
+*
+* Runs only when the codegen feeder supplies vector-namespace evidence
+* (`context.vectorNamespaceAccesses`); a runtime caller flags nothing. One
+* finding per arg-derived, unscoped `ctx.vectors` call.
+*/
+declare const vectorsNamespaceFromUserInput: Lint;
+/**
+* Flags a durable step name reused within one workflow.
+*
+* Cloudflare Workflows memoizes every `step.do` / `step.sleep` / `step.sleepUntil`
+* / `step.waitForEvent` call by its name: on replay the runtime returns the cached
+* result for a name it has already seen. Two distinct steps that share a name are
+* therefore a silent bug — the second call never runs its body and instead yields
+* the first's result, skipping the work (a charge, a write, an external wait)
+* without error. Hence `ERROR`/`INTERNAL`: it is a developer-facing correctness
+* defect in the workflow's own code, not a runtime-data nit.
+*
+* Only the first string-literal argument of each step call is compared; a step
+* named dynamically (`step.do(\`load-${id}\`, …)`) is omitted by the feeder, so a
+* deliberately-parameterized fan-out is never flagged. `ctx.runStep(stepDef, …)`
+* names (which come from `defineStep` in another file) are out of scope here.
+* Only runs when the declaration feeder supplied step evidence
+* (`workflow.steps` present); a runtime caller flags nothing.
+*/
+declare const workflowDuplicateStepName: Lint;
+/**
 * A correctness lint: every `ctx.workflows.get("name")` call must reference a
 * workflow that exists — i.e. a `defineWorkflow` export in `lunora/workflows.ts`.
 * A `.get("x")` whose `"x"` resolves to no declared workflow is a typo or a
@@ -1448,4 +3602,4 @@ interface RunAdvisorOptions {
 * `static` lints at build time and defer `runtime` lints to a live shard.
 */
 declare const runAdvisor: (context: LintContext, options?: RunAdvisorOptions) => Finding[];
-export { AE_METRIC_EVENTS, ALL_LINTS, type AdvisorAdminRoute, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorContainer, type AdvisorHyperdriveCall, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorMaskProcedure, type AdvisorNondeterministicCall, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorR2sqlCall, type AdvisorRelation, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShardTraffic, type AdvisorSqlInterpolation, type AdvisorTable, type AdvisorTableSample, type AdvisorTableScan, type AdvisorWorkflow, type AdvisorWorkflowCall, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type Category, type Facing, type Finding, type Level, type Lint, type LintContext, type LintSource, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, adminRouteWithoutGuard, authApiCallWithoutHeaders, circularFk, constraintValidator, containerOversizedInstance, containerPublicInternet, duplicateIndex, emptyIndex, filterWithoutIndex, fromServerSchema, hardcodedSecret, hotShard, hyperdriveOutsideAction, indexReferencesUnknownField, indexUtilization, loadAnalyticsRuntimeMetrics, maskUncoveredPiiColumn, nondeterministicQueryMutation, policyReferencesUnknownTable, publicArgumentUsesAny, publicMutationWithoutRatelimit, r2sqlOutsideAction, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, sqlInjectionRisk, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, workflowUnknownTarget, workflowUnused };
+export { AE_METRIC_EVENTS, ALL_LINTS, type AdvisorAdminRoute, type AdvisorAiRawRun, type AdvisorAiToolSideEffect, type AdvisorArgumentDerivedFetch, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorAuthConfig, type AdvisorBrowserUrlAccess, type AdvisorConfigCall, type AdvisorContainer, type AdvisorContainerKeyAccess, type AdvisorContainerOverride, type AdvisorFailOpenGuard, type AdvisorFlagSecurityDefault, type AdvisorHttpActionGuard, type AdvisorHttpHeaderWrite, type AdvisorHyperdriveCall, type AdvisorIdentityClaimRead, type AdvisorImageDeliveryUrlAccess, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorKvKeyAccess, type AdvisorMailRecipientAccess, type AdvisorMaskProcedure, type AdvisorMaskStrategy, type AdvisorMutatorWrite, type AdvisorNondeterministicCall, type AdvisorNormalizeIdAuthorization, type AdvisorOwnerFieldWrite, type AdvisorPaymentWebhook, type AdvisorPrivilegedDispatch, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorQueue, type AdvisorQueueTuning, type AdvisorR2sqlCall, type AdvisorRatelimitKeySelector, type AdvisorRawRowReturn, type AdvisorRelation, type AdvisorRelationLoad, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShape, type AdvisorShardTraffic, type AdvisorSoftDeleteRead, type AdvisorSqlInterpolation, type AdvisorStorageKeyAccess, type AdvisorStorageUpload, type AdvisorTable, type AdvisorTableSample, type AdvisorTableScan, type AdvisorVectorNamespaceAccess, type AdvisorWorkflow, type AdvisorWorkflowCall, type AdvisorWranglerVariable, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type Category, type Facing, type Finding, type Level, type Lint, type LintContext, type LintSource, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, actionFetchSsrf, adminRouteWithoutGuard, aiRawRunEscapeHatch, aiToolSideEffectPromptInjection, aiUnboundedGenerationPublic, allowUnauthenticatedShardAccessEnabled, authApiCallWithoutHeaders, authCsrfCheckDisabled, authEmailVerificationDisabled, authSecureCookiesDisabled, authSessionFreshageZero, authTrustedOriginsWildcard, browserAllowPrivateTargets, browserUserUrlWithoutAllowlist, circularFk, constraintValidator, containerInstanceKeyFromUserInput, containerOversizedInstance, containerPublicInternet, containerRuntimeEgressRelaxation, containerStartEnableInternetOverride, duplicateIndex, emptyIndex, externalSourceOnGlobal, externalSourceUnscoped, filterWithoutIndex, flagGatesSecurityWithUnsafeDefault, fromServerSchema, hardcodedSecret, hotShard, httpActionMissingAuthGuard, httpActionResponseHeaderInjection, hyperdriveOutsideAction, identityUndeclaredClaimTrusted, imagesUrlSourceFromUserInput, indexReferencesUnknownField, indexUtilization, insertManyUnsafeUserData, kvUnscopedUserKeyIdor, loadAnalyticsRuntimeMetrics, mailInboundDispatchWithoutVerify, mailRecipientFromRequestInput, maskUncoveredPiiColumn, maskWeakHashStrategyOnPii, maskedRelationLeakViaWith, mutatorFullRowReplace, nondeterministicQueryMutation, normalizeIdUsedAsAuthorization, outputProjectionMissingOnPublicRead, ownerFieldFromArgsNotAuth, paymentCreateWithoutAuthorize, paymentWebhookWideTolerance, plaintextSecretInWranglerVariables, policyReferencesUnknownTable, privilegedDispatchUnvalidatedPayload, privilegedFanoutFromPublicProcedure, publicArgumentUsesAny, publicMutationWithoutRatelimit, publicTableRlsOptoutConfusion, queueWithoutDlq, r2sqlOutsideAction, ratelimitDefaultMemoryStore, ratelimitKeySpoofableOrGlobal, ratelimitMiddlewareFailOpen, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, softDeleteIncludeDeletedFromArgs, sqlInjectionRisk, storageGenerateUploadUrlNoContentTypePin, storageKeyFromUserArgs, storagePresignedUrlForPrivateContent, storageUploadWithoutContentTypeAllowlist, storageUploadWithoutMaxSize, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, vectorsNamespaceFromUserInput, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };