@lunora/advisor 1.0.0-alpha.3 → 1.0.0-alpha.31

package/dist/index.d.mts

@@ -1,10 +1,10 @@
 import { Schema } from '@lunora/server';
 /**
-* One `httpRoute.<verb>("/admin/…")` REST route on an admin/privileged-looking
-* path, with whether its handler references an auth/admin guard — the input the
-* `admin_route_without_guard` lint consumes. Produced by the codegen feeder;
-* runtime callers don't supply it, so the lint finds nothing there.
-*/
+ * One `httpRoute.<verb>("/admin/…")` REST route on an admin/privileged-looking
+ * path, with whether its handler references an auth/admin guard — the input the
+ * `admin_route_without_guard` lint consumes. Produced by the codegen feeder;
+ * runtime callers don't supply it, so the lint finds nothing there.
+ */
 interface AdvisorAdminRoute {
   /** The exported binding name of the route handler. */
   exportName: string;
@@ -18,13 +18,76 @@ interface AdvisorAdminRoute {
   usesGuard: boolean;
 }
 /**
-* One public procedure's argument validators reduced to the input-safety facts
-* the `public_arg_uses_any` and `unbounded_string_arg` lints consume: which args
-* are declared `v.any()` (unvalidated input) and which `v.string()` args carry no
-* length bound (a DoS / storage-abuse vector). Produced by the codegen feeder for
-* public procedures only; internal functions take server-trusted input. Runtime
-* callers don't supply it, so the lints find nothing there.
-*/
+ * One `ctx.ai.run(model, …)` call whose model-id argument is derived from the
+ * handler's `args` with no server-side scoping — the input the
+ * `ai_raw_run_escape_hatch` lint consumes. `ctx.ai.run` is the raw Workers AI
+ * binding passthrough, bypassing the typed `ctx.ai.model(...)` + AI-SDK layer
+ * (`generateText`/`streamText`/…) that caps output and enforces a schema. When
+ * the model id comes straight from request input, any caller can select an
+ * arbitrary model. A fixed literal model, or one scoped by a server-trusted
+ * `ctx.*` value, is *not* recorded; only an arg-derived, unscoped model id
+ * reaches here — an arg-derived `inputs` argument is normal usage and is never
+ * inspected. Produced by the codegen feeder; runtime callers don't supply it,
+ * so the lint finds nothing there.
+ */
+interface AdvisorAiRawRun {
+  /** The exported binding name of the procedure performing the `ctx.ai.run` call. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the `ctx.ai.run` call, or `0` when unknown. */
+  line: number;
+}
+/**
+ * One `generateText` / `streamText` call whose `tools` reach a privileged side
+ * effect — the shared input for the `ai_tool_side_effect_prompt_injection` lint.
+ * A model-callable `tool({ execute })` that writes to the database, dispatches
+ * another function, or sends outbound (fetch / mail / queue) hands the LLM the
+ * trigger for a real-world action; `userInputDerived` records whether the model
+ * input (`prompt`/`messages`/`system`) flows from the handler's `args`, the
+ * channel a prompt injection rides in on. Produced by the codegen feeder; runtime
+ * callers don't supply it, so the lint finds nothing there.
+ */
+interface AdvisorAiToolSideEffect {
+  /** The exported binding name of the procedure performing the call. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the generation call, or `0` when unknown. */
+  line: number;
+  /** The generation entrypoint invoked. */
+  method: "generateText" | "streamText";
+  /** The privileged side-effect sink a model-callable tool reaches (`ctx.db.insert`, `ctx.run`, `ctx.fetch`, …). */
+  sideEffect: string;
+  /** `true` when a model-input option is derived from the handler's `args` (a bare `args.x`, or a name destructured from `args`). */
+  userInputDerived: boolean;
+}
+/**
+ * One `ctx.fetch(url, …)` call inside an action whose URL argument is derived
+ * from the handler's `args` — the input the `action_fetch_ssrf` lint consumes.
+ * `ctx.fetch` is the action-only outbound-request escape hatch with no host
+ * allowlist, so a URL assembled from request input is a server-side request
+ * forgery vector (cloud metadata endpoints, internal services). A fixed literal
+ * URL, or one built from config/`ctx.*`, is *not* recorded; only an arg-derived
+ * URL reaches here. Produced by the codegen feeder; runtime callers don't supply
+ * it, so the lint finds nothing there.
+ */
+interface AdvisorArgumentDerivedFetch {
+  /** The exported binding name of the action performing the `ctx.fetch` call. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the `ctx.fetch` call, or `0` when unknown. */
+  line: number;
+}
+/**
+ * One public procedure's argument validators reduced to the input-safety facts
+ * the `public_arg_uses_any` and `unbounded_string_arg` lints consume: which args
+ * are declared `v.any()` (unvalidated input) and which `v.string()` args carry no
+ * length bound (a DoS / storage-abuse vector). Produced by the codegen feeder for
+ * public procedures only; internal functions take server-trusted input. Runtime
+ * callers don't supply it, so the lints find nothing there.
+ */
 interface AdvisorArgumentValidator {
   /** Arg names declared as `v.any()`. */
   anyArgs: ReadonlyArray<string>;
@@ -38,10 +101,50 @@ interface AdvisorArgumentValidator {
   unboundedStringArgs: ReadonlyArray<string>;
 }
 /**
-* One `ctx.authApi.&lt;method>(...)` call discovered in a function body — the input
-* the `auth_api_call_without_headers` lint consumes. Produced by the codegen
-* feeder; runtime callers don't supply it, so the lint finds nothing there.
-*/
+ * One `createAuth({...})` call's configuration snapshot — the shared input for
+ * the five `auth_*` security lints (`auth_trusted_origins_wildcard`,
+ * `auth_csrf_check_disabled`, `auth_secure_cookies_disabled`,
+ * `auth_email_verification_disabled`, `auth_session_freshage_zero`).
+ *
+ * The feeder matches the `createAuth` call by callee name and, when its config
+ * argument is a static object literal, reads the handful of nested facts each
+ * lint cares about. An opaque config (a top-level spread, or a non-object-literal
+ * argument) is recorded with `analyzable: false` and every boolean fact left at
+ * its SAFE (not-flagged) value, so a config assembled elsewhere can't be flagged
+ * on a key it may or may not set. Produced by the codegen feeder; runtime
+ * callers don't supply it, so the auth-config lints find nothing there.
+ */
+interface AdvisorAuthConfig {
+  /**
+   * `true` when the call's config argument was a static object literal the
+   * feeder could read. `false` when the config was opaque (a variable, spread,
+   * call result, or missing argument) — every lint below skips such a config.
+   */
+  analyzable: boolean;
+  /** `advanced.disableCSRFCheck === true`. */
+  disableCsrfCheck: boolean;
+  /** `emailAndPassword.enabled === true`. */
+  emailPasswordEnabled: boolean;
+  /** The exported binding name enclosing the `createAuth(...)` call. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the `createAuth(...)` call, or `0` when unknown. */
+  line: number;
+  /** `emailAndPassword.requireEmailVerification === true` present. */
+  requireEmailVerification: boolean;
+  /** `advanced.useSecureCookies === false`. */
+  secureCookiesDisabled: boolean;
+  /** `session.freshAge === 0` (explicit literal). */
+  sessionFreshAgeZero: boolean;
+  /** `trustedOrigins` array literal contains a `"*"` element. */
+  trustedOriginsWildcard: boolean;
+}
+/**
+ * One `ctx.authApi.&lt;method>(...)` call discovered in a function body — the input
+ * the `auth_api_call_without_headers` lint consumes. Produced by the codegen
+ * feeder; runtime callers don't supply it, so the lint finds nothing there.
+ */
 interface AdvisorAuthApiCall {
   /** The exported function performing the call (e.g. `createOrg`). */
   exportName: string;
@@ -55,20 +158,114 @@ interface AdvisorAuthApiCall {
   method: string;
 }
 /**
-* One container declaration discovered in `lunora/containers.ts` — the input
-* the `container_*` lints consume. Produced by the codegen feeder (which lifts
-* the static fields of each `defineContainer({...})` export); runtime callers
-* don't supply it, so the container lints simply find nothing there.
-*
-* A structural subset of codegen's `ContainerIR`, so the feeder can pass the
-* IR array straight through without conversion (mirrors how `AdvisorQueryRead`
-* tracks `QueryReadIR`).
-*/
+ * One `ctx.browser.&lt;method>(url, …)` call whose navigation URL (`arguments[0]`)
+ * is derived from the handler's `args` with no server-side scoping — the input
+ * the `browser_user_url_without_allowlist` lint consumes. `@lunora/browser`
+ * blocks private/internal targets by default, but a request-supplied *public*
+ * URL can still turn the headless browser into an open-proxy / SSRF tool
+ * (fetching arbitrary third-party URLs, DNS-rebinding to internal hosts). A
+ * fixed literal URL, or one scoped by a server-trusted `ctx.*` value, is not
+ * recorded; only an arg-derived, unscoped URL reaches here. Produced by the
+ * codegen feeder; runtime callers don't supply it, so the lint finds nothing
+ * there.
+ */
+interface AdvisorBrowserUrlAccess {
+  /** The exported binding name of the procedure performing the `ctx.browser` call. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the `ctx.browser` call, or `0` when unknown. */
+  line: number;
+  /** The browser method invoked: `content` / `pdf` / `scrape` / `screenshot`. */
+  method: string;
+}
+/**
+ * One factory/constructor call in `lunora/` whose configuration object literal a
+ * security lint inspects for a present-or-absent key — the shared input for the
+ * config-call security lints (payment authorize, inbound-mail verify, rate-limit
+ * store, browser private-targets).
+ *
+ * The feeder records the callee name and, when the config argument is a static
+ * object literal it could read, the set of keys present and the subset assigned
+ * the literal `true`. Produced by the codegen feeder; runtime callers don't
+ * supply it, so the config-call lints find nothing there.
+ */
+interface AdvisorConfigCall {
+  /**
+   * `true` when the call's config argument was a static object literal the
+   * feeder could read. `false` when the config was opaque (a variable, spread,
+   * call result, or missing argument) — key-presence lints skip such calls so
+   * a config assembled elsewhere can't be flagged on a key it may well set.
+   */
+  analyzable: boolean;
+  /** The factory function or constructor name at the call site, e.g. `createPayment` / `RateLimiter`. */
+  callee: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the call site, or `0` when unknown. */
+  line: number;
+  /** Keys present in the config object literal (empty when not `analyzable`). */
+  presentKeys: ReadonlyArray<string>;
+  /** Keys in the config object literal explicitly assigned the literal `true`. */
+  trueKeys: ReadonlyArray<string>;
+}
+/**
+ * One `ctx.containers.&lt;exportName>.get(name, …)` call whose instance key is
+ * derived from the handler's `args` with no server-side scoping — the input
+ * the `container_instance_key_from_user_input` lint consumes. A container
+ * definition's `.get(name)` accessor routes to one instance per `name`, so a
+ * key taken straight from request input lets any caller reach any other
+ * tenant's container (a cross-tenant IDOR). A fixed literal key, or one
+ * derived from a server-trusted identity (`` `${ctx.auth.userId}` `` —
+ * references `ctx`, so treated as scoped), is not recorded; only an
+ * arg-derived, unscoped key reaches here. Produced by the codegen feeder;
+ * runtime callers don't supply it, so the lint finds nothing there.
+ */
+interface AdvisorContainerKeyAccess {
+  /** The exported binding name of the procedure performing the `ctx.containers` access. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the `ctx.containers.*.get` call, or `0` when unknown. */
+  line: number;
+  /** The container accessor method invoked — always `get` (the only per-instance-key sink). */
+  method: string;
+}
+/**
+ * One runtime container-override call: a `&lt;handle>.start({ enableInternet: true, … })`
+ * launch override, or a `&lt;handle>.egress.&lt;method>(...)` runtime firewall mutation
+ * (`allow` / `deny` / `setAllowed`) — the `container_start_enable_internet_override`
+ * and `container_runtime_egress_relaxation` lint input. Both shapes re-open network
+ * access the static `defineContainer` declaration (and its `container_public_internet`
+ * lint) assumes is locked down. Structurally identical to `ContainerOverrideIR`.
+ */
+interface AdvisorContainerOverride {
+  /** e.g. the egress method name, or `"enableInternet: true"`. */
+  detail: string;
+  /** Export binding name of the procedure performing the call. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** Which override shape matched. */
+  kind: "egress_relaxation" | "enable_internet";
+  /** 1-based line of the call, or `0` when unknown. */
+  line: number;
+}
+/**
+ * One container declaration discovered in `lunora/containers.ts` — the input
+ * the `container_*` lints consume. Produced by the codegen feeder (which lifts
+ * the static fields of each `defineContainer({...})` export); runtime callers
+ * don't supply it, so the container lints simply find nothing there.
+ *
+ * A structural subset of codegen's `ContainerIR`, so the feeder can pass the
+ * IR array straight through without conversion (mirrors how `AdvisorQueryRead`
+ * tracks `QueryReadIR`).
+ */
 interface AdvisorContainer {
   /**
-  * Whether outbound internet was explicitly configured. `undefined` means
-  * the field was omitted (platform default `true`) or wasn't a static literal.
-  */
+   * Whether outbound internet was explicitly configured. `undefined` means
+   * the field was omitted (platform default `true`) or wasn't a static literal.
+   */
   enableInternet?: boolean;
   /** The `lunora/containers.ts` export name, e.g. `transcoder`. */
   exportName: string;
@@ -84,19 +281,121 @@ interface AdvisorContainer {
   sleepAfter?: number | string;
 }
 /**
-* One `ctx.sql` access discovered lexically inside a `query(...)` or
-* `mutation(...)` handler body — the input the `hyperdrive_outside_action` lint
-* consumes. Produced by the codegen feeder, which walks each exported function's
-* handler with ts-morph and records reads of the Hyperdrive `ctx.sql` surface
-* (`ctx.sql(...)`, `ctx.sql.query(...)`).
-*
-* Hyperdrive points at an **external** database Lunora does not own: a `ctx.sql`
-* call is a network round-trip with a mutable result (non-deterministic, like
-* `fetch`) and its writes are invisible to Lunora live queries. It therefore
-* belongs **only** in `action(...)` handlers. Calls inside `action(...)` are
-* intentionally **not** recorded — actions are the escape hatch. Runtime callers
-* don't supply this, so the lint finds nothing there.
-*/
+ * One rate-limit / Turnstile middleware call — the `ratelimit_middleware_fail_open`
+ * lint input. `rateLimit`/`dbRateLimit` (`@lunora/ratelimit`) and
+ * `verifyTurnstileMiddleware` (`@lunora/auth`) each accept a `failOpen` escape
+ * hatch that admits every request when the limiter/siteverify is unavailable;
+ * `failOpen` is `true` only when the options literal set it to the boolean
+ * literal `true` (anything else is fail-closed). The lint escalates a fail-open
+ * guard to a finding when the guarded procedure (`exportName`/`limitName`) looks
+ * auth/payment-sensitive. Produced by the codegen feeder; runtime callers don't
+ * supply it, so the lint finds nothing there.
+ */
+interface AdvisorFailOpenGuard {
+  /** The middleware factory at the call site: `rateLimit` / `dbRateLimit` / `verifyTurnstileMiddleware`. */
+  callee: string;
+  /** The exported binding name of the procedure the guard is attached to, or `"&lt;module>"` at file scope. */
+  exportName: string;
+  /** `true` only when the options literal set `failOpen: true` as a boolean literal; a non-literal or absent option is treated as fail-closed. */
+  failOpen: boolean;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** The rate-limit `name` (second string argument) for `rateLimit`/`dbRateLimit`; `""` for `verifyTurnstileMiddleware`. */
+  limitName: string;
+  /** 1-based line of the middleware call, or `0` when unknown. */
+  line: number;
+}
+/**
+ * One `ctx.flags.boolean("key", &lt;boolean-literal>)` read — the
+ * `flag_gates_security_with_unsafe_default` lint input. OpenFeature returns the
+ * `defaultValue` when the provider errors, so a fail-open default on a
+ * security-shaped key (an `enforce`/`rls`/`gate`/`lockdown` protection
+ * defaulting `false`, or an `allow`/`permit`/`bypass` permission defaulting
+ * `true`) silently opens access during an outage. Only reads with a
+ * statically-known string key and boolean-literal default are recorded; the lint
+ * owns the security-shape + polarity judgment. Produced by the codegen feeder;
+ * runtime callers don't supply it, so the lint finds nothing there.
+ */
+interface AdvisorFlagSecurityDefault {
+  /** The boolean-literal default returned on a provider outage (fail-open value). */
+  defaultValue: boolean;
+  /** The exported binding name of the procedure performing the flag read, or `"&lt;module>"` at file scope. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** The flag key — the first string-literal argument of `ctx.flags.boolean`. */
+  key: string;
+  /** 1-based line of the `ctx.flags.boolean` call, or `0` when unknown. */
+  line: number;
+}
+/**
+ * One discovered `httpAction`/`httpRoute` handler that performs a side effect
+ * (`ctx.runMutation` / `ctx.runAction` / a `ctx.db.{insert,patch,replace,delete,
+ * insertManyUnsafe}` write) from the HTTP edge, with whether it reads `ctx.auth`
+ * — the `http_action_missing_auth_guard` lint input. A handler that mutates state
+ * or dispatches an action without ever consulting the request identity is an
+ * unauthenticated write bypassing identity/RLS (distinct from
+ * `admin_route_without_guard`, which covers Studio/admin paths). Only handlers
+ * with a statically-resolvable inline body and `ctx` binding are recorded
+ * (fail-safe under-report); read-only handlers are never recorded. Produced by
+ * the codegen feeder; runtime callers don't supply it, so the lint finds nothing
+ * there.
+ */
+interface AdvisorHttpActionGuard {
+  /** The exported binding name of the handler (or `"&lt;module>"` when mounted inline / not a named binding). */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** Which HTTP surface the handler is: a raw `httpAction` or a typed `httpRoute` route. */
+  kind: "httpAction" | "httpRoute";
+  /** 1-based line of the handler call, or `0` when unknown. */
+  line: number;
+  /** For an `httpRoute`, the uppercased verb (`"POST"`); absent for a raw `httpAction`. */
+  method?: string;
+  /** `true` when the handler reads `ctx.auth` (a direct member access or a `const { auth } = ctx` destructure). */
+  readsAuth: boolean;
+  /** The first side effect found, as a stable label: `runMutation`, `runAction`, or `db.&lt;method>`. */
+  sideEffect: string;
+}
+/**
+ * One response-header write, inside an `httpAction` handler, whose value is derived
+ * from raw request input (`request.headers`, `request.url`/query, `await
+ * request.json()`) with no CR/LF sanitizer — the
+ * `http_action_response_header_injection` lint input. A `Request`-derived string
+ * placed verbatim into a response header lets a caller smuggle `\r\n` and inject
+ * extra headers or split the response. Only request-tainted, unguarded sites are
+ * recorded — a value routed through `isSafeHeaderValue`, `encodeURIComponent`/
+ * `encodeURI`, a numeric coercion, or `btoa` is treated as safe (`String(...)` /
+ * `.toString()` are NOT sanitizers). Produced by the codegen feeder; runtime
+ * callers don't supply it, so the lint finds nothing there. Structurally identical
+ * to `HttpHeaderWriteIR`.
+ */
+interface AdvisorHttpHeaderWrite {
+  /** The exported binding name of the enclosing handler, or `"&lt;module>"` when mounted inline. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** The header name being written (`"location"`), or `""` when the key is not a string literal. */
+  headerName: string;
+  /** 1-based line of the request-tainted header value. */
+  line: number;
+  /** How the header was written. */
+  via: "headers-append" | "headers-ctor" | "headers-set" | "response-init";
+}
+/**
+ * One `ctx.sql` access discovered lexically inside a `query(...)` or
+ * `mutation(...)` handler body — the input the `hyperdrive_outside_action` lint
+ * consumes. Produced by the codegen feeder, which walks each exported function's
+ * handler with ts-morph and records reads of the Hyperdrive `ctx.sql` surface
+ * (`ctx.sql(...)`, `ctx.sql.query(...)`).
+ *
+ * Hyperdrive points at an **external** database Lunora does not own: a `ctx.sql`
+ * call is a network round-trip with a mutable result (non-deterministic, like
+ * `fetch`) and its writes are invisible to Lunora live queries. It therefore
+ * belongs **only** in `action(...)` handlers. Calls inside `action(...)` are
+ * intentionally **not** recorded — actions are the escape hatch. Runtime callers
+ * don't supply this, so the lint finds nothing there.
+ */
 interface AdvisorHyperdriveCall {
   /** The accessed `ctx.sql` surface, e.g. `ctx.sql.query` / `ctx.sql`. */
   callee: string;
@@ -110,29 +409,64 @@ interface AdvisorHyperdriveCall {
   line: number;
 }
 /**
-* Observed read signal over a table — the input the `index_utilization` runtime
-* lint consumes. Produced by the studio backend from each shard's recorded
-* metrics.
-*
-* `AdvisorTableScan` comes straight from the per-`(function, table)` full-scan
-* attribution the runtime already records (`__lunora_metrics_scans`, surfaced as
-* `FunctionCallStat.scannedTables`). Each entry is a table the app read with no
-* index — a hot one points at a missing index.
-*
-* `AdvisorIndexHit` is the per-declared-index hit count. The runtime now records
-* this in the durable `__lunora_metrics_index` table (stamped on every index use
-* via `onIndexUse`) and surfaces it through the `getMetrics` admin RPC; the
-* studio sums the per-shard arrays and feeds them as `context.indexHits`, and the
-* lint flags a declared index with zero recorded reads as dead. When the feed is
-* absent (a static caller, or a shard that recorded nothing) the dead-index half
-* is a no-op and only the hot-scan half runs off the scan attribution.
-*/
-/**
-* Per-table full-scan volume observed over the window — a read that hit no
-* index. Sourced from `FunctionCallStat.scannedTables` aggregated across
-* functions and shards. Runtime callers supply this; static callers don't, so
-* the hot-scan half of the lint finds nothing there.
-*/
+ * One `&lt;receiver>.identity.&lt;key>` claim read (where `&lt;receiver>` is an RLS/mask
+ * policy `auth`, or `ctx.auth`/`context.auth`) — the shared input for the
+ * `identity_undeclared_claim_trusted` lint. `defineIdentity` validates only its
+ * declared claims at the trust boundary and forwards undeclared claims
+ * verbatim, so a read of a claim outside the declared contract trusts an
+ * unvalidated, forgeable value. `declared` records whether `key` is in the
+ * contract (or the always-present `userId`); the lint flags the undeclared reads.
+ * Produced by the codegen feeder — and only when a resolvable `defineIdentity`
+ * contract exists — so runtime callers supply nothing and the lint finds nothing
+ * there.
+ */
+interface AdvisorIdentityClaimRead {
+  /** `true` when `key` is a declared claim (in the `defineIdentity` contract, or the always-present `userId`). */
+  declared: boolean;
+  /** The exported binding name of the enclosing declaration (`&lt;module>` at file scope). */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** The claim key read off the identity bag. */
+  key: string;
+  /** 1-based line of the read, or `0` when unknown. */
+  line: number;
+}
+/**
+ * One `buildImageDeliveryUrl({ key, … })` call (`@lunora/bindings/images`) whose
+ * `key` — the CDN transform's source image, an absolute URL or an
+ * origin-relative key — is derived from the handler's `args` with no
+ * server-side scoping — the `images_url_source_from_user_input` lint input.
+ */
+interface AdvisorImageDeliveryUrlAccess {
+  exportName: string;
+  file: string;
+  line: number;
+}
+/**
+ * Observed read signal over a table — the input the `index_utilization` runtime
+ * lint consumes. Produced by the studio backend from each shard's recorded
+ * metrics.
+ *
+ * `AdvisorTableScan` comes straight from the per-`(function, table)` full-scan
+ * attribution the runtime already records (`__lunora_metrics_scans`, surfaced as
+ * `FunctionCallStat.scannedTables`). Each entry is a table the app read with no
+ * index — a hot one points at a missing index.
+ *
+ * `AdvisorIndexHit` is the per-declared-index hit count. The runtime now records
+ * this in the durable `__lunora_metrics_index` table (stamped on every index use
+ * via `onIndexUse`) and surfaces it through the `getMetrics` admin RPC; the
+ * studio sums the per-shard arrays and feeds them as `context.indexHits`, and the
+ * lint flags a declared index with zero recorded reads as dead. When the feed is
+ * absent (a static caller, or a shard that recorded nothing) the dead-index half
+ * is a no-op and only the hot-scan half runs off the scan attribution.
+ */
+/**
+ * Per-table full-scan volume observed over the window — a read that hit no
+ * index. Sourced from `FunctionCallStat.scannedTables` aggregated across
+ * functions and shards. Runtime callers supply this; static callers don't, so
+ * the hot-scan half of the lint finds nothing there.
+ */
 interface AdvisorTableScan {
   /** Total full-scans of `table` over the observed window. */
   scans: number;
@@ -140,17 +474,17 @@ interface AdvisorTableScan {
   table: string;
 }
 /**
-* Per-declared-index hit count observed over the window — how many recorded
-* reads used the index to narrow.
-*
-* Produced by the runtime: every index use (`onIndexUse` in the DO) bumps a
-* per-`(table, index)` counter in the durable `__lunora_metrics_index` table, the
-* complement of the full-*scan* attribution in `__lunora_metrics_scans`. The
-* `getMetrics` admin RPC surfaces it per shard; the studio sums the arrays across
-* shards and passes them as `context.indexHits`. A declared index that appears
-* with `reads: 0` (or is absent entirely after the schema reconciliation) is dead
-* for the window.
-*/
+ * Per-declared-index hit count observed over the window — how many recorded
+ * reads used the index to narrow.
+ *
+ * Produced by the runtime: every index use (`onIndexUse` in the DO) bumps a
+ * per-`(table, index)` counter in the durable `__lunora_metrics_index` table, the
+ * complement of the full-*scan* attribution in `__lunora_metrics_scans`. The
+ * `getMetrics` admin RPC surfaces it per shard; the studio sums the arrays across
+ * shards and passes them as `context.indexHits`. A declared index that appears
+ * with `reads: 0` (or is absent entirely after the schema reconciliation) is dead
+ * for the window.
+ */
 interface AdvisorIndexHit {
   /** The declared index name. */
   index: string;
@@ -160,12 +494,12 @@ interface AdvisorIndexHit {
   table: string;
 }
 /**
-* One `ctx.db.insert("table", …)` write discovered in a function body — the
-* write-side analog of `AdvisorQueryRead`, the input the
-* `table_without_insert` lint consumes. Produced by the codegen feeder (which
-* attributes each insert to the exported function performing it); runtime callers
-* don't supply it, so the lint simply finds nothing there.
-*/
+ * One `ctx.db.insert("table", …)` write discovered in a function body — the
+ * write-side analog of `AdvisorQueryRead`, the input the
+ * `table_without_insert` lint consumes. Produced by the codegen feeder (which
+ * attributes each insert to the exported function performing it); runtime callers
+ * don't supply it, so the lint simply finds nothing there.
+ */
 interface AdvisorInsertWrite {
   /** The exported function performing the insert (e.g. `send`). */
   exportName: string;
@@ -177,24 +511,67 @@ interface AdvisorInsertWrite {
   table: string;
 }
 /**
-* One procedure (query / mutation / action) discovered in the lunora source,
-* reduced to the facts the `mask_uncovered_pii_column` lint needs: whether the
-* procedure's builder chain includes `.use(mask(...))`, which `(table, column)`
-* pairs that mask declares, and which tables the procedure reads or writes.
-* Produced by the codegen feeder; runtime callers don't supply it, so the lint
-* finds nothing there. The column-level twin of `AdvisorRlsProcedure`.
-*/
+ * One `ctx.kv.&lt;method>(key, …)` call whose namespace key is derived from the
+ * handler's `args` with no server-side scoping — the input the
+ * `kv_unscoped_user_key_idor` lint consumes. Workers KV is a single flat
+ * namespace, so a key taken straight from request input lets any caller read,
+ * overwrite, or delete another user's entry (an insecure direct object
+ * reference). A fixed literal key, or one prefixed with a server-trusted identity
+ * (`` `${ctx.auth.userId}:…` `` — references `ctx`, so treated as scoped), is not
+ * recorded; only an arg-derived, unscoped key reaches here. Produced by the
+ * codegen feeder; runtime callers don't supply it, so the lint finds nothing
+ * there.
+ */
+interface AdvisorKvKeyAccess {
+  /** The exported binding name of the procedure performing the `ctx.kv` access. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the `ctx.kv` call, or `0` when unknown. */
+  line: number;
+  /** The `ctx.kv` method invoked: `get` / `getRaw` / `getWithMetadata` / `put` / `delete`. */
+  method: string;
+}
+/**
+ * One `ctx.mail`/`ctx.email` `send`/`queue` call whose recipient field
+ * (`to`/`cc`/`bcc`) is derived from the handler's `args` with no server-side
+ * scoping — the input the `mail_recipient_from_request_input` lint consumes. A
+ * recipient taken straight from request input turns the deployment into an
+ * open relay / spam amplifier: any caller can direct mail to an arbitrary
+ * address. A fixed literal recipient, or one scoped by a server-trusted
+ * `ctx.*` value (e.g. `ctx.auth.user.email`), is not recorded; only an
+ * arg-derived, unscoped recipient reaches here. Produced by the codegen
+ * feeder; runtime callers don't supply it, so the lint finds nothing there.
+ */
+interface AdvisorMailRecipientAccess {
+  /** The exported binding name of the procedure performing the `ctx.mail`/`ctx.email` call. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the `ctx.mail`/`ctx.email` call, or `0` when unknown. */
+  line: number;
+  /** The mailer method invoked: `send` / `queue`. */
+  method: string;
+}
+/**
+ * One procedure (query / mutation / action) discovered in the lunora source,
+ * reduced to the facts the `mask_uncovered_pii_column` lint needs: whether the
+ * procedure's builder chain includes `.use(mask(...))`, which `(table, column)`
+ * pairs that mask declares, and which tables the procedure reads or writes.
+ * Produced by the codegen feeder; runtime callers don't supply it, so the lint
+ * finds nothing there. The column-level twin of `AdvisorRlsProcedure`.
+ */
 interface AdvisorMaskProcedure {
   /** The exported binding name of the procedure (e.g. `listUsers`). */
   exportName: string;
   /** Source file relative to the lunora dir, no extension. */
   file: string;
   /**
-  * The `(table, column)` pairs declared by the `mask(policies)` object passed
-  * to `.use(mask(...))` in this procedure's builder chain. Empty when the
-  * policies argument is not a statically-readable object literal
-  * (conservative: `usesMask` is still `true`).
-  */
+   * The `(table, column)` pairs declared by the `mask(policies)` object passed
+   * to `.use(mask(...))` in this procedure's builder chain. Empty when the
+   * policies argument is not a statically-readable object literal
+   * (conservative: `usesMask` is still `true`).
+   */
   maskColumns: ReadonlyArray<{
     column: string;
     table: string;
@@ -204,25 +581,71 @@ interface AdvisorMaskProcedure {
   /** Tables written by the procedure via `ctx.db.insert("table", …)` / `ctx.db.patch(...)` etc. */
   tablesWritten: ReadonlyArray<string>;
   /**
-  * `true` when the procedure's builder chain includes `.use(mask(...))` — the
-  * `mask` callee is identified by name from `@lunora/server`. `false` when no
-  * `.use(mask(...))` is found in the chain (or the procedure uses the bare
-  * `query({...})` factory form, which never carries a builder chain at all).
-  */
+   * `true` when the procedure's builder chain includes `.use(mask(...))` — the
+   * `mask` callee is identified by name from `@lunora/server`. `false` when no
+   * `.use(mask(...))` is found in the chain (or the procedure uses the bare
+   * `query({...})` factory form, which never carries a builder chain at all).
+   */
   usesMask: boolean;
   /** `"internal"` when the procedure uses `internalQuery` / `internalMutation` / `internalAction`. */
   visibility: "internal" | "public";
 }
 /**
-* One non-deterministic API call discovered lexically inside a `query(...)` or
-* `mutation(...)` handler body — the input the `nondeterministic_query_mutation`
-* lint consumes. Produced by the codegen feeder, which walks each exported
-* function's handler with ts-morph and records calls to `Date.now`,
-* `Math.random`, `crypto.randomUUID`, `crypto.getRandomValues`, and `fetch`.
-* Calls inside `action(...)` handlers are intentionally **not** recorded — actions
-* are the determinism escape hatch. Runtime callers don't supply this, so the
-* lint finds nothing there.
-*/
+ * One masked column whose `mask(policies)` strategy is a statically-known
+ * literal (`"hash"` or `"redact"`) — the `mask_weak_hash_strategy_on_pii` lint
+ * input. Unlike `AdvisorMaskProcedure` (one row per procedure, `maskColumns`
+ * without a strategy), this is one row per masked column with its strategy
+ * literal attached, so the lint can flag `"hash"` applied to a PII-named
+ * column. A `MaskFn` (custom, non-literal) strategy carries no lint-relevant
+ * signal and is never recorded here. Produced by the codegen feeder; runtime
+ * callers don't supply it, so the lint finds nothing there.
+ */
+interface AdvisorMaskStrategy {
+  /** Masked column name. */
+  column: string;
+  /** The exported binding name of the procedure whose `.use(mask(...))` chain declared this column, or `"&lt;module>"` when declared at file scope. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the masked column's strategy property. */
+  line: number;
+  /** The statically-known strategy literal: `"hash"` or `"redact"`. */
+  strategy: string;
+  /** Logical table the masked column belongs to. */
+  table: string;
+}
+/**
+ * One whole-row `ctx.db.replace(id, document)` write discovered inside a custom
+ * mutator's authoritative `server` impl (`lunora/mutators.ts`) — the input the
+ * `mutator_full_row_replace` lint consumes.
+ *
+ * In the local-first sync engine a `replace` overwrites the entire row, so a
+ * concurrent edit to a *different* column (committed between this mutator's read
+ * and its write) is silently clobbered. `patch(id, { onlyTheField })` merges at
+ * the column level instead, letting independent field edits coexist — the
+ * blessed pattern for mutators on a synced (poke-live) table. Produced by the
+ * codegen feeder, which attributes each `replace` to the mutator export
+ * performing it; runtime callers don't supply it, so the lint finds nothing
+ * there.
+ */
+interface AdvisorMutatorWrite {
+  /** The mutator export whose `server` impl performs the replace (e.g. `renameChannel`). */
+  exportName: string;
+  /** Openable source path the replace appears in — always `lunora/mutators.ts`. */
+  file: string;
+  /** 1-based line of the `replace(...)` call, or `0` when unknown. */
+  line: number;
+}
+/**
+ * One non-deterministic API call discovered lexically inside a `query(...)` or
+ * `mutation(...)` handler body — the input the `nondeterministic_query_mutation`
+ * lint consumes. Produced by the codegen feeder, which walks each exported
+ * function's handler with ts-morph and records calls to `Date.now`,
+ * `Math.random`, `crypto.randomUUID`, `crypto.getRandomValues`, and `fetch`.
+ * Calls inside `action(...)` handlers are intentionally **not** recorded — actions
+ * are the determinism escape hatch. Runtime callers don't supply this, so the
+ * lint finds nothing there.
+ */
 interface AdvisorNondeterministicCall {
   /** The non-deterministic API invoked, e.g. `Date.now` / `Math.random` / `crypto.randomUUID` / `fetch`. */
   callee: string;
@@ -236,25 +659,135 @@ interface AdvisorNondeterministicCall {
   line: number;
 }
 /**
-* One procedure (query / mutation / action) reduced to the protective middlewares
-* its builder chain installs plus the behavioural facts that decide whether a
-* guard is expected — the input the `public_mutation_without_ratelimit` and
-* `user_creating_mutation_without_captcha` lints consume. A `protectPublic({...})`
-* bundle is unwrapped by the feeder: its keys set `usesRateLimit`/`usesCaptcha`
-* exactly as the standalone `.use(...)` steps would. Produced by the codegen
-* feeder; runtime callers don't supply it, so the lints find nothing there.
-*/
+ * One `query`/`mutation` handler that gates a `ctx.db.get`/`patch`/`delete` on a
+ * null-checked `ctx.db.normalizeId(table, id)` result — the shared input for the
+ * `normalize_id_used_as_authorization` lint. `normalizeId` validates an id's
+ * structural shape only (it never reads the database), so a non-null result proves
+ * the id is well-formed, never that the caller owns the row; gating access on it is
+ * an IDOR. The lint keeps only public procedures with no `.use(rls(...))` and no
+ * ownership/identity mention (`mentionsOwnership`), then joins `table` against the
+ * schema's RLS mode before flagging. Produced by the codegen feeder; runtime callers
+ * don't supply it, so the lint finds nothing there. Structurally identical to
+ * `@lunora/codegen`'s `NormalizeIdAuthorizationIR`.
+ */
+interface AdvisorNormalizeIdAuthorization {
+  /** The exported binding name of the procedure performing the normalize-then-access. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the `ctx.db.normalizeId(...)` call the access is gated on. */
+  line: number;
+  /** `true` when the handler anywhere reads an ownership-named identifier or `ctx.auth`/`ctx.identity`/… — an intervening ownership signal. */
+  mentionsOwnership: boolean;
+  /** The id-first `ctx.db` sink the normalized id reaches. */
+  sinkMethod: "delete" | "get" | "patch";
+  /** Table named in the `normalizeId` call, or `""` when its table argument wasn't a string literal. */
+  table: string;
+  /** `true` when the procedure's builder chain carries a `.use(rls(...))` step. */
+  usesRls: boolean;
+  /** `"internal"` for `internalQuery`/`internalMutation`; `"public"` for `query`/`mutation`. */
+  visibility: "internal" | "public";
+}
+/**
+ * One `ctx.db` write (`insert` / `replace` / `patch` / `insertManyUnsafe`) that
+ * sets an ownership / identity column — `userId`, `ownerId`, `tenantId`, and the
+ * like — from the handler's `args` instead of the server-trusted identity. This
+ * is the `owner_field_from_args_not_auth` lint input: the ownership column decides
+ * who a row belongs to, so a value taken from request input lets any caller write
+ * rows owned by another user or tenant (the act-as-any-user / cross-tenant IDOR
+ * vector). A column stamped from `ctx.auth` / `ctx.identity`, or set to a fixed
+ * literal, is *not* recorded; only an arg-derived identity write reaches here.
+ * Produced by the codegen feeder; runtime callers don't supply it, so the lint
+ * finds nothing there. Structurally identical to `OwnerFieldWriteIR`.
+ */
+interface AdvisorOwnerFieldWrite {
+  /** The exported binding name of the procedure performing the write. */
+  exportName: string;
+  /** The identity column being written from `args` (e.g. `userId`). */
+  field: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the `ctx.db` write call, or `0` when unknown. */
+  line: number;
+  /** The `ctx.db` write method (`insert` / `replace` / `patch` / `insertManyUnsafe`). */
+  method: string;
+}
+/**
+ * One payment webhook-adapter construction (`createStripeAdapter` /
+ * `createPolarAdapter` / `createAutumnAdapter` / `createDodoPaymentsAdapter`) —
+ * the shared input for the `payment_webhook_wide_tolerance` lint. The adapters
+ * verify a webhook's signed timestamp against a `webhookToleranceSeconds` replay
+ * window (default 300s); an implausibly wide window leaves the endpoint accepting
+ * stale, replayable signed payloads long after capture. `toleranceSeconds`
+ * carries the statically-known literal (when present and a plain numeric
+ * literal); the lint fires only above a conservative ceiling. Produced by the
+ * codegen feeder; runtime callers don't supply it, so the lint finds nothing
+ * there.
+ */
+interface AdvisorPaymentWebhook {
+  /** The adapter factory invoked. */
+  callee: "createAutumnAdapter" | "createDodoPaymentsAdapter" | "createPolarAdapter" | "createStripeAdapter";
+  /** The exported binding name of the enclosing declaration (`&lt;module>` at file scope). */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the construction, or `0` when unknown. */
+  line: number;
+  /** Statically-known `webhookToleranceSeconds` literal, when present and a plain numeric literal. */
+  toleranceSeconds?: number;
+}
+/**
+ * One payload-derived privileged dispatch — a `ctx.run`/`context.run` back into a
+ * Lunora function from inside a `defineQueue` push handler or a `defineWorkflow`
+ * handler, whose args reference the handler's untrusted payload (`context.params`
+ * for a workflow, a `for (… of batch.messages)` body for a queue) — the input the
+ * `privileged_dispatch_unvalidated_payload` lint consumes. Both handler kinds run
+ * under the **system identity** (RLS disabled), so forwarding attacker-influenced
+ * payload into the dispatch skips the target's row policy. The lint joins the
+ * resolved `targetFile`/`targetExport` against the RLS-procedure evidence and
+ * fires only when the target enforces RLS. Produced by the codegen feeder;
+ * runtime callers don't supply it, so the lint finds nothing there.
+ */
+interface AdvisorPrivilegedDispatch {
+  /** `"queue"` for a `defineQueue` handler, `"workflow"` for a `defineWorkflow` handler. */
+  dispatchKind: "queue" | "workflow";
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** The exported handler binding performing the dispatch. */
+  handlerExport: string;
+  /** 1-based line of the dispatch call, or `0` when unknown. */
+  line: number;
+  /** Export name of the dispatched target (`send` in `api.messages.send`). */
+  targetExport: string;
+  /** File path of the dispatched target relative to the lunora dir (`messages` in `api.messages.send`). */
+  targetFile: string;
+}
+/**
+ * One procedure (query / mutation / action) reduced to the protective middlewares
+ * its builder chain installs plus the behavioural facts that decide whether a
+ * guard is expected — the input the `public_mutation_without_ratelimit` and
+ * `user_creating_mutation_without_captcha` lints consume. A `protectPublic({...})`
+ * bundle is unwrapped by the feeder: its keys set `usesRateLimit`/`usesCaptcha`
+ * exactly as the standalone `.use(...)` steps would. Produced by the codegen
+ * feeder; runtime callers don't supply it, so the lints find nothing there.
+ */
 interface AdvisorProcedureProtection {
   /** `true` when the handler references `ctx.mail` / `ctx.email` (sends mail). */
   callsMail: boolean;
   /** The exported binding name of the procedure (e.g. `signUp`). */
   exportName: string;
+  /** `true` when the handler fans work out to a privileged, cost-bearing dispatch surface (scheduler `runAfter`/`runAt`, a queue producer send, or a workflow create). Read by the privileged-fanout lint, paired with public visibility and no rate limit. */
+  fanOut: boolean;
   /** Source file relative to the lunora dir, no extension. */
   file: string;
   /** Registration kind — `query` is read-only; `mutation`/`action` are write-shaped. */
   kind: "action" | "mutation" | "query";
+  /** `true` when the handler runs an AI generation (`generateText`/`streamText`/`generateObject`/`streamObject`) with no `maxOutputTokens` bound. Read by the `ai_unbounded_generation_public` lint (paired with public visibility). */
+  unboundedAiGeneration: boolean;
   /** `true` when the chain carries `.use(verifyTurnstile(...))` or a `protectPublic({ captcha })` bundle. */
   usesCaptcha: boolean;
+  /** `true` when the handler calls `ctx.db.insertManyUnsafe(...)`, which bypasses validators and triggers. Read by the `insert_many_unsafe_user_data` lint (paired with public visibility). */
+  usesInsertManyUnsafe: boolean;
   /** `true` when the chain carries `.use(mask(...))`. */
   usesMask: boolean;
   /** `true` when the chain carries `.use(rateLimit(...))` or a `protectPublic({ rateLimit })` bundle. */
@@ -267,11 +800,11 @@ interface AdvisorProcedureProtection {
   writesUserTable: boolean;
 }
 /**
-* One query read discovered in a function body — the input the
-* `filter_without_index` lint consumes. Produced by the codegen feeder (which
-* parses `ctx.db.query("table")…` chains from the AST); runtime callers don't
-* supply it, so the lint simply finds nothing there.
-*/
+ * One query read discovered in a function body — the input the
+ * `filter_without_index` lint consumes. Produced by the codegen feeder (which
+ * parses `ctx.db.query("table")…` chains from the AST); runtime callers don't
+ * supply it, so the lint simply finds nothing there.
+ */
 interface AdvisorQueryRead {
   /** Source file the read appears in (relative to the lunora dir, no extension). */
   file: string;
@@ -285,20 +818,59 @@ interface AdvisorQueryRead {
   table: string;
 }
 /**
-* One `ctx.r2sql` access discovered lexically inside a `query(...)` or
-* `mutation(...)` handler body — the input the `r2sql_outside_action` lint
-* consumes. Produced by the codegen feeder, which walks each exported function's
-* handler with ts-morph and records reads of the R2 SQL `ctx.r2sql` surface
-* (`ctx.r2sql.query(...)`, `ctx.r2sql.from(...)`, …).
-*
-* R2 SQL queries Apache Iceberg tables over an **external** REST endpoint Lunora
-* does not own (there is no Workers binding): a `ctx.r2sql` call is a network
-* round-trip with a mutable result (non-deterministic, like `fetch`) and its
-* reads are invisible to Lunora live queries. It therefore belongs **only** in
-* `action(...)` handlers. Calls inside `action(...)` are intentionally **not**
-* recorded — actions are the escape hatch. Runtime callers don't supply this, so
-* the lint finds nothing there.
-*/
+ * The queue-shaped input the `queue_*` lints consume, produced by the codegen
+ * feeder — one per `defineQueue` export in `lunora/queues.ts`. Runtime callers
+ * don't supply it, so the queue lints simply find nothing there.
+ *
+ * A structural subset of codegen's `QueueIR`, so the feeder passes the IR array
+ * straight through without conversion (mirrors how `AdvisorWorkflow` tracks
+ * `WorkflowIR` and `AdvisorContainer` tracks `ContainerIR`).
+ */
+/**
+ * The push-consumer batch/retry tuning a queue lint inspects — the subset of
+ * `QueueIR["tuning"]` mirrored onto the wrangler `queues.consumers[]` entry.
+ */
+interface AdvisorQueueTuning {
+  /**
+   * The wrangler name of the dead-letter queue exhausted messages are routed
+   * to. `undefined` when none is declared — a message that exhausts its
+   * retries is then dropped and permanently lost.
+   */
+  deadLetterQueue?: string;
+  /** Max delivery retries before a message is dead-lettered/dropped (Cloudflare default 3). */
+  maxRetries?: number;
+}
+/** One queue declared via a `defineQueue()` export in `lunora/queues.ts`. */
+interface AdvisorQueue {
+  /** The `lunora/queues.ts` export name, e.g. `notifications`. */
+  exportName: string;
+  /** How the queue is consumed: `"push"` (a worker `queue()` handler) or `"pull"` (external HTTP). */
+  mode: "pull" | "push";
+  /**
+   * The stable wrangler queue name (kebab-cased export name unless a `name:`
+   * literal overrides it). Used to recognise a queue that is itself another
+   * queue's `deadLetterQueue` target — a terminal sink that must not be
+   * flagged for lacking its own DLQ.
+   */
+  name: string;
+  /** Push-consumer batch/retry tuning; the `deadLetterQueue`/`maxRetries` the queue lints read. */
+  tuning: AdvisorQueueTuning;
+}
+/**
+ * One `ctx.r2sql` access discovered lexically inside a `query(...)` or
+ * `mutation(...)` handler body — the input the `r2sql_outside_action` lint
+ * consumes. Produced by the codegen feeder, which walks each exported function's
+ * handler with ts-morph and records reads of the R2 SQL `ctx.r2sql` surface
+ * (`ctx.r2sql.query(...)`, `ctx.r2sql.from(...)`, …).
+ *
+ * R2 SQL queries Apache Iceberg tables over an **external** REST endpoint Lunora
+ * does not own (there is no Workers binding): a `ctx.r2sql` call is a network
+ * round-trip with a mutable result (non-deterministic, like `fetch`) and its
+ * reads are invisible to Lunora live queries. It therefore belongs **only** in
+ * `action(...)` handlers. Calls inside `action(...)` are intentionally **not**
+ * recorded — actions are the escape hatch. Runtime callers don't supply this, so
+ * the lint finds nothing there.
+ */
 interface AdvisorR2sqlCall {
   /** The accessed `ctx.r2sql` surface, e.g. `ctx.r2sql.query` / `ctx.r2sql.from`. */
   callee: string;
@@ -312,99 +884,227 @@ interface AdvisorR2sqlCall {
   line: number;
 }
 /**
-* One procedure (query / mutation / action) discovered in the lunora source,
-* reduced to the facts the `rls_uncovered_table` lint needs: whether the
-* procedure's builder chain includes `.use(rls(...))`, and which tables the
-* procedure reads or writes. Produced by the codegen feeder; runtime callers
-* don't supply it, so the lint finds nothing there.
-*/
+ * One `rateLimit`/`dbRateLimit` middleware call (`@lunora/ratelimit`) whose
+ * `key` selector is derived from the handler's `args` with no server-side
+ * scoping — the `ratelimit_key_spoofable_or_global` lint input.
+ */
+interface AdvisorRatelimitKeySelector {
+  callee: string;
+  exportName: string;
+  file: string;
+  limitName: string;
+  line: number;
+}
+/**
+ * One `query` handler whose `return` hands back the raw rows of a table — the
+ * result of a `ctx.db.&lt;table>.findMany()` / `.findFirst()` / `.get()` read, or a
+ * `ctx.db.query("&lt;table>")…collect()` fluent chain — returned directly (or through
+ * one local `const` hop) with no hand-built projection. The shared input for the
+ * `output_projection_missing_on_public_read` lint, which keeps only `visibility
+ * === "public"` rows with no `.output(...)` / `.use(mask(...))` on the chain and
+ * joins `table` against the schema's PII-named columns before flagging. Produced by
+ * the codegen feeder; runtime callers don't supply it, so the lint finds nothing
+ * there. Structurally identical to `@lunora/codegen`'s `RawRowReturnIR`.
+ */
+interface AdvisorRawRowReturn {
+  /** The exported binding name of the query returning the raw rows. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the `return` (or concise-body) expression. */
+  line: number;
+  /** Table whose raw rows are returned, or `""` when the read's table couldn't be statically resolved. */
+  table: string;
+  /** `true` when the procedure's builder chain carries a `.use(mask(...))` step. */
+  usesMask: boolean;
+  /** `true` when the procedure's builder chain carries an `.output(...)` return-shape projection. */
+  usesOutput: boolean;
+  /** `"internal"` for `internalQuery`; `"public"` for `query`. */
+  visibility: "internal" | "public";
+}
+/**
+ * One `ctx.db.&lt;table>.findMany({ with: { &lt;rel> } })` relation-hydrating list read
+ * — the shared input for the `masked_relation_leak_via_with` lint. Column
+ * masking is applied per-procedure to the top-level rows of the table named in
+ * the read; it does **not** descend into `with`-hydrated relations, so a masked
+ * table surfaced only through a `with` on an unprotected parent read is returned
+ * in the clear. The lint resolves each relation accessor to its target table and
+ * joins it against the discovered mask evidence before flagging. Produced by the
+ * codegen feeder; runtime callers don't supply it, so the lint finds nothing
+ * there. Structurally identical to `@lunora/codegen`'s `RelationLoadIR`.
+ */
+interface AdvisorRelationLoad {
+  /** The exported binding name of the procedure performing the read. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the read call. */
+  line: number;
+  /** Parent table the read targets, or `""` when it couldn't be statically resolved. */
+  parentTable: string;
+  /** Relation accessor names named in the read's `with: { … }` map — matched against the parent table's declared relations. */
+  relations: ReadonlyArray<string>;
+  /** `"internal"` for `internalQuery` / `internalMutation` / `internalAction`. */
+  visibility: "internal" | "public";
+}
+/**
+ * One procedure (query / mutation / action) discovered in the lunora source,
+ * reduced to the facts the `rls_uncovered_table` lint needs: whether the
+ * procedure's builder chain includes `.use(rls(...))`, and which tables the
+ * procedure reads or writes. Produced by the codegen feeder; runtime callers
+ * don't supply it, so the lint finds nothing there.
+ */
 interface AdvisorRlsProcedure {
   /** The exported binding name of the procedure (e.g. `listDocuments`). */
   exportName: string;
   /** Source file relative to the lunora dir, no extension. */
   file: string;
   /**
-  * Tables explicitly named in the `rls(policies)` array passed to `.use(rls(...))`
-  * in this procedure's builder chain. Empty when the policies argument is not a
-  * statically-readable array literal (conservative: `usesRls` is still `true`).
-  */
+   * Tables explicitly named in the `rls(policies)` array passed to `.use(rls(...))`
+   * in this procedure's builder chain. Empty when the policies argument is not a
+   * statically-readable array literal (conservative: `usesRls` is still `true`).
+   */
   rlsTables: ReadonlyArray<string>;
   /** Tables read by the procedure via `ctx.db.query("table")` / `ctx.db.findMany(...)` etc. */
   tablesRead: ReadonlyArray<string>;
   /** Tables written by the procedure via `ctx.db.insert("table", …)` / `ctx.db.patch(...)` etc. */
   tablesWritten: ReadonlyArray<string>;
   /**
-  * `true` when the procedure's builder chain includes `.use(rls(...))` — the
-  * `rls` callee is identified by name from `@lunora/server`. `false` when no
-  * `.use(rls(...))` is found in the chain (or the procedure uses the bare
-  * `query({...})` factory form, which never carries a builder chain at all).
-  */
+   * `true` when the procedure's builder chain includes `.use(rls(...))` — the
+   * `rls` callee is identified by name from `@lunora/server`. `false` when no
+   * `.use(rls(...))` is found in the chain (or the procedure uses the bare
+   * `query({...})` factory form, which never carries a builder chain at all).
+   */
   usesRls: boolean;
   /** `"internal"` when the procedure uses `internalQuery` / `internalMutation` / `internalAction`. */
   visibility: "internal" | "public";
 }
 /**
-* Normalized, feeder-agnostic view of a schema that lints run against. Both the
-* runtime `@lunora/server` {@link Schema} (record-shaped) and `@lunora/codegen`'s
-* `SchemaIR` (array-shaped, AST-derived) collapse to this same shape, so a lint
-* is written once and runs in either place. It carries only what the lints
-* read — tables, their columns, indexes, and relations.
-*/
+ * Normalized, feeder-agnostic view of a schema that lints run against. Both the
+ * runtime `@lunora/server` {@link Schema} (record-shaped) and `@lunora/codegen`'s
+ * `SchemaIR` (array-shaped, AST-derived) collapse to this same shape, so a lint
+ * is written once and runs in either place. It carries only what the lints
+ * read — tables, their columns, indexes, and relations.
+ */
 interface AdvisorSchema {
+  /**
+   * Set when the schema opted into `.rls("required")` — every table's `ctx.db`
+   * write path is denied without an RLS-covering procedure UNLESS the table
+   * itself is `.public()` (see {@link AdvisorTable.isPublic}). `undefined` when
+   * the schema never called `.rls("required")`. Read by the
+   * `public_table_rls_optout_confusion` and `allow_unauthenticated_shard_access_enabled`
+   * lints.
+   */
+  rlsMode?: "required";
   tables: ReadonlyArray<AdvisorTable>;
 }
 /** A table plus the column/index/relation metadata lints inspect. */
 interface AdvisorTable {
   /**
-  * `true` when the table is written outside Lunora's discoverable insert path
-  * — declared via `.externallyManaged()` (e.g. `@lunora/auth`'s better-auth
-  * tables, `@lunora/ratelimit`'s store). Insert-path lints
-  * (`table_without_insert`) skip such tables. Defaults to `false`.
-  */
+   * `true` when the table is written outside Lunora's discoverable insert path
+   * — declared via `.externallyManaged()` (e.g. `@lunora/auth`'s better-auth
+   * tables, `@lunora/ratelimit`'s store). Insert-path lints
+   * (`table_without_insert`) skip such tables. Defaults to `false`.
+   */
   externallyManaged?: boolean;
   /**
-  * Declared column names (the `defineTable({...})` keys). Excludes the
-  * framework-managed system fields `_id` / `_creationTime`, which every table
-  * has implicitly — lints that resolve a column treat those as always valid.
-  */
+   * Set when the table was declared with `.source(...)` (plan 077) —
+   * materialized from an external Hyperdrive-backed database. Read by the
+   * `external_source_*` lints to enforce the tenant-scope boundary (mandatory
+   * `tenantBy` under `.shardBy()`) and reject sourcing a `.global()` table.
+   * Optional — feeders that don't know about sourced tables omit it.
+   */
+  externalSource?: AdvisorExternalSource;
+  /**
+   * Declared column names (the `defineTable({...})` keys). Excludes the
+   * framework-managed system fields `_id` / `_creationTime`, which every table
+   * has implicitly — lints that resolve a column treat those as always valid.
+   */
   fields: ReadonlyArray<string>;
   /** Every declared index, across all kinds (secondary / search / rank / vector). */
   indexes: ReadonlyArray<AdvisorIndex>;
+  /**
+   * `true` when the table was declared with `.public()` — an explicit opt-OUT
+   * of the schema's `.rls("required")` enforcement for this one table (the
+   * name is misleading: it means "unprotected by RLS", not "safe to read
+   * publicly"). Has no effect when the schema itself never required RLS.
+   * Defaults to `false`. Read by `public_table_rls_optout_confusion` and
+   * `allow_unauthenticated_shard_access_enabled`.
+   */
+  isPublic?: boolean;
   /** Table name. */
   name: string;
   /**
-  * Column names that are optional or nullable and therefore may legally hold
-  * `null` / `undefined` in stored rows. Populated by {@link fromServerSchema}
-  * from the runtime validator graph (`v.optional(...)` → kind `"optional"`;
-  * `.nullable()` → `column.notNull === false`). When absent (e.g. from the
-  * codegen feeder, which does not supply this field), constraint lints that
-  * check NOT NULL should skip the check entirely or treat every field as
-  * required (the codegen feeder never runs runtime lints anyway).
-  */
+   * Column names that are optional or nullable and therefore may legally hold
+   * `null` / `undefined` in stored rows. Populated by {@link fromServerSchema}
+   * from the runtime validator graph (`v.optional(...)` → kind `"optional"`;
+   * `.nullable()` → `column.notNull === false`). When absent (e.g. from the
+   * codegen feeder, which does not supply this field), constraint lints that
+   * check NOT NULL should skip the check entirely or treat every field as
+   * required (the codegen feeder never runs runtime lints anyway).
+   */
   optionalFields?: ReadonlySet<string>;
   /** Declared relations (`.relations((r) => …)`). */
   relations: ReadonlyArray<AdvisorRelation>;
+  /**
+   * Storage tier the table is declared in: `"global"` (a `.global()` table,
+   * lives in D1 — the cross-shard tier), `"shardBy"` (partitioned across
+   * shard DOs by a key), or `"root"` (the default single-DO table). Read by
+   * the `shape_*` lints to flag replication shapes targeting a `.global()`
+   * table (poll-refreshed/latency-tiered, not poke-live). Optional — the
+   * codegen feeder always supplies it, the runtime feeder derives it; a feeder
+   * that omits it leaves tier-sensitive lints to treat the table as local.
+   */
+  shardKind?: "global" | "root" | "shardBy";
+  /**
+   * Set when the table opted into `.softDelete()` — the marker column
+   * (`field`, default `deletedAt`) whose presence excludes a row from list
+   * reads unless `includeDeleted: true` is passed. Read by
+   * `soft_delete_include_deleted_from_args` to confirm a read's target actually
+   * soft-deletes before flagging an `includeDeleted` toggle on a public read.
+   * Optional — a feeder that doesn't track soft-delete omits it.
+   */
+  softDelete?: {
+    field: string;
+  };
 }
 /**
-* One declared index, flattened across Lunora's index kinds so a single lint can
-* reason about every column an index touches. `kind` distinguishes the DSL that
-* declared it — only `index` (a btree secondary index) covers a foreign-key
-* equality lookup, so the FK lint filters on it. `fields` is every column the
-* index references (a secondary index's columns; a search index's text +
-* filter fields; a rank index's sort + partition fields; a vector index's
-* source field). `unique` is set only for unique secondary indexes.
-*/
+ * One declared index, flattened across Lunora's index kinds so a single lint can
+ * reason about every column an index touches. `kind` distinguishes the DSL that
+ * declared it — only `index` (a btree secondary index) covers a foreign-key
+ * equality lookup, so the FK lint filters on it. `fields` is every column the
+ * index references (a secondary index's columns; a search index's text +
+ * filter fields; a rank index's sort + partition fields; a vector index's
+ * source field). `unique` is set only for unique secondary indexes.
+ */
 interface AdvisorIndex {
   fields: ReadonlyArray<string>;
   kind: "index" | "rank" | "search" | "vector";
   name: string;
   unique?: boolean;
 }
+/** The statically-knowable `.source(...)` bits the `external_source_*` lints read. */
+interface AdvisorExternalSource {
+  /** `true` when a `reconcileEveryMs` was given — one incremental delete-visibility path the `external_source_incremental_no_delete_path` lint accepts. */
+  hasReconcile?: boolean;
+  /** `true` when a `softDeleteColumn` was given — the other incremental delete-visibility path. */
+  hasSoftDelete?: boolean;
+  /** `true` when a `tenantBy` mapper was given — the tenant-isolation boundary. */
+  hasTenantBy: boolean;
+  /** Delete-detection mode literal, when given (`"full-pull"` or `"incremental"`). */
+  mode?: string;
+  /**
+   * `true` when `.source(...)` was declared but its config wasn't a static object
+   * literal, so `hasTenantBy` (and the rest) couldn't be read. Only the codegen
+   * feeder can hit this; the runtime feeder always holds the real config.
+   */
+  unanalyzable?: boolean;
+}
 /**
-* One declared relation. For a `one` relation the FK column `field` lives on
-* the holding table; for `many` it lives on the target. `name` is the accessor
-* the relation is loaded under.
-*/
+ * One declared relation. For a `one` relation the FK column `field` lives on
+ * the holding table; for `many` it lives on the target. `name` is the accessor
+ * the relation is loaded under.
+ */
 interface AdvisorRelation {
   field: string;
   kind: "many" | "one";
@@ -414,21 +1114,21 @@ interface AdvisorRelation {
   table: string;
 }
 /**
-* Adapt the runtime `@lunora/server` {@link Schema} into an {@link AdvisorSchema}.
-* Runtime callers (the studio backend, a live shard) hold the real schema
-* object; this collapses its record-keyed `tables`/`relationMap` into the array
-* form lints consume and flattens the per-kind index arrays into one list. The
-* codegen feeder builds the same shape from its AST IR independently (it never
-* imports `@lunora/server`).
-*/
+ * Adapt the runtime `@lunora/server` {@link Schema} into an {@link AdvisorSchema}.
+ * Runtime callers (the studio backend, a live shard) hold the real schema
+ * object; this collapses its record-keyed `tables`/`relationMap` into the array
+ * form lints consume and flattens the per-kind index arrays into one list. The
+ * codegen feeder builds the same shape from its AST IR independently (it never
+ * imports `@lunora/server`).
+ */
 declare const fromServerSchema: (schema: Schema) => AdvisorSchema;
 /**
-* One secret-shaped string literal discovered in the lunora source — the input
-* the `hardcoded_secret` lint consumes. The full value is never carried; only a
-* redacted {@link AdvisorSecretLiteral.preview}. Produced by the codegen feeder
-* (complementing the pre-commit `vis secrets` scan); runtime callers don't supply
-* it, so the lint finds nothing there.
-*/
+ * One secret-shaped string literal discovered in the lunora source — the input
+ * the `hardcoded_secret` lint consumes. The full value is never carried; only a
+ * redacted {@link AdvisorSecretLiteral.preview}. Produced by the codegen feeder
+ * (complementing the pre-commit `vis secrets` scan); runtime callers don't supply
+ * it, so the lint finds nothing there.
+ */
 interface AdvisorSecretLiteral {
   /** Source file relative to the lunora dir, no extension. */
   file: string;
@@ -440,43 +1140,91 @@ interface AdvisorSecretLiteral {
   preview: string;
 }
 /**
-* One shard's observed traffic share — the input the `hot_shard` runtime lint
-* consumes. Produced by the studio backend, which fans out over a sharded
-* function's shards and reads each shard's recorded request volume from the
-* durable `__lunora_metrics` accumulator (`SUM(calls)`) — or, equivalently, the
-* per-shard request-log count. Codegen and other static callers don't supply
-* it, so the lint simply finds nothing there.
-*
-* The lint is a pure function over its context, so it can't fan out over shards
-* itself; the caller does the cross-shard read and hands the aggregated
-* distribution here, exactly as the codegen feeder hands `AdvisorQueryRead`s for
-* the static query lints.
-*/
+ * A replication shape declared via `defineShape({ table, where, columns? })` in
+ * `lunora/shapes.ts` (the local-first sync engine's partial-replication unit).
+ * The `shape_*` lints cross-reference each shape's {@link AdvisorShape.table}
+ * against the declared schema to flag a shape targeting an unknown table or a
+ * `.global()` table (which replicates through the latency-tiered D1 poll path,
+ * not the poke-live op-log). Supplied by the codegen feeder, which lifts only
+ * the export name + the static `table` literal; absent for runtime callers,
+ * where the shape lints find nothing.
+ */
+interface AdvisorShape {
+  /** Export binding name — the shape's registry key (e.g. `channelMessages`). */
+  exportName: string;
+  /** File the shape is declared in (relative, for the operator to open). */
+  file: string;
+  /**
+   * The `table` string literal the shape replicates from, or `undefined` when
+   * the feeder could not read it as a plain string literal — tier-sensitive
+   * lints skip a shape with no resolvable table rather than guessing.
+   */
+  table?: string;
+}
+/**
+ * One shard's observed traffic share — the input the `hot_shard` runtime lint
+ * consumes. Produced by the studio backend, which fans out over a sharded
+ * function's shards and reads each shard's recorded request volume from the
+ * durable `__lunora_metrics` accumulator (`SUM(calls)`) — or, equivalently, the
+ * per-shard request-log count. Codegen and other static callers don't supply
+ * it, so the lint simply finds nothing there.
+ *
+ * The lint is a pure function over its context, so it can't fan out over shards
+ * itself; the caller does the cross-shard read and hands the aggregated
+ * distribution here, exactly as the codegen feeder hands `AdvisorQueryRead`s for
+ * the static query lints.
+ */
 interface AdvisorShardTraffic {
   /**
-  * The sharded function group these shards belong to, when the caller scopes
-  * the distribution to one `.shardBy(...)` function. Used only to name the
-  * finding; empty when the traffic is the whole deployment's shard set.
-  */
+   * The sharded function group these shards belong to, when the caller scopes
+   * the distribution to one `.shardBy(...)` function. Used only to name the
+   * finding; empty when the traffic is the whole deployment's shard set.
+   */
   group?: string;
   /** Total requests (function dispatches) recorded against this shard over the observed window. */
   requests: number;
   /**
-  * The shard key (the Durable Object id name) traffic was attributed to —
-  * a user / tenant / room id, depending on the `.shardBy(...)` key. Empty for
-  * the unnamed root DO.
-  */
+   * The shard key (the Durable Object id name) traffic was attributed to —
+   * a user / tenant / room id, depending on the `.shardBy(...)` key. Empty for
+   * the unnamed root DO.
+   */
   shardKey: string;
 }
 /**
-* One `ctx.sql` tagged-template interpolation that splices an unparameterized
-* string-building expression into the query — the input the `sql_injection_risk`
-* lint consumes. A `${…}` placeholder that simply names a value is bound as a
-* parameter by the Hyperdrive driver and is *not* recorded; only in-place string
-* construction (`"… " + raw`, a nested template literal) reaches here. Produced by
-* the codegen feeder; runtime callers don't supply it, so the lint finds nothing
-* there.
-*/
+ * One `ctx.db.&lt;table>.findMany({ includeDeleted })` list read whose
+ * `includeDeleted` is either a hardcoded `true` or derived from the handler's
+ * `args` — the shared input for the `soft_delete_include_deleted_from_args`
+ * lint. `includeDeleted` resurfaces rows a `.softDelete()` table would otherwise
+ * hide from list reads; on a public read that means any caller (arg-derived) or
+ * every caller (hardcoded `true`) can see soft-deleted rows. Produced by the
+ * codegen feeder; runtime callers don't supply it, so the lint finds nothing
+ * there. Structurally identical to `@lunora/codegen`'s `SoftDeleteReadIR`.
+ */
+interface AdvisorSoftDeleteRead {
+  /** The exported binding name of the procedure performing the read. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** `true` when `includeDeleted` was derived from the handler's `args` (any caller can flip it). */
+  fromArgs: boolean;
+  /** `true` when `includeDeleted` was a hardcoded `true` literal (always resurfaces soft-deleted rows). */
+  hardcodedTrue: boolean;
+  /** 1-based line of the read call. */
+  line: number;
+  /** Table read, or `""` when the table couldn't be statically resolved. */
+  table: string;
+  /** `"internal"` for `internalQuery` / `internalMutation` / `internalAction`. */
+  visibility: "internal" | "public";
+}
+/**
+ * One `ctx.sql` tagged-template interpolation that splices an unparameterized
+ * string-building expression into the query — the input the `sql_injection_risk`
+ * lint consumes. A `${…}` placeholder that simply names a value is bound as a
+ * parameter by the Hyperdrive driver and is *not* recorded; only in-place string
+ * construction (`"… " + raw`, a nested template literal) reaches here. Produced by
+ * the codegen feeder; runtime callers don't supply it, so the lint finds nothing
+ * there.
+ */
 interface AdvisorSqlInterpolation {
   /** The exported binding name of the procedure performing the `ctx.sql` call. */
   exportName: string;
@@ -486,22 +1234,71 @@ interface AdvisorSqlInterpolation {
   line: number;
 }
 /**
-* A bounded sample of rows from one table, fed into the constraint-validator
-* lint by the studio backend (via `readTablePage`). The cap prevents unbounded
-* scans while still catching obvious violations on small-to-medium tables.
-*
-* The studio notes the cap to the operator when the row count exceeds it
-* (`truncated: true`), so violations on rows beyond the sample window are not
-* silently missed — the finding description mentions the cap.
-*/
+ * One `ctx.storage.&lt;bucket>.&lt;method>(key, …)` call whose R2 object key is derived
+ * from the handler's `args` with no server-side scoping — the input the
+ * `storage_key_from_user_args` lint consumes. An object key taken straight from
+ * request input lets any caller read, overwrite, or delete another user's object
+ * (object-level IDOR). A key prefixed with a server-trusted identity (a `ctx.*`
+ * value such as `` `${ctx.auth.userId}/…` ``) is treated as scoped and is *not*
+ * recorded; only an arg-derived, `ctx`-free key reaches here. Produced by the
+ * codegen feeder; runtime callers don't supply it, so the lint finds nothing there.
+ */
+interface AdvisorStorageKeyAccess {
+  /** The exported binding name of the procedure performing the storage call. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the storage call, or `0` when unknown. */
+  line: number;
+  /** The bucket method invoked with the arg-derived key, e.g. `get` / `put` / `delete` / `download`. */
+  method: string;
+}
+/**
+ * One tracked `ctx.storage.&lt;bucket>.&lt;method>(...)` upload/signing call — the
+ * shared input for the storage config-hygiene security lints
+ * (`storage_upload_without_content_type_allowlist`, `storage_upload_without_max_size`,
+ * `storage_generate_upload_url_no_content_type_pin`, `storage_presigned_url_for_private_content`).
+ * `upload`/`store` carry the `UploadOptions` guards (`allowedContentTypes` /
+ * `maxSize`); `generateUploadUrl` carries the signed-PUT `contentType` pin;
+ * `getPresignedUrl`/`getSignedUrl` carry a statically-known `expiresInSeconds`
+ * literal. `presentKeys` is empty (and `expiresInSeconds` unset) when the
+ * options argument was absent, a non-literal, or a spread — see `analyzable`.
+ * Produced by the codegen feeder; runtime callers don't supply it, so the
+ * lints find nothing there.
+ */
+interface AdvisorStorageUpload {
+  /** `true` when the call's options-object argument (or its deliberate absence) was statically resolvable. */
+  analyzable: boolean;
+  /** Numeric literal value of an `expiresInSeconds` option, when statically known (`getSignedUrl` / `getPresignedUrl` only). */
+  expiresInSeconds?: number;
+  /** The exported binding name of the procedure performing the call. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the call, or `0` when unknown. */
+  line: number;
+  /** The `ctx.storage` method invoked. */
+  method: "generateUploadUrl" | "getPresignedUrl" | "getSignedUrl" | "store" | "upload";
+  /** Options-object keys present at the call site (empty when not `analyzable`, or when no options argument was passed). */
+  presentKeys: string[];
+}
+/**
+ * A bounded sample of rows from one table, fed into the constraint-validator
+ * lint by the studio backend (via `readTablePage`). The cap prevents unbounded
+ * scans while still catching obvious violations on small-to-medium tables.
+ *
+ * The studio notes the cap to the operator when the row count exceeds it
+ * (`truncated: true`), so violations on rows beyond the sample window are not
+ * silently missed — the finding description mentions the cap.
+ */
 interface AdvisorTableSample {
   /** The cap applied; equals `rows.length` when not truncated. */
   readonly cap: number;
   /**
-  * The row ids of every existing row in this table (bounded to `cap`), used
-  * for FK referential-integrity checks: if a FK value does not appear in the
-  * target table's `existingIds`, it is a dangling reference.
-  */
+   * The row ids of every existing row in this table (bounded to `cap`), used
+   * for FK referential-integrity checks: if a FK value does not appear in the
+   * target table's `existingIds`, it is a dangling reference.
+   */
   readonly existingIds: ReadonlySet<string>;
   /** Sampled rows (up to `cap`). Each row includes `_id` and all declared columns. */
   readonly rows: ReadonlyArray<Record<string, unknown>>;
@@ -511,22 +1308,61 @@ interface AdvisorTableSample {
   readonly truncated: boolean;
 }
 /**
-* The two workflow-shaped inputs the `workflow_*` lints consume, produced by the
-* codegen feeder. {@link AdvisorWorkflow} is the declaration side (one per
-* `defineWorkflow` export in `lunora/workflows.ts`); {@link AdvisorWorkflowCall}
-* is the use side (one per `ctx.workflows.get("name")` call discovered in a
-* function body). Runtime callers don't supply either, so the workflow lints
-* simply find nothing there.
-*
-* Both are structural subsets of codegen's `WorkflowIR` / `WorkflowCallIR`, so
-* the feeder passes the IR arrays straight through without conversion (mirrors
-* how `AdvisorContainer` tracks `ContainerIR` and `AdvisorInsertWrite` tracks
-* `InsertWriteIR`).
-*/
+ * One `ctx.vectors.&lt;method>(indexName, input)` call whose `input.namespace` is
+ * derived from the handler's `args` with no server-side scoping — the input the
+ * `vectors_namespace_from_user_input` lint consumes. A Vectorize namespace
+ * partitions one index into isolated sub-collections, so a namespace taken
+ * straight from request input lets any caller read or poison another tenant's
+ * vectors. A fixed literal namespace, or one prefixed with a server-trusted
+ * identity (`` `${ctx.auth.orgId}` `` — references `ctx`, so treated as
+ * scoped), is not recorded; only an arg-derived, unscoped namespace reaches
+ * here. Produced by the codegen feeder; runtime callers don't supply it, so
+ * the lint finds nothing there.
+ */
+interface AdvisorVectorNamespaceAccess {
+  /** The exported binding name of the procedure performing the `ctx.vectors` access. */
+  exportName: string;
+  /** Source file relative to the lunora dir, no extension. */
+  file: string;
+  /** 1-based line of the `ctx.vectors` call, or `0` when unknown. */
+  line: number;
+  /** The `ctx.vectors` method invoked: `query` / `upsert` / `upsertMany`. */
+  method: string;
+}
+/**
+ * The two workflow-shaped inputs the `workflow_*` lints consume, produced by the
+ * codegen feeder. {@link AdvisorWorkflow} is the declaration side (one per
+ * `defineWorkflow` export in `lunora/workflows.ts`); {@link AdvisorWorkflowCall}
+ * is the use side (one per `ctx.workflows.get("name")` call discovered in a
+ * function body). Runtime callers don't supply either, so the workflow lints
+ * simply find nothing there.
+ *
+ * Both are structural subsets of codegen's `WorkflowIR` / `WorkflowCallIR`, so
+ * the feeder passes the IR arrays straight through without conversion (mirrors
+ * how `AdvisorContainer` tracks `ContainerIR` and `AdvisorInsertWrite` tracks
+ * `InsertWriteIR`).
+ */
+/** One durable step call lifted from a workflow handler body — the input the duplicate-step-name lint compares. Structural subset of codegen's `WorkflowStepIR`. */
+interface AdvisorWorkflowStep {
+  /** 1-based line of the durable step call, or `0` when unknown. */
+  line: number;
+  /** The native step method invoked: `do` / `sleep` / `sleepUntil` / `waitForEvent`. */
+  method: string;
+  /** The step's static label (the first string-literal argument). */
+  name: string;
+}
 /** One workflow declared via a `defineWorkflow()` export in `lunora/workflows.ts`. */
 interface AdvisorWorkflow {
   /** The `lunora/workflows.ts` export name, e.g. `orderPipeline`. */
   exportName: string;
+  /**
+   * The durable step labels discovered in the handler body, in source order —
+   * the duplicate-step-name input. Cloudflare memoizes a step by its name, so a
+   * name used twice makes the second call silently return the first's cached
+   * result. Supplied by the codegen feeder; `undefined` for runtime callers,
+   * where the lint finds nothing.
+   */
+  steps?: ReadonlyArray<AdvisorWorkflowStep>;
 }
 /** One `ctx.workflows.get("name")` call discovered in a function body. */
 interface AdvisorWorkflowCall {
@@ -540,41 +1376,58 @@ interface AdvisorWorkflowCall {
   workflow: string;
 }
 /**
-* Severity of a finding, mirroring splinter's `level`. `ERROR` is a definite
-* problem, `WARN` a likely one, `INFO` an advisory nudge.
-*/
+ * One committed `wrangler.jsonc` `vars` entry whose value is a plaintext secret —
+ * the input the `plaintext_secret_in_wrangler_vars` lint consumes. The full value
+ * is never carried; only a redacted {@link AdvisorWranglerVariable.preview}.
+ * Produced by `@lunora/config` (which reads `wrangler.jsonc`) and threaded through
+ * codegen; runtime callers don't supply it, so the lint finds nothing there.
+ */
+interface AdvisorWranglerVariable {
+  /** The `wrangler.jsonc` file the var was read from, relative to the project root. */
+  file: string;
+  /** The offending `vars` key (e.g. `STRIPE_SECRET_KEY`). */
+  key: string;
+  /** Heuristic that matched, e.g. `stripe_live_key` / `private_key` / `secret_named_var`. */
+  kind: string;
+  /** Redacted preview (first few chars + length) — never the full secret. */
+  preview: string;
+}
+/**
+ * Severity of a finding, mirroring splinter's `level`. `ERROR` is a definite
+ * problem, `WARN` a likely one, `INFO` an advisory nudge.
+ */
 type Level = "ERROR" | "INFO" | "WARN";
 /**
-* Who the finding concerns, mirroring splinter's `facing`. `EXTERNAL` findings
-* affect clients of the app (performance/security a user can feel); `INTERNAL`
-* ones are operator-only hygiene.
-*/
+ * Who the finding concerns, mirroring splinter's `facing`. `EXTERNAL` findings
+ * affect clients of the app (performance/security a user can feel); `INTERNAL`
+ * ones are operator-only hygiene.
+ */
 type Facing = "EXTERNAL" | "INTERNAL";
 /**
-* Concern bucket a lint belongs to. `SCHEMA` covers shape/correctness nits that
-* are neither a perf nor a security issue (missing primary key, duplicate
-* index). `PERFORMANCE` and `SECURITY` match splinter's two categories.
-*/
+ * Concern bucket a lint belongs to. `SCHEMA` covers shape/correctness nits that
+ * are neither a perf nor a security issue (missing primary key, duplicate
+ * index). `PERFORMANCE` and `SECURITY` match splinter's two categories.
+ */
 type Category = "PERFORMANCE" | "SCHEMA" | "SECURITY";
 /**
-* Where a lint draws its evidence from.
-*
-* `static` runs against the declared {@link AdvisorSchema} alone (tables,
-* indexes, relations) — deterministic, runnable at codegen/build time, and
-* catches a problem _before_ it ships. This is the edge Lunora has over a
-* live-DB-only advisor like Supabase's.
-*
-* `runtime` needs observed signal from a running shard (full-scan attribution,
-* function call stats). Added in a later slice; the context grows optional
-* fields the runtime lints read.
-*/
+ * Where a lint draws its evidence from.
+ *
+ * `static` runs against the declared {@link AdvisorSchema} alone (tables,
+ * indexes, relations) — deterministic, runnable at codegen/build time, and
+ * catches a problem _before_ it ships. This is the edge Lunora has over a
+ * live-DB-only advisor like Supabase's.
+ *
+ * `runtime` needs observed signal from a running shard (full-scan attribution,
+ * function call stats). Added in a later slice; the context grows optional
+ * fields the runtime lints read.
+ */
 type LintSource = "runtime" | "static";
 /**
-* One emitted advisory, shaped after splinter's lint-view row so the studio
-* Advisors table can render any lint uniformly. `cacheKey` is a stable,
-* content-derived id used to dedup across runs and to let an operator dismiss a
-* specific finding without silencing the whole lint.
-*/
+ * One emitted advisory, shaped after splinter's lint-view row so the studio
+ * Advisors table can render any lint uniformly. `cacheKey` is a stable,
+ * content-derived id used to dedup across runs and to let an operator dismiss a
+ * specific finding without silencing the whole lint.
+ */
 interface Finding {
   /** Stable identifier for dedup/dismissal across runs. */
   cacheKey: string;
@@ -598,173 +1451,483 @@ interface Finding {
   title: string;
 }
 /**
-* Everything a lint may inspect. Static lints read only {@link LintContext.schema};
-* runtime lints will additionally read observed-signal fields added here later.
-*/
+ * Everything a lint may inspect. Static lints read only {@link LintContext.schema};
+ * runtime lints will additionally read observed-signal fields added here later.
+ */
 interface LintContext {
   /**
-  * `httpRoute.&lt;verb>("/admin/…")` routes on admin/privileged-looking paths and
-  * whether each references an auth/admin guard — the `admin_route_without_guard`
-  * input. Supplied by the codegen feeder; absent for runtime callers, where the
-  * lint finds nothing.
-  */
+   * `httpRoute.&lt;verb>("/admin/…")` routes on admin/privileged-looking paths and
+   * whether each references an auth/admin guard — the `admin_route_without_guard`
+   * input. Supplied by the codegen feeder; absent for runtime callers, where the
+   * lint finds nothing.
+   */
   adminRoutes?: ReadonlyArray<AdvisorAdminRoute>;
   /**
-  * Per-public-procedure argument validators that weaken input safety — the
-  * `public_arg_uses_any` (`v.any()` args) and `unbounded_string_arg` (length-less
-  * `v.string()` args) input. Supplied by the codegen feeder for public procedures
-  * only; absent for runtime callers, where the lints find nothing.
-  */
+   * `ctx.ai.run(model, …)` calls whose model-id argument is derived from the
+   * handler's `args` with no server-side scoping — the `ai_raw_run_escape_hatch`
+   * input. `ctx.ai.run` is the raw Workers AI passthrough, so an arg-derived model
+   * id lets any caller select an arbitrary model, bypassing the typed
+   * `ctx.ai.model(...)` + AI-SDK layer's cap/schema (an arg-derived `inputs`
+   * argument is normal usage and is not recorded). Supplied by the codegen feeder;
+   * absent for runtime callers, where the lint finds nothing.
+   */
+  aiRawRuns?: ReadonlyArray<AdvisorAiRawRun>;
+  /**
+   * `generateText` / `streamText` calls whose model-callable `tools` reach a
+   * privileged side effect (DB write / function dispatch / outbound
+   * fetch/mail/queue) — the `ai_tool_side_effect_prompt_injection` input. Each
+   * row's `userInputDerived` says whether the model input flows from `args`; the
+   * lint fires only when it does. Supplied by the codegen feeder; absent for
+   * runtime callers, where the lint finds nothing.
+   */
+  aiToolSideEffects?: ReadonlyArray<AdvisorAiToolSideEffect>;
+  /**
+   * `ctx.fetch(url, …)` calls inside actions whose URL argument is derived from
+   * the handler's `args` — the `action_fetch_ssrf` input. `ctx.fetch` has no
+   * host allowlist, so a URL built from request input is a server-side request
+   * forgery vector. Supplied by the codegen feeder; absent for runtime callers,
+   * where the lint finds nothing.
+   */
+  argumentDerivedFetches?: ReadonlyArray<AdvisorArgumentDerivedFetch>;
+  /**
+   * Per-public-procedure argument validators that weaken input safety — the
+   * `public_arg_uses_any` (`v.any()` args) and `unbounded_string_arg` (length-less
+   * `v.string()` args) input. Supplied by the codegen feeder for public procedures
+   * only; absent for runtime callers, where the lints find nothing.
+   */
   argValidators?: ReadonlyArray<AdvisorArgumentValidator>;
   /**
-  * `ctx.authApi.&lt;method>(...)` calls discovered in function bodies (the
-  * `auth_api_call_without_headers` input). Supplied by the codegen feeder; absent
-  * for runtime callers, where the lint finds nothing.
-  */
+   * `ctx.authApi.&lt;method>(...)` calls discovered in function bodies (the
+   * `auth_api_call_without_headers` input). Supplied by the codegen feeder; absent
+   * for runtime callers, where the lint finds nothing.
+   */
   authApiCalls?: ReadonlyArray<AdvisorAuthApiCall>;
   /**
-  * Containers declared in `lunora/containers.ts` — the `container_*` lint
-  * input. Supplied by the codegen feeder; absent for runtime callers, where
-  * the container lints find nothing.
-  */
+   * Per-`createAuth({...})`-call configuration snapshots — the shared input for
+   * the five `auth_*` security lints (`auth_trusted_origins_wildcard`,
+   * `auth_csrf_check_disabled`, `auth_secure_cookies_disabled`,
+   * `auth_email_verification_disabled`, `auth_session_freshage_zero`). Each
+   * carries whether the call's config object literal was statically analyzable
+   * and, when it was, the handful of nested facts the lints check (a
+   * `trustedOrigins` wildcard, `advanced.disableCSRFCheck`/`useSecureCookies`,
+   * `emailAndPassword.enabled`/`requireEmailVerification`,
+   * `session.freshAge === 0`). Supplied by the codegen feeder; absent for
+   * runtime callers, where the auth-config lints find nothing.
+   */
+  authConfigs?: ReadonlyArray<AdvisorAuthConfig>;
+  /**
+   * `ctx.browser.&lt;method>(url, …)` calls whose navigation URL is derived from the
+   * handler's `args` with no server-side scoping — the
+   * `browser_user_url_without_allowlist` input. `@lunora/browser` blocks
+   * private/internal targets by default, but a request-supplied public URL can
+   * still be an open-proxy / SSRF vector; the lint suppresses findings when a
+   * `createBrowser` config-call is hardened with `allowedHosts` or `resolveDns`.
+   * Supplied by the codegen feeder; absent for runtime callers, where the lint
+   * finds nothing.
+   */
+  browserUrlAccesses?: ReadonlyArray<AdvisorBrowserUrlAccess>;
+  /**
+   * Factory/constructor calls in `lunora/` whose config object literal a
+   * security lint inspects for a present-or-absent key — the shared input for
+   * the config-call security lints (payment authorize, inbound-mail verify,
+   * rate-limit store, browser private-targets). Supplied by the codegen feeder;
+   * absent for runtime callers, where the config-call lints find nothing.
+   */
+  configCalls?: ReadonlyArray<AdvisorConfigCall>;
+  /**
+   * `ctx.containers.&lt;name>.get(key, …)` calls whose instance key is derived from
+   * the handler's `args` with no server-side scoping — the
+   * `container_instance_key_from_user_input` input. Each container definition's
+   * `.get(name)` accessor routes to one instance per key, so an arg-derived key lets
+   * any caller reach another tenant's container (cross-tenant IDOR). A key scoped by
+   * a server-trusted `ctx.*` value, or a fixed literal, is not recorded. Supplied by
+   * the codegen feeder; absent for runtime callers, where the lint finds nothing.
+   */
+  containerKeyAccesses?: ReadonlyArray<AdvisorContainerKeyAccess>;
+  /**
+   * Runtime container-override calls — a `.start({ enableInternet: true, … })`
+   * launch override, or a `.egress.&lt;method>(...)` runtime firewall mutation — the
+   * `container_start_enable_internet_override` and `container_runtime_egress_relaxation`
+   * lint input. Supplied by the codegen feeder; absent for runtime callers, where
+   * those lints find nothing.
+   */
+  containerOverrides?: ReadonlyArray<AdvisorContainerOverride>;
+  /**
+   * Containers declared in `lunora/containers.ts` — the `container_*` lint
+   * input. Supplied by the codegen feeder; absent for runtime callers, where
+   * the container lints find nothing.
+   */
   containers?: ReadonlyArray<AdvisorContainer>;
   /**
-  * Hyperdrive `ctx.sql` accesses discovered lexically inside `query`/`mutation`
-  * handler bodies — the `hyperdrive_outside_action` input. Supplied by the
-  * codegen feeder, which omits `action` handlers (where `ctx.sql` is the typed,
-  * intended surface); absent for runtime callers, where the lint finds nothing.
-  */
+   * `rateLimit`/`dbRateLimit` (`@lunora/ratelimit`) and `verifyTurnstileMiddleware`
+   * (`@lunora/auth`) middleware calls, each with whether its options literal set
+   * `failOpen: true` and the rate-limit `name` — the
+   * `ratelimit_middleware_fail_open` input. These guards fail closed by default; a
+   * `failOpen: true` admits every request during a limiter/siteverify outage, so
+   * the lint fires when a fail-open guard protects an auth/payment-sensitive
+   * procedure. Supplied by the codegen feeder; absent for runtime callers, where
+   * the lint finds nothing.
+   */
+  failOpenGuards?: ReadonlyArray<AdvisorFailOpenGuard>;
+  /**
+   * `ctx.flags.boolean(key, default)` reads with a statically-known string key and
+   * boolean-literal default — the `flag_gates_security_with_unsafe_default` input.
+   * OpenFeature returns the default when the provider errors, so a fail-open
+   * default on a security-shaped key (an `enforce`/`rls`/`gate`/`lockdown`
+   * protection defaulting `false`, or an `allow`/`permit`/`bypass` permission
+   * defaulting `true`) silently opens access during an outage. Supplied by the
+   * codegen feeder; absent for runtime callers, where the lint finds nothing.
+   */
+  flagSecurityDefaults?: ReadonlyArray<AdvisorFlagSecurityDefault>;
+  /**
+   * `httpAction`/`httpRoute` handlers that perform a side effect
+   * (`ctx.runMutation` / `ctx.runAction` / a `ctx.db` write) from the HTTP edge,
+   * with whether each reads `ctx.auth` — the `http_action_missing_auth_guard`
+   * input. Supplied by the codegen feeder; absent for runtime callers, where the
+   * lint finds nothing.
+   */
+  httpActionGuards?: ReadonlyArray<AdvisorHttpActionGuard>;
+  /**
+   * Response-header writes, inside `httpAction` handlers, whose value is derived
+   * from raw request input (`request.headers`/URL/query/body) with no CR/LF
+   * sanitizer — the `http_action_response_header_injection` input. Supplied by the
+   * codegen feeder; absent for runtime callers, where the lint finds nothing.
+   */
+  httpHeaderWrites?: ReadonlyArray<AdvisorHttpHeaderWrite>;
+  /**
+   * Hyperdrive `ctx.sql` accesses discovered lexically inside `query`/`mutation`
+   * handler bodies — the `hyperdrive_outside_action` input. Supplied by the
+   * codegen feeder, which omits `action` handlers (where `ctx.sql` is the typed,
+   * intended surface); absent for runtime callers, where the lint finds nothing.
+   */
   hyperdriveCalls?: ReadonlyArray<AdvisorHyperdriveCall>;
   /**
-  * Per-declared-index hit counts observed at runtime (the dead-index half of
-  * the `index_utilization` lint input). Supplied by the studio backend, which
-  * sums the per-`(table, index)` reads each shard records in the durable
-  * `__lunora_metrics_index` table and surfaces through the `getMetrics` admin
-  * RPC (see {@link AdvisorIndexHit}). Absent for static callers, where the
-  * dead-index check finds nothing.
-  */
+   * `&lt;receiver>.identity.&lt;key>` claim reads (RLS/mask policy `auth`, or
+   * `ctx.auth`/`context.auth`) — the `identity_undeclared_claim_trusted` input.
+   * `defineIdentity` validates only declared claims and forwards undeclared ones
+   * verbatim, so each row's `declared` flag says whether `key` is in the contract
+   * (or the always-present `userId`); the lint fires on the undeclared reads.
+   * Supplied by the codegen feeder — and only when a resolvable `defineIdentity`
+   * contract exists; absent for runtime callers, where the lint finds nothing.
+   */
+  identityClaimReads?: ReadonlyArray<AdvisorIdentityClaimRead>;
+  /**
+   * `buildImageDeliveryUrl({ key, … })` calls (`@lunora/bindings/images`) whose
+   * `key` — the CDN transform's source image, an absolute URL or an
+   * origin-relative key — is derived from the handler's `args` with no
+   * server-side scoping — the `images_url_source_from_user_input` input.
+   * `ctx.images.transform`/`info` take image bytes, never a URL, so they are
+   * not sinks; only the `key` of `buildImageDeliveryUrl` accepts a URL-or-key
+   * source and is inspected. An arg-derived key lets any caller point the
+   * CDN's `/cdn-cgi/image/` transform at an attacker-chosen origin (SSRF /
+   * open proxy). A fixed literal, or a key scoped by a server-trusted `ctx.*`
+   * value, is not recorded. Supplied by the codegen feeder; absent for
+   * runtime callers, where the lint finds nothing.
+   */
+  imageDeliveryUrlAccesses?: ReadonlyArray<AdvisorImageDeliveryUrlAccess>;
+  /**
+   * Per-declared-index hit counts observed at runtime (the dead-index half of
+   * the `index_utilization` lint input). Supplied by the studio backend, which
+   * sums the per-`(table, index)` reads each shard records in the durable
+   * `__lunora_metrics_index` table and surfaces through the `getMetrics` admin
+   * RPC (see {@link AdvisorIndexHit}). Absent for static callers, where the
+   * dead-index check finds nothing.
+   */
   indexHits?: ReadonlyArray<AdvisorIndexHit>;
   /**
-  * Insert writes discovered in function bodies (the `table_without_insert`
-  * input). Supplied by the codegen feeder; absent for runtime callers, where
-  * the write-shaped lints simply find nothing.
-  */
+   * Insert writes discovered in function bodies (the `table_without_insert`
+   * input). Supplied by the codegen feeder; absent for runtime callers, where
+   * the write-shaped lints simply find nothing.
+   */
   inserts?: ReadonlyArray<AdvisorInsertWrite>;
   /**
-  * Per-procedure column-masking usage discovered in function bodies (the
-  * `mask_uncovered_pii_column` input). Carries whether each procedure's builder
-  * chain includes `.use(mask(...))`, which `(table, column)` pairs its mask
-  * policy declares, and which tables the procedure reads/writes. Supplied by
-  * the codegen feeder; absent for runtime callers, where the lint finds
-  * nothing.
-  */
+   * `ctx.kv.&lt;method>(key, …)` calls whose namespace key is derived from the
+   * handler's `args` with no server-side scoping — the `kv_unscoped_user_key_idor`
+   * input. Workers KV is one flat namespace, so a key taken straight from request
+   * input lets any caller read/overwrite/delete another user's entry (IDOR). Only
+   * arg-derived, unscoped keys are recorded (a fixed literal or a
+   * `${ctx.auth.userId}:…` prefix is not). Supplied by the codegen feeder; absent
+   * for runtime callers, where the lint finds nothing.
+   */
+  kvKeyAccesses?: ReadonlyArray<AdvisorKvKeyAccess>;
+  /**
+   * `ctx.mail`/`ctx.email` `send`/`queue` calls whose `to`/`cc`/`bcc` recipient is
+   * derived from the handler's `args` with no server-side scoping — the
+   * `mail_recipient_from_request_input` input. A recipient taken straight from
+   * request input turns the deployment into an open relay / spam amplifier (any
+   * caller can direct mail to an arbitrary address). A recipient scoped by a
+   * server-trusted `ctx.*` value, or a fixed literal, is not recorded. Supplied by
+   * the codegen feeder; absent for runtime callers, where the lint finds nothing.
+   */
+  mailRecipientAccesses?: ReadonlyArray<AdvisorMailRecipientAccess>;
+  /**
+   * Per-procedure column-masking usage discovered in function bodies (the
+   * `mask_uncovered_pii_column` input). Carries whether each procedure's builder
+   * chain includes `.use(mask(...))`, which `(table, column)` pairs its mask
+   * policy declares, and which tables the procedure reads/writes. Supplied by
+   * the codegen feeder; absent for runtime callers, where the lint finds
+   * nothing.
+   */
   maskProcedures?: ReadonlyArray<AdvisorMaskProcedure>;
   /**
-  * Non-deterministic API calls (`Date.now`, `Math.random`,
-  * `crypto.randomUUID`, `crypto.getRandomValues`, `fetch`) discovered lexically
-  * inside `query`/`mutation` handler bodies — the `nondeterministic_query_mutation`
-  * input. Supplied by the codegen feeder, which omits `action` handlers (their
-  * non-determinism is intentional); absent for runtime callers, where the lint
-  * finds nothing.
-  */
+   * Masked columns whose `mask(policies)` strategy is a statically-known
+   * literal (the `mask_weak_hash_strategy_on_pii` input). One row per masked
+   * column, with the `"hash"` / `"redact"` strategy literal attached; a
+   * `MaskFn` (custom, non-literal) strategy is never recorded. Supplied by
+   * the codegen feeder; absent for runtime callers, where the lint finds
+   * nothing.
+   */
+  maskStrategies?: ReadonlyArray<AdvisorMaskStrategy>;
+  /**
+   * Whole-row `ctx.db.replace(id, document)` writes lifted from custom
+   * mutators' authoritative `server` impls (the `mutator_full_row_replace`
+   * input). Each `replace` overwrites the entire row, clobbering a concurrent
+   * edit to a different column on a synced table. Supplied by the codegen
+   * feeder; absent for runtime callers, where the lint finds nothing.
+   */
+  mutatorWrites?: ReadonlyArray<AdvisorMutatorWrite>;
+  /**
+   * Non-deterministic API calls (`Date.now`, `Math.random`,
+   * `crypto.randomUUID`, `crypto.getRandomValues`, `fetch`) discovered lexically
+   * inside `query`/`mutation` handler bodies — the `nondeterministic_query_mutation`
+   * input. Supplied by the codegen feeder, which omits `action` handlers (their
+   * non-determinism is intentional); absent for runtime callers, where the lint
+   * finds nothing.
+   */
   nondeterministicCalls?: ReadonlyArray<AdvisorNondeterministicCall>;
   /**
-  * Per-procedure protective-middleware snapshots — the
-  * `public_mutation_without_ratelimit` and `user_creating_mutation_without_captcha`
-  * input. Records which `.use(...)` guards (`rateLimit`, captcha, `rls`, `mask`,
-  * the `protectPublic` bundle) each procedure carries and whether it writes a
-  * user table or sends mail. Supplied by the codegen feeder; absent for runtime
-  * callers, where the lints find nothing.
-  */
+   * `query`/`mutation` handlers that gate a `ctx.db.get`/`patch`/`delete` on a
+   * null-checked `ctx.db.normalizeId(table, id)` result — the
+   * `normalize_id_used_as_authorization` input. `normalizeId` validates an id's
+   * structural shape only (it never reads the database), so gating access on a
+   * non-null result is an IDOR. The lint keeps only public procedures with no
+   * `.use(rls(...))` and no ownership/identity mention, then joins `table` against
+   * the schema's RLS mode before flagging. Supplied by the codegen feeder; absent
+   * for runtime callers, where the lint finds nothing.
+   */
+  normalizeIdAuthorizations?: ReadonlyArray<AdvisorNormalizeIdAuthorization>;
+  /**
+   * `ctx.db` writes (`insert` / `replace` / `patch` / `insertManyUnsafe`) that set
+   * an ownership / identity column (`userId`, `ownerId`, `tenantId`, …) from the
+   * handler's `args` instead of the server-trusted identity — the
+   * `owner_field_from_args_not_auth` input. The ownership column decides who a row
+   * belongs to, so an arg-derived value lets any caller write rows owned by another
+   * user or tenant (act-as-any-user / cross-tenant IDOR). A column stamped from
+   * `ctx.*`, or a fixed literal, is not recorded. Supplied by the codegen feeder;
+   * absent for runtime callers, where the lint finds nothing.
+   */
+  ownerFieldWrites?: ReadonlyArray<AdvisorOwnerFieldWrite>;
+  /**
+   * Payment webhook-adapter constructions (`createStripeAdapter` /
+   * `createPolarAdapter` / `createAutumnAdapter` / `createDodoPaymentsAdapter`) — the payment-webhook wide-tolerance lint's input. Each row's
+   * `toleranceSeconds` is the statically-known `webhookToleranceSeconds` replay
+   * window (default 300s); the lint fires only above a conservative ceiling, where
+   * the endpoint would accept stale, replayable signed payloads. Supplied by the
+   * codegen feeder; absent for runtime callers, where the lint finds nothing.
+   */
+  paymentWebhooks?: ReadonlyArray<AdvisorPaymentWebhook>;
+  /**
+   * Payload-derived privileged dispatches — the `privileged_dispatch_unvalidated_payload`
+   * input. Each is a `ctx.run`/`context.run` back into a Lunora function from inside a
+   * `defineQueue` push handler or a `defineWorkflow` handler, whose args reference the
+   * handler's untrusted payload (`context.params` for a workflow, a `for (… of
+   * batch.messages)` body for a queue). Both handler kinds run under the system identity
+   * (RLS disabled), so the lint joins the resolved target against `rlsProcedures` and
+   * fires only when the target enforces a row policy. Supplied by the codegen feeder;
+   * absent for runtime callers, where the lint finds nothing.
+   */
+  privilegedDispatches?: ReadonlyArray<AdvisorPrivilegedDispatch>;
+  /**
+   * Per-procedure protective-middleware snapshots — the
+   * `public_mutation_without_ratelimit` and `user_creating_mutation_without_captcha`
+   * input. Records which `.use(...)` guards (`rateLimit`, captcha, `rls`, `mask`,
+   * the `protectPublic` bundle) each procedure carries and whether it writes a
+   * user table or sends mail. Supplied by the codegen feeder; absent for runtime
+   * callers, where the lints find nothing.
+   */
   procedureProtections?: ReadonlyArray<AdvisorProcedureProtection>;
   /**
-  * Query reads discovered in function bodies (the `filter_without_index`
-  * input). Supplied by the codegen feeder; absent for runtime callers, where
-  * the query-shaped lints simply find nothing.
-  */
+   * Query reads discovered in function bodies (the `filter_without_index`
+   * input). Supplied by the codegen feeder; absent for runtime callers, where
+   * the query-shaped lints simply find nothing.
+   */
   queries?: ReadonlyArray<AdvisorQueryRead>;
   /**
-  * R2 SQL `ctx.r2sql` accesses discovered lexically inside `query`/`mutation`
-  * handler bodies — the `r2sql_outside_action` input. Supplied by the codegen
-  * feeder, which omits `action` handlers (where `ctx.r2sql` is the typed,
-  * intended surface); absent for runtime callers, where the lint finds nothing.
-  */
+   * Queues declared via `defineQueue` exports in `lunora/queues.ts` — the
+   * declaration-side input for the `queue_*` lints (`queue_without_dlq`).
+   * Supplied by the codegen feeder; absent for runtime callers, where the
+   * queue lints find nothing.
+   */
+  queues?: ReadonlyArray<AdvisorQueue>;
+  /**
+   * R2 SQL `ctx.r2sql` accesses discovered lexically inside `query`/`mutation`
+   * handler bodies — the `r2sql_outside_action` input. Supplied by the codegen
+   * feeder, which omits `action` handlers (where `ctx.r2sql` is the typed,
+   * intended surface); absent for runtime callers, where the lint finds nothing.
+   */
   r2sqlCalls?: ReadonlyArray<AdvisorR2sqlCall>;
   /**
-  * Per-procedure RLS usage discovered in function bodies (the
-  * `rls_uncovered_table` input). Carries whether each procedure's builder chain
-  * includes `.use(rls(...))`, which tables the procedure reads/writes, and which
-  * tables its RLS policy array names. Supplied by the codegen feeder; absent for
-  * runtime callers, where the lint finds nothing.
-  */
+   * `rateLimit`/`dbRateLimit` middleware calls (`@lunora/ratelimit`) whose
+   * `key` selector is derived from the handler's `args` with no server-side
+   * scoping — the `ratelimit_key_spoofable_or_global` input. A key an
+   * attacker controls lets them rotate it per request and bypass the limit
+   * entirely, defeating its purpose. A selector scoped by `ctx` (e.g.
+   * `ctx.auth.userId`, `ctx.ip`), or one with no `args` reference at all (a
+   * fixed/global bucket), is not recorded. Supplied by the codegen feeder;
+   * absent for runtime callers, where the lint finds nothing.
+   */
+  ratelimitKeySelectors?: ReadonlyArray<AdvisorRatelimitKeySelector>;
+  /**
+   * `query` handlers that `return` the raw rows of a table (a `ctx.db` row read
+   * or `ctx.db.query(...)` fluent chain, returned directly or through one local
+   * `const` hop, with no hand-built projection) — the
+   * `output_projection_missing_on_public_read` input. The lint keeps only public
+   * queries with no `.output(...)`/mask on the chain, then joins `table` against
+   * the schema's PII-named columns before nudging. Supplied by the codegen
+   * feeder; absent for runtime callers, where the lint finds nothing.
+   */
+  rawRowReturns?: ReadonlyArray<AdvisorRawRowReturn>;
+  /**
+   * `ctx.db.&lt;table>.findMany({ with: { &lt;rel> } })` relation-hydrating list reads
+   * — the `masked_relation_leak_via_with` input. Column masking is applied to a
+   * read's top-level rows but does not descend into `with`-hydrated relations,
+   * so a masked table surfaced only through a `with` on an unprotected public
+   * read is returned in the clear. Supplied by the codegen feeder; absent for
+   * runtime callers, where the lint finds nothing.
+   */
+  relationLoads?: ReadonlyArray<AdvisorRelationLoad>;
+  /**
+   * Per-procedure RLS usage discovered in function bodies (the
+   * `rls_uncovered_table` input). Carries whether each procedure's builder chain
+   * includes `.use(rls(...))`, which tables the procedure reads/writes, and which
+   * tables its RLS policy array names. Supplied by the codegen feeder; absent for
+   * runtime callers, where the lint finds nothing.
+   */
   rlsProcedures?: ReadonlyArray<AdvisorRlsProcedure>;
   /** The declared schema under audit, normalized to the feeder-agnostic {@link AdvisorSchema}. */
   schema: AdvisorSchema;
   /**
-  * Secret-shaped string literals discovered in the lunora source — the
-  * `hardcoded_secret` input. Each carries only a redacted preview, never the
-  * full value. Supplied by the codegen feeder; absent for runtime callers,
-  * where the lint finds nothing.
-  */
+   * Secret-shaped string literals discovered in the lunora source — the
+   * `hardcoded_secret` input. Each carries only a redacted preview, never the
+   * full value. Supplied by the codegen feeder; absent for runtime callers,
+   * where the lint finds nothing.
+   */
   secretLiterals?: ReadonlyArray<AdvisorSecretLiteral>;
   /**
-  * Per-shard observed traffic — the `hot_shard` lint input. Supplied by the
-  * studio backend, which fans out over a sharded function's shards and reads
-  * each shard's recorded request volume from the durable `__lunora_metrics`
-  * accumulator. Absent for static callers, where the lint finds nothing.
-  */
+   * Replication shapes declared via `defineShape` in `lunora/shapes.ts` — the
+   * `shape_unknown_table` and `shape_targets_global_table` lint input. Each
+   * carries the export name and its static `table` literal, cross-referenced
+   * against {@link LintContext.schema}. Supplied by the codegen feeder; absent
+   * for runtime callers, where the shape lints find nothing.
+   */
+  shapes?: ReadonlyArray<AdvisorShape>;
+  /**
+   * Per-shard observed traffic — the `hot_shard` lint input. Supplied by the
+   * studio backend, which fans out over a sharded function's shards and reads
+   * each shard's recorded request volume from the durable `__lunora_metrics`
+   * accumulator. Absent for static callers, where the lint finds nothing.
+   */
   shardTraffic?: ReadonlyArray<AdvisorShardTraffic>;
   /**
-  * `ctx.sql` tagged-template interpolations that splice an unparameterized
-  * string-building expression into the query — the `sql_injection_risk` input.
-  * Supplied by the codegen feeder; absent for runtime callers, where the lint
-  * finds nothing.
-  */
+   * `ctx.db.&lt;table>.findMany({ includeDeleted })` list reads whose
+   * `includeDeleted` is a hardcoded `true` or derived from the handler's
+   * `args` — the `soft_delete_include_deleted_from_args` input. On a public
+   * read of a `.softDelete()` table this resurfaces soft-deleted rows to any
+   * caller (arg-derived) or every caller (hardcoded). Supplied by the codegen
+   * feeder; absent for runtime callers, where the lint finds nothing.
+   */
+  softDeleteReads?: ReadonlyArray<AdvisorSoftDeleteRead>;
+  /**
+   * `ctx.sql` tagged-template interpolations that splice an unparameterized
+   * string-building expression into the query — the `sql_injection_risk` input.
+   * Supplied by the codegen feeder; absent for runtime callers, where the lint
+   * finds nothing.
+   */
   sqlInterpolations?: ReadonlyArray<AdvisorSqlInterpolation>;
   /**
-  * Bounded row samples per table — the `constraint_validator` lint input.
-  * Supplied by the studio backend, which reads up to the configured row cap
-  * from each table via `readTablePage` and assembles the existing-id set for
-  * FK referential-integrity checks. Absent for static callers or codegen
-  * feeders, where the constraint lint simply finds nothing.
-  *
-  * Each entry carries `existingIds` (every `_id` in the sample window) so
-  * FK columns can be cross-checked across tables in O(1) per value. When
-  * `truncated` is `true`, violations on rows beyond the cap are not reported
-  * — the finding description notes the sample cap so the operator understands
-  * the bounded window.
-  */
+   * `ctx.storage.&lt;bucket>.&lt;method>(key, …)` calls whose R2 object key is derived
+   * from the handler's `args` with no server-side scoping — the
+   * `storage_key_from_user_args` input. The bucket read/write/URL/delete methods
+   * key by their first argument, so an arg-derived key is object-level IDOR
+   * (read/overwrite/delete anyone's object). A key referencing a server-trusted
+   * `ctx.*` value (e.g. `${ctx.auth.userId}/…`) is treated as scoped and not
+   * recorded. Supplied by the codegen feeder; absent for runtime callers, where
+   * the lint finds nothing.
+   */
+  storageKeyAccesses?: ReadonlyArray<AdvisorStorageKeyAccess>;
+  /**
+   * Tracked `ctx.storage.&lt;bucket>.&lt;method>(...)` upload/signing calls — the
+   * shared input for the storage config-hygiene lints
+   * (`storage_upload_without_content_type_allowlist`, `storage_upload_without_max_size`,
+   * `storage_generate_upload_url_no_content_type_pin`,
+   * `storage_presigned_url_for_private_content`). Each row carries the method
+   * invoked, which options-object keys were present, and (for the two URL
+   * signers) a statically-known `expiresInSeconds` literal. Supplied by the
+   * codegen feeder; absent for runtime callers, where these lints find
+   * nothing.
+   */
+  storageUploads?: ReadonlyArray<AdvisorStorageUpload>;
+  /**
+   * Bounded row samples per table — the `constraint_validator` lint input.
+   * Supplied by the studio backend, which reads up to the configured row cap
+   * from each table via `readTablePage` and assembles the existing-id set for
+   * FK referential-integrity checks. Absent for static callers or codegen
+   * feeders, where the constraint lint simply finds nothing.
+   *
+   * Each entry carries `existingIds` (every `_id` in the sample window) so
+   * FK columns can be cross-checked across tables in O(1) per value. When
+   * `truncated` is `true`, violations on rows beyond the cap are not reported
+   * — the finding description notes the sample cap so the operator understands
+   * the bounded window.
+   */
   tableSamples?: ReadonlyArray<AdvisorTableSample>;
   /**
-  * Per-table full-scan volume observed at runtime (the hot-scan half of the
-  * `index_utilization` lint input). Sourced from the per-`(function, table)`
-  * full-scan attribution the runtime records (`__lunora_metrics_scans`,
-  * surfaced as `FunctionCallStat.scannedTables`), aggregated across functions
-  * and shards. Absent for static callers, where the lint finds nothing.
-  */
+   * Per-table full-scan volume observed at runtime (the hot-scan half of the
+   * `index_utilization` lint input). Sourced from the per-`(function, table)`
+   * full-scan attribution the runtime records (`__lunora_metrics_scans`,
+   * surfaced as `FunctionCallStat.scannedTables`), aggregated across functions
+   * and shards. Absent for static callers, where the lint finds nothing.
+   */
   tableScans?: ReadonlyArray<AdvisorTableScan>;
   /**
-  * `ctx.workflows.get("name")` call sites discovered in function bodies — the
-  * use-side input the `workflow_unused` and `workflow_unknown_target` lints
-  * cross-reference against {@link LintContext.workflows}. Supplied by the
-  * codegen feeder; absent for runtime callers, where the workflow lints find
-  * nothing.
-  */
+   * `ctx.vectors.&lt;method>(index, { namespace, … })` calls whose `namespace` is
+   * derived from the handler's `args` with no server-side scoping — the
+   * `vectors_namespace_from_user_input` input. A Vectorize namespace partitions one
+   * index into isolated sub-collections, so an arg-derived namespace lets any caller
+   * read or poison another tenant's vectors. A namespace scoped by a server-trusted
+   * `ctx.*` value, or a fixed literal, is not recorded. Supplied by the codegen
+   * feeder; absent for runtime callers, where the lint finds nothing.
+   */
+  vectorNamespaceAccesses?: ReadonlyArray<AdvisorVectorNamespaceAccess>;
+  /**
+   * `ctx.workflows.get("name")` call sites discovered in function bodies — the
+   * use-side input the `workflow_unused` and `workflow_unknown_target` lints
+   * cross-reference against {@link LintContext.workflows}. Supplied by the
+   * codegen feeder; absent for runtime callers, where the workflow lints find
+   * nothing.
+   */
   workflowCalls?: ReadonlyArray<AdvisorWorkflowCall>;
   /**
-  * Workflows declared via `defineWorkflow` exports in `lunora/workflows.ts` —
-  * the declaration-side input for the `workflow_*` lints. Supplied by the
-  * codegen feeder; absent for runtime callers, where the workflow lints find
-  * nothing.
-  */
+   * Workflows declared via `defineWorkflow` exports in `lunora/workflows.ts` —
+   * the declaration-side input for the `workflow_*` lints. Supplied by the
+   * codegen feeder; absent for runtime callers, where the workflow lints find
+   * nothing.
+   */
   workflows?: ReadonlyArray<AdvisorWorkflow>;
+  /**
+   * Committed `wrangler.jsonc` `vars` entries holding plaintext secrets — the
+   * input for the `plaintext_secret_in_wrangler_vars` lint. Supplied by
+   * `@lunora/config` (which reads `wrangler.jsonc`) via the codegen pass-through;
+   * absent for runtime callers, where the lint finds nothing.
+   */
+  wranglerVariables?: ReadonlyArray<AdvisorWranglerVariable>;
 }
 /**
-* A single advisory rule. `run` is pure over its {@link LintContext} so lints are
-* trivially testable and order-independent. Each rule owns the static metadata
-* (`name`/`title`/…) that its findings inherit, keeping individual `Finding`
-* construction to just the per-occurrence `detail`/`metadata`/`cacheKey`.
-*/
+ * A single advisory rule. `run` is pure over its {@link LintContext} so lints are
+ * trivially testable and order-independent. Each rule owns the static metadata
+ * (`name`/`title`/…) that its findings inherit, keeping individual `Finding`
+ * construction to just the per-occurrence `detail`/`metadata`/`cacheKey`.
+ */
 interface Lint {
   /** Concern buckets every finding from this lint carries. */
   categories: Category[];
@@ -786,20 +1949,20 @@ interface Lint {
   title: string;
 }
 /**
-* Minimal structural view of the `@lunora/analytics` SQL client — just its
-* `query(sql)` method. Kept structural (not an `import type` from
-* `@lunora/analytics`) so the advisor needn't depend on the analytics package;
-* the real `AnalyticsSqlClient` satisfies it, as does a plain test double.
-*/
+ * Minimal structural view of the `@lunora/bindings/analytics` SQL client — just its
+ * `query(sql)` method. Kept structural (not an `import type` from
+ * `@lunora/bindings/analytics`) so the advisor needn't depend on the analytics package;
+ * the real `AnalyticsSqlClient` satisfies it, as does a plain test double.
+ */
 interface AnalyticsMetricsSource {
   query: (sql: string) => Promise<{
     rows: ReadonlyArray<Record<string, unknown>>;
   }>;
 }
 /**
-* The AE event-name + dimension-column contract the runtime writes and this
-* reader reads. `blob1` is the event name; dimensions start at `blob2`.
-*/
+ * The AE event-name + dimension-column contract the runtime writes and this
+ * reader reads. `blob1` is the event name; dimensions start at `blob2`.
+ */
 declare const AE_METRIC_EVENTS: {
   /** `lunora.index.hit` — one row per `(table, index)` use. `blob2`=table, `blob3`=index. */
   readonly indexHit: {
@@ -824,21 +1987,21 @@ interface AnalyticsMetricsOptions {
   /** The AE dataset (the wrangler `analytics_engine_datasets[].dataset`) to read from. */
   dataset: string;
   /**
-  * Declared index names per table, used to synthesise the `reads: 0` rows the
-  * `index_utilization` dead-index half needs. AE only stores rows for indexes
-  * that were *used*, so a never-hit index has no AE row at all; supplying the
-  * declared set lets the reader emit an explicit `reads: 0` entry for any
-  * declared index absent from the AE hit feed. Omit it to report only the
-  * positive hit counts AE returns.
-  */
+   * Declared index names per table, used to synthesise the `reads: 0` rows the
+   * `index_utilization` dead-index half needs. AE only stores rows for indexes
+   * that were *used*, so a never-hit index has no AE row at all; supplying the
+   * declared set lets the reader emit an explicit `reads: 0` entry for any
+   * declared index absent from the AE hit feed. Omit it to report only the
+   * positive hit counts AE returns.
+   */
   declaredIndexes?: ReadonlyArray<{
     index: string;
     table: string;
   }>;
   /**
-  * Restrict the shard-traffic read to one sharded-function group (`blob3`).
-  * Omit to read the whole deployment's shard set.
-  */
+   * Restrict the shard-traffic read to one sharded-function group (`blob3`).
+   * Omit to read the whole deployment's shard set.
+   */
   group?: string;
 }
 /** The runtime-lint input arrays this module reconstructs from AE. */
@@ -848,590 +2011,1632 @@ interface AnalyticsRuntimeMetrics {
   tableScans: AdvisorTableScan[];
 }
 /**
-* Reconstruct the runtime-lint input arrays (`shardTraffic` / `tableScans` /
-* `indexHits`) from the Analytics Engine SQL API. The three reads run
-* concurrently; each degrades to an empty array on a query failure, so a
-* partially-misconfigured read path still returns what it can.
-*
-* Feed the result into a {@link LintContext} alongside the declared schema:
-*
-* ```ts
-* const metrics = await loadAnalyticsRuntimeMetrics(client, { dataset: "ANALYTICS" });
-* runAdvisor({ schema, ...metrics }, { source: "runtime" });
-* ```
-*/
+ * Reconstruct the runtime-lint input arrays (`shardTraffic` / `tableScans` /
+ * `indexHits`) from the Analytics Engine SQL API. The three reads run
+ * concurrently; each degrades to an empty array on a query failure, so a
+ * partially-misconfigured read path still returns what it can.
+ *
+ * Feed the result into a {@link LintContext} alongside the declared schema:
+ *
+ * ```ts
+ * const metrics = await loadAnalyticsRuntimeMetrics(client, { dataset: "ANALYTICS" });
+ * runAdvisor({ schema, ...metrics }, { source: "runtime" });
+ * ```
+ */
 declare const loadAnalyticsRuntimeMetrics: (source: AnalyticsMetricsSource, options: AnalyticsMetricsOptions) => Promise<AnalyticsRuntimeMetrics>;
 /**
-* Constraint validator — flag rows that violate declared FK / NOT NULL / UNIQUE
-* constraints by cross-checking sampled row data against the schema.
-*
-* This lint reads the `context.tableSamples` feed (bounded row samples supplied
-* by the studio backend via `readTablePage`) and the declared schema. Three
-* families of check run over each sample:
-*
-* FK referential integrity: for every `one` relation the holding table declares,
-* check that each sampled row's FK column value appears in the target table's
-* sampled id set. A dangling value means no target row exists for the reference.
-*
-* NOT NULL / non-optional columns: the lint surfaces rows with null/undefined in
-* declared fields — inserted before a column was added or via raw import.
-*
-* UNIQUE index violations: for each declared unique secondary index, check the
-* sampled rows for duplicate values across the index's columns.
-*
-* All checks are bounded by the cap in each sample; the lint never triggers an
-* additional read. When a sample is truncated, findings note the caveat.
-*/
+ * Disambiguate {@link Finding}s that share a `cacheKey`.
+ *
+ * A `cacheKey` is the studio's dedup / dismissal id (see {@link Finding.cacheKey}):
+ * two findings with the same key collapse to one row, and a single dismissal
+ * silences both. A lint keyed on `name:file:line` (the argument-derived sinks,
+ * `sql_injection_risk`, `kv_unscoped_user_key_idor`, `hardcoded_secret`, …) can
+ * legitimately emit two occurrences on one physical source line, so without a
+ * within-line discriminator the second finding is silently hidden.
+ *
+ * This suffixes the second-and-later occurrence of any repeated key with
+ * `:&lt;n>` (`:2`, `:3`, …), leaving the first occurrence unsuffixed so existing
+ * single-occurrence keys stay stable across runs. Order is preserved. Keys are
+ * lint-name-prefixed, so this never merges across lints.
+ */
+declare const dedupeCacheKeys: (findings: ReadonlyArray<Finding>) => Finding[];
+/**
+ * Constraint validator — flag rows that violate declared FK / NOT NULL / UNIQUE
+ * constraints by cross-checking sampled row data against the schema.
+ *
+ * This lint reads the `context.tableSamples` feed (bounded row samples supplied
+ * by the studio backend via `readTablePage`) and the declared schema. Three
+ * families of check run over each sample:
+ *
+ * FK referential integrity: for every `one` relation the holding table declares,
+ * check that each sampled row's FK column value appears in the target table's
+ * sampled id set. A dangling value means no target row exists for the reference.
+ *
+ * NOT NULL / non-optional columns: the lint surfaces rows with null/undefined in
+ * declared fields — inserted before a column was added or via raw import.
+ *
+ * UNIQUE index violations: for each declared unique secondary index, check the
+ * sampled rows for duplicate values across the index's columns.
+ *
+ * All checks are bounded by the cap in each sample; the lint never triggers an
+ * additional read. When a sample is truncated, findings note the caveat.
+ */
 declare const constraintValidator: Lint;
 /**
-* `hot_shard` — flag a shard whose request share is disproportionately high.
-*
-* Sharding (`.shardBy(key)`) spreads state and load across many Durable Objects
-* by user / tenant / room. Its whole value is *even* distribution: when one
-* shard absorbs a dominant fraction of traffic, that single DO becomes the
-* bottleneck (one request stream, one SQLite, one WS fan-out) while its siblings
-* idle — the hot-key skew sharding is meant to avoid. That usually means the
-* shard key has too little cardinality, or one entity is unusually busy and
-* needs its own split.
-*
-* The per-shard request volume comes from the runtime feeder
-* (`context.shardTraffic`): the studio backend fans out over the function's
-* shards and reads each shard's recorded `__lunora_metrics` call total. The lint
-* is pure over that distribution, so it only fires once the window has more than
-* one shard and enough total requests (`MIN_TOTAL_REQUESTS`) for the proportion
-* to be trustworthy.
-*/
+ * `hot_shard` — flag a shard whose request share is disproportionately high.
+ *
+ * Sharding (`.shardBy(key)`) spreads state and load across many Durable Objects
+ * by user / tenant / room. Its whole value is *even* distribution: when one
+ * shard absorbs a dominant fraction of traffic, that single DO becomes the
+ * bottleneck (one request stream, one SQLite, one WS fan-out) while its siblings
+ * idle — the hot-key skew sharding is meant to avoid. That usually means the
+ * shard key has too little cardinality, or one entity is unusually busy and
+ * needs its own split.
+ *
+ * The per-shard request volume comes from the runtime feeder
+ * (`context.shardTraffic`): the studio backend fans out over the function's
+ * shards and reads each shard's recorded `__lunora_metrics` call total. The lint
+ * is pure over that distribution, so it only fires once the window has more than
+ * one shard and enough total requests (`MIN_TOTAL_REQUESTS`) for the proportion
+ * to be trustworthy.
+ */
 declare const hotShard: Lint;
 /**
-* `index_utilization` — flag indexes the workload doesn't pay for. Two
-* complementary checks over recorded reads.
-*
-* Dead index — a declared index that recorded reads never used. An unused index
-* is pure overhead: every write maintains it, every byte of storage holds it,
-* and nothing reads through it. Fired off the per-index hit feed
-* (`context.indexHits`); a declared index whose recorded `reads` is `0` is dead.
-* The runtime records this in the durable `__lunora_metrics_index` table (every
-* index use stamps a per-`(table, index)` counter via `onIndexUse`) and surfaces
-* it through the `getMetrics` admin RPC; the studio sums the per-shard arrays
-* into `context.indexHits` (see `AdvisorIndexHit`). The counter is cumulative and
-* never decays, so a non-zero index never reverts to "dead" — `reads: 0` means
-* the index has not been used once since the counter was created.
-*
-* Hot unindexed scan — a table read hot with no index at all. Fired off the
-* full-scan attribution the runtime does record (`context.tableScans`, sourced
-* from `__lunora_metrics_scans` / `FunctionCallStat.scannedTables`): a table
-* whose scan count clears `HOT_SCAN_THRESHOLD` is one the app keeps
-* full-scanning, the runtime-confirmed counterpart to the static
-* `filter_without_index` advisory.
-*/
+ * `index_utilization` — flag indexes the workload doesn't pay for. Two
+ * complementary checks over recorded reads.
+ *
+ * Dead index — a declared index that recorded reads never used. An unused index
+ * is pure overhead: every write maintains it, every byte of storage holds it,
+ * and nothing reads through it. Fired off the per-index hit feed
+ * (`context.indexHits`); a declared index whose recorded `reads` is `0` is dead.
+ * The runtime records this in the durable `__lunora_metrics_index` table (every
+ * index use stamps a per-`(table, index)` counter via `onIndexUse`) and surfaces
+ * it through the `getMetrics` admin RPC; the studio sums the per-shard arrays
+ * into `context.indexHits` (see `AdvisorIndexHit`). The counter is cumulative and
+ * never decays, so a non-zero index never reverts to "dead" — `reads: 0` means
+ * the index has not been used once since the counter was created.
+ *
+ * Hot unindexed scan — a table read hot with no index at all. Fired off the
+ * full-scan attribution the runtime does record (`context.tableScans`, sourced
+ * from `__lunora_metrics_scans` / `FunctionCallStat.scannedTables`): a table
+ * whose scan count clears `HOT_SCAN_THRESHOLD` is one the app keeps
+ * full-scanning, the runtime-confirmed counterpart to the static
+ * `filter_without_index` advisory.
+ */
 declare const indexUtilization: Lint;
 /**
-* Flags an `httpRoute` on an admin/privileged-looking path whose handler shows no
-* auth/admin guard.
-*
-* REST routes (unlike queries/mutations) aren't covered by RLS — they run whatever
-* the handler does, so an `/admin/*` (or `/internal/*`, `/_*`) route with no
-* session/admin check is an open privilege door: anyone who can reach the URL can
-* invoke it. The handler must assert an authenticated, authorized caller
-* (`ctx.auth` / `getSession` / a `requireAdmin`-style guard) before doing
-* privileged work.
-*
-* Detection is heuristic: the feeder records whether the handler body references
-* any known guard token. Runs only when the codegen feeder supplies route evidence
-* (`context.adminRoutes`); a runtime caller flags nothing.
-*/
+ * Flags an action's `ctx.fetch(url, …)` whose URL is derived from the handler's
+ * `args` — a server-side request forgery (SSRF) vector.
+ *
+ * `ctx.fetch` is the action-only outbound-request escape hatch, and it applies no
+ * host allowlist: whatever URL it is handed, it fetches. When that URL comes from
+ * request input (`ctx.fetch(args.url)`, a template embedding `args.*`, or a URL
+ * built one hop earlier from `args`), a caller can point the worker at the cloud
+ * metadata endpoint (`169.254.169.254`) or an internal service and read the
+ * response — classic SSRF. The fix is to validate the URL against an allowlist of
+ * expected hosts before fetching, and to reject private / link-local targets.
+ *
+ * Runs only when the codegen feeder supplies fetch-taint evidence
+ * (`context.argumentDerivedFetches`); a runtime caller flags nothing. One finding per
+ * arg-derived `ctx.fetch` call.
+ */
+declare const actionFetchSsrf: Lint;
+/**
+ * Flags an `httpRoute` on an admin/privileged-looking path whose handler shows no
+ * auth/admin guard.
+ *
+ * REST routes (unlike queries/mutations) aren't covered by RLS — they run whatever
+ * the handler does, so an `/admin/*` (or `/internal/*`, `/_*`) route with no
+ * session/admin check is an open privilege door: anyone who can reach the URL can
+ * invoke it. The handler must assert an authenticated, authorized caller
+ * (`ctx.auth` / `getSession` / a `requireAdmin`-style guard) before doing
+ * privileged work.
+ *
+ * Detection is heuristic: the feeder records whether the handler body references
+ * any known guard token. Runs only when the codegen feeder supplies route evidence
+ * (`context.adminRoutes`); a runtime caller flags nothing.
+ */
 declare const adminRouteWithoutGuard: Lint;
 /**
-* Flags a `ctx.authApi.&lt;method>(...)` call whose argument object omits `headers`.
-*
-* `@lunora/auth`'s `withAuthPlugins` middleware attaches the full privileged
-* better-auth API to `ctx.authApi` — `banUser`, `setRole`, impersonation,
-* `createOrganization`, `removeMember`, etc. better-auth authorizes these calls
-* from the caller's session carried in the `headers` you pass. Called
-* **without** `headers`, better-auth treats the invocation as a trusted
-* server-to-server call and **skips session authorization entirely**. So a
-* header-less `ctx.authApi.banUser({ body })` runs with full privileges
-* regardless of who the caller is — an authorization bypass.
-*
-* This lint runs when the codegen feeder has supplied call evidence
-* (`context.authApiCalls` present); a runtime caller with no evidence flags
-* nothing rather than raising false alarms.
-*/
+ * Flags a `ctx.ai.run(model, …)` call whose model-id argument is derived from
+ * the handler's `args` with no server-side scoping — arbitrary model
+ * selection that bypasses the typed AI-SDK layer.
+ *
+ * `ctx.ai.run` is the raw Workers AI binding passthrough (void-style
+ * `ai.run`), bypassing `ctx.ai.model(...)` plus the AI SDK functions
+ * (`generateText`, `streamText`, …) entirely — no output cap, no schema. When
+ * the model id comes straight from request input (`ctx.ai.run(args.model,
+ * …)`, or one built one hop earlier from `args`), any caller can pick which
+ * model runs, sidestepping whatever the typed path would have enforced. Only
+ * the model argument (`arguments[0]`) is inspected; an arg-derived `inputs`
+ * (`arguments[1]`) is normal, expected usage and is never flagged. A model
+ * scoped by a server-trusted `ctx.*` value is treated as scoped and not
+ * flagged.
+ *
+ * Runs only when the codegen feeder supplies raw-run evidence
+ * (`context.aiRawRuns`); a runtime caller flags nothing. One finding per
+ * arg-derived, unscoped `ctx.ai.run` call.
+ */
+declare const aiRawRunEscapeHatch: Lint;
+/**
+ * Flags a `generateText` / `streamText` call whose model input is user-derived
+ * **and** whose model-callable `tools` reach a privileged side effect.
+ *
+ * The AI SDK lets the model call a `tool({ execute })` to take an action. When
+ * that tool's `execute` performs a real side effect — a DB write, a function
+ * dispatch (`ctx.run`), or an outbound send (fetch / mail / queue) — and the
+ * model's prompt / messages carry user-supplied text, an injected instruction in
+ * that text can steer the model into firing the side effect. The model becomes a
+ * confused deputy: attacker-authored words drive privileged actions. This is the
+ * canonical LLM prompt-injection-to-tool-call hazard.
+ *
+ * Runs only when the codegen feeder supplies generation evidence
+ * (`context.aiToolSideEffects`); a runtime caller flags nothing. Fires only when
+ * the model input is derived from the handler's `args` — a fully server-authored
+ * prompt driving a side-effecting tool is not flagged. Deliberately narrow (an
+ * inherently heuristic rule): one finding per matching call.
+ */
+declare const aiToolSideEffectPromptInjection: Lint;
+/**
+ * Flags a public procedure that runs an AI text/object generation
+ * (`generateText` / `streamText` / `generateObject` / `streamObject`) with no
+ * `maxOutputTokens` bound in its config.
+ *
+ * Each generation call bills against the account's Workers AI / provider budget
+ * in proportion to the tokens produced. Left unbounded and reachable from a
+ * `.public()` procedure, an anonymous caller can request arbitrarily long
+ * completions in a loop — a denial-of-wallet vector — and can also tie up worker
+ * CPU/time on long streams. The fix is to cap output with `maxOutputTokens` (and
+ * ideally rate-limit the entry point).
+ *
+ * Only a call whose config is a visible object literal is judged; a hoisted or
+ * spread config is statically opaque and left un-flagged (fail-open) to avoid a
+ * false positive. Runs only when the codegen feeder supplies procedure-protection
+ * evidence (`context.procedureProtections`); a runtime caller flags nothing.
+ */
+declare const aiUnboundedGenerationPublic: Lint;
+/**
+ * Flags an app that opts into `allowUnauthenticatedShardAccess: true` while its
+ * schema has an RLS gap (no `.rls("required")`, or a `.public()` table).
+ *
+ * `allowUnauthenticatedShardAccess` (a `WorkerOptions` field consumed by
+ * `createWorker(...)`) turns off the fail-closed default that denies a shard
+ * lookup for a request with no verified identity. That is a deliberate, opt-in
+ * posture switch — appropriate for a public/anonymous-first shard resolver — but
+ * combined with a schema that never enforces `.rls("required")` (or that leaves
+ * a table `.public()`, i.e. exempt from it), an unauthenticated caller can shard-hop
+ * and read another tenant's rows with no row-security guard behind the door.
+ *
+ * **Evidence and coverage gap**: this reads `context.configCalls`, fed by the
+ * codegen `discover-config-calls.ts` feeder's `.extend(fn)` callback-shape
+ * support — it only sees the setting when a `lunora/`-local file calls the
+ * generated `defineApp()...extend(() => ({ allowUnauthenticatedShardAccess:
+ * true }))` escape hatch (the pattern the `nuxt` / `analog` templates use in
+ * `lunora/server.ts`). An app that sets the same field via `@lunora/vite`'s
+ * `LunoraPluginOptions` (`vite.config.ts`) or a hand-authored worker entry
+ * outside `lunora/` (the `sveltekit` / `astro` / `react-router` /
+ * `tanstack-start` template style) is invisible to this lint — a coverage gap,
+ * not a false negative this lint claims to catch.
+ *
+ * Runs only when the codegen feeder supplies config-call evidence; a runtime
+ * caller flags nothing. One finding per opted-in `.extend(...)` call site.
+ */
+declare const allowUnauthenticatedShardAccessEnabled: Lint;
+/**
+ * Flags a `ctx.authApi.&lt;method>(...)` call whose argument object omits `headers`.
+ *
+ * `@lunora/auth`'s `withAuthPlugins` middleware attaches the full privileged
+ * better-auth API to `ctx.authApi` — `banUser`, `setRole`, impersonation,
+ * `createOrganization`, `removeMember`, etc. better-auth authorizes these calls
+ * from the caller's session carried in the `headers` you pass. Called
+ * **without** `headers`, better-auth treats the invocation as a trusted
+ * server-to-server call and **skips session authorization entirely**. So a
+ * header-less `ctx.authApi.banUser({ body })` runs with full privileges
+ * regardless of who the caller is — an authorization bypass.
+ *
+ * This lint runs when the codegen feeder has supplied call evidence
+ * (`context.authApiCalls` present); a runtime caller with no evidence flags
+ * nothing rather than raising false alarms.
+ */
 declare const authApiCallWithoutHeaders: Lint;
 /**
-* Detect FK cycles in the declared relation graph via a DFS.
-*
-* A "circular FK" exists when a chain of `one` relations forms a loop — for
-* example `A.authorId → B`, `B.ownerId → C`, `C.postId → A`. Such cycles can
-* cause unexpected behavior during DELETE operations: a CASCADE chain may loop
-* forever (or deadlock), and even a RESTRICT cycle prevents deletion of any row
-* in the loop without temporarily disabling constraints.
-*
-* Only `one` relations are followed because they are the side that owns the FK
-* column (the `field` lives on the holding table). `many` relations point back
-* to the same edge from the opposite side and would cause every edge to be
-* double-counted; skipping them gives the correct directed graph.
-*
-* A single-table self-reference (`A.parentId → A`) is **not** reported: a
-* self-referential FK is the canonical, intentional shape for trees/hierarchies
-* (categories, org charts, threaded comments), so flagging every such schema
-* would be noise. Only multi-table cycles — the ones the description illustrates
-* — are surfaced.
-*
-* Each unique cycle is reported once: the cycle path is canonicalized to its
-* lexicographically smallest rotation so two DFS traversals that enter the same
-* ring at different nodes emit the same cacheKey and detail. A representative
-* cycle is reported for each distinct simple cycle in the graph; overlapping or
-* chord cycles that share interior nodes are each detected independently.
-*/
+ * Flags a `createAuth({...})` call whose `advanced.disableCSRFCheck` is
+ * explicitly `true`.
+ *
+ * better-auth's CSRF check validates the request's origin against
+ * `trustedOrigins` before applying a state-changing auth mutation (sign-in,
+ * sign-up, session revocation, …). `disableCSRFCheck: true` turns that check
+ * off outright, so a cross-site request riding the browser's ambient auth
+ * cookie is processed the same as a same-origin one — the standard CSRF
+ * exposure.
+ *
+ * Runs only when the codegen feeder supplies auth-config evidence
+ * (`context.authConfigs`), and only for an analyzable config (a static,
+ * spread-free object literal); an opaque config could set the key elsewhere
+ * and is skipped rather than guessed at. One finding per matching `createAuth`
+ * call.
+ */
+declare const authCsrfCheckDisabled: Lint;
+/**
+ * Flags a `createAuth({...})` call with `emailAndPassword.enabled: true` and no
+ * `emailAndPassword.requireEmailVerification: true`.
+ *
+ * better-auth defaults `requireEmailVerification` off, so an email/password
+ * account is usable — signed in, able to act — the moment it's created, before
+ * the caller has proven ownership of the email address. That lets an attacker
+ * sign up with a victim's email (or an address they don't control) and operate
+ * the account immediately, and it weakens any downstream flow (password reset,
+ * account recovery) that assumes a verified address.
+ *
+ * Runs only when the codegen feeder supplies auth-config evidence
+ * (`context.authConfigs`), and only for an analyzable config (a static,
+ * spread-free object literal); an opaque config could set the key elsewhere
+ * and is skipped rather than guessed at. One finding per matching `createAuth`
+ * call.
+ */
+declare const authEmailVerificationDisabled: Lint;
+/**
+ * Flags a `createAuth({...})` call whose `advanced.useSecureCookies` is
+ * explicitly `false`.
+ *
+ * `@lunora/auth` defaults `useSecureCookies` ON unless the deployment's
+ * `baseURL` is provably plain `http://` (a local dev origin) — see
+ * `hardenAuthOptions` in `packages/auth/src/create-auth.ts`. An explicit
+ * `useSecureCookies: false` overrides that secure-by-default posture, so the
+ * session cookie ships without the `Secure` attribute even on an HTTPS
+ * deployment — it is then sent over any plaintext connection an attacker can
+ * coerce (mixed-content requests, a downgraded subdomain), exposing the
+ * session.
+ *
+ * Runs only when the codegen feeder supplies auth-config evidence
+ * (`context.authConfigs`), and only for an analyzable config (a static,
+ * spread-free object literal); an opaque config could set the key elsewhere
+ * and is skipped rather than guessed at. One finding per matching `createAuth`
+ * call.
+ */
+declare const authSecureCookiesDisabled: Lint;
+/**
+ * Flags a `createAuth({...})` call whose `session.freshAge` is explicitly the
+ * literal `0`.
+ *
+ * `freshAge` is the window better-auth treats a session as "recently
+ * re-authenticated" for sensitive operations (changing the password, adding a
+ * passkey, revoking other sessions, …) that gate on a fresh session rather than
+ * merely a valid one. Setting it to `0` disables that recent-reauth check
+ * entirely — every sensitive operation is treated as fresh regardless of how
+ * old the session is, so a long-lived stolen session (or token) can perform
+ * them without ever proving the caller still controls the credentials.
+ *
+ * Runs only when the codegen feeder supplies auth-config evidence
+ * (`context.authConfigs`), and only for an analyzable config (a static,
+ * spread-free object literal); an opaque config could set the key elsewhere
+ * and is skipped rather than guessed at. One finding per matching `createAuth`
+ * call.
+ */
+declare const authSessionFreshageZero: Lint;
+/**
+ * Flags a `createAuth({...})` call whose `trustedOrigins` array literal
+ * contains a `"*"` entry.
+ *
+ * better-auth's `trustedOrigins` is the allowlist its CSRF/origin validation
+ * checks every state-changing request against. A `"*"` entry disables that
+ * check entirely — any origin is accepted, which is exactly the protection
+ * Lunora leans on to keep cross-site requests from riding an authenticated
+ * cookie.
+ *
+ * Runs only when the codegen feeder supplies auth-config evidence
+ * (`context.authConfigs`), and only for an analyzable config (a static,
+ * spread-free object literal); an opaque config could set `trustedOrigins`
+ * elsewhere and is skipped rather than guessed at. One finding per matching
+ * `createAuth` call.
+ */
+declare const authTrustedOriginsWildcard: Lint;
+/**
+ * Flags a `createBrowser({ allowPrivateTargets: true })`.
+ *
+ * `@lunora/browser` blocks navigation to private / internal / loopback addresses
+ * by default — that guard is what stops a browser action from being turned into a
+ * server-side request forgery (SSRF) tool that reaches cloud metadata endpoints
+ * (`169.254.169.254`), internal services, or `localhost`. Setting
+ * `allowPrivateTargets: true` disables it wholesale. Combined with a
+ * request-supplied URL that is the classic SSRF-to-metadata exfiltration path.
+ *
+ * Runs only when the codegen feeder supplies config-call evidence
+ * (`context.configCalls`); a runtime caller flags nothing. One finding per
+ * opted-out browser.
+ */
+declare const browserAllowPrivateTargets: Lint;
+/**
+ * Flags a `ctx.browser.&lt;method>(url, …)` call whose navigation URL is derived
+ * from the handler's `args` with no server-side scoping — and no hardened
+ * `createBrowser` allowlist to contain it.
+ *
+ * `@lunora/browser` blocks navigation to private/internal/loopback addresses by
+ * default, but that guard only stops SSRF to *internal* targets. A
+ * request-supplied *public* URL still turns the headless browser into an
+ * open-proxy / request-forgery tool: any caller can make the deployment fetch
+ * an arbitrary third-party URL (SSRF to public cloud APIs that trust the egress
+ * IP, data exfiltration through the fetched URL), and — without pinned DNS — a
+ * public hostname can rebind to an internal address after the guard's check.
+ * The containment is an `allowedHosts` allowlist on `createBrowser`, or a
+ * pinned `resolveDns`. This lint therefore suppresses all findings when the
+ * config-call evidence shows a `createBrowser` hardened with either key; only
+ * an unhardened browser reaching an arg-derived URL is flagged.
+ *
+ * Runs only when the codegen feeder supplies browser URL-access evidence
+ * (`context.browserUrlAccesses`); a runtime caller flags nothing. One finding
+ * per arg-derived, unscoped `ctx.browser` navigation.
+ */
+declare const browserUserUrlWithoutAllowlist: Lint;
+/**
+ * Detect FK cycles in the declared relation graph.
+ *
+ * A "circular FK" exists when a chain of `one` relations forms a loop — for
+ * example `A.authorId → B`, `B.ownerId → C`, `C.postId → A`. Such cycles can
+ * cause unexpected behavior during DELETE operations: a CASCADE chain may loop
+ * forever (or deadlock), and even a RESTRICT cycle prevents deletion of any row
+ * in the loop without temporarily disabling constraints.
+ *
+ * Only `one` relations are followed because they are the side that owns the FK
+ * column (the `field` lives on the holding table). `many` relations point back
+ * to the same edge from the opposite side and would cause every edge to be
+ * double-counted; skipping them gives the correct directed graph.
+ *
+ * A single-table self-reference (`A.parentId → A`) is **not** reported: a
+ * self-referential FK is the canonical, intentional shape for trees/hierarchies
+ * (categories, org charts, threaded comments), so flagging every such schema
+ * would be noise. Only multi-table cycles — the ones the description illustrates
+ * — are surfaced.
+ *
+ * Cycle enumeration uses **Johnson's algorithm** rather than a naive
+ * enumerate-all-paths DFS. A plain path-DFS re-walks every simple path in the
+ * graph, which is worst-case exponential even on a fully **acyclic** schema
+ * (reconverging FK fan-out — many tables referencing shared parents in a chain —
+ * makes codegen appear to hang). Johnson blocks a vertex once a fruitless
+ * subtree is exhausted and only unblocks it when a new cycle through it is
+ * found, so it runs in `O((V + E)(C + 1))` for `C` elementary circuits — no
+ * blowup on acyclic input. Each circuit is enumerated exactly once from its
+ * lowest-indexed member (vertices are ordered lexicographically), so overlapping
+ * / chord cycles that share interior nodes are each detected independently. The
+ * emitted cycle is still canonicalized to its lexicographically smallest
+ * rotation for a stable cacheKey.
+ */
 declare const circularFk: Lint;
 /**
-* Flags a container declared on a large instance type. The big `standard-3` /
-* `standard-4` sizes (and large custom shapes) are billed on their provisioned
-* memory + disk for the whole time an instance runs, so an over-provisioned
-* container is a standing cost. Informational — a real workload may need it —
-* but worth surfacing so the choice is deliberate.
-*/
+ * Flags a `ctx.containers.&lt;exportName>.get(name, …)` call whose instance key
+ * is derived from the handler's `args` with no server-side scoping — a
+ * cross-tenant container IDOR.
+ *
+ * A container definition's `.get(name)` accessor routes to one Durable
+ * Object-backed container instance per `name` — one container per entity
+ * (user, room, job…). When the key comes straight from request input
+ * (`ctx.containers.app.get(args.id)`, a template embedding `args.*`, or a key
+ * built one hop earlier from `args`), any caller can hand in another tenant's
+ * key and reach that tenant's container instance. The fix is to derive the
+ * key from a server-trusted identity (`` `${ctx.auth.userId}` ``) or a record
+ * the caller owns — a key that references `ctx` is treated as scoped and is
+ * not flagged. `.any()`/`.pool()` are not sinks (they take no key).
+ *
+ * Runs only when the codegen feeder supplies container key-access evidence
+ * (`context.containerKeyAccesses`); a runtime caller flags nothing. One
+ * finding per arg-derived, unscoped `ctx.containers.*.get` call.
+ */
+declare const containerInstanceKeyFromUserInput: Lint;
+/**
+ * Flags a container declared on a large instance type. The big `standard-3` /
+ * `standard-4` sizes (and large custom shapes) are billed on their provisioned
+ * memory + disk for the whole time an instance runs, so an over-provisioned
+ * container is a standing cost. Informational — a real workload may need it —
+ * but worth surfacing so the choice is deliberate.
+ */
 declare const containerOversizedInstance: Lint;
 /**
-* Flags a container that leaves outbound internet access at the platform
-* default (`enableInternet: true`). Egress is billed per GB and an open
-* outbound path widens the attack surface, so a container that doesn't call
-* external services should set `enableInternet: false` explicitly. We can't
-* tell from config whether egress is actually used, so this is an INFO nudge to
-* make the choice deliberate, not an error.
-*
-* Only fires when the field was omitted (or a non-literal we couldn't read) —
-* an explicit `enableInternet: true` is treated as a deliberate opt-in and left
-* alone.
-*/
+ * Flags a container that leaves outbound internet access at the platform
+ * default (`enableInternet: true`). Egress is billed per GB and an open
+ * outbound path widens the attack surface, so a container that doesn't call
+ * external services should set `enableInternet: false` explicitly. We can't
+ * tell from config whether egress is actually used, so this is an INFO nudge to
+ * make the choice deliberate, not an error.
+ *
+ * Only fires when the field was omitted (or a non-literal we couldn't read) —
+ * an explicit `enableInternet: true` is treated as a deliberate opt-in and left
+ * alone.
+ */
 declare const containerPublicInternet: Lint;
-/**
-* Lunora port of splinter's `0009_duplicate_index`.
-*
-* A btree secondary index is redundant when another index already serves every
-* lookup it does — i.e. its columns are a leading prefix of the other's
-* (SQLite's leftmost-prefix rule means `["a", "b"]` already covers `["a"]`).
-* Exact duplicates are the degenerate case. A redundant index is pure overhead:
-* extra storage and a write amplified on every insert/update/delete.
-*
-* Only `kind: "index"` participates — search/rank/vector indexes are distinct
-* structures, never redundant with a btree. A `unique` index is never reported
-* as redundant even when its columns are a prefix: it enforces a constraint the
-* covering index does not, so dropping it would change behavior.
-*/
+declare const containerRuntimeEgressRelaxation: Lint;
+declare const containerStartEnableInternetOverride: Lint;
+/**
+ * Lunora port of splinter's `0009_duplicate_index`.
+ *
+ * A btree secondary index is redundant when another index already serves every
+ * lookup it does — i.e. its columns are a leading prefix of the other's
+ * (SQLite's leftmost-prefix rule means `["a", "b"]` already covers `["a"]`).
+ * Exact duplicates are the degenerate case. A redundant index is pure overhead:
+ * extra storage and a write amplified on every insert/update/delete.
+ *
+ * Only `kind: "index"` participates — search/rank/vector indexes are distinct
+ * structures, never redundant with a btree. A `unique` index is never reported
+ * as redundant even when its columns are a prefix: it enforces a constraint the
+ * covering index does not, so dropping it would change behavior.
+ */
 declare const duplicateIndex: Lint;
 /**
-* Flags a secondary index declared with no columns (`.index("x", [])`). The
-* `.index(name, fields)` builder types `fields` as `string[]`, not
-* `keyof Shape[]`, so an empty array slips past the compiler — but an index over
-* zero columns indexes nothing and can never narrow a read. Almost always a
-* leftover from a refactor. (Search / rank / vector indexes always carry at
-* least one field by construction, so only `kind: "index"` is checked.)
-*/
+ * Flags a secondary index declared with no columns (`.index("x", [])`). The
+ * `.index(name, fields)` builder types `fields` as `string[]`, not
+ * `keyof Shape[]`, so an empty array slips past the compiler — but an index over
+ * zero columns indexes nothing and can never narrow a read. Almost always a
+ * leftover from a refactor. (Search / rank / vector indexes always carry at
+ * least one field by construction, so only `kind: "index"` is checked.)
+ */
 declare const emptyIndex: Lint;
 /**
-* Flags a query read that calls `.filter()` without first narrowing with
-* `.withIndex()` / `.withSearchIndex()`. Such a read loads *every* row of the
-* table and applies the predicate in memory — a full table scan that degrades
-* linearly as the table grows. The healthy pattern is `.withIndex(...)` to
-* narrow, then `.filter(...)` only for predicates the index can't express
-* (which is why an indexed read with a trailing `.filter()` is NOT flagged).
-*
-* The query reads come from the codegen feeder, which parses
-* `ctx.db.query("table")…` chains out of function bodies. Runtime callers supply
-* no `queries`, so this lint is a no-op there.
-*/
+ * Flags a `.source({ mode: "incremental" })` table that declares neither a
+ * `reconcileEveryMs` sweep nor a `softDeleteColumn` (plan 136).
+ *
+ * Incremental ingest pulls only rows past a watermark, so an upstream **delete**
+ * is invisible to it — the deleted row simply stops appearing in the changed-rows
+ * slice, and the locally-materialized copy lingers forever. Over time the table
+ * fills with phantom rows that no longer exist upstream, which `defineShape` then
+ * serves to clients as live data. That is silent data corruption, so it is an
+ * `ERROR` (STOP) that fails the build.
+ *
+ * The fix is a declared delete-visibility path: `reconcileEveryMs` (a periodic
+ * full-pull sweep that GCs vanished rows) or `softDeleteColumn` (an upstream
+ * tombstone column the incremental pull returns, turned into a local delete).
+ *
+ * `defineSchema` throws on this exact condition too — this lint is the build-time
+ * mirror (same belt-and-suspenders as `external_source_unscoped`), and it also
+ * covers the `unanalyzable` config case the runtime guard can't see.
+ *
+ * **Evidence supply**: reads `table.externalSource.{mode,hasReconcile,hasSoftDelete}`
+ * (the codegen feeder captures them from `.source({...})`; the runtime feeder
+ * derives them). A non-incremental source, or one with either delete path, is skipped.
+ */
+declare const externalSourceIncrementalNoDeletePath: Lint;
+/**
+ * Flags a table that is both `.source(...)` and `.global()`.
+ *
+ * The two are contradictory. `.global()` already places a table in an external
+ * store (D1, or a Hyperdrive-fronted Postgres/MySQL) that Lunora owns the schema
+ * for and reads through the global backend. `.source(...)` declares the table as
+ * **materialized from** an external database into a shard DO's SQLite by the
+ * ingest poll loop. A table cannot simultaneously live in the global tier and be
+ * polled into per-shard SQLite — the ingest loop has no DO-local table to write,
+ * and the global backend has no poll loop. This is a definite misconfiguration,
+ * so it is an `ERROR`.
+ *
+ * **Evidence supply**: reads `table.externalSource` + `table.shardKind`. Skipped
+ * unless both a sourced declaration and the `global` tier are present.
+ */
+declare const externalSourceOnGlobal: Lint;
+/**
+ * Flags a `.source(...)` + `.shardBy(...)` table that has no `tenantBy` mapper.
+ *
+ * Per-shard SQLite isolation only controls *where* materialized rows land — not
+ * what* the ingest query pulls. A sourced + sharded table whose `tenantBy` is
+ * absent runs the same unscoped membership query on every tenant's Durable
+ * Object, so each agent replicates the **entire** multitenant table into its own
+ * SQLite (and then to its clients via `defineShape`). That is a cross-tenant data
+ * leak, not a performance nit — so it is an `ERROR` that fails the build.
+ *
+ * `tenantBy(shardKey)` is the boundary: it binds this DO's shard key into the
+ * query's parameters so the tenant can only ever pull its own rows.
+ *
+ * **Evidence supply**: reads `table.externalSource` (the codegen feeder captures
+ * it from `.source({...})`; the runtime feeder derives it). A table without a
+ * sourced declaration, or one not sharded, is skipped.
+ */
+declare const externalSourceUnscoped: Lint;
+/**
+ * Flags a query read that calls `.filter()` without first narrowing with
+ * `.withIndex()` / `.withSearchIndex()`. Such a read loads *every* row of the
+ * table and applies the predicate in memory — a full table scan that degrades
+ * linearly as the table grows. The healthy pattern is `.withIndex(...)` to
+ * narrow, then `.filter(...)` only for predicates the index can't express
+ * (which is why an indexed read with a trailing `.filter()` is NOT flagged).
+ *
+ * The query reads come from the codegen feeder, which parses
+ * `ctx.db.query("table")…` chains out of function bodies. Runtime callers supply
+ * no `queries`, so this lint is a no-op there.
+ */
 declare const filterWithoutIndex: Lint;
 /**
-* Flags a secret-shaped string literal checked into the lunora source.
-*
-* A live API key, access key, private key, or high-entropy token committed to the
-* codebase leaks the moment the repo is cloned, forked, or its history is read —
-* and rotating it means a redeploy. Secrets belong in `.dev.vars` locally and
-* `wrangler secret put` in production, read at runtime via `env`. This lint
-* surfaces the same class of finding the pre-commit `vis secrets` gate catches,
-* inside the studio Advisors table.
-*
-* Runs only when the codegen feeder supplies secret evidence
-* (`context.secretLiterals`); a runtime caller flags nothing. One finding per
-* literal.
-*/
+ * Flags a `ctx.flags.boolean(key, default)` read on a security-shaped key whose
+ * fail-open default selects the *permissive* branch.
+ *
+ * OpenFeature returns the caller-supplied default when the provider errors, so a
+ * flag read is a security decision that fails to its default. When the key names
+ * a protection (`enforce*`/`rls*`/`gate*`/`lockdown*`) and defaults `false`, or
+ * names a permission/bypass (`allow*`/`permit*`/`bypass*`) and defaults `true`,
+ * a flag-backend outage silently disables the protection or grants the
+ * permission for every request.
+ *
+ * Runs only when the codegen feeder supplies flag-default evidence
+ * (`context.flagSecurityDefaults`); a runtime caller flags nothing. Deliberately
+ * narrow — matched on security-shaped key tokens with an unambiguous polarity
+ * plus a boolean-literal default; keys whose polarity is indeterminate (a bare
+ * `auth`/`admin`) or contradictory are skipped to keep the false-positive rate
+ * low. One finding per read.
+ */
+declare const flagGatesSecurityWithUnsafeDefault: Lint;
+/**
+ * Flags a secret-shaped string literal checked into the lunora source.
+ *
+ * A live API key, access key, private key, or high-entropy token committed to the
+ * codebase leaks the moment the repo is cloned, forked, or its history is read —
+ * and rotating it means a redeploy. Secrets belong in `.dev.vars` locally and
+ * `wrangler secret put` in production, read at runtime via `env`. This lint
+ * surfaces the same class of finding the pre-commit `vis secrets` gate catches,
+ * inside the studio Advisors table.
+ *
+ * Runs only when the codegen feeder supplies secret evidence
+ * (`context.secretLiterals`); a runtime caller flags nothing. One finding per
+ * literal.
+ */
 declare const hardcodedSecret: Lint;
 /**
-* Flags a Hyperdrive `ctx.sql` access inside a `query(...)` or `mutation(...)`
-* handler body.
-*
-* Hyperdrive (`@lunora/hyperdrive`) points at an **external** Postgres/MySQL
-* database Lunora does not own. A `ctx.sql` query is a network round-trip with a
-* mutable result — non-deterministic, exactly like `fetch` — so it breaks the
-* determinism the coordinator relies on when it re-runs a query on subscription
-* re-evaluation or a mutation on OCC retry. Worse, external writes are invisible
-* to the DO/SQLite change-feed, so a subscription will never re-fire on them.
-* `ctx.sql` is therefore wired onto `ActionCtx` **only** and belongs exclusively
-* in `action(...)` handlers; using it in a query/mutation is the same class of
-* bug as `fetch`/`Date.now`.
-*
-* This is the enforcement teeth behind the action-only rule — runtime
-* enforcement is still absent (see `MEMORY.md` "Query/mutation determinism not
-* enforced"), so the lint is the guardrail.
-*
-* This lint runs when the codegen feeder has supplied access evidence
-* (`context.hyperdriveCalls` present); a runtime caller with no evidence flags
-* nothing rather than raising false alarms. The feeder records accesses only
-* inside `query`/`mutation` handlers, so `action(...)` bodies never reach here.
-*/
+ * Flags an `httpAction`/`httpRoute` handler that performs a side effect
+ * (`ctx.runMutation` / `ctx.runAction` / a `ctx.db` write) but never reads
+ * `ctx.auth`.
+ *
+ * Unlike `query`/`mutation`/`action` procedures — which run under a resolved
+ * identity and RLS — a raw HTTP handler is reached directly from the public
+ * internet with no framework-supplied auth step. `HttpActionCtx` still exposes
+ * `ctx.auth` (`getIdentity()` / `userId`), but nothing forces the handler to
+ * consult it. A handler that mutates state or dispatches an action without ever
+ * touching `ctx.auth` is an unauthenticated write endpoint: any anonymous caller
+ * can drive the side effect, and the downstream `runMutation`/`runAction`/`db`
+ * write runs with whatever ambient authority the handler carries — bypassing the
+ * identity/RLS checks the rest of the app relies on. Distinct from
+ * `admin_route_without_guard`, which covers Studio/admin-path routes.
+ *
+ * Runs only when the codegen feeder supplies HTTP-handler evidence
+ * (`context.httpActionGuards`); a runtime caller flags nothing. The feeder only
+ * records handlers that already perform a side effect and whose `ctx` binding was
+ * statically resolvable (a named-function or wrapped handler is skipped,
+ * fail-safe), so this lint just filters to those that never read `ctx.auth`. One
+ * finding per handler.
+ */
+declare const httpActionMissingAuthGuard: Lint;
+/**
+ * Flags an `httpAction` handler that writes a response-header value derived from
+ * raw request input (`request.headers`, `request.url`/query, `await
+ * request.json()`) with no CR/LF sanitizer.
+ *
+ * A `Request`-derived string placed verbatim into a response header lets a caller
+ * smuggle carriage-return/line-feed sequences (`\r\n`) into the response — injecting
+ * additional headers (`Set-Cookie`, `Location`, CORS) or splitting the response body
+ * (HTTP response splitting / header injection). Unlike `query`/`mutation` handlers,
+ * a raw `httpAction` builds its own `Response`, so nothing forces the value through
+ * the framework's `isSafeHeaderValue` CR/LF guard.
+ *
+ * Runs only when the codegen feeder supplies header-write evidence
+ * (`context.httpHeaderWrites`); a runtime caller flags nothing. The feeder records
+ * a site only when its value is request-tainted AND unguarded — a value routed
+ * through `isSafeHeaderValue`, `encodeURIComponent`/`encodeURI`, a numeric coercion
+ * (`Number`/`parseInt`/`parseFloat`), or `btoa` is treated as safe and never
+ * recorded. One finding per unsafe header write.
+ */
+declare const httpActionResponseHeaderInjection: Lint;
+/**
+ * Flags a Hyperdrive `ctx.sql` access inside a `query(...)` or `mutation(...)`
+ * handler body.
+ *
+ * Hyperdrive (`@lunora/hyperdrive`) points at an **external** Postgres/MySQL
+ * database Lunora does not own. A `ctx.sql` query is a network round-trip with a
+ * mutable result — non-deterministic, exactly like `fetch` — so it breaks the
+ * determinism the coordinator relies on when it re-runs a query on subscription
+ * re-evaluation or a mutation on OCC retry. Worse, external writes are invisible
+ * to the DO/SQLite change-feed, so a subscription will never re-fire on them.
+ * `ctx.sql` is therefore wired onto `ActionCtx` **only** and belongs exclusively
+ * in `action(...)` handlers; using it in a query/mutation is the same class of
+ * bug as `fetch`/`Date.now`.
+ *
+ * This is the enforcement teeth behind the action-only rule — runtime
+ * enforcement is still absent (see `MEMORY.md` "Query/mutation determinism not
+ * enforced"), so the lint is the guardrail.
+ *
+ * This lint runs when the codegen feeder has supplied access evidence
+ * (`context.hyperdriveCalls` present); a runtime caller with no evidence flags
+ * nothing rather than raising false alarms. The feeder records accesses only
+ * inside `query`/`mutation` handlers, so `action(...)` bodies never reach here.
+ */
 declare const hyperdriveOutsideAction: Lint;
 /**
-* A correctness lint with no splinter analogue — it exploits Lunora's static
-* edge: the schema is fully declared, so a typo'd index column is catchable at
-* codegen time rather than surfacing as a runtime error or a silently
-* never-matching index.
-*
-* Every index (secondary / search / rank / vector) names the columns it covers;
-* each must be a declared column of the table (or a system field). A reference
-* to an unknown column is almost always a typo or a column that was renamed
-* without updating the index.
-*/
+ * Flags an authorization read of an identity claim that is **not** in the app's
+ * declared `defineIdentity({ ... })` contract.
+ *
+ * `defineIdentity` is the trust boundary for `ctx.auth.identity`: the worker
+ * validates a resolver's returned claims against the *declared* validators, but
+ * — by design — forwards any **undeclared** claims through verbatim, unchecked.
+ * So a policy predicate or authorize hook that reads `auth.identity.&lt;key>` for a
+ * `&lt;key>` the contract never declares is trusting a value the runtime never
+ * validated — a claim an attacker's token can carry with an arbitrary value.
+ * Reading `userId` (always declared) or any declared claim is fine.
+ *
+ * Runs only when the codegen feeder supplies claim-read evidence
+ * (`context.identityClaimReads`) — which it does only when a resolvable
+ * `defineIdentity` contract exists — so an app with no typed identity contract,
+ * or a runtime caller, flags nothing. One finding per undeclared read.
+ */
+declare const identityUndeclaredClaimTrusted: Lint;
+/**
+ * Flags a `buildImageDeliveryUrl({ key, … })` call (`@lunora/bindings/images`)
+ * whose `key` is derived from the handler's `args` with no server-side scoping.
+ *
+ * `key` is the CDN transform's source image — an absolute URL, or an
+ * origin-relative key under the account's own store — that `buildImageDeliveryUrl`
+ * splices into the `/cdn-cgi/image/…` delivery URL. `ctx.images.transform`/`info`
+ * take image *bytes*, never a URL, so they carry no equivalent risk and are not
+ * flagged. An arg-derived `key` lets any caller point the CDN's on-the-fly
+ * transform at an attacker-chosen origin (SSRF / open proxy against whatever
+ * that origin trusts the CDN's egress IP for) or at an arbitrary key under the
+ * account's own store.
+ *
+ * Runs only when the codegen feeder supplies image-delivery-URL evidence
+ * (`context.imageDeliveryUrlAccesses`); a runtime caller flags nothing. One
+ * finding per arg-derived, unscoped `key`.
+ */
+declare const imagesUrlSourceFromUserInput: Lint;
+/**
+ * A correctness lint with no splinter analogue — it exploits Lunora's static
+ * edge: the schema is fully declared, so a typo'd index column is catchable at
+ * codegen time rather than surfacing as a runtime error or a silently
+ * never-matching index.
+ *
+ * Every index (secondary / search / rank / vector) names the columns it covers;
+ * each must be a declared column of the table (or a system field). A reference
+ * to an unknown column is almost always a typo or a column that was renamed
+ * without updating the index.
+ */
 declare const indexReferencesUnknownField: Lint;
 /**
-* Flags a public procedure that reads a table for which at least one other
-* procedure declares a column mask (evidence the developer decided that table
-* carries sensitive columns), but whose own builder chain does NOT include
-* `.use(mask(...))`.
-*
-* Lunora masking is **opt-in per procedure**: a `mask(policies)` object only
-* redacts columns inside procedures whose builder chain includes
-* `.use(mask(policies))`. A procedure without it returns the raw column value —
-* even when another procedure in the same app declares that column maskable.
-* This is the "one procedure masks `users.email`, another leaks it" failure
-* mode, the column-level sibling of `rls_uncovered_table`.
-*
-* **Granularity**: the lint is table-granular, not column-precise. Statically
-* proving that a procedure *returns* a specific masked column would need
-* return-shape analysis that is infeasible over the IR; instead the lint flags a
-* public procedure that *reads* a mask-covered table without any
-* `.use(mask(...))` of its own, and the finding lists the masked columns the
-* developer flagged elsewhere. Only reads are considered — masking is a
-* read/return-path concern, so writes never trigger it.
-*
-* **Scope**: only `public` procedures are flagged. `internal*` procedures
-* (e.g. `internalQuery`, `internalMutation`) intentionally bypass masking, so
-* flagging them would produce only noise. Remediation text notes this exemption.
-*
-* **Evidence supply**: this lint runs only when the codegen feeder has supplied
-* `context.maskProcedures`; a runtime caller with no evidence flags nothing
-* rather than raising false alarms.
-*
-* **Conservative policy detection**: when a procedure calls `mask(policies)`
-* with a non-literal object (a variable reference), the feeder cannot statically
-* enumerate the masked `(table, column)` pairs. In that case the procedure is
-* still marked `usesMask: true` (so it is NOT itself flagged), but its pairs
-* contribute nothing to the masked-column map. The lint may under-report (false
-* negatives) when policies are extracted into named constants, but never
-* over-reports (no false positives).
-*/
+ * Flags a public procedure whose handler calls `ctx.db.insertManyUnsafe(...)`.
+ *
+ * `insertManyUnsafe` is the bulk-insert escape hatch: it writes rows straight to
+ * storage, bypassing the per-row argument validators AND the schema's insert
+ * triggers (which is where server-trusted columns, ownership stamping, and RLS
+ * write checks live). That is acceptable for a seed script or an internal import
+ * fed server-trusted rows — but on a `.public()` procedure the rows are shaped
+ * from request input, so the bypass lets a caller write columns they should never
+ * control and skip every trigger-enforced invariant. The fix is to use the
+ * validated `ctx.db.insert(...)` path, or keep the unsafe bulk write in an
+ * internal function fed only server-built rows.
+ *
+ * Runs only when the codegen feeder supplies procedure-protection evidence
+ * (`context.procedureProtections`); a runtime caller flags nothing. One finding
+ * per public procedure using the unsafe bulk insert.
+ */
+declare const insertManyUnsafeUserData: Lint;
+/**
+ * Flags a `ctx.kv` read/write whose namespace key is derived from the handler's
+ * `args` with no server-side scoping — a namespace-level insecure direct object
+ * reference (IDOR).
+ *
+ * Workers KV is a single flat namespace with no per-caller isolation. When a key
+ * comes straight from request input (`ctx.kv.get(args.key)`, a template embedding
+ * `args.*`, or a key built one hop earlier from `args`), any caller can hand in
+ * another user's key and read, overwrite, or delete that user's entry. The fix is
+ * to prefix every key with a server-trusted identity (`` `${ctx.auth.userId}:…` ``)
+ * so a caller can only ever address their own entries — a key that references
+ * `ctx` is treated as scoped and is not flagged. `list` is not a sink (it takes a
+ * prefix, not a per-entry key).
+ *
+ * Runs only when the codegen feeder supplies KV key-access evidence
+ * (`context.kvKeyAccesses`); a runtime caller flags nothing. One finding per
+ * arg-derived, unscoped `ctx.kv` call.
+ */
+declare const kvUnscopedUserKeyIdor: Lint;
+/**
+ * Flags a `createInboundEmailHandler({...})` built without a `verify` hook.
+ *
+ * An inbound email handler receives mail from the public internet, where the
+ * `from` address is trivially spoofable and the DKIM/SPF/DMARC verdicts are only
+ * meaningful if the handler actually checks them. The `verify` hook is where that
+ * check belongs. Omit it and the handler trusts every message it receives — and
+ * when the handler dispatches into a Lunora function (which runs under the admin
+ * bearer, with RLS disabled), a forged sender can drive privileged writes: a
+ * confused-deputy escalation reachable by anyone who can send an email.
+ *
+ * Runs only when the codegen feeder supplies config-call evidence
+ * (`context.configCalls`); a runtime caller flags nothing. Skips calls whose
+ * config wasn't a static object literal. One finding per unverified handler.
+ */
+declare const mailInboundDispatchWithoutVerify: Lint;
+/**
+ * Flags a `ctx.mail`/`ctx.email` `send`/`queue` call whose recipient field
+ * (to/cc/bcc) is derived from the handler's `args` with no server-side
+ * scoping.
+ *
+ * A recipient derived straight from request input turns the deployment into
+ * an open relay / spam amplifier — any caller can direct mail to an arbitrary
+ * address just by supplying it as an argument. The fix is to derive
+ * recipients from server-trusted state (e.g. the authenticated user's own
+ * record via `ctx.auth`), never straight from `args`; if user-chosen
+ * recipients are a genuine product requirement, gate the path behind
+ * authentication and rate limiting rather than leaving it open to any caller.
+ *
+ * Runs only when the codegen feeder supplies mail recipient-access evidence
+ * (`context.mailRecipientAccesses`); a runtime caller flags nothing. One
+ * finding per offending `ctx.mail`/`ctx.email` call — not per recipient field.
+ */
+declare const mailRecipientFromRequestInput: Lint;
+/**
+ * Flags a public procedure that reads a table for which at least one other
+ * procedure declares a column mask (evidence the developer decided that table
+ * carries sensitive columns), but whose own builder chain does NOT include
+ * `.use(mask(...))`.
+ *
+ * Lunora masking is **opt-in per procedure**: a `mask(policies)` object only
+ * redacts columns inside procedures whose builder chain includes
+ * `.use(mask(policies))`. A procedure without it returns the raw column value —
+ * even when another procedure in the same app declares that column maskable.
+ * This is the "one procedure masks `users.email`, another leaks it" failure
+ * mode, the column-level sibling of `rls_uncovered_table`.
+ *
+ * **Granularity**: the lint is table-granular, not column-precise. Statically
+ * proving that a procedure *returns* a specific masked column would need
+ * return-shape analysis that is infeasible over the IR; instead the lint flags a
+ * public procedure that *reads* a mask-covered table without any
+ * `.use(mask(...))` of its own, and the finding lists the masked columns the
+ * developer flagged elsewhere. Only reads are considered — masking is a
+ * read/return-path concern, so writes never trigger it.
+ *
+ * **Scope**: only `public` procedures are flagged. `internal*` procedures
+ * (e.g. `internalQuery`, `internalMutation`) intentionally bypass masking, so
+ * flagging them would produce only noise. Remediation text notes this exemption.
+ *
+ * **Evidence supply**: this lint runs only when the codegen feeder has supplied
+ * `context.maskProcedures`; a runtime caller with no evidence flags nothing
+ * rather than raising false alarms.
+ *
+ * **Conservative policy detection**: when a procedure calls `mask(policies)`
+ * with a non-literal object (a variable reference), the feeder cannot statically
+ * enumerate the masked `(table, column)` pairs. In that case the procedure is
+ * still marked `usesMask: true` (so it is NOT itself flagged), but its pairs
+ * contribute nothing to the masked-column map. The lint may under-report (false
+ * negatives) when policies are extracted into named constants, but never
+ * over-reports (no false positives).
+ */
 declare const maskUncoveredPiiColumn: Lint;
 /**
-* Flags a non-deterministic API call inside a `query(...)` or `mutation(...)`
-* handler body.
-*
-* Lunora queries and mutations must be **deterministic**: the coordinator may
-* re-run a mutation on optimistic-concurrency (OCC) retry and a query on
-* subscription re-evaluation, so a handler that reads wall-clock time, draws
-* randomness, or hits the network can produce different results on each run —
-* breaking read-your-writes, cache invalidation, and replayable history.
-* `Date.now`, `Math.random`, `crypto.randomUUID`, `crypto.getRandomValues`, and
-* `fetch` are therefore disallowed in query/mutation handlers and belong in an
-* `action(...)`, which runs exactly once and may use ambient/non-deterministic
-* APIs freely (pass the result into a mutation as an argument).
-*
-* This lint runs when the codegen feeder has supplied call evidence
-* (`context.nondeterministicCalls` present); a runtime caller with no evidence
-* flags nothing rather than raising false alarms. The feeder records calls only
-* inside `query`/`mutation` handlers, so `action(...)` bodies never reach here.
-*/
+ * Flags a `mask(policies)` column whose strategy is the literal `"hash"` and
+ * whose column name matches a PII heuristic (`email`, `ssn`, `phone`, …).
+ *
+ * Lunora's `"hash"` mask strategy is an unsalted 32-bit FNV-1a digest — a
+ * stable pseudonym for grouping/joining, deliberately **not** a confidentiality
+ * control. Its narrow (~2^32) output space makes it brute-force-recoverable by
+ * the very caller it is meant to mask from, and identical inputs always
+ * produce identical tokens, so it also leaks cross-row/cross-tenant equality.
+ * Applying it to a PII column reads as protection but isn't; `"redact"` (drop
+ * to `null`) is the strategy that actually hides the value.
+ *
+ * Runs only when the codegen feeder supplies strategy evidence
+ * (`context.maskStrategies`); a runtime caller with no evidence flags nothing.
+ * A `MaskFn` (custom, non-literal) strategy carries no static signal and is
+ * never recorded by the feeder, so it never reaches this lint either.
+ */
+declare const maskWeakHashStrategyOnPii: Lint;
+/**
+ * Flags a public read that hydrates a masked table's rows in the clear through a
+ * `with` relation.
+ *
+ * Column masking (`.use(mask(...))`) is applied per-procedure to the *top-level*
+ * rows of the table named in a read. It does **not** descend into relations
+ * hydrated via `with` — `ctx.db.posts.findMany({ with: { author: true } })`
+ * returns each `author` fully unmasked even when the `users` table is masked
+ * elsewhere. So a table whose columns you carefully mask on its own reads is
+ * still served in the clear whenever an unprotected parent read pulls it in as a
+ * relation.
+ *
+ * INFO, near-zero false positives by construction: it fires only when all of
+ * (1) the enclosing read is public, (2) the read declares `with: { &lt;rel> }`,
+ * (3) `&lt;rel>` resolves through the schema to a real target table, and (4) that
+ * target table actually has masked columns (per the discovered mask evidence).
+ * Absent any mask usage the lint is a no-op. Runs only when the codegen feeder
+ * supplies `context.relationLoads`; a runtime caller flags nothing. One finding
+ * per `(read, masked relation)` pair.
+ */
+declare const maskedRelationLeakViaWith: Lint;
+/**
+ * Flags a custom mutator whose authoritative `server` impl writes a row with
+ * `ctx.db.replace(id, document)` — a whole-document overwrite.
+ *
+ * The local-first sync engine serializes mutators in the shard DO, so two
+ * mutators that touch the *same row* but *different columns* both run to
+ * completion — but only if each writes its own column. A `replace` overwrites
+ * the entire row from the document the mutator assembled, so a concurrent edit
+ * to another column (committed between this mutator's read and its write, or
+ * carried as a pending optimistic overlay on a client) is silently clobbered:
+ * the kind of "two offline edits to different fields fight each other" data loss
+ * a column-level merge avoids. `ctx.db.patch(id, { onlyTheChangedField })`
+ * merges at the column level instead, so independent field edits coexist.
+ *
+ * `WARN`, not `ERROR`: `replace` is legitimate when the mutator genuinely owns
+ * the whole row (a full-form save, a state-machine transition that rewrites
+ * every field). The lint just surfaces the column-clobber risk so a developer
+ * reaches for `patch` by default on a synced table.
+ *
+ * **Evidence supply**: runs only when the codegen feeder supplies
+ * `context.mutatorWrites` (each a `replace` call lifted from a mutator's inline
+ * `server` body); absent for runtime callers, where the lint finds nothing.
+ */
+declare const mutatorFullRowReplace: Lint;
+/**
+ * Flags a non-deterministic API call inside a `query(...)` or `mutation(...)`
+ * handler body.
+ *
+ * Lunora queries and mutations must be **deterministic**: the coordinator may
+ * re-run a mutation on optimistic-concurrency (OCC) retry and a query on
+ * subscription re-evaluation, so a handler that reads wall-clock time, draws
+ * randomness, or hits the network can produce different results on each run —
+ * breaking read-your-writes, cache invalidation, and replayable history.
+ * `Date.now`, `Math.random`, `crypto.randomUUID`, `crypto.getRandomValues`, and
+ * `fetch` are therefore disallowed in query/mutation handlers and belong in an
+ * `action(...)`, which runs exactly once and may use ambient/non-deterministic
+ * APIs freely (pass the result into a mutation as an argument).
+ *
+ * This lint runs when the codegen feeder has supplied call evidence
+ * (`context.nondeterministicCalls` present); a runtime caller with no evidence
+ * flags nothing rather than raising false alarms. The feeder records calls only
+ * inside `query`/`mutation` handlers, so `action(...)` bodies never reach here.
+ */
 declare const nondeterministicQueryMutation: Lint;
 /**
-* Flags an RLS policy whose `table` names a table that does not exist in the
-* schema.
-*
-* A policy is bound to a table by a plain string (`definePolicy({ table:
-* "documents", … })`). The `rls()` middleware only applies a policy to reads and
-* writes of that exact table name — so a typo, a stale name after a rename, or a
-* copy-paste mistake produces a policy that silently matches **nothing**. The
-* table the developer believes is gated is left completely ungated, which is a
-* security gap, not a mere dead-code wart: every read of the real table returns
-* unrestricted rows and every write is allowed.
-*
-* This is strictly worse than `rls_uncovered_table` (a procedure forgetting the
-* middleware): here the middleware *is* wired up, the policy *is* in the list,
-* and it still does nothing — the failure is invisible at every call site.
-*
-* **Evidence supply**: like `rls_uncovered_table`, this runs only when the
-* codegen feeder supplies `context.rlsProcedures`. The covered-table names come
-* from each procedure's statically-read `rls(policies)` array (`rlsTables`); a
-* policies argument that isn't a literal array contributes no names, so the lint
-* under-reports rather than raising false alarms.
-*/
+ * Flags a public `query`/`mutation` whose handler gates a `ctx.db.get`/`patch`/`delete`
+ * on a null-checked `ctx.db.normalizeId(table, id)` result, with no intervening
+ * ownership predicate and no RLS coverage.
+ *
+ * `normalizeId` performs pure structural validation — it checks that a string is
+ * shaped like a valid id for `table` and returns the branded id, but it **never reads
+ * the database**. A non-null result therefore proves only that the id is well-formed,
+ * never that the row exists or that the caller owns it. Treating "normalizeId returned
+ * non-null" as authorization is an IDOR: any caller who supplies a syntactically valid
+ * id of another user's row reaches it. This is an INFO-level nudge — the handler may be
+ * intentionally public — it flags a place where the shape check is doing load-bearing
+ * work it can't actually do.
+ *
+ * **Negative-proof gates** (bias toward silence — a false negative is cheaper than a
+ * false positive that trains users to ignore the advisor): the feeder records a row
+ * only when a null-gated normalized id reaches an id-first sink, and this lint
+ * additionally requires (1) `visibility === "public"` (an internal procedure trusts
+ * its server caller for authorization), (2) no `.use(rls(...))` on the builder chain,
+ * (3) no ownership/identity mention anywhere in the handler (`mentionsOwnership` — any
+ * `ctx.auth`/`ctx.identity` read or ownership-named identifier suppresses), and (4) the
+ * table not covered by schema-required RLS. A handler that compares the loaded row's
+ * `userId` to `ctx.auth.userId`, or a schema in `.rls("required")` mode, is never
+ * flagged.
+ *
+ * Runs only when the codegen feeder supplies `context.normalizeIdAuthorizations`; a
+ * runtime caller flags nothing.
+ */
+declare const normalizeIdUsedAsAuthorization: Lint;
+/**
+ * Nudges a `.public()` `query` whose handler returns raw table rows — with no
+ * `.output(...)` projection and no `.use(mask(...))` — when that table carries
+ * PII-named columns (`email`, `phone`, `ssn`, …).
+ *
+ * A public query is reachable by any client. Returning a table row verbatim ships
+ * every column it holds — including PII the caller never needed — and silently
+ * widens the exposed surface every time a column is added to the table later. An
+ * explicit `.output(v.object({ … }))` projection (or a `.use(mask(...))` policy)
+ * makes the exposed shape intentional and stops the next-added column from leaking
+ * by default. This is an INFO-level nudge, not a defect: the query may be perfectly
+ * fine — it flags a place worth a deliberate projection decision.
+ *
+ * **Low-FP gates**: the feeder records a row only when the handler returns the raw
+ * read result itself (a hand-built object / array / `.map(...)` projection is not
+ * recorded), and this lint additionally requires (1) `visibility === "public"`,
+ * (2) no `.output(...)` and no `.use(mask(...))` on the builder chain, and (3) the
+ * returned table to declare at least one PII-named column. A public query returning
+ * a non-PII lookup table (`emojis`, `countries`) is never flagged.
+ *
+ * Runs only when the codegen feeder supplies `context.rawRowReturns`; a runtime
+ * caller flags nothing.
+ */
+declare const outputProjectionMissingOnPublicRead: Lint;
+/**
+ * Flags a `ctx.db` write (`insert` / `replace` / `patch` / `insertManyUnsafe`)
+ * that sets an ownership / identity column — `userId`, `ownerId`, `tenantId`, and
+ * the like — from the handler's `args` instead of the server-trusted identity.
+ *
+ * The ownership column decides *who a row belongs to*. When its value comes from
+ * request input (`ctx.db.insert("posts", { userId: args.userId })`), any caller
+ * can claim to be anyone: pass a different `userId` / `tenantId` and the write
+ * lands a row owned by another user or tenant — the classic act-as-any-user /
+ * cross-tenant IDOR. The fix is to stamp the ownership column from `ctx.auth` /
+ * `ctx.identity` on the server and never read it from `args`. A column set from
+ * `ctx.*`, or to a fixed literal, is correct and not flagged.
+ *
+ * Runs only when the codegen feeder supplies owner-write evidence
+ * (`context.ownerFieldWrites`); a runtime caller flags nothing. One finding per
+ * offending identity-column write.
+ */
+declare const ownerFieldFromArgsNotAuth: Lint;
+/**
+ * Flags a `createPayment({...})` constructed without an `authorize` callback.
+ *
+ * The `authorize(referenceId)` hook is `@lunora/payment`'s access-control gate: it
+ * runs before every charge/refund/subscription operation and decides whether the
+ * current caller may act on that payment reference. Omit it and the guard is
+ * effectively open — any caller who can reach a reference id (often a
+ * client-supplied string) can drive money movement against someone else's
+ * payment, a broken-access-control (IDOR) escalation on the most sensitive
+ * surface an app has.
+ *
+ * The context accessor `ctx.payments` is authorization-scoped by default; this
+ * lint targets the direct `createPayment(...)` factory, where the gate is
+ * opt-in. Runs only when the codegen feeder supplies config-call evidence
+ * (`context.configCalls`); a runtime caller flags nothing. Skips calls whose
+ * config wasn't a static object literal (the key may be set on a config built
+ * elsewhere). One finding per unguarded call.
+ */
+declare const paymentCreateWithoutAuthorize: Lint;
+/**
+ * Flags a payment webhook adapter (`createStripeAdapter` / `createPolarAdapter` /
+ * `createAutumnAdapter` / `createDodoPaymentsAdapter`) configured with an
+ * implausibly wide `webhookToleranceSeconds` replay window.
+ *
+ * The adapters reject a webhook whose signed timestamp is more than
+ * `webhookToleranceSeconds` from now, so a captured-then-replayed signed payload
+ * is refused once it ages past the window. The default (300s) is the recommended
+ * clock-skew allowance; widening it to hours or days keeps stale, replayable
+ * signed events valid long after capture, defeating the timestamp check and
+ * re-opening the replay window the signature scheme exists to close.
+ *
+ * Runs only when the codegen feeder supplies adapter evidence
+ * (`context.paymentWebhooks`); a runtime caller flags nothing. Fires only on a
+ * statically-known numeric `webhookToleranceSeconds` literal above the ceiling —
+ * a computed or env-sourced value is not evaluated, to keep the false-positive
+ * rate low. One finding per matching adapter.
+ */
+declare const paymentWebhookWideTolerance: Lint;
+/**
+ * Flags a plaintext secret committed to `wrangler.jsonc`'s `vars` block.
+ *
+ * `vars` are **plaintext environment variables**: Wrangler bakes them into the
+ * deployed Worker's bundle in cleartext, and `wrangler.jsonc` is checked into
+ * source control — so a real API key, access key, private key, or token placed
+ * there leaks two ways at once (every reader of the repo and the deployed bundle)
+ * and rotating it means editing tracked config plus a redeploy. Secrets belong in
+ * a Secrets Store binding (`ctx.secrets.get(name)`) or `wrangler secret put`, never
+ * `vars`. The evidence comes from `@lunora/config`, which reads `wrangler.jsonc`
+ * and applies the same secret-shape heuristics as `hardcoded_secret`, plus a
+ * secret-suggestive key-name rule (`*_KEY` / `*_SECRET` / `*_TOKEN` / `*_PASSWORD`
+ * / `*_DSN`), while skipping placeholders and public/publishable keys.
+ *
+ * Runs only when the config feeder supplies wrangler-variable evidence
+ * (`context.wranglerVariables`); a runtime caller flags nothing. One finding per var.
+ */
+declare const plaintextSecretInWranglerVariables: Lint;
+/**
+ * Flags an RLS policy whose `table` names a table that does not exist in the
+ * schema.
+ *
+ * A policy is bound to a table by a plain string (`definePolicy({ table:
+ * "documents", … })`). The `rls()` middleware only applies a policy to reads and
+ * writes of that exact table name — so a typo, a stale name after a rename, or a
+ * copy-paste mistake produces a policy that silently matches **nothing**. The
+ * table the developer believes is gated is left completely ungated, which is a
+ * security gap, not a mere dead-code wart: every read of the real table returns
+ * unrestricted rows and every write is allowed.
+ *
+ * This is strictly worse than `rls_uncovered_table` (a procedure forgetting the
+ * middleware): here the middleware *is* wired up, the policy *is* in the list,
+ * and it still does nothing — the failure is invisible at every call site.
+ *
+ * **Evidence supply**: like `rls_uncovered_table`, this runs only when the
+ * codegen feeder supplies `context.rlsProcedures`. The covered-table names come
+ * from each procedure's statically-read `rls(policies)` array (`rlsTables`); a
+ * policies argument that isn't a literal array contributes no names, so the lint
+ * under-reports rather than raising false alarms.
+ */
 declare const policyReferencesUnknownTable: Lint;
 /**
-* Flags a `v.any()` argument on a public procedure.
-*
-* `v.any()` disables validation: the field accepts arbitrary, untyped,
-* arbitrarily-large input straight from an untrusted client. That defeats the
-* end-to-end type safety Lunora exists to provide and opens the door to injection,
-* prototype pollution, and oversized-payload abuse. Public input should be a
-* precise validator (`v.object`, `v.string`, `v.union`, …).
-*
-* Runs only when the codegen feeder supplies arg evidence
-* (`context.argValidators`, public procedures only); a runtime caller flags
-* nothing. One finding per offending arg.
-*/
+ * Flags a `ctx.run`/`context.run` back into a Lunora function from inside a
+ * `defineQueue` push handler or a `defineWorkflow` handler, when the dispatch's
+ * args reference the handler's untrusted payload (`context.params` for a
+ * workflow, a `for (… of batch.messages)` body for a queue) **and** the target
+ * enforces row-level security.
+ *
+ * A queue/workflow handler runs under the deployment's **system identity** with
+ * end-user RLS disabled — that is by design, so the handler can touch any row.
+ * But the payload it receives is attacker-influenced: a queue body is whatever
+ * was enqueued (often straight from a public mutation's `args`), and a
+ * workflow's `params` are set by the `.create({ params })` caller. Forwarding
+ * that payload into a function whose own protection is a *row policy* is a
+ * confused-deputy: the policy that would have rejected the caller's request is
+ * skipped because the handler, not the user, is now the principal. Any field
+ * the payload controls that the target's RLS keys on (owner id, tenant id, row
+ * id) becomes an act-as-any-user / cross-tenant write.
+ *
+ * The lint is deliberately narrow to stay false-positive-free: it fires **only**
+ * when the resolved target (`api.&lt;file>.&lt;export>`) is found in the
+ * RLS-procedure evidence with `usesRls: true`. A dispatch into a function that
+ * does its own arg validation and carries no row policy (the common, correct
+ * case — e.g. a welcome-message mutation with no `rls`) is not flagged. Runs
+ * only when the codegen feeder supplies dispatch evidence
+ * (`context.privilegedDispatches`); a runtime caller flags nothing.
+ */
+declare const privilegedDispatchUnvalidatedPayload: Lint;
+/**
+ * Flags a public procedure whose handler fans work out to a privileged,
+ * cost-bearing dispatch surface without a rate-limit guard.
+ *
+ * `ctx.scheduler.runAfter` / `runAt`, a `ctx.queues.&lt;name>` producer send, and
+ * `ctx.workflows.&lt;name>.create` all enqueue work that runs later under the
+ * system identity (RLS disabled) and bills against the account. Triggered from a
+ * `.public()` procedure with no rate limit, an anonymous caller can drive that
+ * dispatch in a loop — a cost-amplification / denial-of-wallet vector, and a way
+ * to flood a privileged async surface. The fix is to gate the public entry point
+ * with a rate limit (or make it internal and trigger it from a guarded path).
+ *
+ * Runs only when the codegen feeder supplies procedure-protection evidence
+ * (`context.procedureProtections`); a runtime caller flags nothing. One finding
+ * per unguarded public fan-out procedure.
+ */
+declare const privilegedFanoutFromPublicProcedure: Lint;
+/**
+ * Flags a `v.any()` argument on a public procedure.
+ *
+ * `v.any()` disables validation: the field accepts arbitrary, untyped,
+ * arbitrarily-large input straight from an untrusted client. That defeats the
+ * end-to-end type safety Lunora exists to provide and opens the door to injection,
+ * prototype pollution, and oversized-payload abuse. Public input should be a
+ * precise validator (`v.object`, `v.string`, `v.union`, …).
+ *
+ * Runs only when the codegen feeder supplies arg evidence
+ * (`context.argValidators`, public procedures only); a runtime caller flags
+ * nothing. One finding per offending arg.
+ */
 declare const publicArgumentUsesAny: Lint;
 /**
-* Flags a public `mutation`/`action` whose builder chain installs no rate limit.
-*
-* Every publicly-callable write is a flood target: without a `rateLimit`
-* middleware a single client can hammer it to exhaust D1 writes, send-mail quota,
-* or paid credits, and brute-force auth-shaped endpoints (login / reset / OTP).
-* Lunora ships `rateLimit()` (`@lunora/ratelimit`) and the `protectPublic({...})`
-* bundle for exactly this; this lint fires when neither is present on a public
-* write.
-*
-* Runs only when the codegen feeder supplies protection evidence
-* (`context.procedureProtections`); a runtime caller with no evidence flags
-* nothing. `query` is read-only and excluded; internal functions are
-* server-called and excluded.
-*/
+ * Flags a public `mutation`/`action` whose builder chain installs no rate limit.
+ *
+ * Every publicly-callable write is a flood target: without a `rateLimit`
+ * middleware a single client can hammer it to exhaust D1 writes, send-mail quota,
+ * or paid credits, and brute-force auth-shaped endpoints (login / reset / OTP).
+ * Lunora ships `rateLimit()` (`@lunora/ratelimit`) and the `protectPublic({...})`
+ * bundle for exactly this; this lint fires when neither is present on a public
+ * write.
+ *
+ * Runs only when the codegen feeder supplies protection evidence
+ * (`context.procedureProtections`); a runtime caller with no evidence flags
+ * nothing. `query` is read-only and excluded; internal functions are
+ * server-called and excluded.
+ */
 declare const publicMutationWithoutRatelimit: Lint;
 /**
-* Flags an R2 SQL `ctx.r2sql` access inside a `query(...)` or `mutation(...)`
-* handler body.
-*
-* R2 SQL (`@lunora/r2sql`) queries Apache Iceberg tables over an **external**
-* REST endpoint Lunora does not own — there is no Workers binding, every query
-* is an HTTPS round-trip. A `ctx.r2sql` query is therefore non-deterministic
-* (exactly like `fetch`), which breaks the determinism the coordinator relies on
-* when it re-runs a query on subscription re-evaluation or a mutation on OCC
-* retry. And R2 SQL reads are invisible to the DO/SQLite change-feed, so a
-* subscription will never re-fire on them. `ctx.r2sql` is therefore wired onto
-* `ActionCtx` **only** and belongs exclusively in `action(...)` handlers; using
-* it in a query/mutation is the same class of bug as `fetch`/`Date.now`.
-*
-* This mirrors `hyperdrive_outside_action` — the action-only enforcement teeth
-* for external, non-reactive I/O. Runtime enforcement is still absent (see
-* `MEMORY.md` "Query/mutation determinism not enforced"), so the lint is the
-* guardrail.
-*
-* This lint runs when the codegen feeder has supplied access evidence
-* (`context.r2sqlCalls` present); a runtime caller with no evidence flags nothing
-* rather than raising false alarms. The feeder records accesses only inside
-* `query`/`mutation` handlers, so `action(...)` bodies never reach here.
-*/
+ * Flags a `.public()` table that carries ownership/tenancy- or PII-named
+ * columns, on a schema that requires RLS (`.rls("required")`).
+ *
+ * `.public()`'s name is misleading: it does NOT mean "this table holds public
+ * data" — it means the OPPOSITE of that from an enforcement standpoint. It opts
+ * one table OUT of the schema-wide `.rls("required")` enforcement, so its
+ * `ctx.db` write path is never denied for missing RLS coverage. A table named
+ * `.public()` that also carries `userId` / `email` / `ssn`-shaped columns reads
+ * as "safe to expose" but is actually "exempt from the row-security guard" —
+ * exactly the confusion the method name invites.
+ *
+ * **Low-FP gate**: only flagged when (1) the schema opted into
+ * `.rls("required")` at all (`.public()` is a documented no-op otherwise — see
+ * {@link https://lunora.sh}'s `.public()` docs), and (2) the table's declared
+ * columns match the ownership/PII heuristic ({@link ownershipOrPiiColumns}). A
+ * genuinely public lookup table (e.g. `emojis`, `countries`) with no such
+ * columns is not flagged.
+ *
+ * **Pure schema evidence**: reads only `context.schema` — both `isPublic` and
+ * `rlsMode` are forwarded by the runtime `fromServerSchema` and the codegen
+ * `toAdvisorSchema` paths, so this lint runs identically from a live shard and
+ * from codegen, with no feeder required.
+ */
+declare const publicTableRlsOptoutConfusion: Lint;
+/**
+ * Flags a declared queue — push or pull — that has no dead-letter queue.
+ *
+ * A Cloudflare Queues consumer retries a failing message up to `maxRetries`
+ * times (default 3 — roughly four total delivery attempts); once that budget is
+ * exhausted, a message with no `deadLetterQueue` is **deleted permanently** with
+ * no record an operator can inspect. Routing exhausted messages to a DLQ turns
+ * silent data loss into a backlog you can inspect, alert on, and replay. Hence
+ * `WARN`/`INTERNAL`: an operator-facing reliability nudge, not a hard error — a
+ * genuinely fire-and-forget queue may accept the loss.
+ *
+ * A queue that is itself some other queue's `deadLetterQueue` target is skipped:
+ * a DLQ is a terminal sink and requiring it to have its own DLQ would recurse
+ * forever (and mis-flag the best-practice scaffold, which pairs a queue with a
+ * dedicated DLQ consumer).
+ *
+ * Only runs when the declaration feeder supplied evidence (`context.queues`
+ * present); a runtime caller flags nothing.
+ */
+declare const queueWithoutDlq: Lint;
+/**
+ * Flags an R2 SQL `ctx.r2sql` access inside a `query(...)` or `mutation(...)`
+ * handler body.
+ *
+ * R2 SQL (`@lunora/bindings/r2sql`) queries Apache Iceberg tables over an **external**
+ * REST endpoint Lunora does not own — there is no Workers binding, every query
+ * is an HTTPS round-trip. A `ctx.r2sql` query is therefore non-deterministic
+ * (exactly like `fetch`), which breaks the determinism the coordinator relies on
+ * when it re-runs a query on subscription re-evaluation or a mutation on OCC
+ * retry. And R2 SQL reads are invisible to the DO/SQLite change-feed, so a
+ * subscription will never re-fire on them. `ctx.r2sql` is therefore wired onto
+ * `ActionCtx` **only** and belongs exclusively in `action(...)` handlers; using
+ * it in a query/mutation is the same class of bug as `fetch`/`Date.now`.
+ *
+ * This mirrors `hyperdrive_outside_action` — the action-only enforcement teeth
+ * for external, non-reactive I/O. Runtime enforcement is still absent (see
+ * `MEMORY.md` "Query/mutation determinism not enforced"), so the lint is the
+ * guardrail.
+ *
+ * This lint runs when the codegen feeder has supplied access evidence
+ * (`context.r2sqlCalls` present); a runtime caller with no evidence flags nothing
+ * rather than raising false alarms. The feeder records accesses only inside
+ * `query`/`mutation` handlers, so `action(...)` bodies never reach here.
+ */
 declare const r2sqlOutsideAction: Lint;
 /**
-* A correctness lint covering the columns a relation wires together: the FK
-* `field` and the `references` column must each exist on their respective
-* tables, or the join can never resolve. Caught here at codegen time rather
-* than as a runtime failure.
-*/
+ * Flags a `new RateLimiter({...})` constructed without an explicit `store`.
+ *
+ * The default store is per-instance in-memory. On Cloudflare Workers each request
+ * can land on a different isolate, so an in-memory counter never sums across
+ * them: the limiter silently under-counts and, under real traffic, is close to a
+ * no-op. A rate limit that doesn't actually limit gives a false sense of
+ * protection against brute-force, enumeration, and cost-abuse — exactly the
+ * attacks it was added to stop. The fix is a shared, durable store (a Durable
+ * Object or KV-backed one) so every isolate reads and writes the same bucket.
+ *
+ * Runs only when the codegen feeder supplies config-call evidence
+ * (`context.configCalls`); a runtime caller flags nothing. Skips calls whose
+ * config wasn't a static object literal. One finding per limiter.
+ */
+declare const ratelimitDefaultMemoryStore: Lint;
+/**
+ * Flags a `rateLimit`/`dbRateLimit` middleware call (`@lunora/ratelimit`) whose
+ * `key` selector is derived from the handler's `args` with no server-side
+ * scoping.
+ *
+ * The middleware's `key` is `(ctx) => string | undefined` — a sub-key that
+ * isolates the limit per caller. When the selector reads straight from `args`
+ * (an email, a client-supplied id, …) instead of a server-trusted identity
+ * (`ctx.auth.userId`) or the server-trusted `ctx.ip`, an attacker can rotate the
+ * key on every request and never share a bucket with themselves, defeating the
+ * limit entirely. A selector with no `args` reference at all — a fixed/global
+ * bucket, including simply omitting `key` — is a *different*, fuzzier problem
+ * (one caller can still exhaust a shared global bucket for everyone) and is
+ * deliberately **not** flagged here, to keep this lint's false-positive rate
+ * low: a global bucket is a legitimate choice for some limits (e.g. a
+ * deployment-wide cost cap), so its absence alone is not a reliable signal.
+ *
+ * Runs only when the codegen feeder supplies rate-limit key-selector evidence
+ * (`context.ratelimitKeySelectors`); a runtime caller flags nothing. One finding
+ * per arg-derived, unscoped selector.
+ */
+declare const ratelimitKeySpoofableOrGlobal: Lint;
+/**
+ * Flags a `rateLimit`/`dbRateLimit`/`verifyTurnstileMiddleware` guard configured
+ * `failOpen: true` on an auth/payment-sensitive procedure.
+ *
+ * `@lunora/ratelimit`'s `rateLimit`/`dbRateLimit` and `@lunora/auth`'s
+ * `verifyTurnstileMiddleware` fail **closed** by default — a store outage or a
+ * failed Turnstile siteverify rejects the request (503). Passing `failOpen: true`
+ * inverts that: the middleware swallows the failure and admits the request. On a
+ * sign-in / account-creation / password-reset / OTP / payment endpoint that turns
+ * a transient limiter outage into an unthrottled brute-force / abuse window.
+ *
+ * Runs only when the codegen feeder supplies fail-open-guard evidence
+ * (`context.failOpenGuards`); a runtime caller flags nothing. Deliberately narrow
+ * — fires only when the options literal provably set `failOpen: true` AND the
+ * guarded procedure's export name or rate-limit `name` matches an auth/payment
+ * token, keeping the false-positive rate low. One finding per guard.
+ */
+declare const ratelimitMiddlewareFailOpen: Lint;
+/**
+ * A correctness lint covering the columns a relation wires together: the FK
+ * `field` and the `references` column must each exist on their respective
+ * tables, or the join can never resolve. Caught here at codegen time rather
+ * than as a runtime failure.
+ */
 declare const relationReferencesUnknownField: Lint;
 /**
-* A correctness lint: every relation declared via `.relations((r) => …)` names a
-* target table, which must exist in the schema. A target that resolves to no
-* table is a typo or a reference to a table that was removed/renamed — the
-* relation can never load. Caught here at codegen time rather than at runtime.
-*
-* (Extension tables are already namespaced and their relation targets rewritten
-* by the time the schema reaches a lint, so a surviving unknown target is a real
-* miss, not an unresolved cross-package reference.)
-*/
+ * A correctness lint: every relation declared via `.relations((r) => …)` names a
+ * target table, which must exist in the schema. A target that resolves to no
+ * table is a typo or a reference to a table that was removed/renamed — the
+ * relation can never load. Caught here at codegen time rather than at runtime.
+ *
+ * (Extension tables are already namespaced and their relation targets rewritten
+ * by the time the schema reaches a lint, so a surviving unknown target is a real
+ * miss, not an unresolved cross-package reference.)
+ */
 declare const relationReferencesUnknownTable: Lint;
 /**
-* Flags a public procedure that reads or writes a table named in at least one
-* other procedure's `rls(policies)` list, but whose own builder chain does NOT
-* include `.use(rls(...))`.
-*
-* Lunora RLS is **opt-in per procedure**: a policy list only takes effect
-* inside procedures whose builder chain includes `.use(rls(policies))`. A
-* procedure without it sees the raw, unwrapped `ctx.db` and silently bypasses
-* every policy in the list — even when another procedure in the same app
-* declares that table as policy-gated.
-*
-* The lint surfaces the most dangerous subclass of this failure mode: a table
-* that the developer explicitly decided to gate with RLS (evidenced by naming
-* it in at least one procedure's policy list) is nonetheless accessible
-* without restriction from a procedure that forgot the `.use(rls(...))` call.
-*
-* **Scope**: only `public` procedures are flagged. `internal*` procedures
-* (e.g. `internalQuery`, `internalMutation`) are intentional server-side
-* helpers that legitimately bypass the user-facing RLS gate, so flagging them
-* would produce only noise. Remediation text notes this exemption so authors
-* know to use `internalQuery`/`internalMutation`/`internalAction` when they
-* truly need unwrapped access.
-*
-* **Evidence supply**: this lint runs only when the codegen feeder has supplied
-* `context.rlsProcedures`; a runtime caller with no evidence flags nothing
-* rather than raising false alarms.
-*
-* **Conservative policy-table detection**: when a procedure calls
-* `rls(policies)` with a non-literal array (a variable reference), the feeder
-* cannot statically enumerate the covered tables. In that case the procedure is
-* still marked `usesRls: true` (so it is NOT itself flagged), but its tables
-* contribute nothing to `policyCoveredTables`. This means the lint may
-* under-report (false negatives) when policies are extracted into named
-* constants, but it never over-reports (no false positives).
-*/
+ * Flags a public procedure that reads or writes a table named in at least one
+ * other procedure's `rls(policies)` list, but whose own builder chain does NOT
+ * include `.use(rls(...))`.
+ *
+ * Lunora RLS is **opt-in per procedure**: a policy list only takes effect
+ * inside procedures whose builder chain includes `.use(rls(policies))`. A
+ * procedure without it sees the raw, unwrapped `ctx.db` and silently bypasses
+ * every policy in the list — even when another procedure in the same app
+ * declares that table as policy-gated.
+ *
+ * The lint surfaces the most dangerous subclass of this failure mode: a table
+ * that the developer explicitly decided to gate with RLS (evidenced by naming
+ * it in at least one procedure's policy list) is nonetheless accessible
+ * without restriction from a procedure that forgot the `.use(rls(...))` call.
+ *
+ * **Scope**: only `public` procedures are flagged. `internal*` procedures
+ * (e.g. `internalQuery`, `internalMutation`) are intentional server-side
+ * helpers that legitimately bypass the user-facing RLS gate, so flagging them
+ * would produce only noise. Remediation text notes this exemption so authors
+ * know to use `internalQuery`/`internalMutation`/`internalAction` when they
+ * truly need unwrapped access.
+ *
+ * **Evidence supply**: this lint runs only when the codegen feeder has supplied
+ * `context.rlsProcedures`; a runtime caller with no evidence flags nothing
+ * rather than raising false alarms.
+ *
+ * **Conservative policy-table detection**: when a procedure calls
+ * `rls(policies)` with a non-literal array (a variable reference), the feeder
+ * cannot statically enumerate the covered tables. In that case the procedure is
+ * still marked `usesRls: true` (so it is NOT itself flagged), but its tables
+ * contribute nothing to `policyCoveredTables`. This means the lint may
+ * under-report (false negatives) when policies are extracted into named
+ * constants, but it never over-reports (no false positives).
+ */
 declare const rlsUncoveredTable: Lint;
 /**
-* Flags a `ctx.sql` tagged-template that splices an unparameterized
-* string-building expression into the query.
-*
-* The Hyperdrive `ctx.sql\`…\`` driver binds each `${value}` placeholder as a
-* query parameter — safe by construction. But a placeholder that *builds* a string
-* in place (`ctx.sql\`… ${"WHERE name='" + name + "'"}\``, or a nested template
-* literal) splices raw, attacker-controlled text into the SQL, reopening classic
-* SQL injection. The fix is always to pass the value through a placeholder so the
-* driver parameterizes it.
-*
-* Runs only when the codegen feeder supplies interpolation evidence
-* (`context.sqlInterpolations`); a runtime caller flags nothing. One finding per
-* interpolation.
-*/
+ * Flags a replication shape whose `table` is a `.global()` table.
+ *
+ * Poke-live replication is a per-shard-DO property: the shard owns its SQLite
+ * and a monotonic `__cdc_log`, so a write produces an ordered op the DO pokes to
+ * every subscriber at the next flush. A `.global()` table lives outside the
+ * shard DO's SQLite op-log (in a global backend — D1, or Hyperdrive-fronted
+ * Postgres/MySQL) — so a shape over a global table cannot be poke-live. It is
+ * served through the cross-shard tier: **coordinator/poll-refreshed, latency-
+ * tiered**, not live. That is a real and supported tier (it is the recommended
+ * answer for cross-shard reads — denormalize, or move the joined table to
+ * `.global()` and read through the global backend), but its freshness semantics
+ * differ from a sharded shape's, so the boundary is surfaced rather than hidden.
+ *
+ * `WARN`, not `ERROR`: a global-table shape is a legitimate design once you
+ * accept the poll-refresh latency; the lint just makes the tier explicit so a
+ * developer does not assume poke-live freshness.
+ *
+ * **Evidence supply**: runs only when the codegen feeder supplies
+ * `context.shapes`; the table's tier comes from the schema's `shardKind`. A
+ * shape whose table is unknown (caught by `shape_unknown_table`) or whose tier
+ * the feeder didn't supply is skipped.
+ */
+declare const shapeTargetsGlobalTable: Lint;
+/**
+ * Flags a replication shape whose `table` names a table that does not exist in
+ * the schema.
+ *
+ * `defineShape({ table: "messages", … })` binds a shape to a table by a plain
+ * string. A live `subscribeShape("…")` resolves that shape server-side and runs
+ * its membership query against the named table — so a typo, a stale name after a
+ * rename, or a copy-paste mistake produces a shape that can never resolve a
+ * rowset: the subscription seeds empty and then errors at the first flush
+ * (`no such table`). This is a definite, build-time-detectable break, so it is
+ * an `ERROR` — surfaced before the broken shape ever ships.
+ *
+ * **Evidence supply**: runs only when the codegen feeder supplies
+ * `context.shapes`. A shape whose `table` wasn't a static string literal (no
+ * resolvable name) is skipped rather than guessed at, so the lint under-reports
+ * rather than raising false alarms.
+ */
+declare const shapeUnknownTable: Lint;
+/**
+ * Flags a public read that resurfaces soft-deleted rows via `includeDeleted` —
+ * either hardcoded `true` or wired from the handler's `args`.
+ *
+ * A `.softDelete()` table hides deleted rows from list reads (`findMany` /
+ * `findFirst`) unless the call passes `includeDeleted: true`. That opt-out is a
+ * deliberate, privileged escape hatch (an admin trash view, a restore flow). On
+ * a `.public()` read it becomes a leak: `includeDeleted: true` returns
+ * soft-deleted rows to *every* caller, and `includeDeleted: args.showDeleted`
+ * lets *any* caller flip the toggle per request — either way the "deleted" rows
+ * a user believes are gone (and that your UI hides) are served straight back.
+ *
+ * INFO, near-zero false positives by construction: it fires only when all of
+ * (1) the enclosing procedure is public, (2) the read's target is a schema table
+ * that actually declares `.softDelete()`, and (3) `includeDeleted` is a hardcoded
+ * `true` or arg-derived. A literal `false`, or an `includeDeleted` gated by a
+ * server-trusted `ctx.*` value, is never recorded by the feeder, so a correct
+ * admin-gated read is not flagged. Runs only when the codegen feeder supplies
+ * `context.softDeleteReads`; a runtime caller flags nothing. One finding per
+ * matching read.
+ */
+declare const softDeleteIncludeDeletedFromArgs: Lint;
+/**
+ * Flags a `ctx.sql` tagged-template that splices an unparameterized
+ * string-building expression into the query.
+ *
+ * The Hyperdrive `ctx.sql\`…\`` driver binds each `${value}` placeholder as a
+ * query parameter — safe by construction. But a placeholder that *builds* a string
+ * in place (`ctx.sql\`… ${"WHERE name='" + name + "'"}\``, or a nested template
+ * literal) splices raw, attacker-controlled text into the SQL, reopening classic
+ * SQL injection. The fix is always to pass the value through a placeholder so the
+ * driver parameterizes it.
+ *
+ * Runs only when the codegen feeder supplies interpolation evidence
+ * (`context.sqlInterpolations`); a runtime caller flags nothing. One finding per
+ * interpolation.
+ */
 declare const sqlInjectionRisk: Lint;
 /**
-* Flags a declared table that no function inserts into.
-*
-* Using `@lunora/codegen`'s write-side discovery (the analog of the read
-* discovery that feeds `filter_without_index`), this lint cross-references every
-* schema table against the set of tables some exported function writes via
-* `ctx.db.insert("&lt;table>", …)`. A table with no such write either is dead schema
-* or is populated through a path the static analysis can't see — a migration/seed,
-* cross-region replication, the `ctx.orm.insert(...)` builder, or a trusted
-* snapshot import. Hence `INFO`/`INTERNAL`: a nudge to confirm intent, not an error.
-*
-* A table declared `.externallyManaged()` is skipped — that flag is the explicit
-* acknowledgement that its rows are written outside Lunora (an adapter/migration/
-* middleware), so `@lunora/auth`'s better-auth tables and `@lunora/ratelimit`'s
-* store never flag here.
-*
-* Only runs when the write feeder supplied evidence (`context.inserts` present);
-* a runtime caller with no insert signal flags nothing rather than every table.
-*/
+ * Flags a `ctx.storage.generateUploadUrl(key, …)` call whose options argument
+ * omits `contentType`.
+ *
+ * `generateUploadUrl` mints a signed `PUT` URL the *client* uploads directly
+ * to R2, bypassing `upload()`/`store()` entirely — including their
+ * `allowedContentTypes`/`maxSize` guards, which this alias never sees. The one
+ * guard `generateUploadUrl` itself offers is `contentType`: passing it pins
+ * the `Content-Type` into the signature, so the signed URL only authorizes a
+ * PUT with exactly that content-type. Omit it and the minted URL accepts any
+ * content-type/size the client chooses, entirely unchecked server-side.
+ *
+ * Runs only when the codegen feeder supplies storage-upload evidence
+ * (`context.storageUploads`); a runtime caller flags nothing. Skips calls
+ * whose options argument wasn't statically analyzable (a variable, call
+ * result, or a spread) — the key may be set on an object built elsewhere. One
+ * finding per unpinned call.
+ */
+declare const storageGenerateUploadUrlNoContentTypePin: Lint;
+/**
+ * Flags a `ctx.storage.&lt;bucket>.&lt;method>(key, …)` whose R2 object key is derived
+ * from the handler's `args` with no server-side scoping — an object-level IDOR.
+ *
+ * The bucket read/write/URL/delete methods (`get`, `put`, `delete`, `download`,
+ * `store`, `getSignedUrl`, …) take the object key as their first argument. When
+ * that key comes straight from request input (`ctx.storage.docs.get(args.key)`, or
+ * a key built one hop earlier from `args`), any caller can name any object — reading,
+ * overwriting, or deleting another user's file. The fix is to prefix the key with a
+ * server-trusted identity (`` `${ctx.auth.userId}/…` ``) or to resolve the object
+ * through a record the caller is known to own; a key that references `ctx` is treated
+ * as scoped and is not flagged.
+ *
+ * Runs only when the codegen feeder supplies storage-key evidence
+ * (`context.storageKeyAccesses`); a runtime caller flags nothing. One finding per
+ * offending call.
+ */
+declare const storageKeyFromUserArgs: Lint;
+/**
+ * Flags a `ctx.storage.getPresignedUrl(...)` call, or a `getPresignedUrl`/
+ * `getSignedUrl` call whose `expiresInSeconds` sits near the shared 7-day
+ * signing ceiling.
+ *
+ * `getPresignedUrl` mints a native S3 SigV4 URL that resolves directly
+ * against R2's S3 endpoint — the holder reaches the object straight off R2,
+ * **bypassing the Worker entirely**, so any auth/RLS/rate-limit gate the app
+ * enforces in its own handlers never runs for that request. That's the right
+ * trade for genuinely public or bulk content where the app has no per-request
+ * gating to apply; it's the wrong choice for private, per-user, or
+ * policy-gated content, where `getSignedUrl` (worker-signed, resolves back
+ * through the app) is the fit. Separately, either signer minting a long TTL
+ * near the shared 7-day ceiling hands out a bearer credential that stays
+ * valid almost as long as the platform allows — a leaked link (referrer,
+ * logs, browser history) then grants access for nearly a week.
+ *
+ * Runs only when the codegen feeder supplies storage-upload evidence
+ * (`context.storageUploads`); a runtime caller flags nothing. The
+ * near-ceiling check only fires on a statically-known numeric
+ * `expiresInSeconds` literal — a variable or computed expression is not
+ * evaluated, to keep the false-positive rate low. One finding per matching
+ * call.
+ */
+declare const storagePresignedUrlForPrivateContent: Lint;
+/**
+ * Flags a `ctx.storage.upload`/`store` call whose options argument omits
+ * `allowedContentTypes`.
+ *
+ * `@lunora/storage`'s `upload`/`store` accept an `allowedContentTypes`
+ * allowlist that, when set, rejects a mismatched (or missing) `contentType` —
+ * the control that stops an uploader from storing `text/html` or
+ * `image/svg+xml` and having it served back from `publicBaseUrl`, a classic
+ * stored-XSS path against your own origin. Omitting the option leaves any
+ * content-type acceptable. `generateUploadUrl`'s signed PUT has no
+ * `allowedContentTypes` option at all (it bypasses `upload()`'s guards
+ * entirely) — that gap is `storage_generate_upload_url_no_content_type_pin`'s
+ * concern, not this lint's.
+ *
+ * Runs only when the codegen feeder supplies storage-upload evidence
+ * (`context.storageUploads`); a runtime caller flags nothing. Skips calls
+ * whose options argument wasn't statically analyzable (a variable, call
+ * result, or a spread) — the key may be set on an object built elsewhere. One
+ * finding per unguarded call.
+ */
+declare const storageUploadWithoutContentTypeAllowlist: Lint;
+/**
+ * Flags a `ctx.storage.upload`/`store` call whose options argument omits
+ * `maxSize`.
+ *
+ * `@lunora/storage`'s `upload`/`store` accept a `maxSize` byte ceiling that
+ * rejects an oversized `ArrayBuffer`/`Blob` up front, and pipes a
+ * `ReadableStream` through a counting `TransformStream` that aborts once the
+ * limit is exceeded — without it, a caller can push an unbounded body through
+ * the Worker straight into R2, exhausting storage/billing (and, for a
+ * streamed body, worker CPU/time) with no cap.
+ *
+ * Runs only when the codegen feeder supplies storage-upload evidence
+ * (`context.storageUploads`); a runtime caller flags nothing. Skips calls
+ * whose options argument wasn't statically analyzable (a variable, call
+ * result, or a spread) — the key may be set on an object built elsewhere. One
+ * finding per unbounded call.
+ */
+declare const storageUploadWithoutMaxSize: Lint;
+/**
+ * Flags a declared table that no function inserts into.
+ *
+ * Using `@lunora/codegen`'s write-side discovery (the analog of the read
+ * discovery that feeds `filter_without_index`), this lint cross-references every
+ * schema table against the set of tables some exported function writes via
+ * `ctx.db.insert("&lt;table>", …)`. A table with no such write either is dead schema
+ * or is populated through a path the static analysis can't see — a migration/seed,
+ * cross-region replication, the `ctx.orm.insert(...)` builder, or a trusted
+ * snapshot import. Hence `INFO`/`INTERNAL`: a nudge to confirm intent, not an error.
+ *
+ * A table declared `.externallyManaged()` is skipped — that flag is the explicit
+ * acknowledgement that its rows are written outside Lunora (an adapter/migration/
+ * middleware), so `@lunora/auth`'s better-auth tables and `@lunora/ratelimit`'s
+ * store never flag here.
+ *
+ * Only runs when the write feeder supplied evidence (`context.inserts` present);
+ * a runtime caller with no insert signal flags nothing rather than every table.
+ */
 declare const tableWithoutInsert: Lint;
 /**
-* Flags a public `v.string()` argument with no length bound.
-*
-* A string field that accepts an unbounded value lets a client send megabytes of
-* text per request — inflating storage, blowing the row/document size budget, and
-* driving CPU/memory on every handler that processes it. A `.check()`/`.meta()`
-* max-length bound caps the blast radius. Advisory (INFO): a deliberately-open
-* free-text field is sometimes legitimate, so this nudges rather than blocks.
-*
-* Runs only when the codegen feeder supplies arg evidence
-* (`context.argValidators`, public procedures only); a runtime caller flags
-* nothing. One finding per offending arg.
-*/
+ * Flags a public `v.string()` argument with no length bound.
+ *
+ * A string field that accepts an unbounded value lets a client send megabytes of
+ * text per request — inflating storage, blowing the row/document size budget, and
+ * driving CPU/memory on every handler that processes it. A `.check()`/`.meta()`
+ * max-length bound caps the blast radius. Advisory (INFO): a deliberately-open
+ * free-text field is sometimes legitimate, so this nudges rather than blocks.
+ *
+ * Runs only when the codegen feeder supplies arg evidence
+ * (`context.argValidators`, public procedures only); a runtime caller flags
+ * nothing. One finding per offending arg.
+ */
 declare const unboundedStringArgument: Lint;
 /**
-* Lunora port of splinter's `0001_unindexed_foreign_keys`.
-*
-* A `one` (many-to-one) relation declares a foreign-key column (`relation.field`)
-* on the holder table pointing at the target's `references` column. If no index
-* leads with that column, every read that filters or joins on the FK degrades to
-* a full table scan — the canonical silent performance cliff as a table grows.
-*
-* Coverage follows SQLite's leftmost-prefix rule: a composite index
-* `["authorId", "createdAt"]` covers lookups on `authorId`, so the FK is
-* satisfied when it is the *leading* column of any declared index. `many`
-* relations are skipped here — their FK lives on the opposite table and is
-* caught when that table's own `one` side is audited.
-*/
+ * Lunora port of splinter's `0001_unindexed_foreign_keys`.
+ *
+ * A `one` (many-to-one) relation declares a foreign-key column (`relation.field`)
+ * on the holder table pointing at the target's `references` column. If no index
+ * leads with that column, every read that filters or joins on the FK degrades to
+ * a full table scan — the canonical silent performance cliff as a table grows.
+ *
+ * Coverage follows SQLite's leftmost-prefix rule: a composite index
+ * `["authorId", "createdAt"]` covers lookups on `authorId`, so the FK is
+ * satisfied when it is the *leading* column of any declared index. `many`
+ * relations are skipped here — their FK lives on the opposite table and is
+ * caught when that table's own `one` side is audited.
+ */
 declare const unindexedForeignKey: Lint;
 /**
-* The to-many counterpart of `unindexed_foreign_key`.
-*
-* A `many` relation declares its foreign-key column (`relation.field`) on the
-* target table — `users.posts = r.many("posts", { field: "authorId" })` puts
-* `authorId` on `posts`. A relation predicate over that relation (`{ posts: {
-* some|none|every: W } }` in a `where`/RLS policy) and a `with:` child load both
-* resolve by querying the target table on that FK column, so an unindexed FK
-* there is the same silent full-scan cliff `unindexed_foreign_key` warns about —
-* just on the other side of the relation.
-*
-* `unindexed_foreign_key` only audits a table's own `one` relations, so it
-* catches this column **only when the target table declares the inverse `one`
-* relation** (`posts.author = r.one("users", { field: "authorId" })`). A
-* one-directional `many` (declared on the parent, with no inverse `one` on the
-* child) slips through — that exact gap is this lint's job. To stay strictly
-* complementary it skips any FK the target already covers via its own `one`
-* relation (reported there) and only fires on the otherwise-unaudited column.
-*/
+ * The to-many counterpart of `unindexed_foreign_key`.
+ *
+ * A `many` relation declares its foreign-key column (`relation.field`) on the
+ * target table — `users.posts = r.many("posts", { field: "authorId" })` puts
+ * `authorId` on `posts`. A relation predicate over that relation (`{ posts: {
+ * some|none|every: W } }` in a `where`/RLS policy) and a `with:` child load both
+ * resolve by querying the target table on that FK column, so an unindexed FK
+ * there is the same silent full-scan cliff `unindexed_foreign_key` warns about —
+ * just on the other side of the relation.
+ *
+ * `unindexed_foreign_key` only audits a table's own `one` relations, so it
+ * catches this column **only when the target table declares the inverse `one`
+ * relation** (`posts.author = r.one("users", { field: "authorId" })`). A
+ * one-directional `many` (declared on the parent, with no inverse `one` on the
+ * child) slips through — that exact gap is this lint's job. To stay strictly
+ * complementary it skips any FK the target already covers via its own `one`
+ * relation (reported there) and only fires on the otherwise-unaudited column.
+ */
 declare const unindexedRelationTarget: Lint;
 /**
-* Flags a public `mutation`/`action` that creates a user/session or sends mail but
-* installs no CAPTCHA / bot check.
-*
-* Endpoints that mint accounts or trigger emails are the classic automated-abuse
-* surface: credential-stuffing sign-ups, mailbox-flooding "forgot password" loops,
-* and disposable-account farming. A server-verified human check (Turnstile) in
-* front of them is the defense. Lunora ships `verifyTurnstile()` (`@lunora/auth`)
-* and the `protectPublic({ captcha })` bundle; this lint fires when a public
-* procedure writes a user/session/account-shaped table (or references `ctx.mail`)
-* with no captcha middleware.
-*
-* Runs only when the codegen feeder supplies protection evidence
-* (`context.procedureProtections`); a runtime caller with no evidence flags
-* nothing.
-*/
+ * Flags a public `mutation`/`action` that creates a user/session or sends mail but
+ * installs no CAPTCHA / bot check.
+ *
+ * Endpoints that mint accounts or trigger emails are the classic automated-abuse
+ * surface: credential-stuffing sign-ups, mailbox-flooding "forgot password" loops,
+ * and disposable-account farming. A server-verified human check (Turnstile) in
+ * front of them is the defense. Lunora ships `verifyTurnstile()` (`@lunora/auth`)
+ * and the `protectPublic({ captcha })` bundle; this lint fires when a public
+ * procedure writes a user/session/account-shaped table (or references `ctx.mail`)
+ * with no captcha middleware.
+ *
+ * Runs only when the codegen feeder supplies protection evidence
+ * (`context.procedureProtections`); a runtime caller with no evidence flags
+ * nothing.
+ */
 declare const userCreatingMutationWithoutCaptcha: Lint;
 /**
-* A correctness lint: every `ctx.workflows.get("name")` call must reference a
-* workflow that exists — i.e. a `defineWorkflow` export in `lunora/workflows.ts`.
-* A `.get("x")` whose `"x"` resolves to no declared workflow is a typo or a
-* reference to a workflow that was removed/renamed; codegen wires the typed
-* `ctx.workflows` accessor off the declared set, so the call throws at runtime.
-* Caught here at codegen time instead.
-*
-* Calls with a non-literal name (`workflow === ""`) are skipped — they can't be
-* statically resolved, so they're neither confirmed-unknown here nor counted as
-* a typo. Only runs when both feeders supplied evidence (declared workflows and
-* discovered calls); a runtime caller flags nothing.
-*/
+ * Flags a `ctx.vectors.query`/`upsert`/`upsertMany` call whose `namespace`
+ * input is derived from the handler's `args` with no server-side scoping — a
+ * tenant-partition escape.
+ *
+ * Vectorize namespaces partition a single index into isolated sub-collections
+ * (typically one per tenant/user). When a namespace comes straight from
+ * request input (`ctx.vectors.query(idx, { namespace: args.tenant })`, or a
+ * value built one hop earlier from `args`), any caller can hand in another
+ * tenant's namespace and read or poison that tenant's vectors. The fix is to
+ * derive the namespace from a server-trusted identity (`` `${ctx.auth.orgId}` ``)
+ * so a caller can only ever address their own partition — a namespace that
+ * references `ctx` is treated as scoped and is not flagged.
+ *
+ * Runs only when the codegen feeder supplies vector-namespace evidence
+ * (`context.vectorNamespaceAccesses`); a runtime caller flags nothing. One
+ * finding per arg-derived, unscoped `ctx.vectors` call.
+ */
+declare const vectorsNamespaceFromUserInput: Lint;
+/**
+ * Flags a durable step name reused within one workflow.
+ *
+ * Cloudflare Workflows memoizes every `step.do` / `step.sleep` / `step.sleepUntil`
+ * / `step.waitForEvent` call by its name: on replay the runtime returns the cached
+ * result for a name it has already seen. Two distinct steps that share a name are
+ * therefore a silent bug — the second call never runs its body and instead yields
+ * the first's result, skipping the work (a charge, a write, an external wait)
+ * without error. Hence `ERROR`/`INTERNAL`: it is a developer-facing correctness
+ * defect in the workflow's own code, not a runtime-data nit.
+ *
+ * Only the first string-literal argument of each step call is compared; a step
+ * named dynamically (`step.do(\`load-${id}\`, …)`) is omitted by the feeder, so a
+ * deliberately-parameterized fan-out is never flagged. `ctx.runStep(stepDef, …)`
+ * names (which come from `defineStep` in another file) are out of scope here.
+ * Only runs when the declaration feeder supplied step evidence
+ * (`workflow.steps` present); a runtime caller flags nothing.
+ */
+declare const workflowDuplicateStepName: Lint;
+/**
+ * A correctness lint: every `ctx.workflows.get("name")` call must reference a
+ * workflow that exists — i.e. a `defineWorkflow` export in `lunora/workflows.ts`.
+ * A `.get("x")` whose `"x"` resolves to no declared workflow is a typo or a
+ * reference to a workflow that was removed/renamed; codegen wires the typed
+ * `ctx.workflows` accessor off the declared set, so the call throws at runtime.
+ * Caught here at codegen time instead.
+ *
+ * Calls with a non-literal name (`workflow === ""`) are skipped — they can't be
+ * statically resolved, so they're neither confirmed-unknown here nor counted as
+ * a typo. Only runs when both feeders supplied evidence (declared workflows and
+ * discovered calls); a runtime caller flags nothing.
+ */
 declare const workflowUnknownTarget: Lint;
 /**
-* Flags a declared workflow that nothing starts.
-*
-* Cross-references every `defineWorkflow` export against the set of workflow
-* names some function references via `ctx.workflows.get("&lt;name>")`. A workflow
-* with no such call is either dead code (declared, deployed as a billable
-* `WorkflowEntrypoint`, never triggered) or is started through a path the static
-* analysis can't see — the Cloudflare REST API, a `wrangler` invocation, or a
-* cross-service binding. Hence `INFO`/`INTERNAL`: a nudge to confirm intent.
-*
-* Suppressed entirely when any call uses a non-literal name
-* (`ctx.workflows.get(someVariable)`), because a dynamic dispatch could target
-* any declared workflow — flagging "unused" workflows then would be a false
-* positive. Only runs when the declaration feeder supplied evidence
-* (`context.workflows` present); a runtime caller flags nothing.
-*/
+ * Flags a declared workflow that nothing starts.
+ *
+ * Cross-references every `defineWorkflow` export against the set of workflow
+ * names some function references via `ctx.workflows.get("&lt;name>")`. A workflow
+ * with no such call is either dead code (declared, deployed as a billable
+ * `WorkflowEntrypoint`, never triggered) or is started through a path the static
+ * analysis can't see — the Cloudflare REST API, a `wrangler` invocation, or a
+ * cross-service binding. Hence `INFO`/`INTERNAL`: a nudge to confirm intent.
+ *
+ * Suppressed entirely when any call uses a non-literal name
+ * (`ctx.workflows.get(someVariable)`), because a dynamic dispatch could target
+ * any declared workflow — flagging "unused" workflows then would be a false
+ * positive. Only runs when the declaration feeder supplied evidence
+ * (`context.workflows` present); a runtime caller flags nothing.
+ */
 declare const workflowUnused: Lint;
 /**
-* Every lint that runs against the declared schema (and, for
-* `filter_without_index`, the discovered query reads) — no running shard
-* required. Correctness lints (`*_unknown_*`, `empty_index`) come first so a
-* broken schema's errors surface above the performance advisories.
-*/
+ * Every lint that runs against the declared schema (and, for
+ * `filter_without_index`, the discovered query reads) — no running shard
+ * required. Correctness lints (`*_unknown_*`, `empty_index`) come first so a
+ * broken schema's errors surface above the performance advisories.
+ */
 declare const STATIC_LINTS: ReadonlyArray<Lint>;
 /**
-* Every lint that needs observed runtime signal (recorded metrics) rather than
-* just the declared schema. They read the feeder-supplied
-* {@link LintContext.shardTraffic} / {@link LintContext.tableScans} /
-* {@link LintContext.indexHits}; absent that signal (a static caller) each is a
-* no-op. Run them with `runAdvisor(ctx, { source: "runtime" })` against a live
-* deployment's aggregated metrics.
-*/
+ * Every lint that needs observed runtime signal (recorded metrics) rather than
+ * just the declared schema. They read the feeder-supplied
+ * {@link LintContext.shardTraffic} / {@link LintContext.tableScans} /
+ * {@link LintContext.indexHits}; absent that signal (a static caller) each is a
+ * no-op. Run them with `runAdvisor(ctx, { source: "runtime" })` against a live
+ * deployment's aggregated metrics.
+ */
 declare const RUNTIME_LINTS: ReadonlyArray<Lint>;
 /** The default lint set: the static lints, then the runtime lints. A caller filters by `source` to run one tier. */
 declare const ALL_LINTS: ReadonlyArray<Lint>;
@@ -1443,9 +3648,9 @@ interface RunAdvisorOptions {
   source?: LintSource;
 }
 /**
-* Run lints against a context and return their findings in lint-declaration
-* order. Filtering by {@link RunAdvisorOptions.source} lets a caller run only
-* `static` lints at build time and defer `runtime` lints to a live shard.
-*/
+ * Run lints against a context and return their findings in lint-declaration
+ * order. Filtering by {@link RunAdvisorOptions.source} lets a caller run only
+ * `static` lints at build time and defer `runtime` lints to a live shard.
+ */
 declare const runAdvisor: (context: LintContext, options?: RunAdvisorOptions) => Finding[];
-export { AE_METRIC_EVENTS, ALL_LINTS, type AdvisorAdminRoute, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorContainer, type AdvisorHyperdriveCall, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorMaskProcedure, type AdvisorNondeterministicCall, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorR2sqlCall, type AdvisorRelation, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShardTraffic, type AdvisorSqlInterpolation, type AdvisorTable, type AdvisorTableSample, type AdvisorTableScan, type AdvisorWorkflow, type AdvisorWorkflowCall, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type Category, type Facing, type Finding, type Level, type Lint, type LintContext, type LintSource, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, adminRouteWithoutGuard, authApiCallWithoutHeaders, circularFk, constraintValidator, containerOversizedInstance, containerPublicInternet, duplicateIndex, emptyIndex, filterWithoutIndex, fromServerSchema, hardcodedSecret, hotShard, hyperdriveOutsideAction, indexReferencesUnknownField, indexUtilization, loadAnalyticsRuntimeMetrics, maskUncoveredPiiColumn, nondeterministicQueryMutation, policyReferencesUnknownTable, publicArgumentUsesAny, publicMutationWithoutRatelimit, r2sqlOutsideAction, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, sqlInjectionRisk, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, workflowUnknownTarget, workflowUnused };
+export { AE_METRIC_EVENTS, ALL_LINTS, type AdvisorAdminRoute, type AdvisorAiRawRun, type AdvisorAiToolSideEffect, type AdvisorArgumentDerivedFetch, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorAuthConfig, type AdvisorBrowserUrlAccess, type AdvisorConfigCall, type AdvisorContainer, type AdvisorContainerKeyAccess, type AdvisorContainerOverride, type AdvisorFailOpenGuard, type AdvisorFlagSecurityDefault, type AdvisorHttpActionGuard, type AdvisorHttpHeaderWrite, type AdvisorHyperdriveCall, type AdvisorIdentityClaimRead, type AdvisorImageDeliveryUrlAccess, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorKvKeyAccess, type AdvisorMailRecipientAccess, type AdvisorMaskProcedure, type AdvisorMaskStrategy, type AdvisorMutatorWrite, type AdvisorNondeterministicCall, type AdvisorNormalizeIdAuthorization, type AdvisorOwnerFieldWrite, type AdvisorPaymentWebhook, type AdvisorPrivilegedDispatch, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorQueue, type AdvisorQueueTuning, type AdvisorR2sqlCall, type AdvisorRatelimitKeySelector, type AdvisorRawRowReturn, type AdvisorRelation, type AdvisorRelationLoad, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShape, type AdvisorShardTraffic, type AdvisorSoftDeleteRead, type AdvisorSqlInterpolation, type AdvisorStorageKeyAccess, type AdvisorStorageUpload, type AdvisorTable, type AdvisorTableSample, type AdvisorTableScan, type AdvisorVectorNamespaceAccess, type AdvisorWorkflow, type AdvisorWorkflowCall, type AdvisorWranglerVariable, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type Category, type Facing, type Finding, type Level, type Lint, type LintContext, type LintSource, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, actionFetchSsrf, adminRouteWithoutGuard, aiRawRunEscapeHatch, aiToolSideEffectPromptInjection, aiUnboundedGenerationPublic, allowUnauthenticatedShardAccessEnabled, authApiCallWithoutHeaders, authCsrfCheckDisabled, authEmailVerificationDisabled, authSecureCookiesDisabled, authSessionFreshageZero, authTrustedOriginsWildcard, browserAllowPrivateTargets, browserUserUrlWithoutAllowlist, circularFk, constraintValidator, containerInstanceKeyFromUserInput, containerOversizedInstance, containerPublicInternet, containerRuntimeEgressRelaxation, containerStartEnableInternetOverride, dedupeCacheKeys, duplicateIndex, emptyIndex, externalSourceIncrementalNoDeletePath, externalSourceOnGlobal, externalSourceUnscoped, filterWithoutIndex, flagGatesSecurityWithUnsafeDefault, fromServerSchema, hardcodedSecret, hotShard, httpActionMissingAuthGuard, httpActionResponseHeaderInjection, hyperdriveOutsideAction, identityUndeclaredClaimTrusted, imagesUrlSourceFromUserInput, indexReferencesUnknownField, indexUtilization, insertManyUnsafeUserData, kvUnscopedUserKeyIdor, loadAnalyticsRuntimeMetrics, mailInboundDispatchWithoutVerify, mailRecipientFromRequestInput, maskUncoveredPiiColumn, maskWeakHashStrategyOnPii, maskedRelationLeakViaWith, mutatorFullRowReplace, nondeterministicQueryMutation, normalizeIdUsedAsAuthorization, outputProjectionMissingOnPublicRead, ownerFieldFromArgsNotAuth, paymentCreateWithoutAuthorize, paymentWebhookWideTolerance, plaintextSecretInWranglerVariables, policyReferencesUnknownTable, privilegedDispatchUnvalidatedPayload, privilegedFanoutFromPublicProcedure, publicArgumentUsesAny, publicMutationWithoutRatelimit, publicTableRlsOptoutConfusion, queueWithoutDlq, r2sqlOutsideAction, ratelimitDefaultMemoryStore, ratelimitKeySpoofableOrGlobal, ratelimitMiddlewareFailOpen, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, softDeleteIncludeDeletedFromArgs, sqlInjectionRisk, storageGenerateUploadUrlNoContentTypePin, storageKeyFromUserArgs, storagePresignedUrlForPrivateContent, storageUploadWithoutContentTypeAllowlist, storageUploadWithoutMaxSize, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, vectorsNamespaceFromUserInput, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };