@lunora/advisor 1.0.0-alpha.65 → 1.0.0-alpha.67

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import { Schema } from '@lunora/server';
 /**
- * One `httpRoute.<verb>("/admin/…")` REST route on an admin/privileged-looking
+ * One `httpRoute.<verb>("/admin/…")` REST route on an admin/privileged-looking
  * path, with whether its handler references an auth/admin guard — the input the
  * `admin_route_without_guard` lint consumes. Produced by the codegen feeder;
  * runtime callers don't supply it, so the lint finds nothing there.
@@ -147,7 +147,7 @@ interface AdvisorAuthConfig {
   trustedOriginsWildcard: boolean;
 }
 /**
- * One `ctx.authApi.&lt;method>(...)` call discovered in a function body — the input
+ * One `ctx.authApi.<method>(...)` call discovered in a function body — the input
  * the `auth_api_call_without_headers` lint consumes. Produced by the codegen
  * feeder; runtime callers don't supply it, so the lint finds nothing there.
  */
@@ -164,7 +164,7 @@ interface AdvisorAuthApiCall {
   method: string;
 }
 /**
- * One `ctx.browser.&lt;method>(url, …)` call whose navigation URL (`arguments[0]`)
+ * One `ctx.browser.<method>(url, …)` call whose navigation URL (`arguments[0]`)
  * is derived from the handler's `args` with no server-side scoping — the input
  * the `browser_user_url_without_allowlist` lint consumes. `@lunora/browser`
  * blocks private/internal targets by default, but a request-supplied *public*
@@ -216,7 +216,7 @@ interface AdvisorConfigCall {
   trueKeys: ReadonlyArray<string>;
 }
 /**
- * One `ctx.containers.&lt;exportName>.get(name, …)` call whose instance key is
+ * One `ctx.containers.<exportName>.get(name, …)` call whose instance key is
  * derived from the handler's `args` with no server-side scoping — the input
  * the `container_instance_key_from_user_input` lint consumes. A container
  * definition's `.get(name)` accessor routes to one instance per `name`, so a
@@ -238,8 +238,8 @@ interface AdvisorContainerKeyAccess {
   method: string;
 }
 /**
- * One runtime container-override call: a `&lt;handle>.start({ enableInternet: true, … })`
- * launch override, or a `&lt;handle>.egress.&lt;method>(...)` runtime firewall mutation
+ * One runtime container-override call: a `<handle>.start({ enableInternet: true, … })`
+ * launch override, or a `<handle>.egress.<method>(...)` runtime firewall mutation
  * (`allow` / `deny` / `setAllowed`) — the `container_start_enable_internet_override`
  * and `container_runtime_egress_relaxation` lint input. Both shapes re-open network
  * access the static `defineContainer` declaration (and its `container_public_internet`
@@ -333,7 +333,7 @@ interface AdvisorExportSink {
 interface AdvisorFailOpenGuard {
   /** The middleware factory at the call site: `rateLimit` / `dbRateLimit` / `verifyTurnstileMiddleware`. */
   callee: string;
-  /** The exported binding name of the procedure the guard is attached to, or `"&lt;module>"` at file scope. */
+  /** The exported binding name of the procedure the guard is attached to, or `"<module>"` at file scope. */
   exportName: string;
   /** `true` only when the options literal set `failOpen: true` as a boolean literal; a non-literal or absent option is treated as fail-closed. */
   failOpen: boolean;
@@ -345,7 +345,7 @@ interface AdvisorFailOpenGuard {
   line: number;
 }
 /**
- * One `ctx.flags.boolean("key", &lt;boolean-literal>)` read — the
+ * One `ctx.flags.boolean("key", <boolean-literal>)` read — the
  * `flag_gates_security_with_unsafe_default` lint input. OpenFeature returns the
  * `defaultValue` when the provider errors, so a fail-open default on a
  * security-shaped key (an `enforce`/`rls`/`gate`/`lockdown` protection
@@ -358,7 +358,7 @@ interface AdvisorFailOpenGuard {
 interface AdvisorFlagSecurityDefault {
   /** The boolean-literal default returned on a provider outage (fail-open value). */
   defaultValue: boolean;
-  /** The exported binding name of the procedure performing the flag read, or `"&lt;module>"` at file scope. */
+  /** The exported binding name of the procedure performing the flag read, or `"<module>"` at file scope. */
   exportName: string;
   /** Source file relative to the lunora dir, no extension. */
   file: string;
@@ -394,7 +394,7 @@ interface AdvisorFunctionMetrics {
   errors: number;
   /** Slowest single dispatch, ms, over the same window. */
   maxDurationMs: number;
-  /** The function's registered path (`&lt;file>:&lt;exportName>`). */
+  /** The function's registered path (`<file>:<exportName>`). */
   path: string;
 }
 /**
@@ -402,7 +402,7 @@ interface AdvisorFunctionMetrics {
  * input the `geo_index_unused` lint cross-references against the declared geo
  * indexes in the lint context's schema. Produced by the codegen feeder, which
  * walks the lunora source for `ctx.db.query("t").withGeoIndex(name, …)` /
- * `ctx.db.&lt;table>.withGeoIndex(name, …)` reads and records each referenced index
+ * `ctx.db.<table>.withGeoIndex(name, …)` reads and records each referenced index
  * name. Runtime callers don't supply it, so the lint finds nothing there.
  *
  * A `.geoIndex(name, { field })` maintains a geohash companion column on every
@@ -432,7 +432,7 @@ interface AdvisorGeoIndexUsage {
  * there.
  */
 interface AdvisorHttpActionGuard {
-  /** The exported binding name of the handler (or `"&lt;module>"` when mounted inline / not a named binding). */
+  /** The exported binding name of the handler (or `"<module>"` when mounted inline / not a named binding). */
   exportName: string;
   /** Source file relative to the lunora dir, no extension. */
   file: string;
@@ -444,7 +444,7 @@ interface AdvisorHttpActionGuard {
   method?: string;
   /** `true` when the handler reads `ctx.auth` (a direct member access or a `const { auth } = ctx` destructure). */
   readsAuth: boolean;
-  /** The first side effect found, as a stable label: `runMutation`, `runAction`, or `db.&lt;method>`. */
+  /** The first side effect found, as a stable label: `runMutation`, `runAction`, or `db.<method>`. */
   sideEffect: string;
 }
 /**
@@ -461,7 +461,7 @@ interface AdvisorHttpActionGuard {
  * to `HttpHeaderWriteIR`.
  */
 interface AdvisorHttpHeaderWrite {
-  /** The exported binding name of the enclosing handler, or `"&lt;module>"` when mounted inline. */
+  /** The exported binding name of the enclosing handler, or `"<module>"` when mounted inline. */
   exportName: string;
   /** Source file relative to the lunora dir, no extension. */
   file: string;
@@ -499,7 +499,7 @@ interface AdvisorHyperdriveCall {
   line: number;
 }
 /**
- * One `&lt;receiver>.identity.&lt;key>` claim read (where `&lt;receiver>` is an RLS/mask
+ * One `<receiver>.identity.<key>` claim read (where `<receiver>` is an RLS/mask
  * policy `auth`, or `ctx.auth`/`context.auth`) — the shared input for the
  * `identity_undeclared_claim_trusted` lint. `defineIdentity` validates only its
  * declared claims at the trust boundary and forwards undeclared claims
@@ -513,7 +513,7 @@ interface AdvisorHyperdriveCall {
 interface AdvisorIdentityClaimRead {
   /** `true` when `key` is a declared claim (in the `defineIdentity` contract, or the always-present `userId`). */
   declared: boolean;
-  /** The exported binding name of the enclosing declaration (`&lt;module>` at file scope). */
+  /** The exported binding name of the enclosing declaration (`<module>` at file scope). */
   exportName: string;
   /** Source file relative to the lunora dir, no extension. */
   file: string;
@@ -601,7 +601,7 @@ interface AdvisorInsertWrite {
   table: string;
 }
 /**
- * One `ctx.kv.&lt;method>(key, …)` call whose namespace key is derived from the
+ * One `ctx.kv.<method>(key, …)` call whose namespace key is derived from the
  * handler's `args` with no server-side scoping — the input the
  * `kv_unscoped_user_key_idor` lint consumes. Workers KV is a single flat
  * namespace, so a key taken straight from request input lets any caller read,
@@ -693,7 +693,7 @@ interface AdvisorMaskProcedure {
 interface AdvisorMaskStrategy {
   /** Masked column name. */
   column: string;
-  /** The exported binding name of the procedure whose `.use(mask(...))` chain declared this column, or `"&lt;module>"` when declared at file scope. */
+  /** The exported binding name of the procedure whose `.use(mask(...))` chain declared this column, or `"<module>"` when declared at file scope. */
   exportName: string;
   /** Source file relative to the lunora dir, no extension. */
   file: string;
@@ -866,7 +866,7 @@ interface AdvisorOwnerFieldWrite {
 interface AdvisorPaymentWebhook {
   /** The adapter factory invoked. */
   callee: "createAutumnAdapter" | "createDodoPaymentsAdapter" | "createPolarAdapter" | "createStripeAdapter";
-  /** The exported binding name of the enclosing declaration (`&lt;module>` at file scope). */
+  /** The exported binding name of the enclosing declaration (`<module>` at file scope). */
   exportName: string;
   /** Source file relative to the lunora dir, no extension. */
   file: string;
@@ -1123,8 +1123,8 @@ interface AdvisorRatelimitKeySelector {
 }
 /**
  * One `query` handler whose `return` hands back the raw rows of a table — the
- * result of a `ctx.db.&lt;table>.findMany()` / `.findFirst()` / `.get()` read, or a
- * `ctx.db.query("&lt;table>")…collect()` fluent chain — returned directly (or through
+ * result of a `ctx.db.<table>.findMany()` / `.findFirst()` / `.get()` read, or a
+ * `ctx.db.query("<table>")…collect()` fluent chain — returned directly (or through
  * one local `const` hop) with no hand-built projection. The shared input for the
  * `output_projection_missing_on_public_read` lint, which keeps only `visibility
  * === "public"` rows with no `.output(...)` / `.use(mask(...))` on the chain and
@@ -1149,7 +1149,7 @@ interface AdvisorRawRowReturn {
   visibility: "internal" | "public";
 }
 /**
- * One `ctx.db.&lt;table>.findMany({ with: { &lt;rel> } })` relation-hydrating list read
+ * One `ctx.db.<table>.findMany({ with: { <rel> } })` relation-hydrating list read
  * — the shared input for the `masked_relation_leak_via_with` lint. Column
  * masking is applied per-procedure to the top-level rows of the table named in
  * the read; it does **not** descend into `with`-hydrated relations, so a masked
@@ -1434,7 +1434,7 @@ interface AdvisorShardTraffic {
   shardKey: string;
 }
 /**
- * One `ctx.db.&lt;table>.findMany({ includeDeleted })` list read whose
+ * One `ctx.db.<table>.findMany({ includeDeleted })` list read whose
  * `includeDeleted` is either a hardcoded `true` or derived from the handler's
  * `args` — the shared input for the `soft_delete_include_deleted_from_args`
  * lint. `includeDeleted` resurfaces rows a `.softDelete()` table would otherwise
@@ -1477,7 +1477,7 @@ interface AdvisorSqlInterpolation {
   line: number;
 }
 /**
- * One `ctx.storage.&lt;bucket>.&lt;method>(key, …)` call whose R2 object key is derived
+ * One `ctx.storage.<bucket>.<method>(key, …)` call whose R2 object key is derived
  * from the handler's `args` with no server-side scoping — the input the
  * `storage_key_from_user_args` lint consumes. An object key taken straight from
  * request input lets any caller read, overwrite, or delete another user's object
@@ -1505,7 +1505,7 @@ interface AdvisorStorageKeyAccess {
   visibility?: "internal" | "public";
 }
 /**
- * One tracked `ctx.storage.&lt;bucket>.&lt;method>(...)` upload/signing call — the
+ * One tracked `ctx.storage.<bucket>.<method>(...)` upload/signing call — the
  * shared input for the storage config-hygiene security lints
  * (`storage_upload_without_content_type_allowlist`, `storage_upload_without_max_size`,
  * `storage_generate_upload_url_no_content_type_pin`, `storage_presigned_url_for_private_content`).
@@ -1589,7 +1589,7 @@ interface AdvisorUnrestrictedWhereBranch {
   owner: string;
 }
 /**
- * One `ctx.vectors.&lt;method>(indexName, input)` call whose `input.namespace` is
+ * One `ctx.vectors.<method>(indexName, input)` call whose `input.namespace` is
  * derived from the handler's `args` with no server-side scoping — the input the
  * `vectors_namespace_from_user_input` lint consumes. A Vectorize namespace
  * partitions one index into isolated sub-collections, so a namespace taken
@@ -1737,7 +1737,7 @@ interface Finding {
  */
 interface LintContext {
   /**
-   * `httpRoute.&lt;verb>("/admin/…")` routes on admin/privileged-looking paths and
+   * `httpRoute.<verb>("/admin/…")` routes on admin/privileged-looking paths and
    * whether each references an auth/admin guard — the `admin_route_without_guard`
    * input. Supplied by the codegen feeder; absent for runtime callers, where the
    * lint finds nothing.
@@ -1778,7 +1778,7 @@ interface LintContext {
    */
   argValidators?: ReadonlyArray<AdvisorArgumentValidator>;
   /**
-   * `ctx.authApi.&lt;method>(...)` calls discovered in function bodies (the
+   * `ctx.authApi.<method>(...)` calls discovered in function bodies (the
    * `auth_api_call_without_headers` input). Supplied by the codegen feeder; absent
    * for runtime callers, where the lint finds nothing.
    */
@@ -1797,7 +1797,7 @@ interface LintContext {
    */
   authConfigs?: ReadonlyArray<AdvisorAuthConfig>;
   /**
-   * `ctx.browser.&lt;method>(url, …)` calls whose navigation URL is derived from the
+   * `ctx.browser.<method>(url, …)` calls whose navigation URL is derived from the
    * handler's `args` with no server-side scoping — the
    * `browser_user_url_without_allowlist` input. `@lunora/browser` blocks
    * private/internal targets by default, but a request-supplied public URL can
@@ -1816,7 +1816,7 @@ interface LintContext {
    */
   configCalls?: ReadonlyArray<AdvisorConfigCall>;
   /**
-   * `ctx.containers.&lt;name>.get(key, …)` calls whose instance key is derived from
+   * `ctx.containers.<name>.get(key, …)` calls whose instance key is derived from
    * the handler's `args` with no server-side scoping — the
    * `container_instance_key_from_user_input` input. Each container definition's
    * `.get(name)` accessor routes to one instance per key, so an arg-derived key lets
@@ -1827,7 +1827,7 @@ interface LintContext {
   containerKeyAccesses?: ReadonlyArray<AdvisorContainerKeyAccess>;
   /**
    * Runtime container-override calls — a `.start({ enableInternet: true, … })`
-   * launch override, or a `.egress.&lt;method>(...)` runtime firewall mutation — the
+   * launch override, or a `.egress.<method>(...)` runtime firewall mutation — the
    * `container_start_enable_internet_override` and `container_runtime_egress_relaxation`
    * lint input. Supplied by the codegen feeder; absent for runtime callers, where
    * those lints find nothing.
@@ -1912,7 +1912,7 @@ interface LintContext {
    */
   hyperdriveCalls?: ReadonlyArray<AdvisorHyperdriveCall>;
   /**
-   * `&lt;receiver>.identity.&lt;key>` claim reads (RLS/mask policy `auth`, or
+   * `<receiver>.identity.<key>` claim reads (RLS/mask policy `auth`, or
    * `ctx.auth`/`context.auth`) — the `identity_undeclared_claim_trusted` input.
    * `defineIdentity` validates only declared claims and forwards undeclared ones
    * verbatim, so each row's `declared` flag says whether `key` is in the contract
@@ -1951,7 +1951,7 @@ interface LintContext {
    */
   inserts?: ReadonlyArray<AdvisorInsertWrite>;
   /**
-   * `ctx.kv.&lt;method>(key, …)` calls whose namespace key is derived from the
+   * `ctx.kv.<method>(key, …)` calls whose namespace key is derived from the
    * handler's `args` with no server-side scoping — the `kv_unscoped_user_key_idor`
    * input. Workers KV is one flat namespace, so a key taken straight from request
    * input lets any caller read/overwrite/delete another user's entry (IDOR). Only
@@ -2113,7 +2113,7 @@ interface LintContext {
    */
   rawRowReturns?: ReadonlyArray<AdvisorRawRowReturn>;
   /**
-   * `ctx.db.&lt;table>.findMany({ with: { &lt;rel> } })` relation-hydrating list reads
+   * `ctx.db.<table>.findMany({ with: { <rel> } })` relation-hydrating list reads
    * — the `masked_relation_leak_via_with` input. Column masking is applied to a
    * read's top-level rows but does not descend into `with`-hydrated relations,
    * so a masked table surfaced only through a `with` on an unprotected public
@@ -2154,7 +2154,7 @@ interface LintContext {
    */
   shardTraffic?: ReadonlyArray<AdvisorShardTraffic>;
   /**
-   * `ctx.db.&lt;table>.findMany({ includeDeleted })` list reads whose
+   * `ctx.db.<table>.findMany({ includeDeleted })` list reads whose
    * `includeDeleted` is a hardcoded `true` or derived from the handler's
    * `args` — the `soft_delete_include_deleted_from_args` input. On a public
    * read of a `.softDelete()` table this resurfaces soft-deleted rows to any
@@ -2170,7 +2170,7 @@ interface LintContext {
    */
   sqlInterpolations?: ReadonlyArray<AdvisorSqlInterpolation>;
   /**
-   * `ctx.storage.&lt;bucket>.&lt;method>(key, …)` calls whose R2 object key is derived
+   * `ctx.storage.<bucket>.<method>(key, …)` calls whose R2 object key is derived
    * from the handler's `args` with no server-side scoping — the
    * `storage_key_from_user_args` input. The bucket read/write/URL/delete methods
    * key by their first argument, so an arg-derived key is object-level IDOR
@@ -2181,7 +2181,7 @@ interface LintContext {
    */
   storageKeyAccesses?: ReadonlyArray<AdvisorStorageKeyAccess>;
   /**
-   * Tracked `ctx.storage.&lt;bucket>.&lt;method>(...)` upload/signing calls — the
+   * Tracked `ctx.storage.<bucket>.<method>(...)` upload/signing calls — the
    * shared input for the storage config-hygiene lints
    * (`storage_upload_without_content_type_allowlist`, `storage_upload_without_max_size`,
    * `storage_generate_upload_url_no_content_type_pin`,
@@ -2221,7 +2221,7 @@ interface LintContext {
    */
   unrestrictedWhereBranches?: ReadonlyArray<AdvisorUnrestrictedWhereBranch>;
   /**
-   * `ctx.vectors.&lt;method>(index, { namespace, … })` calls whose `namespace` is
+   * `ctx.vectors.<method>(index, { namespace, … })` calls whose `namespace` is
    * derived from the handler's `args` with no server-side scoping — the
    * `vectors_namespace_from_user_input` input. A Vectorize namespace partitions one
    * index into isolated sub-collections, so an arg-derived namespace lets any caller
@@ -2329,7 +2329,7 @@ interface AnalyticsRuntimeMetrics {
  * within-line discriminator the second finding is silently hidden.
  *
  * This suffixes the second-and-later occurrence of any repeated key with
- * `:&lt;n>` (`:2`, `:3`, …), leaving the first occurrence unsuffixed so existing
+ * `:<n>` (`:2`, `:3`, …), leaving the first occurrence unsuffixed so existing
  * single-occurrence keys stay stable across runs. Order is preserved. Keys are
  * lint-name-prefixed, so this never merges across lints.
  */
@@ -2553,7 +2553,7 @@ declare const aiUnboundedGenerationPublic: Lint;
  */
 declare const allowUnauthenticatedShardAccessEnabled: Lint;
 /**
- * Flags a `ctx.authApi.&lt;method>(...)` call whose argument object omits `headers`.
+ * Flags a `ctx.authApi.<method>(...)` call whose argument object omits `headers`.
  *
  * `@lunora/auth`'s `withAuthPlugins` middleware attaches the full privileged
  * better-auth API to `ctx.authApi` — `banUser`, `setRole`, impersonation,
@@ -2701,7 +2701,7 @@ declare const authTrustedOriginsWildcard: Lint;
  */
 declare const browserAllowPrivateTargets: Lint;
 /**
- * Flags a `ctx.browser.&lt;method>(url, …)` call whose navigation URL is derived
+ * Flags a `ctx.browser.<method>(url, …)` call whose navigation URL is derived
  * from the handler's `args` with no server-side scoping — and no hardened
  * `createBrowser` allowlist to contain it.
  *
@@ -2757,7 +2757,7 @@ declare const browserUserUrlWithoutAllowlist: Lint;
  */
 declare const circularFk: Lint;
 /**
- * Flags a `ctx.containers.&lt;exportName>.get(name, …)` call whose instance key
+ * Flags a `ctx.containers.<exportName>.get(name, …)` call whose instance key
  * is derived from the handler's `args` with no server-side scoping — a
  * cross-tenant container IDOR.
  *
@@ -2982,7 +2982,7 @@ declare const geoIndexFieldNotGeopoint: Lint;
  * `withGeoIndex(name, q => q.near(…) | q.within(…))` the companion is pure dead
  * overhead — the geo analogue of a dead regular index. Cross-references every geo
  * index in the schema against the set of index names some handler references via
- * `withGeoIndex("&lt;name>")`.
+ * `withGeoIndex("<name>")`.
  *
  * Suppressed entirely when any usage passes a non-literal name
  * (`withGeoIndex(someVariable, …)`), because a dynamic reference could target any
@@ -3081,8 +3081,8 @@ declare const hyperdriveOutsideAction: Lint;
  * `defineIdentity` is the trust boundary for `ctx.auth.identity`: the worker
  * validates a resolver's returned claims against the *declared* validators, but
  * — by design — forwards any **undeclared** claims through verbatim, unchecked.
- * So a policy predicate or authorize hook that reads `auth.identity.&lt;key>` for a
- * `&lt;key>` the contract never declares is trusting a value the runtime never
+ * So a policy predicate or authorize hook that reads `auth.identity.<key>` for a
+ * `<key>` the contract never declares is trusting a value the runtime never
  * validated — a claim an attacker's token can carry with an arbitrary value.
  * Reading `userId` (always declared) or any declared claim is fine.
  *
@@ -3262,8 +3262,8 @@ declare const maskWeakHashStrategyOnPii: Lint;
  * relation.
  *
  * INFO, near-zero false positives by construction: it fires only when all of
- * (1) the enclosing read is public, (2) the read declares `with: { &lt;rel> }`,
- * (3) `&lt;rel>` resolves through the schema to a real target table, and (4) that
+ * (1) the enclosing read is public, (2) the read declares `with: { <rel> }`,
+ * (3) `<rel>` resolves through the schema to a real target table, and (4) that
  * target table actually has masked columns (per the discovered mask evidence).
  * Absent any mask usage the lint is a no-op. Runs only when the codegen feeder
  * supplies `context.relationLoads`; a runtime caller flags nothing. One finding
@@ -3529,7 +3529,7 @@ declare const policyReferencesUnknownTable: Lint;
  * id) becomes an act-as-any-user / cross-tenant write.
  *
  * The lint is deliberately narrow to stay false-positive-free: it fires **only**
- * when the resolved target (`api.&lt;file>.&lt;export>`) is found in the
+ * when the resolved target (`api.<file>.<export>`) is found in the
  * RLS-procedure evidence with `usesRls: true`. A dispatch into a function that
  * does its own arg validation and carries no row policy (the common, correct
  * case — e.g. a welcome-message mutation with no `rls`) is not flagged. Runs
@@ -3541,8 +3541,8 @@ declare const privilegedDispatchUnvalidatedPayload: Lint;
  * Flags a public procedure whose handler fans work out to a privileged,
  * cost-bearing dispatch surface without a rate-limit guard.
  *
- * `ctx.scheduler.runAfter` / `runAt`, a `ctx.queues.&lt;name>` producer send, and
- * `ctx.workflows.&lt;name>.create` all enqueue work that runs later under the
+ * `ctx.scheduler.runAfter` / `runAt`, a `ctx.queues.<name>` producer send, and
+ * `ctx.workflows.<name>.create` all enqueue work that runs later under the
  * system identity (RLS disabled) and bills against the account. Triggered from a
  * `.public()` procedure with no rate limit, an anonymous caller can drive that
  * dispatch in a loop — a cost-amplification / denial-of-wallet vector, and a way
@@ -3906,7 +3906,7 @@ declare const sqlInjectionRisk: Lint;
  */
 declare const storageGenerateUploadUrlNoContentTypePin: Lint;
 /**
- * Flags a `ctx.storage.&lt;bucket>.&lt;method>(key, …)` whose R2 object key is derived
+ * Flags a `ctx.storage.<bucket>.<method>(key, …)` whose R2 object key is derived
  * from the handler's `args` with no server-side scoping — an object-level IDOR.
  *
  * The bucket read/write/URL/delete methods (`get`, `put`, `delete`, `download`,
@@ -3993,7 +3993,7 @@ declare const storageUploadWithoutMaxSize: Lint;
  * Using `@lunora/codegen`'s write-side discovery (the analog of the read
  * discovery that feeds `filter_without_index`), this lint cross-references every
  * schema table against the set of tables some exported function writes via
- * `ctx.db.insert("&lt;table>", …)`. A table with no such write either is dead schema
+ * `ctx.db.insert("<table>", …)`. A table with no such write either is dead schema
  * or is populated through a path the static analysis can't see — a migration/seed,
  * cross-region replication, the `ctx.orm.insert(...)` builder, or a trusted
  * snapshot import. Hence `INFO`/`INTERNAL`: a nudge to confirm intent, not an error.
@@ -4162,7 +4162,7 @@ declare const workflowUnknownTarget: Lint;
  * Flags a declared workflow that nothing starts.
  *
  * Cross-references every `defineWorkflow` export against the set of workflow
- * names some function references via `ctx.workflows.get("&lt;name>")`. A workflow
+ * names some function references via `ctx.workflows.get("<name>")`. A workflow
  * with no such call is either dead code (declared, deployed as a billable
  * `WorkflowEntrypoint`, never triggered) or is started through a path the static
  * analysis can't see — the Cloudflare REST API, a `wrangler` invocation, or a

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { Schema } from '@lunora/server';
 /**
- * One `httpRoute.<verb>("/admin/…")` REST route on an admin/privileged-looking
+ * One `httpRoute.<verb>("/admin/…")` REST route on an admin/privileged-looking
  * path, with whether its handler references an auth/admin guard — the input the
  * `admin_route_without_guard` lint consumes. Produced by the codegen feeder;
  * runtime callers don't supply it, so the lint finds nothing there.
@@ -147,7 +147,7 @@ interface AdvisorAuthConfig {
   trustedOriginsWildcard: boolean;
 }
 /**
- * One `ctx.authApi.&lt;method>(...)` call discovered in a function body — the input
+ * One `ctx.authApi.<method>(...)` call discovered in a function body — the input
  * the `auth_api_call_without_headers` lint consumes. Produced by the codegen
  * feeder; runtime callers don't supply it, so the lint finds nothing there.
  */
@@ -164,7 +164,7 @@ interface AdvisorAuthApiCall {
   method: string;
 }
 /**
- * One `ctx.browser.&lt;method>(url, …)` call whose navigation URL (`arguments[0]`)
+ * One `ctx.browser.<method>(url, …)` call whose navigation URL (`arguments[0]`)
  * is derived from the handler's `args` with no server-side scoping — the input
  * the `browser_user_url_without_allowlist` lint consumes. `@lunora/browser`
  * blocks private/internal targets by default, but a request-supplied *public*
@@ -216,7 +216,7 @@ interface AdvisorConfigCall {
   trueKeys: ReadonlyArray<string>;
 }
 /**
- * One `ctx.containers.&lt;exportName>.get(name, …)` call whose instance key is
+ * One `ctx.containers.<exportName>.get(name, …)` call whose instance key is
  * derived from the handler's `args` with no server-side scoping — the input
  * the `container_instance_key_from_user_input` lint consumes. A container
  * definition's `.get(name)` accessor routes to one instance per `name`, so a
@@ -238,8 +238,8 @@ interface AdvisorContainerKeyAccess {
   method: string;
 }
 /**
- * One runtime container-override call: a `&lt;handle>.start({ enableInternet: true, … })`
- * launch override, or a `&lt;handle>.egress.&lt;method>(...)` runtime firewall mutation
+ * One runtime container-override call: a `<handle>.start({ enableInternet: true, … })`
+ * launch override, or a `<handle>.egress.<method>(...)` runtime firewall mutation
  * (`allow` / `deny` / `setAllowed`) — the `container_start_enable_internet_override`
  * and `container_runtime_egress_relaxation` lint input. Both shapes re-open network
  * access the static `defineContainer` declaration (and its `container_public_internet`
@@ -333,7 +333,7 @@ interface AdvisorExportSink {
 interface AdvisorFailOpenGuard {
   /** The middleware factory at the call site: `rateLimit` / `dbRateLimit` / `verifyTurnstileMiddleware`. */
   callee: string;
-  /** The exported binding name of the procedure the guard is attached to, or `"&lt;module>"` at file scope. */
+  /** The exported binding name of the procedure the guard is attached to, or `"<module>"` at file scope. */
   exportName: string;
   /** `true` only when the options literal set `failOpen: true` as a boolean literal; a non-literal or absent option is treated as fail-closed. */
   failOpen: boolean;
@@ -345,7 +345,7 @@ interface AdvisorFailOpenGuard {
   line: number;
 }
 /**
- * One `ctx.flags.boolean("key", &lt;boolean-literal>)` read — the
+ * One `ctx.flags.boolean("key", <boolean-literal>)` read — the
  * `flag_gates_security_with_unsafe_default` lint input. OpenFeature returns the
  * `defaultValue` when the provider errors, so a fail-open default on a
  * security-shaped key (an `enforce`/`rls`/`gate`/`lockdown` protection
@@ -358,7 +358,7 @@ interface AdvisorFailOpenGuard {
 interface AdvisorFlagSecurityDefault {
   /** The boolean-literal default returned on a provider outage (fail-open value). */
   defaultValue: boolean;
-  /** The exported binding name of the procedure performing the flag read, or `"&lt;module>"` at file scope. */
+  /** The exported binding name of the procedure performing the flag read, or `"<module>"` at file scope. */
   exportName: string;
   /** Source file relative to the lunora dir, no extension. */
   file: string;
@@ -394,7 +394,7 @@ interface AdvisorFunctionMetrics {
   errors: number;
   /** Slowest single dispatch, ms, over the same window. */
   maxDurationMs: number;
-  /** The function's registered path (`&lt;file>:&lt;exportName>`). */
+  /** The function's registered path (`<file>:<exportName>`). */
   path: string;
 }
 /**
@@ -402,7 +402,7 @@ interface AdvisorFunctionMetrics {
  * input the `geo_index_unused` lint cross-references against the declared geo
  * indexes in the lint context's schema. Produced by the codegen feeder, which
  * walks the lunora source for `ctx.db.query("t").withGeoIndex(name, …)` /
- * `ctx.db.&lt;table>.withGeoIndex(name, …)` reads and records each referenced index
+ * `ctx.db.<table>.withGeoIndex(name, …)` reads and records each referenced index
  * name. Runtime callers don't supply it, so the lint finds nothing there.
  *
  * A `.geoIndex(name, { field })` maintains a geohash companion column on every
@@ -432,7 +432,7 @@ interface AdvisorGeoIndexUsage {
  * there.
  */
 interface AdvisorHttpActionGuard {
-  /** The exported binding name of the handler (or `"&lt;module>"` when mounted inline / not a named binding). */
+  /** The exported binding name of the handler (or `"<module>"` when mounted inline / not a named binding). */
   exportName: string;
   /** Source file relative to the lunora dir, no extension. */
   file: string;
@@ -444,7 +444,7 @@ interface AdvisorHttpActionGuard {
   method?: string;
   /** `true` when the handler reads `ctx.auth` (a direct member access or a `const { auth } = ctx` destructure). */
   readsAuth: boolean;
-  /** The first side effect found, as a stable label: `runMutation`, `runAction`, or `db.&lt;method>`. */
+  /** The first side effect found, as a stable label: `runMutation`, `runAction`, or `db.<method>`. */
   sideEffect: string;
 }
 /**
@@ -461,7 +461,7 @@ interface AdvisorHttpActionGuard {
  * to `HttpHeaderWriteIR`.
  */
 interface AdvisorHttpHeaderWrite {
-  /** The exported binding name of the enclosing handler, or `"&lt;module>"` when mounted inline. */
+  /** The exported binding name of the enclosing handler, or `"<module>"` when mounted inline. */
   exportName: string;
   /** Source file relative to the lunora dir, no extension. */
   file: string;
@@ -499,7 +499,7 @@ interface AdvisorHyperdriveCall {
   line: number;
 }
 /**
- * One `&lt;receiver>.identity.&lt;key>` claim read (where `&lt;receiver>` is an RLS/mask
+ * One `<receiver>.identity.<key>` claim read (where `<receiver>` is an RLS/mask
  * policy `auth`, or `ctx.auth`/`context.auth`) — the shared input for the
  * `identity_undeclared_claim_trusted` lint. `defineIdentity` validates only its
  * declared claims at the trust boundary and forwards undeclared claims
@@ -513,7 +513,7 @@ interface AdvisorHyperdriveCall {
 interface AdvisorIdentityClaimRead {
   /** `true` when `key` is a declared claim (in the `defineIdentity` contract, or the always-present `userId`). */
   declared: boolean;
-  /** The exported binding name of the enclosing declaration (`&lt;module>` at file scope). */
+  /** The exported binding name of the enclosing declaration (`<module>` at file scope). */
   exportName: string;
   /** Source file relative to the lunora dir, no extension. */
   file: string;
@@ -601,7 +601,7 @@ interface AdvisorInsertWrite {
   table: string;
 }
 /**
- * One `ctx.kv.&lt;method>(key, …)` call whose namespace key is derived from the
+ * One `ctx.kv.<method>(key, …)` call whose namespace key is derived from the
  * handler's `args` with no server-side scoping — the input the
  * `kv_unscoped_user_key_idor` lint consumes. Workers KV is a single flat
  * namespace, so a key taken straight from request input lets any caller read,
@@ -693,7 +693,7 @@ interface AdvisorMaskProcedure {
 interface AdvisorMaskStrategy {
   /** Masked column name. */
   column: string;
-  /** The exported binding name of the procedure whose `.use(mask(...))` chain declared this column, or `"&lt;module>"` when declared at file scope. */
+  /** The exported binding name of the procedure whose `.use(mask(...))` chain declared this column, or `"<module>"` when declared at file scope. */
   exportName: string;
   /** Source file relative to the lunora dir, no extension. */
   file: string;
@@ -866,7 +866,7 @@ interface AdvisorOwnerFieldWrite {
 interface AdvisorPaymentWebhook {
   /** The adapter factory invoked. */
   callee: "createAutumnAdapter" | "createDodoPaymentsAdapter" | "createPolarAdapter" | "createStripeAdapter";
-  /** The exported binding name of the enclosing declaration (`&lt;module>` at file scope). */
+  /** The exported binding name of the enclosing declaration (`<module>` at file scope). */
   exportName: string;
   /** Source file relative to the lunora dir, no extension. */
   file: string;
@@ -1123,8 +1123,8 @@ interface AdvisorRatelimitKeySelector {
 }
 /**
  * One `query` handler whose `return` hands back the raw rows of a table — the
- * result of a `ctx.db.&lt;table>.findMany()` / `.findFirst()` / `.get()` read, or a
- * `ctx.db.query("&lt;table>")…collect()` fluent chain — returned directly (or through
+ * result of a `ctx.db.<table>.findMany()` / `.findFirst()` / `.get()` read, or a
+ * `ctx.db.query("<table>")…collect()` fluent chain — returned directly (or through
  * one local `const` hop) with no hand-built projection. The shared input for the
  * `output_projection_missing_on_public_read` lint, which keeps only `visibility
  * === "public"` rows with no `.output(...)` / `.use(mask(...))` on the chain and
@@ -1149,7 +1149,7 @@ interface AdvisorRawRowReturn {
   visibility: "internal" | "public";
 }
 /**
- * One `ctx.db.&lt;table>.findMany({ with: { &lt;rel> } })` relation-hydrating list read
+ * One `ctx.db.<table>.findMany({ with: { <rel> } })` relation-hydrating list read
  * — the shared input for the `masked_relation_leak_via_with` lint. Column
  * masking is applied per-procedure to the top-level rows of the table named in
  * the read; it does **not** descend into `with`-hydrated relations, so a masked
@@ -1434,7 +1434,7 @@ interface AdvisorShardTraffic {
   shardKey: string;
 }
 /**
- * One `ctx.db.&lt;table>.findMany({ includeDeleted })` list read whose
+ * One `ctx.db.<table>.findMany({ includeDeleted })` list read whose
  * `includeDeleted` is either a hardcoded `true` or derived from the handler's
  * `args` — the shared input for the `soft_delete_include_deleted_from_args`
  * lint. `includeDeleted` resurfaces rows a `.softDelete()` table would otherwise
@@ -1477,7 +1477,7 @@ interface AdvisorSqlInterpolation {
   line: number;
 }
 /**
- * One `ctx.storage.&lt;bucket>.&lt;method>(key, …)` call whose R2 object key is derived
+ * One `ctx.storage.<bucket>.<method>(key, …)` call whose R2 object key is derived
  * from the handler's `args` with no server-side scoping — the input the
  * `storage_key_from_user_args` lint consumes. An object key taken straight from
  * request input lets any caller read, overwrite, or delete another user's object
@@ -1505,7 +1505,7 @@ interface AdvisorStorageKeyAccess {
   visibility?: "internal" | "public";
 }
 /**
- * One tracked `ctx.storage.&lt;bucket>.&lt;method>(...)` upload/signing call — the
+ * One tracked `ctx.storage.<bucket>.<method>(...)` upload/signing call — the
  * shared input for the storage config-hygiene security lints
  * (`storage_upload_without_content_type_allowlist`, `storage_upload_without_max_size`,
  * `storage_generate_upload_url_no_content_type_pin`, `storage_presigned_url_for_private_content`).
@@ -1589,7 +1589,7 @@ interface AdvisorUnrestrictedWhereBranch {
   owner: string;
 }
 /**
- * One `ctx.vectors.&lt;method>(indexName, input)` call whose `input.namespace` is
+ * One `ctx.vectors.<method>(indexName, input)` call whose `input.namespace` is
  * derived from the handler's `args` with no server-side scoping — the input the
  * `vectors_namespace_from_user_input` lint consumes. A Vectorize namespace
  * partitions one index into isolated sub-collections, so a namespace taken
@@ -1737,7 +1737,7 @@ interface Finding {
  */
 interface LintContext {
   /**
-   * `httpRoute.&lt;verb>("/admin/…")` routes on admin/privileged-looking paths and
+   * `httpRoute.<verb>("/admin/…")` routes on admin/privileged-looking paths and
    * whether each references an auth/admin guard — the `admin_route_without_guard`
    * input. Supplied by the codegen feeder; absent for runtime callers, where the
    * lint finds nothing.
@@ -1778,7 +1778,7 @@ interface LintContext {
    */
   argValidators?: ReadonlyArray<AdvisorArgumentValidator>;
   /**
-   * `ctx.authApi.&lt;method>(...)` calls discovered in function bodies (the
+   * `ctx.authApi.<method>(...)` calls discovered in function bodies (the
    * `auth_api_call_without_headers` input). Supplied by the codegen feeder; absent
    * for runtime callers, where the lint finds nothing.
    */
@@ -1797,7 +1797,7 @@ interface LintContext {
    */
   authConfigs?: ReadonlyArray<AdvisorAuthConfig>;
   /**
-   * `ctx.browser.&lt;method>(url, …)` calls whose navigation URL is derived from the
+   * `ctx.browser.<method>(url, …)` calls whose navigation URL is derived from the
    * handler's `args` with no server-side scoping — the
    * `browser_user_url_without_allowlist` input. `@lunora/browser` blocks
    * private/internal targets by default, but a request-supplied public URL can
@@ -1816,7 +1816,7 @@ interface LintContext {
    */
   configCalls?: ReadonlyArray<AdvisorConfigCall>;
   /**
-   * `ctx.containers.&lt;name>.get(key, …)` calls whose instance key is derived from
+   * `ctx.containers.<name>.get(key, …)` calls whose instance key is derived from
    * the handler's `args` with no server-side scoping — the
    * `container_instance_key_from_user_input` input. Each container definition's
    * `.get(name)` accessor routes to one instance per key, so an arg-derived key lets
@@ -1827,7 +1827,7 @@ interface LintContext {
   containerKeyAccesses?: ReadonlyArray<AdvisorContainerKeyAccess>;
   /**
    * Runtime container-override calls — a `.start({ enableInternet: true, … })`
-   * launch override, or a `.egress.&lt;method>(...)` runtime firewall mutation — the
+   * launch override, or a `.egress.<method>(...)` runtime firewall mutation — the
    * `container_start_enable_internet_override` and `container_runtime_egress_relaxation`
    * lint input. Supplied by the codegen feeder; absent for runtime callers, where
    * those lints find nothing.
@@ -1912,7 +1912,7 @@ interface LintContext {
    */
   hyperdriveCalls?: ReadonlyArray<AdvisorHyperdriveCall>;
   /**
-   * `&lt;receiver>.identity.&lt;key>` claim reads (RLS/mask policy `auth`, or
+   * `<receiver>.identity.<key>` claim reads (RLS/mask policy `auth`, or
    * `ctx.auth`/`context.auth`) — the `identity_undeclared_claim_trusted` input.
    * `defineIdentity` validates only declared claims and forwards undeclared ones
    * verbatim, so each row's `declared` flag says whether `key` is in the contract
@@ -1951,7 +1951,7 @@ interface LintContext {
    */
   inserts?: ReadonlyArray<AdvisorInsertWrite>;
   /**
-   * `ctx.kv.&lt;method>(key, …)` calls whose namespace key is derived from the
+   * `ctx.kv.<method>(key, …)` calls whose namespace key is derived from the
    * handler's `args` with no server-side scoping — the `kv_unscoped_user_key_idor`
    * input. Workers KV is one flat namespace, so a key taken straight from request
    * input lets any caller read/overwrite/delete another user's entry (IDOR). Only
@@ -2113,7 +2113,7 @@ interface LintContext {
    */
   rawRowReturns?: ReadonlyArray<AdvisorRawRowReturn>;
   /**
-   * `ctx.db.&lt;table>.findMany({ with: { &lt;rel> } })` relation-hydrating list reads
+   * `ctx.db.<table>.findMany({ with: { <rel> } })` relation-hydrating list reads
    * — the `masked_relation_leak_via_with` input. Column masking is applied to a
    * read's top-level rows but does not descend into `with`-hydrated relations,
    * so a masked table surfaced only through a `with` on an unprotected public
@@ -2154,7 +2154,7 @@ interface LintContext {
    */
   shardTraffic?: ReadonlyArray<AdvisorShardTraffic>;
   /**
-   * `ctx.db.&lt;table>.findMany({ includeDeleted })` list reads whose
+   * `ctx.db.<table>.findMany({ includeDeleted })` list reads whose
    * `includeDeleted` is a hardcoded `true` or derived from the handler's
    * `args` — the `soft_delete_include_deleted_from_args` input. On a public
    * read of a `.softDelete()` table this resurfaces soft-deleted rows to any
@@ -2170,7 +2170,7 @@ interface LintContext {
    */
   sqlInterpolations?: ReadonlyArray<AdvisorSqlInterpolation>;
   /**
-   * `ctx.storage.&lt;bucket>.&lt;method>(key, …)` calls whose R2 object key is derived
+   * `ctx.storage.<bucket>.<method>(key, …)` calls whose R2 object key is derived
    * from the handler's `args` with no server-side scoping — the
    * `storage_key_from_user_args` input. The bucket read/write/URL/delete methods
    * key by their first argument, so an arg-derived key is object-level IDOR
@@ -2181,7 +2181,7 @@ interface LintContext {
    */
   storageKeyAccesses?: ReadonlyArray<AdvisorStorageKeyAccess>;
   /**
-   * Tracked `ctx.storage.&lt;bucket>.&lt;method>(...)` upload/signing calls — the
+   * Tracked `ctx.storage.<bucket>.<method>(...)` upload/signing calls — the
    * shared input for the storage config-hygiene lints
    * (`storage_upload_without_content_type_allowlist`, `storage_upload_without_max_size`,
    * `storage_generate_upload_url_no_content_type_pin`,
@@ -2221,7 +2221,7 @@ interface LintContext {
    */
   unrestrictedWhereBranches?: ReadonlyArray<AdvisorUnrestrictedWhereBranch>;
   /**
-   * `ctx.vectors.&lt;method>(index, { namespace, … })` calls whose `namespace` is
+   * `ctx.vectors.<method>(index, { namespace, … })` calls whose `namespace` is
    * derived from the handler's `args` with no server-side scoping — the
    * `vectors_namespace_from_user_input` input. A Vectorize namespace partitions one
    * index into isolated sub-collections, so an arg-derived namespace lets any caller
@@ -2329,7 +2329,7 @@ interface AnalyticsRuntimeMetrics {
  * within-line discriminator the second finding is silently hidden.
  *
  * This suffixes the second-and-later occurrence of any repeated key with
- * `:&lt;n>` (`:2`, `:3`, …), leaving the first occurrence unsuffixed so existing
+ * `:<n>` (`:2`, `:3`, …), leaving the first occurrence unsuffixed so existing
  * single-occurrence keys stay stable across runs. Order is preserved. Keys are
  * lint-name-prefixed, so this never merges across lints.
  */
@@ -2553,7 +2553,7 @@ declare const aiUnboundedGenerationPublic: Lint;
  */
 declare const allowUnauthenticatedShardAccessEnabled: Lint;
 /**
- * Flags a `ctx.authApi.&lt;method>(...)` call whose argument object omits `headers`.
+ * Flags a `ctx.authApi.<method>(...)` call whose argument object omits `headers`.
  *
  * `@lunora/auth`'s `withAuthPlugins` middleware attaches the full privileged
  * better-auth API to `ctx.authApi` — `banUser`, `setRole`, impersonation,
@@ -2701,7 +2701,7 @@ declare const authTrustedOriginsWildcard: Lint;
  */
 declare const browserAllowPrivateTargets: Lint;
 /**
- * Flags a `ctx.browser.&lt;method>(url, …)` call whose navigation URL is derived
+ * Flags a `ctx.browser.<method>(url, …)` call whose navigation URL is derived
  * from the handler's `args` with no server-side scoping — and no hardened
  * `createBrowser` allowlist to contain it.
  *
@@ -2757,7 +2757,7 @@ declare const browserUserUrlWithoutAllowlist: Lint;
  */
 declare const circularFk: Lint;
 /**
- * Flags a `ctx.containers.&lt;exportName>.get(name, …)` call whose instance key
+ * Flags a `ctx.containers.<exportName>.get(name, …)` call whose instance key
  * is derived from the handler's `args` with no server-side scoping — a
  * cross-tenant container IDOR.
  *
@@ -2982,7 +2982,7 @@ declare const geoIndexFieldNotGeopoint: Lint;
  * `withGeoIndex(name, q => q.near(…) | q.within(…))` the companion is pure dead
  * overhead — the geo analogue of a dead regular index. Cross-references every geo
  * index in the schema against the set of index names some handler references via
- * `withGeoIndex("&lt;name>")`.
+ * `withGeoIndex("<name>")`.
  *
  * Suppressed entirely when any usage passes a non-literal name
  * (`withGeoIndex(someVariable, …)`), because a dynamic reference could target any
@@ -3081,8 +3081,8 @@ declare const hyperdriveOutsideAction: Lint;
  * `defineIdentity` is the trust boundary for `ctx.auth.identity`: the worker
  * validates a resolver's returned claims against the *declared* validators, but
  * — by design — forwards any **undeclared** claims through verbatim, unchecked.
- * So a policy predicate or authorize hook that reads `auth.identity.&lt;key>` for a
- * `&lt;key>` the contract never declares is trusting a value the runtime never
+ * So a policy predicate or authorize hook that reads `auth.identity.<key>` for a
+ * `<key>` the contract never declares is trusting a value the runtime never
  * validated — a claim an attacker's token can carry with an arbitrary value.
  * Reading `userId` (always declared) or any declared claim is fine.
  *
@@ -3262,8 +3262,8 @@ declare const maskWeakHashStrategyOnPii: Lint;
  * relation.
  *
  * INFO, near-zero false positives by construction: it fires only when all of
- * (1) the enclosing read is public, (2) the read declares `with: { &lt;rel> }`,
- * (3) `&lt;rel>` resolves through the schema to a real target table, and (4) that
+ * (1) the enclosing read is public, (2) the read declares `with: { <rel> }`,
+ * (3) `<rel>` resolves through the schema to a real target table, and (4) that
  * target table actually has masked columns (per the discovered mask evidence).
  * Absent any mask usage the lint is a no-op. Runs only when the codegen feeder
  * supplies `context.relationLoads`; a runtime caller flags nothing. One finding
@@ -3529,7 +3529,7 @@ declare const policyReferencesUnknownTable: Lint;
  * id) becomes an act-as-any-user / cross-tenant write.
  *
  * The lint is deliberately narrow to stay false-positive-free: it fires **only**
- * when the resolved target (`api.&lt;file>.&lt;export>`) is found in the
+ * when the resolved target (`api.<file>.<export>`) is found in the
  * RLS-procedure evidence with `usesRls: true`. A dispatch into a function that
  * does its own arg validation and carries no row policy (the common, correct
  * case — e.g. a welcome-message mutation with no `rls`) is not flagged. Runs
@@ -3541,8 +3541,8 @@ declare const privilegedDispatchUnvalidatedPayload: Lint;
  * Flags a public procedure whose handler fans work out to a privileged,
  * cost-bearing dispatch surface without a rate-limit guard.
  *
- * `ctx.scheduler.runAfter` / `runAt`, a `ctx.queues.&lt;name>` producer send, and
- * `ctx.workflows.&lt;name>.create` all enqueue work that runs later under the
+ * `ctx.scheduler.runAfter` / `runAt`, a `ctx.queues.<name>` producer send, and
+ * `ctx.workflows.<name>.create` all enqueue work that runs later under the
  * system identity (RLS disabled) and bills against the account. Triggered from a
  * `.public()` procedure with no rate limit, an anonymous caller can drive that
  * dispatch in a loop — a cost-amplification / denial-of-wallet vector, and a way
@@ -3906,7 +3906,7 @@ declare const sqlInjectionRisk: Lint;
  */
 declare const storageGenerateUploadUrlNoContentTypePin: Lint;
 /**
- * Flags a `ctx.storage.&lt;bucket>.&lt;method>(key, …)` whose R2 object key is derived
+ * Flags a `ctx.storage.<bucket>.<method>(key, …)` whose R2 object key is derived
  * from the handler's `args` with no server-side scoping — an object-level IDOR.
  *
  * The bucket read/write/URL/delete methods (`get`, `put`, `delete`, `download`,
@@ -3993,7 +3993,7 @@ declare const storageUploadWithoutMaxSize: Lint;
  * Using `@lunora/codegen`'s write-side discovery (the analog of the read
  * discovery that feeds `filter_without_index`), this lint cross-references every
  * schema table against the set of tables some exported function writes via
- * `ctx.db.insert("&lt;table>", …)`. A table with no such write either is dead schema
+ * `ctx.db.insert("<table>", …)`. A table with no such write either is dead schema
  * or is populated through a path the static analysis can't see — a migration/seed,
  * cross-region replication, the `ctx.orm.insert(...)` builder, or a trusted
  * snapshot import. Hence `INFO`/`INTERNAL`: a nudge to confirm intent, not an error.
@@ -4162,7 +4162,7 @@ declare const workflowUnknownTarget: Lint;
  * Flags a declared workflow that nothing starts.
  *
  * Cross-references every `defineWorkflow` export against the set of workflow
- * names some function references via `ctx.workflows.get("&lt;name>")`. A workflow
+ * names some function references via `ctx.workflows.get("<name>")`. A workflow
  * with no such call is either dead code (declared, deployed as a billable
  * `WorkflowEntrypoint`, never triggered) or is started through a path the static
  * analysis can't see — the Cloudflare REST API, a `wrangler` invocation, or a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/advisor",
-  "version": "1.0.0-alpha.65",
+  "version": "1.0.0-alpha.67",
   "description": "Schema & query lints (splinter-style advisors) for Lunora, feeding the Studio Advisors view",
   "keywords": [
     "advisor",
@@ -46,8 +46,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.13",
-    "@lunora/server": "1.0.0-alpha.60"
+    "@lunora/errors": "1.0.0-alpha.14",
+    "@lunora/server": "1.0.0-alpha.62"
   },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"