@lunora/codegen 1.0.0-alpha.291 → 1.0.0-alpha.292

package/dist/index.d.ts

@@ -251,2237 +251,2301 @@ declare const serializeSchemaSnapshot: (snapshot: SchemaSnapshot) => string;
  */
 declare const diffSchemaSnapshots: (baseline: SchemaSnapshot | undefined, current: SchemaSnapshot) => SchemaDrift;
 /**
- * AST-observable subset of a column's modifier chain (`.unique()`, `.default()`,
- * …). Function-valued modifiers (`.$defaultFn`/`.$onUpdateFn`) can't be
- * serialized, so only their *presence* is recorded.
+ * Who a discovered call site runs on behalf of — the one attribution every
+ * per-call-site IR carries (see `discover/attribution`).
+ *
+ * `export`: lexically inside an exported top-level declaration. `name` is the
+ * EXPORTED name — `export const send = …` → `send`, `export default …` →
+ * `default`, `const run = …; export { run as start }` → `start`.
+ *
+ * `helper`: inside a top-level, non-exported `function` / `const` of the same
+ * file. `callers` are the exports that reach it through same-file value
+ * references (a call, or the helper passed on as a value), transitively and
+ * sorted; a type-only reference (`typeof helper`) does not count. Empty for an
+ * orphan helper no export reaches. `untracked` is set when code attribution
+ * cannot follow — module scope, a class body, a destructured declaration — also
+ * reaches the helper, so `callers` is incomplete.
+ *
+ * `module`: outside every top-level `function` / `const` — module scope, or a
+ * class body.
+ *
+ * A site is recorded once; consumers fan out over its callers. The advisor's
+ * `AdvisorCallSiteScope` is the same type, so feeder rows pass straight through.
  */
-interface ColumnMetaIR {
-  /** `.default(...)` or `.$defaultFn(...)` present — field is optional on insert. */
-  hasDefault?: boolean;
-  /** `.$onUpdateFn(...)` present. */
-  hasOnUpdate?: boolean;
-  /** Default `true`; `.nullable()` flips it to `false`. */
-  notNull: boolean;
-  /** `.unique()` present. */
-  unique?: boolean;
-}
-/** Reflective representation of a single validator call from the schema. */
-interface ValidatorIR {
-  /** For `v.storage(bucket?)` — the named typed bucket the object key lives in, when given. */
-  bucket?: string;
-  /** Column modifiers (`.unique()`, `.default()`, `.nullable()`, …) when present. */
-  column?: ColumnMetaIR;
-  /**
-   * `true` when this validator carries a refinement (`.check(...)`, `.max(n)`,
-   * `.email()`, …) — anything that narrows the accepted values without changing
-   * the kind. `schema-drift` hashes this, so a bound counts here even when it is
-   * modelled below. `.meta(...)` is pure metadata with no parse effect and does
-   * NOT set it.
-   */
-  hasRefinement?: boolean;
-  /** For `v.optional(inner)` / `v.array(inner)`. */
-  inner?: ValidatorIR;
-  /** For `v.record(key, value)`. */
-  keyType?: ValidatorIR;
-  /** Kind of validator (string, number, id, object, optional, array, union, literal, record, ...). */
-  kind: string;
-  /** For `v.literal(value)` — the literal value as source text. */
-  literalValue?: string;
-  /** For `v.union(a, b, ...)`. */
-  members?: ValidatorIR[];
-  /** For `v.object({...})`. */
-  shape?: Record<string, ValidatorIR>;
-  /** Verbatim source text — used in emitted code when we can't reconstruct from AST. */
-  sourceText?: string;
-  /**
-   * The `n` of a `v.string().max(n)` written with a numeric literal — the one
-   * refinement predicate the IR can represent exactly (`value.length <= n`).
-   * The AOT compiler emits it as a guard instead of declining the node, which
-   * is what keeps a length-bounded public argument on the fast path.
-   */
-  stringMaxLength?: number;
-  /** For `v.id("table")` — the table name. */
-  tableName?: string;
+type CallSiteScope = AdvisorCallSiteScope;
+/**
+ * One call-site edge of the architecture graph, attributed through its
+ * {@link CallSiteScope}.
+ * Exactly one of `target` / `reason` is set: `target` is a `namespace:export`
+ * function key (`call` / `schedule`) or a queue / topic export name (`enqueue` /
+ * `publish`); `reason` says why the target could not be read statically.
+ */
+interface CallEdgeIR {
   /**
-   * For `v.from(externalSchema)` — the wrapped Standard Schema's inferred type,
-   * rendered as TS source. Recovered through the type checker from
-   * `~standard.types.output`, mirroring the runtime's `InferStandardOutput`.
-   * Absent when it could not be recovered safely, in which case the emitted
-   * type falls back to `unknown`.
+   * `true` when the hop may not take effect on every pass of its function —
+   * see `isConditionalSite` in `discover/call-edges.ts` for the rules. Set
+   * only, never `false`. The `dispatch_cycle` lint's false-positive gate.
    */
-  tsType?: string;
+  conditional?: true;
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
+  file: string;
+  kind: "call" | "enqueue" | "invoke" | "publish" | "schedule";
+  /** 1-based line of the call. */
+  line: number;
+  reason?: string;
   /**
-   * `true` when this validator carries a refinement the IR could NOT model — a
-   * `.check(...)` closure, `.email()`, `.pattern(re)`, a `.max()` whose bound is
-   * not a literal. The AOT args-validator compiler declines any node with this
-   * flag, because compiling it would silently skip the predicate.
+   * The facts of a scheduled dispatch, present on `schedule` edges only. `delayMs`
+   * is the literal `runAfter` delay (absent for `runAt` or a non-literal delay).
+   * `argKeys` are the top-level property names of the dispatch's args object:
+   * `[]` when there are no args, and `undefined` when the args are not an object
+   * literal (or spread into one), so a lint can tell "no cursor" from "cannot tell".
    */
-  unmodelledRefinement?: boolean;
-  valueType?: ValidatorIR;
-}
-interface IndexIR {
-  fields: ReadonlyArray<string>;
-  name: string;
-  unique?: boolean;
-}
-interface SearchIndexIR {
-  /** Primary text-search field; a dot-separated path reads a nested field. */
-  field: string;
-  /** Optional filter fields surfaced alongside the FTS column. */
-  filterFields?: ReadonlyArray<string>;
-  /** Text-analysis profile (accent folding + that language's stopwords). */
-  language?: string;
-  name: string;
-  /** Skip the migration-time backfill of the search companion (large tables index out-of-band). */
-  staged?: boolean;
-  /** `"native"` opts into the engine's own full-text index where it has one (Postgres). */
-  strategy?: string;
-}
-/** A `.geoIndex(name, { field, precision? })` declaration — a geohash companion over a `v.geoPoint()` column. */
-interface GeoIndexIR {
-  /** The `v.geoPoint()` column feeding the geohash. */
-  field: string;
-  name: string;
-  /** Geohash precision (characters) maintained on the companion; omitted ⇒ the runtime default. */
-  precision?: number;
-}
-/** A `.ttl(field, { after? })` declaration — declarative table-level auto-expiry. */
-interface TtlIR {
-  /** Millisecond offset added to `field` to derive the expiry (`field + after`); omitted ⇒ `field` is the absolute expiry. */
-  after?: number;
-  /** The epoch-millisecond expiry column. */
-  field: string;
-}
-interface VectorIndexIR {
-  dimensions?: number;
-  /** Shape A: the single source column. Shape B: undefined (derived via a `select` fn). */
-  field?: string;
-  /** Shape A: metadata field names mirrored into Vectorize. */
-  metadata?: ReadonlyArray<string>;
-  metric?: "cosine" | "dot-product" | "euclidean";
-  name: string;
-  /** Owning table the vectors are sourced from. */
-  table: string;
+  schedule?: {
+    argKeys?: string[];
+    delayMs?: number;
+  };
+  /** Who the call runs on behalf of. */
+  scope: CallSiteScope;
+  target?: string;
 }
 /**
- * One ordering key on a rank index's `sortBy`: the column and direction.
- * Mirrors the runtime `RankSortKey` (defaults `direction` to `"asc"`).
+ * A literal-infinite loop in `lunora/` source — `while (true)`, `for (;;)` /
+ * `for (; true;)`, `do { … } while (true)` — with no statically reachable way
+ * out: no `break` bound to this loop, no `return`/`throw` outside a nested
+ * function, no labeled `break` escaping it. One record per offending loop; a
+ * loop that can exit records nothing, so the `unbounded_loop` lint has no
+ * bounded loop to sift through.
  */
-interface RankSortKeyIR {
-  direction: "asc" | "desc";
-  field: string;
+interface UnboundedLoopIR {
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** The loop form that never falls out. */
+  kind: "do" | "for" | "while";
+  /** 1-based line of the `loop` keyword. */
+  line: number;
+  /** Who the loop runs on behalf of. */
+  scope: CallSiteScope;
 }
 /**
- * A `.rankIndex(name, { sortBy, partitionBy?, where? })` declaration. The owning
- * table is always the table the index is declared on, so — unlike a vector index
- * — there is no separate `on`/`table` reference to carry: it rides along on its
- * {@link TableIR}. Only the fields needed for type emission are captured.
+ * A `ctx.workflows.get("name")…` call discovered in a function body — the
+ * use-site analog of {@link WorkflowIR} (which is the declaration side). Feeds
+ * the `workflow_unused` lint (a declared workflow with zero call sites) and the
+ * `workflow_unknown_target` lint (a `.get("x")` whose `x` isn't declared — a
+ * typo catcher). {@link WorkflowCallIR.workflow} is `""` when the `get(...)`
+ * argument is not a string literal (a dynamic name — which suppresses the
+ * unused-workflow heuristic rather than producing a false positive).
  */
-interface RankIndexIR {
-  name: string;
-  /** Columns scoping each ranking; omitted ⇒ one global rank over the table. */
-  partitionBy?: ReadonlyArray<string>;
-  /** Ordered sort keys driving the rank. */
-  sortBy: ReadonlyArray<RankSortKeyIR>;
-}
-interface RelationIR {
-  /** FK column: on this table for `one`, on the target table for `many`. */
-  field: string;
-  kind: "many" | "one";
-  /** Accessor name the relation is loaded under (the `with` key). */
-  name: string;
-  /** FK behaviour applied to holder rows when the referenced parent is deleted. */
-  onDelete?: "cascade" | "restrict" | "set null";
-  /** Referenced column (defaults to `_id`). */
-  references: string;
-  /** Target table name. */
-  table: string;
+interface WorkflowCallIR {
+  /** Source file relative to `<projectRoot>/lunora/`, without extension (the api namespace). */
+  file: string;
+  /** 1-based line of the `get(...)` call. */
+  line: number;
+  /** Who the call runs on behalf of. */
+  scope: CallSiteScope;
+  /** The referenced workflow export name, or `""` when the argument is not a string literal. */
+  workflow: string;
 }
 /**
- * Statically-discovered `.source(...)` config (plan 077). Only the bits the
- * advisor lints + DO wiring need are captured; `map`/`tenantBy` are functions and
- * cannot be serialized, so their presence is recorded as `hasTenantBy` rather than
- * the function itself.
+ * A `ctx.db.query("table")…` read discovered in a function body, reduced to what
+ * the query advisor lints need: which table, whether the chain narrows with an
+ * index, whether it filters, and which terminal materializes the result.
+ * `table` is `""` when the `query(...)` argument is not a string literal (a
+ * dynamic table — not lintable).
  */
-interface ExternalSourceIR {
-  /** The wrangler Hyperdrive binding name. */
-  binding: string;
-  /** Whether a `columns` projection allow-list was given. */
-  columns?: ReadonlyArray<string>;
-  /** `true` when a `reconcileEveryMs` was given — one of the two incremental delete-visibility paths the `external_source_incremental_no_delete_path` lint checks. */
-  hasReconcile?: boolean;
-  /** `true` when a `softDeleteColumn` was given — the other incremental delete-visibility path. */
-  hasSoftDelete?: boolean;
-  /** `true` when a `tenantBy` mapper was given — the tenant-isolation boundary the `external_source_unscoped` lint checks. */
-  hasTenantBy: boolean;
-  /** The `idColumn` literal, when given (defaults to `"id"` at runtime). */
-  idColumn?: string;
-  /** Delete-detection mode literal, when given (`"full-pull"` today). */
-  mode?: string;
-  /** The membership query literal, when statically knowable. */
-  query?: string;
+interface QueryReadIR {
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
+  file: string;
   /**
-   * `true` when `.source(...)` was present but its argument was **not** a static
-   * object literal (e.g. `.source(buildConfig())`), so none of the fields above
-   * could be read. The source still exists — this flag lets `hasSourcedTables`
-   * (codegen) and the `external_source_*` lints treat it as a source that can't be
-   * verified, instead of mistaking it for no `.source()` at all.
+   * The fields the chain's `.filter()` predicate reads off its row parameter
+   * (`(r) => r.a < cutoff && r.b === x` → `["a", "b"]`). `undefined` when the
+   * chain has no filter or the predicate is not a function literal. Optional so
+   * a feeder predating this field still typechecks.
    */
-  unanalyzable?: boolean;
-}
-interface TableIR {
+  filterFields?: string[];
   /**
-   * `true` when the table chain carried `.commitOrdered()` — every row carries
-   * `_commitSeq`, a per-shard integer allocated once per mutation and strictly
-   * increasing in commit order. Optional: hand-built IR and tables that never
-   * called `.commitOrdered()` default it to `false`.
+   * True when the chain's `.filter()` predicate compares `_id`
+   * (`(d) => d._id === args.id`) — a full scan for a row that `ctx.db.get`
+   * addresses directly. Optional so a feeder predating this field still
+   * typechecks; absent is treated as "not a primary-key filter".
    */
-  commitOrdered?: boolean;
-  /**
-   * `true` when that extension was resolved from a package in `node_modules`
-   * rather than from source under `lunora/` (a registry copy-in). Decides
-   * whether the component's module owns a `lunora/<key>/` folder.
-   */
-  extensionFromPackage?: true;
-  /**
-   * The `defineSchemaExtension` key that contributed this table, set when it
-   * arrived through `defineSchema(...).extend(...)`. Absent for a table the app
-   * declared itself.
-   *
-   * Drives the generated `AppTableName` union: an add-on's tables
-   * (`ratelimit_buckets`, …) are real tables and stay in `TableName`, but an app
-   * enumerating "my tables" should not have to know about them.
-   */
-  extensionKey?: string;
-  /**
-   * `true` when the table chain carried `.externallyManaged()` — its rows are
-   * written outside Lunora's discoverable insert path (adapter/migration/
-   * middleware), so advisor insert-path lints skip it. Optional: hand-built
-   * IR and the runtime `fromServerSchema` path default it to `false`.
-   */
-  externallyManaged?: boolean;
-  /**
-   * Set when the chain carried `.source(...)` — the table is materialized from an
-   * external Hyperdrive-backed database by a system poll loop (plan 077). Carries
-   * the statically-knowable bits the advisor lints read; the functions (`map`,
-   * `tenantBy`) are not serialized, only their presence (`hasTenantBy`).
-   */
-  externalSource?: ExternalSourceIR;
-  /** Geospatial indexes declared inline via `.geoIndex(name, …)`. Optional so hand-built IR may omit it (discovery always sets it). */
-  geoIndexes?: ReadonlyArray<GeoIndexIR>;
-  /**
-   * Storage backend for a `.global()` table: `"d1"` (default) or
-   * `"hyperdrive"` (a Postgres/MySQL database via Cloudflare Hyperdrive). Only
-   * meaningful when `shardMode === "global"`; absent for sharded/root tables.
-   *
-   * Read it through `isD1GlobalTable` / `isHyperdriveGlobalTable` rather than
-   * comparing here — discovery normalises the absent case to `"d1"`, and only
-   * those predicates encode which comparison is right for hand-built IR.
-   */
-  globalBackend?: "d1" | "hyperdrive";
-  indexes: ReadonlyArray<IndexIR>;
-  /**
-   * `true` when the table chain carried `.public()` — an explicit opt-OUT of
-   * the schema's `.rls("required")` enforcement for this one table. Optional:
-   * hand-built IR and tables that never called `.public()` default it to
-   * `false`.
-   */
-  isPublic?: boolean;
+  filtersPrimaryKey?: boolean;
+  /** The chain calls `.filter(...)`. */
+  hasFilter: boolean;
+  /** The chain narrows with `.withIndex(...)` or `.withSearchIndex(...)`. */
+  hasIndex: boolean;
   /**
-   * `true` when the table chain carried `.memory()` — its rows are cleared on
-   * every Durable Object cold start and never reach the CDC changelog.
-   * Optional: hand-built IR and tables that never called `.memory()` default it
-   * to `false`.
+   * The chain's `.withIndex(…)`, present exactly when the chain has one. `name` is
+   * the literal index name, or `undefined` when it is not a string literal.
+   * `bounds` are the comparators its range callback calls on the index parameter,
+   * sorted and de-duplicated: `[]` for a bare `.withIndex(name)` (the widest range),
+   * `undefined` when the callback exists but cannot be read.
    */
-  memory?: boolean;
-  name: string;
-  /** Rank indexes declared inline via `.rankIndex(name, …)`. */
-  rankIndexes: ReadonlyArray<RankIndexIR>;
-  /** Declared relations (via `.relations((r) => …)`), keyed in source order. */
-  relations: ReadonlyArray<RelationIR>;
-  searchIndexes: ReadonlyArray<SearchIndexIR>;
-  shape: Record<string, ValidatorIR>;
-  shardMode: "global" | "root" | {
-    field: string;
-    kind: "shardBy";
-  };
-  /** Set when the chain carried `.softDelete()` — the marker column's name (default `deletedAt`). The column is injected into `shape` so `Doc_*` carries it. */
-  softDelete?: {
-    field: string;
+  index?: {
+    bounds?: string[];
+    name?: string;
   };
-  /** Set when the chain carried `.ttl(field, { after? })` — the declarative auto-expiry policy read by the DO alarm sweep. */
-  ttl?: TtlIR;
-  /** Vector indexes declared inline via `.vectorize()` (DSL Shape A). */
-  vectorIndexes: ReadonlyArray<VectorIndexIR>;
-}
-/** The Cloudflare DO data-residency jurisdictions the schema may declare. Canonical literal set for the codegen package. */
-type JurisdictionIR = "eu" | "fedramp" | "us";
-interface SchemaIR {
-  /**
-   * Cloudflare data-residency jurisdiction declared via
-   * `defineSchema(...).jurisdiction("…")`. Emitted into the generated worker's
-   * `createWorker({ jurisdiction })` (and `ctx.scheduler` / `ctx.containers`).
-   * Absent ⇒ un-pinned.
-   */
-  jurisdiction?: JurisdictionIR;
+  /** 1-based line of the `query(...)` call. */
+  line: number;
+  /** Who the read runs on behalf of. */
+  scope: CallSiteScope;
+  /** Queried table name, or `""` when the argument is not a string literal. */
+  table: string;
   /**
-   * `.jurisdiction("…", { pinAuth: true })` — the acknowledgement that
-   * DO-backed auth, unpinned before, moves into the jurisdiction (and so to a
-   * new, empty object until its rows are copied). Without it codegen refuses a
-   * project that has DO-backed auth, and does not pin it.
+   * The materializing call the chain ends in — `"collect"`, `"take"`,
+   * `"paginate"`, `"first"`, `"unique"`, … — i.e. how much of the narrowed set
+   * the read actually loads.
+   *
+   * `undefined` when the chain reaches no recognised terminal (a reader passed
+   * on, a bare `query(...)`) AND when a feeder predating this field produced
+   * the read. The two are deliberately not distinguished: no consumer could act
+   * on the difference, so the terminal-shaped lints skip the read either way
+   * rather than guessing a terminal.
    */
-  jurisdictionPinsAuth?: true;
+  terminal?: string;
   /**
-   * Set when `defineSchema(...).rls("required")` was chained onto the schema —
-   * every table's `ctx.db` write path is denied without an RLS-covering
-   * procedure unless the table itself is `.public()` (see {@link TableIR.isPublic}).
-   * Absent when the schema never called `.rls("required")`.
+   * Visibility of the procedure the read runs on behalf of: `internal` when every
+   * caller is internal, `public` when any caller is public. Stamped from the
+   * registered functions, so it is absent when the feeder could not read them.
    */
-  rlsMode?: "required";
-  tables: ReadonlyArray<TableIR>;
-  /** All vector indexes (inline Shape A hoisted + standalone Shape B), flattened. */
-  vectorIndexes: ReadonlyArray<VectorIndexIR>;
+  visibility?: "internal" | "public";
 }
 /**
- * Statically-read mirror of `@lunora/server`'s `RestCacheConfig`. Every field is
- * optional because discovery only records literals it could actually read off the
- * `.expose({ cache: … })` object.
+ * A `ctx.authApi.<method>(...)` call discovered in a function body, attributed
+ * to the exported function (and its file = api namespace) that performs it.
+ * Structurally identical to `AdvisorAuthApiCall` so it passes straight through
+ * to the advisor lint without conversion, exactly as `InsertWriteIR` does for
+ * `AdvisorInsertWrite`.
  */
-interface ExposeCacheIR {
-  maxAge?: number;
-  scope?: "private" | "public";
-  staleWhileRevalidate?: number;
-  tag?: string;
-  vary?: string;
+interface AuthApiCallIR {
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** True when the call's argument object includes a `headers` property. */
+  hasHeaders: boolean;
+  /** 1-based line of the call, or `0` when unknown. */
+  line: number;
+  /** The better-auth method invoked (e.g. `banUser`); empty when not statically known. */
+  method: string;
+  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
+  scope: CallSiteScope;
 }
-interface FunctionIR {
-  /**
-   * Set when the chain carries `.use(platformAdmin(...))`: only a platform admin
-   * can reach the procedure, so its writes are trusted to name any account.
-   */
-  adminOnly?: true;
-  args: Record<string, ValidatorIR>;
-  exportName: string;
-  /**
-   * Set by the `.expose({ rest: true })` builder modifier (plan 167). When
-   * `rest` is `true` the function is published on the public REST surface, so the
-   * OpenAPI emitter describes it as a real `/_lunora/rest/<namespace>/<fn>` path
-   * (the single source of truth the runtime router also derives from). Absent →
-   * RPC-only (the default; not on the REST surface).
-   *
-   * `cache` mirrors the `RestCacheConfig` the runtime turns into response
-   * headers, so the emitted spec can document the `Cache-Control` a caller will
-   * actually observe. Only statically-readable literal fields are carried; a
-   * computed value is simply absent (the spec under-documents rather than lies).
-   */
-  expose?: {
-    cache?: ExposeCacheIR;
-    rest?: boolean;
-  };
-  /** Path relative to `<projectRoot>/lunora/` without extension, e.g. "messages". */
-  filePath: string;
-  kind: "action" | "mutation" | "query" | "stream";
-  /**
-   * Set on lifecycle hooks (`onConnect`/`onDisconnect`/`onShardInit`/
-   * `onQueryChange`/`onWhisper`): the moment the hook fires on. Such a function
-   * is also an internal registration (so it lands in `LUNORA_FUNCTIONS` for path
-   * dispatch) — a mutation for every moment except `whisper`, which is a query;
-   * emit additionally collects it into the `LUNORA_LIFECYCLE_HOOKS` manifest
-   * keyed by this moment. Absent on ordinary functions.
-   */
-  lifecycle?: "connect" | "disconnect" | "init" | "reactor" | "whisper";
-  /**
-   * The `.output(validator)` declaration, when the chain has one.
-   *
-   * Takes precedence over {@link FunctionIR.returnType} (the handler's
-   * inferred type) for the emitted `FunctionReference`. `.output()` is what
-   * validates at runtime and what a reader takes as the contract, so the two
-   * must agree — see the emit-side note for what went wrong when they did not.
-   */
-  output?: ValidatorIR;
+/**
+ * A table write other than a plain `ctx.db.insert(...)` (see {@link InsertWriteIR}):
+ * a by-id `patch`/`replace`/`delete`/`hardDelete`/`restore`, a batch write, or a
+ * `ctx.db.<table>.*` facade write. Feeds the architecture manifest's `write`
+ * edges and the `cross_module_table_write` lint.
+ */
+interface TableWriteIR {
   /**
-   * Serialized TS source for the handler's return type, with `Promise<T>`
-   * unwrapped so callers see `T` directly. Defaults to `"unknown"` when
-   * ts-morph cannot resolve the type (typically because the consuming
-   * project lacks a tsconfig that can reach `@lunora/server`).
+   * The fields a `patch` / `patchMany` writes, read off its object-literal
+   * argument. `undefined` for every other method, and for a patch whose
+   * argument is not an object literal or spreads one: the feeder then cannot
+   * say which fields change.
    */
-  returnType: string;
+  fields?: string[];
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the call. */
+  line: number;
+  /** The writer method called, e.g. `patch`, `deleteMany`, `upsert`. */
+  method: string;
+  /** Who the write runs on behalf of. */
+  scope: CallSiteScope;
   /**
-   * Call surface the function is exposed on. Absent (or `"public"`) means it
-   * lands in the generated `api`; `"internal"` routes it to the separate
-   * `internal` object and is rejected by the DO's external RPC path.
+   * Target table; `""` when it can't be read (an untyped id, a non-literal
+   * name). A union id (`Id<"a"> | Id<"b">`) gives one record per table.
    */
-  visibility?: "internal" | "public";
+  table: string;
 }
 /**
- * A `defineMigration({...})` declaration discovered in the user's lunora
- * sources. The emitted `LUNORA_MIGRATIONS` registry keys on {@link MigrationIR.id}; the
- * import wiring needs {@link MigrationIR.exportName}/{@link MigrationIR.filePath}. The runtime object
- * carries the authoritative {@link MigrationIR.table}, but the lifted value is
- * load-bearing at build time: the schema-drift gate matches it against the
- * tables with breaking drift, so a migration left at `""` covers nothing.
+ * A row-changing write a function performs directly or through the functions it
+ * reaches, attributed to the EXPORT that reaches it. A write in a helper in
+ * another file is included under the export that calls the helper, so a sweep
+ * that deletes through a helper counts as progress. The fields follow
+ * {@link TableWriteIR.fields}.
  */
-interface MigrationIR {
-  /** Export binding name, used to reference the module member in generated imports. */
+interface RowEffectIR {
+  /** The export the write is reachable from. */
   exportName: string;
-  /** Path relative to `<projectRoot>/lunora/` without extension, e.g. "migrations". */
-  filePath: string;
-  /** Stable migration id — the registry key and per-shard run-state key. */
-  id: string;
-  /** Table the migration iterates; `""` when not a static string literal. */
+  /** See {@link TableWriteIR.fields}. */
+  fields?: string[];
+  /** Source file of that export, relative to `<projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** The write method, as on {@link TableWriteIR.method}. */
+  method: string;
+  /** The table the write targets. Never `""`: an unreadable table is not evidence of progress. */
   table: string;
 }
 /**
- * A `defineShape({...})` declaration discovered in `lunora/shapes.ts`
- * (local-first sync engine, Phase 7). The emitted `LUNORA_SHAPES` registry keys
- * on {@link ShapeIR.exportName}; the generated DO's `resolveShape` override
- * dispatches a `shape_subscribe` to the matching registered shape. Discovery is
- * marker-driven (the `__lunoraShape` brand) — no field metadata is lifted here
- * because the runtime object (`columns`/`compileWhere`) carries the authority.
+ * A `ctx.db.insert("table", …)` write discovered in a function body, attributed
+ * to the exported function (and its file = api namespace) that performs it — the
+ * write-side analog of {@link QueryReadIR}. Lets tooling wire a table's write
+ * action by behavior (which function inserts into it) rather than by naming.
+ * {@link InsertWriteIR.table} is `""` when the argument is not a string literal.
  */
-interface ShapeIR {
-  /**
-   * The shape's `args` validator map — its partition selector. Lifted so
-   * `_generated/collections.ts` can type the selector a caller passes instead of
-   * widening it to `Record<string, unknown>`. `{}` for a parameterless shape.
-   */
-  args: Record<string, ValidatorIR>;
-  /** Export binding name — the shape's registry key and import member. */
-  exportName: string;
-  /** Path relative to `<projectRoot>/lunora/` without extension — always `"shapes"`. */
-  filePath: string;
-  /**
-   * The `table` string literal from the `defineShape({ table })` call, lifted
-   * only for static advisor lints (the runtime object stays authoritative).
-   * `undefined` when `table` is not a plain string literal — lints skip those.
-   */
-  table?: string;
+interface InsertWriteIR {
+  /** Source file relative to `<projectRoot>/lunora/`, without extension (the api namespace). */
+  file: string;
+  /** 1-based line of the `insert(...)` call. */
+  line: number;
+  /** Who the insert runs on behalf of. */
+  scope: CallSiteScope;
+  /** Target table name, or `""` when the argument is not a string literal. */
+  table: string;
 }
 /**
- * The single `defineIdentity({...})` claim contract discovered in
- * `lunora/identity.ts`. Discovery is **marker-driven** (the `__lunoraIdentity`
- * brand, exactly like {@link ShapeIR}) — no claim metadata is lifted here
- * because the emitted `_generated/server.ts` recovers the claim *type* from the
- * declaration itself (`InferIdentity` over the contract's `typeof`), and the
- * runtime object (`validate`/`onInvalid`) carries the authority at the boundary.
- * Exactly one per app; absent ⇒ generated output is byte-identical to today.
+ * A non-deterministic API call (`Date.now`, `Math.random`, `crypto.randomUUID`,
+ * `crypto.getRandomValues`, `fetch`) discovered lexically inside a `query(...)`
+ * or `mutation(...)` handler body — the `nondeterministic_query_mutation` lint
+ * input. Structurally identical to `AdvisorNondeterministicCall` so values pass
+ * straight through to the advisor without conversion, exactly as `AuthApiCallIR`
+ * does for `AdvisorAuthApiCall`. `action(...)` handlers are never recorded —
+ * actions are the determinism escape hatch.
  */
-interface IdentityIR {
-  /** Export binding name — the namespace member `_generated/server.ts` reads via `typeof`. */
+interface NondeterministicCallIR {
+  /** The non-deterministic API invoked, e.g. `Date.now` / `Math.random` / `crypto.randomUUID` / `fetch`. */
+  callee: string;
+  /** Export binding name of the function performing the call, e.g. `sendMessage`. */
   exportName: string;
+  /** Source file relative to `<projectRoot>/lunora/`, without extension (the api namespace). */
+  file: string;
+  /** Which procedure kind the call lives in — only `query`/`mutation` handlers are recorded. */
+  kind: "mutation" | "query";
+  /** 1-based line of the call, or `0` when unknown. */
+  line: number;
 }
 /**
- * The single `defineEnv({...})` contract discovered in `lunora/env.ts`. Like
- * {@link IdentityIR}, only the export binding is lifted — the emitted
- * `_generated/server.ts` recovers the validated shape from the declaration
- * itself (`ReturnType` over the accessor's `typeof`), and the generated ShardDO
- * applies the same accessor to the worker `env` at ctx-build time to populate
- * `ctx.env`. Exactly one per app; absent ⇒ generated output is byte-identical.
+ * One `ctx.<property>` access lexically inside a `query`/`mutation` handler —
+ * the feeder shape behind every "action-only surface used outside an action"
+ * advisor lint (`hyperdrive_outside_action` for `ctx.sql`,
+ * `r2sql_outside_action` for `ctx.r2sql`). Structurally identical to the
+ * advisor's `AdvisorHyperdriveCall` / `AdvisorR2sqlCall` (same field set) so
+ * values pass straight through `lintSchema` without conversion, exactly as
+ * {@link NondeterministicCallIR} does. Only `query`/`mutation` handlers are
+ * recorded; `action(...)` is the only context where these surfaces are even
+ * typed, so it is the intended home and is skipped.
  */
-interface EnvIR {
-  /** Export binding name — the namespace member `_generated/server.ts` reads via `typeof`. */
+interface ContextPropertyCallIR {
+  /** The accessed surface, e.g. `ctx.sql.query` / `ctx.r2sql.from` — the property, suffixed with the method when one is called on it. */
+  callee: string;
+  /** Export binding name of the function performing the access. */
   exportName: string;
+  /** Source file relative to the lunora dir, without extension (the api namespace). */
+  file: string;
+  /** Which procedure kind the access lives in — only `query`/`mutation` handlers are recorded. */
+  kind: "mutation" | "query";
+  /** 1-based line of the access. */
+  line: number;
 }
 /**
- * A `defineMutator({...})` declaration discovered in `lunora/mutators.ts`
- * (local-first sync engine, Phase 7). The emitted registry registers the
- * authoritative `server` impl into the DO's `LUNORA_FUNCTIONS` table (so
- * `handleRpc` transaction-wraps it) and records its path in
- * `LUNORA_MUTATOR_PATHS` so the DO's `isCustomMutator` override routes the
- * client-watermark push protocol. The client `client` impl is split into the
- * browser bundle separately — only the path crosses to the server side.
+ * One `ctx.kv.<method>(key, …)` call whose namespace key is derived from the
+ * handler's `args` with no server-side scoping — the `kv_unscoped_user_key_idor`
+ * lint input. Workers KV is a single flat namespace, so a key taken straight from
+ * request input lets any caller read, overwrite, or delete another user's entry
+ * (IDOR). Only arg-derived, unscoped keys reach here; a fixed literal, or a key
+ * prefixed with a server-trusted identity (`${ctx.auth.userId}:…` — references
+ * `ctx`, so treated as scoped), is not recorded. `list` is excluded (it takes a
+ * prefix, not a per-entry key). Structurally identical to `AdvisorKvKeyAccess`.
  */
-interface MutatorIR {
-  /**
-   * The mutator's `args` validator map, parsed exactly as a procedure's is, so
-   * the emitted `api.mutators.<name>` reference carries the arg type a client
-   * `defineMutator` infers instead of restating. `{}` for a parameterless
-   * mutator (or one whose `args` isn't an inline object literal).
-   */
-  args: Record<string, ValidatorIR>;
-  /** Export binding name — the mutator's registry key and import member. */
-  exportName: string;
-  /** Path relative to `<projectRoot>/lunora/` without extension — always `"mutators"`. */
-  filePath: string;
-  /** 1-based line of the `defineMutator(...)` call, for diagnostics and advisor findings. */
+interface KvKeyAccessIR {
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the `ctx.kv` call, or `0` when unknown. */
   line: number;
+  /** The `ctx.kv` method invoked: `get` / `getRaw` / `getWithMetadata` / `put` / `delete`. */
+  method: string;
+  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
+  scope: CallSiteScope;
   /**
-   * The ownership column the declaration scopes the write to
-   * (`defineMutator({ owner: "userId" })`), or `undefined` when it declares
-   * none — which is also what the `mutator_without_owner_scope` lint reports,
-   * since an unowned mutator is a public write endpoint. Only a string-literal
-   * `owner` is lifted; a computed one reads as `undefined` rather than guessed.
-   */
-  owner?: string;
-  /**
-   * Serialized TS source for the authoritative `server` impl's return type,
-   * `Promise<T>` unwrapped. `"unknown"` when ts-morph can't resolve it — same
-   * contract as {@link FunctionIR.returnType}.
+   * Visibility of the enclosing procedure. `internal` procedures have no
+   * untrusted caller by construction — see `owner_field_from_args_not_auth`'s
+   * identical split — so `kv_unscoped_user_key_idor` drops the finding to
+   * INFO rather than ERROR there. `undefined` when the access sits outside any
+   * registered procedure the feeder could attribute it to.
    */
-  returnType: string;
+  visibility?: "internal" | "public";
 }
 /**
- * A whole-row `ctx.db.replace(id, document)` write discovered inside a custom
- * mutator's inline `server` impl (`lunora/mutators.ts`) — the input the
- * `mutator_full_row_replace` advisor lint consumes. A `replace` overwrites the
- * entire row, so a concurrent edit to a different column on a synced table is
- * clobbered; `ctx.db.patch(id, { field })` merges at the column level instead.
- * Structurally identical to `AdvisorMutatorWrite` so it passes straight through
- * to the advisor without conversion, exactly as `InsertWriteIR` does for
- * `AdvisorInsertWrite`.
+ * One `ctx.db` write (`insert` / `replace` / `patch` / `insertManyUnsafe`) that sets
+ * an ownership / identity column — `userId`, `ownerId`, `tenantId`, and the like —
+ * from the handler's `args` instead of the server-trusted identity. The
+ * `owner_field_from_args_not_auth` lint input: the ownership column decides who a
+ * row belongs to, so a value taken from request input lets any caller write rows
+ * owned by another user or tenant (the act-as-any-user / cross-tenant IDOR vector).
+ * A column stamped from `ctx.*`, or set to a fixed literal, is not recorded; only an
+ * arg-derived identity write reaches here. Structurally identical to
+ * `AdvisorOwnerFieldWrite`.
  */
-interface MutatorWriteIR {
-  /** The mutator export whose `server` impl performs the replace, e.g. `renameChannel`. */
+/**
+ * One branching `defineShape({ where })` / `definePolicy({ when })` predicate arm
+ * that returns an unrestricted predicate — the `unrestricted_where_branch` lint
+ * input. A denial arm must match NO rows (`deny()` / `{ OR: [] }`); `{}` matches
+ * every row, so the near-miss silently replicates the whole table.
+ */
+interface UnrestrictedWhereBranchIR {
+  /** Export binding name of the shape / policy the predicate belongs to. */
   exportName: string;
-  /** Openable source path the replace appears in — always `lunora/mutators.ts`. */
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /** 1-based line of the `replace(...)` call. */
+  /** Which unrestricted form was returned. */
+  form: "empty-object" | "undefined";
+  /** The config key carrying the predicate (`where` for a shape, `when` for a policy). */
+  key: string;
+  /** 1-based line of the offending returned expression. */
   line: number;
+  /** The declaring call (`defineShape` / `definePolicy`). */
+  owner: string;
 }
-/**
- * A single cron job lifted from a `cronJobs()` builder in `lunora/crons.ts`.
- * Mirrors `@lunora/scheduler`'s `CronJob`: {@link CronJobIR.cron} is the compiled
- * standard cron expression, {@link CronJobIR.functionPath} is the target
- * `__lunoraRef` (`namespace:fn`), and {@link CronJobIR.args} is the static
- * argument object passed at registration.
- */
-interface CronJobIR {
-  /** Static args object (source-text JSON), defaults to `{}`. */
-  args: Record<string, unknown>;
-  /** Compiled standard cron expression, e.g. `"0 9 * * *"`. */
-  cron: string;
-  /** Target function ref `namespace:fn`. Present for a function target; absent when {@link CronJobIR.workflow} is set. */
-  functionPath?: string;
-  /** Unique, human-readable job name. */
-  name: string;
+interface OwnerFieldWriteIR {
   /**
-   * Set when the job targets a durable workflow (a `lunora/workflows.ts`
-   * export) instead of a function: the workflow's class name (its
-   * `ctx.exports` key) plus its export name. On each fire the worker starts a new workflow
-   * INSTANCE (the {@link CronJobIR.args} become its `params`) rather than
-   * dispatching a one-shot function.
+   * Every procedure that reaches the write carries `.use(platformAdmin(...))`
+   * (see {@link FunctionIR.adminOnly}): the caller is a platform admin by design.
    */
-  workflow?: {
-    className: string;
-    exportName: string;
-  };
-}
-/** A normalized container image source, as written into `wrangler.jsonc`. */
-type ContainerImageIR = {
-  buildContext: string;
-  dockerfilePath: string;
-  kind: "dockerfile";
-} | {
-  buildDir: string;
-  kind: "build";
-} | {
-  kind: "registry";
-  reference: string;
-};
-/** A `durable_object` container's named image — a Dockerfile or a registry digest, never a Railpack build. */
-type ContainerNamedImageIR = Exclude<ContainerImageIR, {
-  kind: "build";
-}>;
-/** The fields every container carries, whichever scheduling policy it uses. */
-interface ContainerIRBase {
-  /** Durable Object binding name, e.g. `CONTAINER_TRANSCODER`. */
-  bindingName: string;
-  /** Static Dockerfile build args (wrangler `image_vars` / named-image `build_vars`), when declared as literals. */
-  buildArgs?: Record<string, string>;
-  /** Generated DO class name, e.g. `TranscoderContainer`. */
-  className: string;
+  adminOnly?: true;
+  /** The identity column being written from `args` (e.g. `userId`). */
+  field: string;
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
+  file: string;
   /**
-   * Whether the container may open outbound internet connections, when the
-   * value was a static literal. `undefined` means the field was omitted (the
-   * platform default is `true`) or wasn't a literal. Lifted for the advisor.
+   * The handler proves the value it writes equals the server identity before the
+   * write: an `if (<args.field> !== <ctx identity>) throw` (also inside an `&&` or
+   * `||` condition), or an `assert*(...)` call given both the argument and the
+   * identity. The write is then validated, so `owner_field_from_args_not_auth`
+   * declines to report it. Only facts that hold before the write count.
    */
-  enableInternet?: boolean;
-  /** The `lunora/containers.ts` export name, e.g. `transcoder`. */
-  exportName: string;
-  /** Static `instanceType`, when declared (the default size, under `durable_object`). */
-  instanceType?: string | {
-    diskMb?: number;
-    memoryMib?: number;
-    vcpu?: number;
-  };
-  /** Static wrangler `containers[].name` override, when declared. */
-  name?: string;
+  guarded?: true;
+  /** 1-based line of the `ctx.db` write call, or `0` when unknown. */
+  line: number;
+  /** The `ctx.db` write method (`insert` / `replace` / `patch` / `insertManyUnsafe`). */
+  method: string;
   /**
-   * `true` when the definition opts in to the Sandbox SDK helpers
-   * (`defineContainer({ sandbox: true })`). Must be a literal: it decides
-   * whether the generated `containers.ts` exports the sandbox gateways, and
-   * it raises the `containerSandboxTools` platform signal.
+   * The enclosing `defineMutator` declared this very column as its `owner`, AND
+   * the value written resolves, by symbol, to that same `args[owner]` of the
+   * `server` impl's own 2nd parameter. A nested closure's or a helper's own
+   * `args` (or any binding shadowing it) never qualifies.
+   *
+   * `applyOwnerScope` requires a verified identity, rejects a client-supplied
+   * value that disagrees with it, and overwrites the column with the verified
+   * one before `server` runs — so on this exact shape `args[owner]` IS the
+   * server identity, and it is what the docs prescribe. Recorded rather than
+   * dropped at discovery: the write did happen, and the feeder is otherwise the
+   * only place that knows. `owner_field_from_args_not_auth` is what declines to
+   * report it.
+   *
+   * Deliberately NOT set when only the column NAME matches: `owner: "userId"`
+   * launders `args.userId` and nothing else, so `{ userId: args.targetUserId }`
+   * is a real IDOR and stays reportable.
    */
-  sandbox?: boolean;
+  ownerScoped?: true;
+  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
+  scope: CallSiteScope;
   /**
-   * The static `sleepAfter` value, when it was a literal. `undefined` means
-   * omitted (platform default `"10m"`) or non-literal. Lifted for the advisor.
+   * Visibility of the enclosing procedure. `internal` procedures are not
+   * reachable by a caller, so the lint's premise ("any caller can write rows
+   * owned by another user") does not hold there — see
+   * `owner_field_from_args_not_auth`. `undefined` when the write sits outside
+   * any recognised procedure (a bare helper).
    */
-  sleepAfter?: number | string;
+  visibility?: "internal" | "public";
 }
-/** A container under the default scheduling policy: one application image, a cap, and a rollout. */
-interface DefaultScheduledContainerIR extends ContainerIRBase {
+/**
+ * One `ctx.storage.<bucket>.<method>(key, …)` call whose R2 object key is derived
+ * from the handler's `args` with no server-side scoping — the
+ * `storage_key_from_user_args` lint input. The bucket read/write/URL/delete methods
+ * key by their first argument, so an object key taken straight from request input is
+ * object-level IDOR (read/overwrite/delete anyone's object). A key referencing a
+ * server-trusted `ctx.*` value (e.g. `${ctx.auth.userId}/…`) is treated as scoped
+ * and is not recorded; only an arg-derived, `ctx`-free key reaches here.
+ * Structurally identical to `AdvisorStorageKeyAccess`.
+ */
+interface StorageKeyAccessIR {
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the storage call, or `0` when unknown. */
+  line: number;
+  /** The bucket method invoked with the arg-derived key, e.g. `get` / `put` / `delete` / `download`. */
+  method: string;
+  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
+  scope: CallSiteScope;
   /**
-   * Normalized image source: a local Dockerfile (`dockerfile`), a pre-built
-   * registry reference (`registry`), or a Railpack source directory (`build`)
-   * that the deploy step builds and pushes before wrangler runs.
+   * Visibility of the enclosing procedure. `internal` procedures have no
+   * untrusted caller by construction — see `owner_field_from_args_not_auth`'s
+   * identical split — so `storage_key_from_user_args` drops the finding to
+   * INFO rather than ERROR there. `undefined` when the access sits outside any
+   * registered procedure the feeder could attribute it to.
    */
-  image: ContainerImageIR;
-  /** Static `maxInstances`, when declared. */
-  maxInstances?: number;
-  /** Static rolling-deploy tuning, when declared as literals. */
-  rollout?: {
-    gracePeriodSeconds?: number;
-    stepPercentage?: number;
-  };
-  /** Absent under the default policy — the union's discriminant. */
-  schedulingPolicy?: never;
+  visibility?: "internal" | "public";
 }
 /**
- * A container under the `durable_object` scheduling policy (wrangler
- * `scheduling_policy`): each instance picks its image and size per start. Also
- * the `containerRuntimeScheduling` platform signal.
+ * One `ctx.ai.run(model, …)` call whose model-id argument is derived from the handler's
+ * `args` with no server-side scoping — the `ai_raw_run_escape_hatch` lint input.
+ * `ctx.ai.run` is the raw Workers AI binding passthrough, bypassing the typed
+ * `ctx.ai.model(...)` + AI-SDK layer (`generateText`/`streamText`/…) that caps output and
+ * enforces a schema, so an arg-derived model id lets any caller select an arbitrary model.
+ * A fixed literal model, or one scoped by a server-trusted `ctx.*` value, is not recorded;
+ * only an arg-derived, unscoped model id reaches here (an arg-derived `inputs` argument is
+ * normal usage and is never inspected). Structurally identical to `AdvisorAiRawRun`.
  */
-interface DurableObjectScheduledContainerIR extends ContainerIRBase {
-  /** The named images an instance can start from (wrangler `containers[].images`). */
-  images?: Record<string, ContainerNamedImageIR>;
-  schedulingPolicy: "durable_object";
+interface AiRawRunIR {
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the `ctx.ai.run` call, or `0` when unknown. */
+  line: number;
+  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
+  scope: CallSiteScope;
 }
 /**
- * A container lifted from a `defineContainer()` export in
- * `lunora/containers.ts`, discriminated on its scheduling policy. Carries
- * everything the emitters and the config layer need to wire wrangler
- * (`containers[]` + the Durable Object binding + migration class) and the
- * generated `_generated/containers.ts` DO class. Names are derived via
- * `@lunora/container`'s shared helpers so codegen and the config layer can
- * never disagree.
+ * One `ctx.vectors.<method>(indexName, input)` call whose `input.namespace` is derived
+ * from the handler's `args` with no server-side scoping — the
+ * `vectors_namespace_from_user_input` lint input. A Vectorize namespace partitions one
+ * index into isolated sub-collections, so a namespace taken straight from request input
+ * lets any caller read or poison another tenant's vectors. A fixed literal namespace, or
+ * one prefixed with a server-trusted identity (`${ctx.auth.orgId}` — references `ctx`, so
+ * treated as scoped), is not recorded; only an arg-derived, unscoped namespace reaches
+ * here. Structurally identical to `AdvisorVectorNamespaceAccess`.
  */
-type ContainerIR = DefaultScheduledContainerIR | DurableObjectScheduledContainerIR;
+interface VectorNamespaceAccessIR {
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the `ctx.vectors` call, or `0` when unknown. */
+  line: number;
+  /** The `ctx.vectors` method invoked: `query` / `upsert` / `upsertNow`. */
+  method: string;
+  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
+  scope: CallSiteScope;
+}
 /**
- * A workflow lifted from a `defineWorkflow()` export in `lunora/workflows.ts`.
- * Carries what the emitters and the config layer need to wire the wrangler
- * `workflows[]` entry and the generated `_generated/workflows.ts`
- * `WorkflowEntrypoint` class. Unlike containers, workflows are NOT Durable
- * Objects — wrangler gets only a `workflows[]` entry, never a `durable_objects`
- * binding or a migration class. Names are derived via `@lunora/workflow`'s
- * shared helpers so codegen and the config layer can never disagree.
+ * One `ctx.mail`/`ctx.email` `send`/`queue` call whose recipient field (`to`/`cc`/`bcc`)
+ * is derived from the handler's `args` with no server-side scoping — the
+ * `mail_recipient_from_request_input` lint input. A recipient taken straight from request
+ * input turns the deployment into an open relay / spam amplifier (any caller can direct
+ * mail to an arbitrary address). A fixed literal recipient, or one scoped by a
+ * server-trusted `ctx.*` value (e.g. `ctx.auth.user.email`), is not recorded; only an
+ * arg-derived, unscoped recipient reaches here. Structurally identical to
+ * `AdvisorMailRecipientAccess`.
  */
-interface WorkflowIR {
-  /** Generated `WorkflowEntrypoint` class name, e.g. `OrderPipelineWorkflow` — also its `exports` key and `ctx.exports` property. */
-  className: string;
-  /** Static `defaultRetention` literal → `exports.<Class>.default_retention`. */
-  defaultRetention?: {
-    errorRetention?: string;
-    successRetention?: string;
-  };
-  /** The `lunora/workflows.ts` export name, e.g. `orderPipeline`. */
-  exportName: string;
-  /**
-   * The file declaring the `handler:` when it is a function passed by reference
-   * and declared in another file — the file {@link WorkflowIR.steps}' lines are
-   * in. Lunora-relative inside `lunora/`, project-relative outside it.
-   */
-  handlerFile?: string;
-  /** See {@link HandlerSiteIR}. */
-  handlerSite?: HandlerSiteIR;
-  /** Static `limits` literal → `exports.<Class>.limits`. */
-  limits?: {
-    steps?: number;
-  };
-  /**
-   * The stable wrangler `exports.<Class>.name`. Defaults to the kebab-cased export
-   * name (`orderPipeline` → `order-pipeline`); a static `name:` literal in the
-   * definition overrides it.
-   */
-  name: string;
-  /**
-   * Static `schedules` cron literals → `exports.<Class>.schedules`. Each one
-   * starts an instance on Cloudflare; gated by the `workflowSchedules`
-   * capability, since a host that ignores them would never run the workflow.
-   */
-  schedules?: ReadonlyArray<string>;
-  /**
-   * Durable step labels lifted from the handler body — the first string-literal
-   * argument of every `ctx.step.do` / `.sleep` / `.sleepUntil` / `.waitForEvent`
-   * call. Feeds the duplicate-step-name lint, which flags a name used twice
-   * (Cloudflare memoizes by name, so the second call silently returns the
-   * first's cached result). Calls with a non-literal name are omitted (not
-   * statically comparable). A handler passed by reference is followed to its
-   * declaration; the lines are then in {@link WorkflowIR.handlerFile}.
-   */
-  steps: ReadonlyArray<WorkflowStepIR>;
+interface MailRecipientAccessIR {
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the `ctx.mail`/`ctx.email` call, or `0` when unknown. */
+  line: number;
+  /** The mailer method invoked: `send` / `queue`. */
+  method: string;
+  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
+  scope: CallSiteScope;
 }
 /**
- * An agent lifted from a `defineAgent()` export in `lunora/agents.ts`. A
- * `defineAgent` compiles its durable tool-loop onto a Cloudflare Workflow, so —
- * like {@link WorkflowIR} — an agent is NOT a Durable Object: wrangler gets only
- * a `workflows[]` entry, never a `durable_objects` binding or a migration class.
- * Carries what the emitters and the config layer need to wire the generated
- * agent `WorkflowEntrypoint` class (e.g. `SupportAgentWorkflow`), the typed
- * per-agent `ctx.agents` producer, and the reconciled wrangler `workflows[]`
- * entry. Names are derived via `@lunora/agent`'s shared helpers so codegen and
- * the config layer can never disagree.
+ * One `ctx.browser.<method>(url, …)` call whose navigation URL (`arguments[0]`)
+ * is derived from the handler's `args` with no server-side scoping — the
+ * `browser_user_url_without_allowlist` lint input. The lint additionally
+ * cross-references `createBrowser` config-call evidence to suppress findings
+ * when the browser is hardened with an `allowedHosts` allowlist or
+ * `resolveDns`. Structurally identical to `AdvisorBrowserUrlAccess`.
  */
-interface AgentIR {
-  /** Generated `WorkflowEntrypoint` class name, e.g. `SupportAgentWorkflow` — also its `exports` key and `ctx.exports` property. */
-  className: string;
-  /** The `lunora/agents.ts` export name, e.g. `support`. */
-  exportName: string;
-  /**
-   * The stable wrangler `exports.<Class>.name`. Defaults to the kebab-cased export
-   * name (`support` → `agent-support`); a static `name:` literal in the
-   * definition overrides it.
-   */
-  name: string;
-  /**
-   * Whether the definition declares an `onEmail` mapper on
-   * `defineAgent({ onEmail: … })`. When `true` the emitter wires this agent
-   * onto the worker's top-level `email()` handler (via `@lunora/agent/inbound`)
-   * so inbound mail starts a durable run. Detected by AST PRESENCE — the
-   * closure is never evaluated — and written to IR only when present, so
-   * email-free agents (and agent-free projects) stay byte-identical.
-   */
-  onEmail?: boolean;
-  /**
-   * Whether the definition opted into public run-starts via
-   * `defineAgent({ publicRun: true })` — emitted into the `ctx.agents` wiring
-   * spec so the public `agents:agentRun` mutation can gate on it fail-closed.
-   * Absent (falsy) means server-side starts only; the field is written to IR
-   * only when the literal is `true`, so agent-free and non-opted-in output is
-   * byte-identical.
-   */
-  publicRun?: boolean;
-  /**
-   * Whether the definition opted into a real-time voice session via a `voice`
-   * block on `defineAgent({ voice: … })`. Unlike the durable loop (a Workflow),
-   * the voice path IS a Durable Object — so when this is `true` the emitter
-   * generates the `voiceClassName` `VoiceSessionDO` subclass and the
-   * `api.agents.{name}Voice` client reference, and the config layer reconciles
-   * a `durable_objects` binding (`voiceBindingName`) + `new_sqlite_classes`
-   * migration. Written to IR only when the literal is present, so voice-free
-   * agents (and agent-free projects) stay byte-identical.
-   */
-  voice?: boolean;
-  /** The voice DO's Cloudflare `DurableObjectNamespace` binding name, e.g. `VOICE_SUPPORT`. Present only when `voice`. */
-  voiceBindingName?: string;
-  /** Generated `VoiceSessionDO` subclass name, e.g. `SupportVoiceDO`. Present only when `voice`. */
-  voiceClassName?: string;
-}
-/** One durable step call lifted from a workflow handler body (the use side of {@link WorkflowIR.steps}). */
-interface WorkflowStepIR {
-  /** 1-based line of the durable step call. */
+interface BrowserUrlAccessIR {
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the `ctx.browser` call, or `0` when unknown. */
   line: number;
-  /** The native step method invoked: `do` / `sleep` / `sleepUntil` / `waitForEvent`. */
+  /** The browser method invoked: `content` / `pdf` / `scrape` / `screenshot`. */
   method: string;
-  /** The step's static label (the first string-literal argument). */
-  name: string;
+  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
+  scope: CallSiteScope;
 }
 /**
- * A queue lifted from a `defineQueue()` export in `lunora/queues.ts`. Carries
- * what the emitters and the config layer need to wire the typed `ctx.queues`
- * producer, the generated worker `queue()` dispatch, and the wrangler
- * `queues.producers[]` / `queues.consumers[]` entries. Like workflows, a queue
- * is NOT a Durable Object — wrangler gets only `queues.*` entries. Names are
- * derived via `@lunora/queue`'s shared helpers so codegen and the config layer
- * can never disagree.
- */
-interface QueueIR {
-  /** The Cloudflare `Queue` producer binding name, e.g. `QUEUE_EMAIL`. */
-  bindingName: string;
-  /** The `lunora/queues.ts` export name, e.g. `emailQueue`. */
-  exportName: string;
-  /** The declaring file, lunora-relative without `.ts`: `queues`, or `billing/queues` for a module's own. */
-  filePath: string;
-  /** See {@link HandlerSiteIR}. */
-  handlerSite?: HandlerSiteIR;
-  /** How the queue is consumed: `"push"` (a worker `queue()` handler) or `"pull"` (external HTTP). */
-  mode: "pull" | "push";
-  /**
-   * The stable wrangler queue name (`queues.producers[].queue`). Defaults to
-   * the kebab-cased export name (`emailQueue` → `email-queue`); a static
-   * `name:` literal in the definition overrides it.
-   */
-  name: string;
-  /**
-   * Set for a `defineSubscription(topic, …)` export: the `defineTopic` export it
-   * consumes. A subscription is an ordinary push queue everywhere except
-   * `ctx.*` — it is published to through `ctx.topics.<topic>`, never `ctx.queues`.
-   */
-  topic?: string;
-  /** Push-consumer batch/retry tuning, mirrored onto the wrangler `queues.consumers[]` entry. */
-  tuning: {
-    deadLetterQueue?: string;
-    maxBatchSize?: number;
-    maxBatchTimeout?: number;
-    maxConcurrency?: number;
-    maxRetries?: number;
-    retryDelay?: number;
-  };
-}
-/**
- * A `defineTopic()` export in `lunora/queues.ts`. A topic deploys nothing of its
- * own: each subscription is a {@link QueueIR} whose `topic` names this export, and
- * that is the only record of the link (see {@link subscriptionsOf}).
+ * One payload-derived privileged dispatch — a `ctx.run`/`context.run` back into a
+ * Lunora function from inside a `defineQueue` push handler or a `defineWorkflow`
+ * handler, whose args reference the handler's untrusted payload (`context.params`
+ * for a workflow, a `for (… of batch.messages)` body for a queue) — the
+ * `privileged_dispatch_unvalidated_payload` lint input. Both handler kinds run
+ * under the **system identity** (RLS disabled), so forwarding attacker-influenced
+ * payload into the dispatch bypasses the target's row policy. The resolved
+ * `targetFile`/`targetExport` let the lint join RLS-procedure evidence and fire
+ * only for RLS-gated targets. Structurally identical to `AdvisorPrivilegedDispatch`.
  */
-interface TopicIR {
-  /** The `lunora/queues.ts` export name, e.g. `signups`. */
-  exportName: string;
-  /** The declaring file, as {@link QueueIR.filePath}. */
-  filePath: string;
+interface PrivilegedDispatchIR {
+  /** `"queue"` for a `defineQueue` handler, `"workflow"` for a `defineWorkflow` handler. */
+  dispatchKind: "queue" | "workflow";
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the dispatch call, or `0` when unknown. */
+  line: number;
+  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
+  scope: CallSiteScope;
+  /** Export name of the dispatched target (`send` in `api.messages.send`). */
+  targetExport: string;
+  /** File path of the dispatched target relative to `lunora/` (`messages` in `api.messages.send`). */
+  targetFile: string;
 }
 /**
- * A module: a folder under `lunora/` whose `module.ts` default-exports
- * `defineModule(...)`. Metadata for the Studio catalog, the architecture
- * manifest and the `cross_module_table_write` lint — it changes no `api.*` path.
+ * One tracked `ctx.storage.<bucket>.<method>(...)` upload/signing call — the
+ * shared input for the storage config-hygiene security lints
+ * (`storage_upload_without_content_type_allowlist`, `storage_upload_without_max_size`,
+ * `storage_generate_upload_url_no_content_type_pin`, `storage_presigned_url_for_private_content`).
+ * `upload`/`store` carry the `UploadOptions` guards (`allowedContentTypes` /
+ * `maxSize`); `generateUploadUrl` carries the signed-PUT `contentType` pin;
+ * `getPresignedUrl`/`getSignedUrl` carry a statically-known `expiresInSeconds`
+ * literal. `presentKeys` is empty (and `expiresInSeconds` unset) when the
+ * options argument was absent, a non-literal, or a spread — see `analyzable`.
+ * Structurally identical to `AdvisorStorageUpload`.
  */
-interface ModuleIR {
-  /** One-line description from `defineModule({ description })`. */
-  description?: string;
-  /**
-   * `true` for an installed component (a `defineSchemaExtension` key merged with
-   * `.extend(...)`) treated as a module: it owns its prefixed tables and the
-   * `lunora/<key>/` folder its copy-in code lives in. Absent for a declared module.
-   */
-  installed?: true;
-  /** The folder path relative to `lunora/`, e.g. `billing` — also the module's name. */
-  name: string;
-  /**
-   * `false` for an installed component shipped as a package: its code is in
-   * `node_modules`, so it owns its tables but no `lunora/<key>/` folder (an app
-   * folder of that name stays the app's). Absent means the module owns its folder.
-   */
-  ownsFolder?: false;
-  /** Tables the module declares it owns (`defineModule({ tables })`); empty when it declares none. */
-  tables: ReadonlyArray<string>;
+interface StorageUploadIR {
+  /** `true` when the call's options-object argument (or its deliberate absence) was statically resolvable. */
+  analyzable: boolean;
+  /** Numeric literal value of an `expiresInSeconds` option, when statically known (`getSignedUrl` / `getPresignedUrl` only). */
+  expiresInSeconds?: number;
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the call, or `0` when unknown. */
+  line: number;
+  /** The `ctx.storage` method invoked. */
+  method: "generateUploadUrl" | "getPresignedUrl" | "getSignedUrl" | "store" | "upload";
+  /** Options-object keys present at the call site (empty when not `analyzable`, or when no options argument was passed). */
+  presentKeys: string[];
+  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
+  scope: CallSiteScope;
 }
 /**
- * Who a discovered call site runs on behalf of — the one attribution every
- * per-call-site IR carries (see `discover/attribution`).
- *
- * `export`: lexically inside an exported top-level declaration. `name` is the
- * EXPORTED name — `export const send = …` → `send`, `export default …` →
- * `default`, `const run = …; export { run as start }` → `start`.
- *
- * `helper`: inside a top-level, non-exported `function` / `const` of the same
- * file. `callers` are the exports that reach it through same-file value
- * references (a call, or the helper passed on as a value), transitively and
- * sorted; a type-only reference (`typeof helper`) does not count. Empty for an
- * orphan helper no export reaches. `untracked` is set when code attribution
- * cannot follow — module scope, a class body, a destructured declaration — also
- * reaches the helper, so `callers` is incomplete.
- *
- * `module`: outside every top-level `function` / `const` — module scope, or a
- * class body.
- *
- * A site is recorded once; consumers fan out over its callers. The advisor's
- * `AdvisorCallSiteScope` is the same type, so feeder rows pass straight through.
+ * One discovered `httpAction`/`httpRoute` handler in `lunora/` that performs a
+ * side effect (`ctx.runMutation` / `ctx.runAction` / a `ctx.db.{insert,patch,
+ * replace,delete,insertManyUnsafe}` write) from the HTTP edge, with whether it
+ * reads `ctx.auth` — the `http_action_missing_auth_guard` lint input. A handler
+ * that mutates state or dispatches an action without ever consulting the request
+ * identity is an unauthenticated write bypassing identity/RLS. Only handlers with
+ * a statically-resolvable inline body and `ctx` binding are recorded (fail-safe
+ * under-report); read-only handlers are never recorded. Structurally identical to
+ * `AdvisorHttpActionGuard`.
  */
-type CallSiteScope = AdvisorCallSiteScope;
+interface HttpActionGuardIR {
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** Which HTTP surface the handler is: a raw `httpAction` or a typed `httpRoute` route. */
+  kind: "httpAction" | "httpRoute";
+  /** 1-based line of the handler call, or `0` when unknown. */
+  line: number;
+  /** For an `httpRoute`, the uppercased verb (`"POST"`); absent for a raw `httpAction`. */
+  method?: string;
+  /** `true` when the handler reads `ctx.auth` (a direct member access or a `const { auth } = ctx` destructure). */
+  readsAuth: boolean;
+  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
+  scope: CallSiteScope;
+  /** The first side effect found, as a stable label: `runMutation`, `runAction`, or `db.<method>`. */
+  sideEffect: string;
+}
 /**
- * Where a queue or workflow `handler:` passed by reference is declared, when it is
- * exported from a lunora source file — `defineWorkflow({ handler: onboard })` with
- * `onboard` exported from `lunora/onboarding/flow.ts` gives
- * `{ exportName: "onboard", file: "onboarding/flow" }`. The architecture graph
- * attributes that export's own call sites to the queue or workflow node, so its
- * calls are not reported as "not a registered function". `exportName` is the
- * exported name (`export { run as start }` → `start`).
+ * One response-header write, inside an `httpAction` handler, whose value is derived
+ * from raw request input (`request.headers`, `request.url`/query, `await
+ * request.json()`) with no CR/LF sanitizer — the
+ * `http_action_response_header_injection` lint input. A `Request`-derived string
+ * placed verbatim into a response header lets a caller smuggle `\r\n` and inject
+ * extra headers or split the response (header injection / response splitting). Only
+ * sites whose value is request-tainted AND unguarded are recorded: a value routed
+ * through a CR/LF guard (`isSafeHeaderValue`), a URL/URI encoder
+ * (`encodeURIComponent`/`encodeURI`), a numeric coercion (`Number`/`parseInt`/
+ * `parseFloat`), or `btoa` is treated as safe and never recorded (`String(...)` /
+ * `.toString()` are NOT sanitizers — they don't strip CR/LF). Structurally
+ * identical to `AdvisorHttpHeaderWrite`.
  */
-interface HandlerSiteIR {
-  exportName: string;
+interface HttpHeaderWriteIR {
   /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
+  /** The header name being written (`"location"`), or `""` when the key is not a string literal. */
+  headerName: string;
+  /** 1-based line of the request-tainted header value. */
+  line: number;
+  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
+  scope: CallSiteScope;
+  /** How the header was written. */
+  via: "headers-append" | "headers-ctor" | "headers-set" | "response-init";
 }
 /**
- * One call-site edge of the architecture graph, attributed through its
- * {@link CallSiteScope}.
- * Exactly one of `target` / `reason` is set: `target` is a `namespace:export`
- * function key (`call` / `schedule`) or a queue / topic export name (`enqueue` /
- * `publish`); `reason` says why the target could not be read statically.
+ * One rate-limit / Turnstile middleware call in `lunora/` — the
+ * `ratelimit_middleware_fail_open` lint input. `rateLimit`/`dbRateLimit`
+ * (`@lunora/ratelimit`) and `verifyTurnstileMiddleware` (`@lunora/auth`) each
+ * accept a `failOpen` escape hatch that admits every request when the
+ * limiter/siteverify is unavailable; `failOpen` is `true` only when the options
+ * literal set it to the boolean literal `true` (anything else is fail-closed).
+ * The lint escalates a fail-open guard to a finding when the guarded procedure
+ * (`exportName`/`limitName`) looks auth/payment-sensitive. Structurally
+ * identical to `AdvisorFailOpenGuard`.
  */
-interface CallEdgeIR {
-  /**
-   * `true` when the hop may not take effect on every pass of its function —
-   * see `isConditionalSite` in `discover/call-edges.ts` for the rules. Set
-   * only, never `false`. The `dispatch_cycle` lint's false-positive gate.
-   */
-  conditional?: true;
+interface FailOpenGuardIR {
+  /** The middleware factory at the call site: `rateLimit` / `dbRateLimit` / `verifyTurnstileMiddleware`. */
+  callee: string;
+  /** `true` only when the options literal set `failOpen: true` as a boolean literal; a non-literal or absent option is treated as fail-closed. */
+  failOpen: boolean;
   /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  kind: "call" | "enqueue" | "invoke" | "publish" | "schedule";
-  /** 1-based line of the call. */
+  /** The rate-limit `name` (second string argument) for `rateLimit`/`dbRateLimit`; `""` for `verifyTurnstileMiddleware`. */
+  limitName: string;
+  /** 1-based line of the middleware call, or `0` when unknown. */
   line: number;
-  reason?: string;
-  /** Who the call runs on behalf of. */
+  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
   scope: CallSiteScope;
-  target?: string;
 }
 /**
- * A literal-infinite loop in `lunora/` source — `while (true)`, `for (;;)` /
- * `for (; true;)`, `do { … } while (true)` — with no statically reachable way
- * out: no `break` bound to this loop, no `return`/`throw` outside a nested
- * function, no labeled `break` escaping it. One record per offending loop; a
- * loop that can exit records nothing, so the `unbounded_loop` lint has no
- * bounded loop to sift through.
+ * One `ctx.flags.boolean("key", <boolean-literal>)` read in `lunora/` — the
+ * `flag_gates_security_with_unsafe_default` lint input. OpenFeature returns the
+ * `defaultValue` when the provider errors, so a fail-open default on a
+ * security-shaped key silently opens access during an outage. Only reads with a
+ * statically-known string key and boolean-literal default are recorded; the lint
+ * owns the security-shape + polarity judgment. Structurally identical to
+ * AdvisorFlagSecurityDefault.
  */
-interface UnboundedLoopIR {
+interface FlagSecurityDefaultIR {
+  /** The boolean-literal default returned on a provider outage (fail-open value). */
+  defaultValue: boolean;
   /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /** The loop form that never falls out. */
-  kind: "do" | "for" | "while";
-  /** 1-based line of the `loop` keyword. */
+  /** The flag key — the first string-literal argument of `ctx.flags.boolean`. */
+  key: string;
+  /** 1-based line of the `ctx.flags.boolean` call, or `0` when unknown. */
   line: number;
-  /** Who the loop runs on behalf of. */
+  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
   scope: CallSiteScope;
 }
 /**
- * A sibling Worker the app calls through a Cloudflare service binding, declared in
- * `lunora.config.*` `services` (plan 457). Becomes a wrangler `services[]` entry,
- * a typed `ctx.services.<name>` on actions, and a `service` node in the
- * architecture manifest.
+ * One `ctx.flags` read lexically inside a `query(...)` handler — the
+ * flag_read_in_subscription advisor lint input. Flag changes append nothing to
+ * `__cdc_log`, so a subscribed query is never re-run when a flag flips and keeps
+ * serving the branch it last picked; `useFlag` is the reactive path. Structurally
+ * identical to the advisor's `AdvisorFlagRead` (same field set) so values pass
+ * straight through `lintSchema` without conversion, exactly as `ContextPropertyCallIR` does.
+ *
+ * Only `query` handlers are recorded — unlike `ContextPropertyCallIR` / `NondeterministicCallIR`
+ * there is no `kind` field, because `mutation`/`action` handlers run once and have
+ * no subscription staleness to warn about, so the feeder drops them rather than
+ * handing the lint rows it would discard.
  */
-interface ServiceBindingIR {
-  /** The `services[].binding` Lunora writes, e.g. `SERVICE_DOCUMENT_PARSER`. */
-  binding: string;
-  /** The exported `WorkerEntrypoint` class the binding targets; absent for the Worker's default export. */
-  entrypoint?: string;
-  /**
-   * The Worker name per `env.<name>` block the service's own wrangler config
-   * sets a `name` in. An environment missing here deploys as wrangler's
-   * default `<worker>-<env>`.
-   */
-  envWorkers: Readonly<Record<string, string>>;
-  /** Absolute path of the service's entry module (its wrangler `main`) — what the RPC type is read from. */
-  main: string;
-  /** The `ctx.services.<name>` key, e.g. `documentParser`. */
-  name: string;
-  /**
-   * The scopes in which the service still serves on `*.workers.dev` with no
-   * route of its own: `""` for the top level, else the environment name.
-   */
-  publicScopes: ReadonlyArray<string>;
-  /**
-   * The `WorkerEntrypoint` class the service is typed — and wired — as an RPC
-   * stub of. Equal to {@link ServiceBindingIR.entrypoint} for an RPC service;
-   * absent for a fetch service, including a named entrypoint declared
-   * `rpc: false`, which is called with plain `fetch` and so needs no import of
-   * the service's sources.
-   */
-  rpcEntrypoint?: string;
-  /** The Worker's own `name` from its wrangler config — the `services[].service` target. */
-  worker: string;
-  /** Absolute path of the service's wrangler config. */
-  wranglerPath: string;
-}
-/**
- * The feature-flag provider declared by the default export of `lunora/flags.ts`
- * (`defineFlags({ provider, … })`). Discovery is **metadata-only** — codegen
- * imports the real module at runtime for the provider value; this IR exists so
- * the config layer can reconcile/validate the wrangler `flagship` binding when
- * the app uses Flagship in binding mode. A `custom` provider (any other
- * OpenFeature factory) carries no binding to reconcile.
- */
-interface FlagsIR {
-  /**
-   * The wrangler `flagship[].binding` name — set **only** for a flagship
-   * `provider` in binding mode (`flagshipProvider({ binding: "FLAGS" })`). The
-   * config layer hints/validates a matching `flagship` binding from this.
-   */
-  bindingName?: string;
-  /**
-   * Flagship operating mode — `"binding"` (wrangler binding, needs a
-   * `flagship` entry) or `"http"` (no binding); `undefined` for a `custom`
-   * provider or when the mode can't be read statically.
-   */
-  mode?: "binding" | "http";
-  /** `"flagship"` when the provider is `flagshipProvider(...)`, else `"custom"` (any other OpenFeature provider factory). */
-  provider: "custom" | "flagship";
-}
-/**
- * A `ctx.workflows.get("name")…` call discovered in a function body — the
- * use-site analog of {@link WorkflowIR} (which is the declaration side). Feeds
- * the `workflow_unused` lint (a declared workflow with zero call sites) and the
- * `workflow_unknown_target` lint (a `.get("x")` whose `x` isn't declared — a
- * typo catcher). {@link WorkflowCallIR.workflow} is `""` when the `get(...)`
- * argument is not a string literal (a dynamic name — which suppresses the
- * unused-workflow heuristic rather than producing a false positive).
- */
-interface WorkflowCallIR {
+interface FlagReadIR {
+  /** The accessed `ctx.flags` surface, e.g. `ctx.flags.boolean` / `ctx.flags.details.string`. */
+  callee: string;
+  /** Export binding name of the query performing the read. */
+  exportName: string;
   /** Source file relative to `<projectRoot>/lunora/`, without extension (the api namespace). */
   file: string;
-  /** 1-based line of the `get(...)` call. */
+  /** 1-based line of the read, or `0` when unknown. */
   line: number;
-  /** Who the call runs on behalf of. */
-  scope: CallSiteScope;
-  /** The referenced workflow export name, or `""` when the argument is not a string literal. */
-  workflow: string;
 }
 /**
- * A `ctx.db.query("table")…` read discovered in a function body, reduced to what
- * the query advisor lints need: which table, whether the chain narrows with an
- * index, whether it filters, and which terminal materializes the result.
- * `table` is `""` when the `query(...)` argument is not a string literal (a
- * dynamic table — not lintable).
+ * One `generateText` / `streamText` call in `lunora/` whose `tools` reach a
+ * privileged side effect (a DB write, function dispatch, or outbound
+ * fetch/mail/queue send). `userInputDerived` records whether the model input
+ * (`prompt`/`messages`/`system`) flows from the handler's `args`; the
+ * `ai_tool_side_effect_prompt_injection` lint fires only when it does.
+ * Structurally identical to `AdvisorAiToolSideEffect`.
  */
-interface QueryReadIR {
+interface AiToolSideEffectIR {
   /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /**
-   * True when the chain's `.filter()` predicate compares `_id`
-   * (`(d) => d._id === args.id`) — a full scan for a row that `ctx.db.get`
-   * addresses directly. Optional so a feeder predating this field still
-   * typechecks; absent is treated as "not a primary-key filter".
-   */
-  filtersPrimaryKey?: boolean;
-  /** The chain calls `.filter(...)`. */
-  hasFilter: boolean;
-  /** The chain narrows with `.withIndex(...)` or `.withSearchIndex(...)`. */
-  hasIndex: boolean;
-  /** 1-based line of the `query(...)` call. */
+  /** 1-based line of the generation call, or `0` when unknown. */
   line: number;
-  /** Who the read runs on behalf of. */
+  /** The generation entrypoint invoked. */
+  method: "generateText" | "streamText";
+  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
   scope: CallSiteScope;
-  /** Queried table name, or `""` when the argument is not a string literal. */
-  table: string;
-  /**
-   * The materializing call the chain ends in — `"collect"`, `"take"`,
-   * `"paginate"`, `"first"`, `"unique"`, … — i.e. how much of the narrowed set
-   * the read actually loads.
-   *
-   * `undefined` when the chain reaches no recognised terminal (a reader passed
-   * on, a bare `query(...)`) AND when a feeder predating this field produced
-   * the read. The two are deliberately not distinguished: no consumer could act
-   * on the difference, so the terminal-shaped lints skip the read either way
-   * rather than guessing a terminal.
-   */
-  terminal?: string;
+  /** The privileged side-effect sink a model-callable tool reaches (`ctx.db.insert`, `ctx.run`, `ctx.fetch`, …). */
+  sideEffect: string;
+  /** `true` when a model-input option is derived from the handler's `args` (a bare `args.x`, or a name destructured from `args`). */
+  userInputDerived: boolean;
 }
 /**
- * A `ctx.authApi.<method>(...)` call discovered in a function body, attributed
- * to the exported function (and its file = api namespace) that performs it.
- * Structurally identical to `AdvisorAuthApiCall` so it passes straight through
- * to the advisor lint without conversion, exactly as `InsertWriteIR` does for
- * `AdvisorInsertWrite`.
+ * One `<receiver>.identity.<key>` claim read in `lunora/`, where `<receiver>` is
+ * an RLS/mask policy `auth` (or `ctx.auth`/`context.auth`). `declared` records
+ * whether `<key>` is in the app's `defineIdentity({ ... })` contract (or the
+ * always-present `userId`); the `identity_undeclared_claim_trusted` lint fires on
+ * the undeclared reads. Emitted only when a resolvable identity contract exists.
+ * Structurally identical to `AdvisorIdentityClaimRead`.
  */
-interface AuthApiCallIR {
+interface IdentityClaimReadIR {
+  /** `true` when `key` is a declared claim (in the `defineIdentity` contract, or the always-present `userId`). */
+  declared: boolean;
   /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /** True when the call's argument object includes a `headers` property. */
-  hasHeaders: boolean;
-  /** 1-based line of the call, or `0` when unknown. */
+  /** The claim key read off the identity bag. */
+  key: string;
+  /** 1-based line of the read, or `0` when unknown. */
   line: number;
-  /** The better-auth method invoked (e.g. `banUser`); empty when not statically known. */
-  method: string;
   /** Who the site runs on behalf of — see {@link CallSiteScope}. */
   scope: CallSiteScope;
 }
 /**
- * A table write other than a plain `ctx.db.insert(...)` (see {@link InsertWriteIR}):
- * a by-id `patch`/`replace`/`delete`/`hardDelete`/`restore`, a batch write, or a
- * `ctx.db.<table>.*` facade write. Feeds the architecture manifest's `write`
- * edges and the `cross_module_table_write` lint.
+ * One payment webhook-adapter construction in `lunora/` (`createStripeAdapter` /
+ * `createPolarAdapter` / `createAutumnAdapter` / `createDodoPaymentsAdapter`).
+ * `toleranceSeconds` carries the statically-known `webhookToleranceSeconds`
+ * replay window when it is a plain numeric literal; the payment-webhook
+ * wide-tolerance lint fires when it exceeds a conservative ceiling. Structurally
+ * identical to `AdvisorPaymentWebhook`.
  */
-interface TableWriteIR {
+interface PaymentWebhookIR {
+  /** The adapter factory invoked. */
+  callee: "createAutumnAdapter" | "createDodoPaymentsAdapter" | "createPolarAdapter" | "createStripeAdapter";
   /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /** 1-based line of the call. */
+  /** 1-based line of the construction, or `0` when unknown. */
   line: number;
-  /** The writer method called, e.g. `patch`, `deleteMany`, `upsert`. */
-  method: string;
-  /** Who the write runs on behalf of. */
+  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
   scope: CallSiteScope;
-  /**
-   * Target table; `""` when it can't be read (an untyped id, a non-literal
-   * name). A union id (`Id<"a"> | Id<"b">`) gives one record per table.
-   */
-  table: string;
+  /** Statically-known `webhookToleranceSeconds` literal, when present and a plain numeric literal. */
+  toleranceSeconds?: number;
 }
 /**
- * A `ctx.db.insert("table", …)` write discovered in a function body, attributed
- * to the exported function (and its file = api namespace) that performs it — the
- * write-side analog of {@link QueryReadIR}. Lets tooling wire a table's write
- * action by behavior (which function inserts into it) rather than by naming.
- * {@link InsertWriteIR.table} is `""` when the argument is not a string literal.
+ * One `query`/`mutation` handler that gates a `ctx.db.get`/`patch`/`delete` on a
+ * null-checked `ctx.db.normalizeId(table, id)` result — the
+ * `normalize_id_used_as_authorization` lint input. `normalizeId` validates an id's
+ * structural shape only (it never reads the database), so a non-null result proves
+ * the id is well-formed, never that the caller owns the row; gating access on it is
+ * an IDOR. The lint owns the negative proof — it keeps only `visibility === "public"`
+ * rows with no `.use(rls(...))` and no ownership/identity mention (`mentionsOwnership`),
+ * then joins `table` against the schema's RLS mode before flagging. Structurally
+ * identical to AdvisorNormalizeIdAuthorization so values pass straight through.
  */
-interface InsertWriteIR {
-  /** Source file relative to `<projectRoot>/lunora/`, without extension (the api namespace). */
+interface NormalizeIdAuthorizationIR {
+  /** Export binding name of the procedure performing the normalize-then-access. */
+  exportName: string;
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /** 1-based line of the `insert(...)` call. */
+  /** 1-based line of the `ctx.db.normalizeId(...)` call the access is gated on. */
   line: number;
-  /** Who the insert runs on behalf of. */
-  scope: CallSiteScope;
-  /** Target table name, or `""` when the argument is not a string literal. */
+  /** `true` when the handler anywhere reads an ownership-named identifier or `ctx.auth`/`ctx.identity`/… — an intervening ownership signal. */
+  mentionsOwnership: boolean;
+  /** The id-first `ctx.db` sink the normalized id reaches. */
+  sinkMethod: "delete" | "get" | "patch";
+  /** Table named in the `normalizeId` call, or `""` when its table argument wasn't a string literal. */
   table: string;
+  /** `true` when the procedure's builder chain carries a `.use(rls(...))` step. */
+  usesRls: boolean;
+  /** `"internal"` for `internalQuery`/`internalMutation`; `"public"` for `query`/`mutation`. */
+  visibility: "internal" | "public";
 }
 /**
- * A non-deterministic API call (`Date.now`, `Math.random`, `crypto.randomUUID`,
- * `crypto.getRandomValues`, `fetch`) discovered lexically inside a `query(...)`
- * or `mutation(...)` handler body — the `nondeterministic_query_mutation` lint
- * input. Structurally identical to `AdvisorNondeterministicCall` so values pass
- * straight through to the advisor without conversion, exactly as `AuthApiCallIR`
- * does for `AdvisorAuthApiCall`. `action(...)` handlers are never recorded —
- * actions are the determinism escape hatch.
+ * Schema, tables, indexes, relations, migrations: what the app declares about its data.
  */
-interface NondeterministicCallIR {
-  /** The non-deterministic API invoked, e.g. `Date.now` / `Math.random` / `crypto.randomUUID` / `fetch`. */
-  callee: string;
-  /** Export binding name of the function performing the call, e.g. `sendMessage`. */
-  exportName: string;
-  /** Source file relative to `<projectRoot>/lunora/`, without extension (the api namespace). */
-  file: string;
-  /** Which procedure kind the call lives in — only `query`/`mutation` handlers are recorded. */
-  kind: "mutation" | "query";
-  /** 1-based line of the call, or `0` when unknown. */
-  line: number;
-}
 /**
- * One `ctx.<property>` access lexically inside a `query`/`mutation` handler —
- * the feeder shape behind every "action-only surface used outside an action"
- * advisor lint (`hyperdrive_outside_action` for `ctx.sql`,
- * `r2sql_outside_action` for `ctx.r2sql`). Structurally identical to the
- * advisor's `AdvisorHyperdriveCall` / `AdvisorR2sqlCall` (same field set) so
- * values pass straight through `lintSchema` without conversion, exactly as
- * {@link NondeterministicCallIR} does. Only `query`/`mutation` handlers are
- * recorded; `action(...)` is the only context where these surfaces are even
- * typed, so it is the intended home and is skipped.
+ * AST-observable subset of a column's modifier chain (`.unique()`, `.default()`,
+ * …). Function-valued modifiers (`.$defaultFn`/`.$onUpdateFn`) can't be
+ * serialized, so only their *presence* is recorded.
  */
-interface ContextPropertyCallIR {
-  /** The accessed surface, e.g. `ctx.sql.query` / `ctx.r2sql.from` — the property, suffixed with the method when one is called on it. */
-  callee: string;
-  /** Export binding name of the function performing the access. */
-  exportName: string;
-  /** Source file relative to the lunora dir, without extension (the api namespace). */
-  file: string;
-  /** Which procedure kind the access lives in — only `query`/`mutation` handlers are recorded. */
-  kind: "mutation" | "query";
-  /** 1-based line of the access. */
-  line: number;
-}
-/**
- * Per-procedure RLS usage snapshot, produced by `discoverRlsProcedures` for the
- * `rls_uncovered_table` advisor lint. Structurally identical to
- * `AdvisorRlsProcedure` (they share the same field set) so values pass straight
- * through to the advisor without conversion, exactly as `AuthApiCallIR` does for
- * `AdvisorAuthApiCall`.
- */
-interface RlsProcedureIR {
-  /** Export binding name of the procedure (e.g. `listDocuments`). */
-  exportName: string;
-  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
-  file: string;
+interface ColumnMetaIR {
+  /** `.default(...)` or `.$defaultFn(...)` present — field is optional on insert. */
+  hasDefault?: boolean;
+  /** `.$onUpdateFn(...)` present. */
+  hasOnUpdate?: boolean;
+  /** Default `true`; `.nullable()` flips it to `false`. */
+  notNull: boolean;
+  /** `.unique()` present. */
+  unique?: boolean;
+}
+/** Reflective representation of a single validator call from the schema. */
+interface ValidatorIR {
+  /** For `v.storage(bucket?)` — the named typed bucket the object key lives in, when given. */
+  bucket?: string;
+  /** Column modifiers (`.unique()`, `.default()`, `.nullable()`, …) when present. */
+  column?: ColumnMetaIR;
   /**
-   * Table names extracted from the `rls(policies)` array literal. Empty when the
-   * policies argument is not a statically-readable array literal.
+   * `true` when this validator carries a refinement (`.check(...)`, `.max(n)`,
+   * `.email()`, …) — anything that narrows the accepted values without changing
+   * the kind. `schema-drift` hashes this, so a bound counts here even when it is
+   * modelled below. `.meta(...)` is pure metadata with no parse effect and does
+   * NOT set it.
    */
-  rlsTables: string[];
-  /** Tables read by the procedure via `ctx.db.query/findMany/findFirst/…`. */
-  tablesRead: string[];
-  /** Tables written by the procedure via `ctx.db.insert/patch/replace/delete`. */
-  tablesWritten: string[];
-  /** `true` when the procedure's builder chain includes `.use(rls(...))`. */
-  usesRls: boolean;
-  /** `"internal"` for `internalQuery` / `internalMutation` / `internalAction`. */
-  visibility: "internal" | "public";
-}
-/**
- * One procedure reduced to the facts the `mask_uncovered_pii_column` lint needs:
- * whether its builder chain includes `.use(mask(...))`, which `(table, column)`
- * pairs that mask declares, and which tables the procedure reads/writes. The
- * column-level analogue of {@link RlsProcedureIR}. Structurally identical to
- * `AdvisorMaskProcedure` so values pass straight through without conversion.
- */
-interface MaskProcedureIR {
-  /** Export binding name of the procedure (e.g. `listUsers`). */
-  exportName: string;
-  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
-  file: string;
+  hasRefinement?: boolean;
+  /** For `v.optional(inner)` / `v.array(inner)`. */
+  inner?: ValidatorIR;
+  /** For `v.record(key, value)`. */
+  keyType?: ValidatorIR;
+  /** Kind of validator (string, number, id, object, optional, array, union, literal, record, ...). */
+  kind: string;
+  /** For `v.literal(value)` — the literal value as source text. */
+  literalValue?: string;
+  /** For `v.union(a, b, ...)`. */
+  members?: ValidatorIR[];
+  /** For `v.object({...})`. */
+  shape?: Record<string, ValidatorIR>;
+  /** Verbatim source text — used in emitted code when we can't reconstruct from AST. */
+  sourceText?: string;
   /**
-   * `(table, column)` pairs this procedure's `mask(policies)` object literal
-   * declares. Empty when the policies argument is not a statically-readable
-   * object literal (conservative: `usesMask` is still `true`).
+   * The `n` of a `v.string().max(n)` written with a numeric literal — the one
+   * refinement predicate the IR can represent exactly (`value.length <= n`).
+   * The AOT compiler emits it as a guard instead of declining the node, which
+   * is what keeps a length-bounded public argument on the fast path.
    */
-  maskColumns: {
-    column: string;
-    table: string;
-  }[];
-  /** Tables read by the procedure via `ctx.db.query/findMany/findFirst/get`. */
-  tablesRead: string[];
-  /** Tables written by the procedure via `ctx.db.insert/patch/replace/delete`. */
-  tablesWritten: string[];
-  /** `true` when the procedure's builder chain includes `.use(mask(...))`. */
-  usesMask: boolean;
-  /** `"internal"` for `internalQuery` / `internalMutation` / `internalAction`. */
-  visibility: "internal" | "public";
+  stringMaxLength?: number;
+  /** For `v.id("table")` — the table name. */
+  tableName?: string;
+  /**
+   * For `v.from(externalSchema)` — the wrapped Standard Schema's inferred type,
+   * rendered as TS source. Recovered through the type checker from
+   * `~standard.types.output`, mirroring the runtime's `InferStandardOutput`.
+   * Absent when it could not be recovered safely, in which case the emitted
+   * type falls back to `unknown`.
+   */
+  tsType?: string;
+  /**
+   * `true` when this validator carries a refinement the IR could NOT model — a
+   * `.check(...)` closure, `.email()`, `.pattern(re)`, a `.max()` whose bound is
+   * not a literal. The AOT args-validator compiler declines any node with this
+   * flag, because compiling it would silently skip the predicate.
+   */
+  unmodelledRefinement?: boolean;
+  valueType?: ValidatorIR;
 }
-/**
- * One masked column surfaced to the studio's data-browser mask preview: a
- * `(table, column)` pair plus the declared {@link MaskProcedureIR} strategy so
- * the preview can pick redact-vs-hash-vs-custom rendering. Aggregated across the
- * project's `.use(mask(...))` chains by `discoverMaskMetadata`; the descriptive
- * twin of {@link RlsPolicyIR}. `"custom"` covers any non-string strategy (a
- * `(value, ctx) => …` function) — its logic is an opaque closure, never read by
- * the UI; the preview renders a fixed sentinel for it.
- */
-interface MaskColumnMetadataIR {
-  /** Column the mask policy redacts. */
-  column: string;
-  /** Declared masking strategy: `"redact"`/`"hash"` string literals, else `"custom"` for a `MaskFn`. */
-  strategy: "custom" | "hash" | "redact";
-  /** Logical table the masked column belongs to. */
-  table: string;
+interface IndexIR {
+  fields: ReadonlyArray<string>;
+  name: string;
+  unique?: boolean;
 }
-/**
- * Schema-wide masking metadata the codegen emits into the generated ShardDO so
- * the studio's data-browser mask toggle can preview what a non-privileged caller
- * would see. Aggregated across every `.use(mask(...))` chain in the project —
- * purely descriptive (table + column + strategy), never the masking closure. The
- * column-level analogue of {@link RlsMetadataIR}.
- */
-interface MaskMetadataIR {
-  /** Every statically-discovered masked column, deduped by `(table, column)` (first declaration wins). */
-  columns: MaskColumnMetadataIR[];
+interface SearchIndexIR {
+  /** Primary text-search field; a dot-separated path reads a nested field. */
+  field: string;
+  /** Optional filter fields surfaced alongside the FTS column. */
+  filterFields?: ReadonlyArray<string>;
+  /** Text-analysis profile (accent folding + that language's stopwords). */
+  language?: string;
+  name: string;
+  /** Skip the migration-time backfill of the search companion (large tables index out-of-band). */
+  staged?: boolean;
+  /** `"native"` opts into the engine's own full-text index where it has one (Postgres). */
+  strategy?: string;
 }
-/**
- * One masked column whose `mask(policies)` strategy is a statically-known
- * literal (`"hash"` or `"redact"`) — the `mask_weak_hash_strategy_on_pii` lint
- * input. Unlike {@link MaskColumnMetadataIR} (app-wide, deduped by `(table,
- * column)`, studio-preview evidence), this is per declaration site (file + line
- * + enclosing export), undeduped, so the lint can point at the exact
- * `mask(...)` call that applies a weak strategy. A `MaskFn` (custom, non-literal)
- * strategy carries no lint-relevant signal and is never recorded here.
- * Structurally identical to `AdvisorMaskStrategy`.
- */
-interface MaskStrategyIR {
-  /** Masked column name. */
-  column: string;
-  /** Export binding name of the procedure whose `.use(mask(...))` chain declared this column, or `"<module>"` when declared at file scope. */
-  exportName: string;
-  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
-  file: string;
-  /** 1-based line of the masked column's strategy property. */
-  line: number;
-  /** The statically-known strategy literal: `"hash"` or `"redact"`. */
-  strategy: string;
-  /** Logical table the masked column belongs to. */
+/** A `.geoIndex(name, { field, precision? })` declaration — a geohash companion over a `v.geoPoint()` column. */
+interface GeoIndexIR {
+  /** The `v.geoPoint()` column feeding the geohash. */
+  field: string;
+  name: string;
+  /** Geohash precision (characters) maintained on the companion; omitted ⇒ the runtime default. */
+  precision?: number;
+}
+/** A `.ttl(field, { after? })` declaration — declarative table-level auto-expiry. */
+interface TtlIR {
+  /** Millisecond offset added to `field` to derive the expiry (`field + after`); omitted ⇒ `field` is the absolute expiry. */
+  after?: number;
+  /** The epoch-millisecond expiry column. */
+  field: string;
+}
+interface VectorIndexIR {
+  dimensions?: number;
+  /** Shape A: the single source column. Shape B: undefined (derived via a `select` fn). */
+  field?: string;
+  /** Shape A: metadata field names mirrored into Vectorize. */
+  metadata?: ReadonlyArray<string>;
+  metric?: "cosine" | "dot-product" | "euclidean";
+  name: string;
+  /** Owning table the vectors are sourced from. */
   table: string;
 }
 /**
- * One statically-readable policy entry from an `rls([...])` array literal,
- * surfaced to the studio's read-only RLS inspector via the generated
- * `rlsPolicies()` hook. Captures the policy's `table` + `on` operation and the
- * procedure it guards — never the `when` predicate, which is an opaque JS
- * closure (its logic stays in code, not the UI). Produced by
- * `discoverRlsProcedures` alongside the lint IR.
+ * One ordering key on a rank index's `sortBy`: the column and direction.
+ * Mirrors the runtime `RankSortKey` (defaults `direction` to `"asc"`).
  */
-interface RlsPolicyIR {
-  /** Source file (relative to `lunora/`, without extension) the policy is declared in. */
-  file: string;
-  /** Operation the policy gates: `read` covers get/query/findMany, the rest are writes. */
-  on: "delete" | "insert" | "read" | "update";
-  /** Export name of the procedure whose `.use(rls(...))` chain declared this policy. */
-  procedure: string;
-  /** Logical table the policy applies to. Empty when not a string literal. */
-  table: string;
+interface RankSortKeyIR {
+  direction: "asc" | "desc";
+  field: string;
 }
 /**
- * One statically-readable role entry from an `rls(policies, { roles: [...] })`
- * call, surfaced to the studio's RLS inspector. Captures the role's `name`,
- * optional `description`, and the names of the permissions it grants (string
- * literals or `definePermission("name")` calls). Produced by
- * `discoverRlsProcedures`.
+ * A `.rankIndex(name, { sortBy, partitionBy?, where? })` declaration. The owning
+ * table is always the table the index is declared on, so — unlike a vector index
+ * — there is no separate `on`/`table` reference to carry: it rides along on its
+ * {@link TableIR}. Only the fields needed for type emission are captured.
  */
-interface RlsRoleIR {
-  /** Optional human-readable description from `defineRole(name, { description })`. */
-  description?: string;
-  /** Role label attached to the request identity (e.g. `"admin"`). */
+interface RankIndexIR {
   name: string;
-  /** Permission names this role grants, deduped and in declared order. */
-  permissions: string[];
+  /** Columns scoping each ranking; omitted ⇒ one global rank over the table. */
+  partitionBy?: ReadonlyArray<string>;
+  /** Ordered sort keys driving the rank. */
+  sortBy: ReadonlyArray<RankSortKeyIR>;
+}
+interface RelationIR {
+  /** FK column: on this table for `one`, on the target table for `many`. */
+  field: string;
+  kind: "many" | "one";
+  /** Accessor name the relation is loaded under (the `with` key). */
+  name: string;
+  /** FK behaviour applied to holder rows when the referenced parent is deleted. */
+  onDelete?: "cascade" | "restrict" | "set null";
+  /** Referenced column (defaults to `_id`). */
+  references: string;
+  /** Target table name. */
+  table: string;
 }
 /**
- * Schema-wide RLS metadata the codegen emits into the generated ShardDO so the
- * studio's read-only inspector can list, per table, which policies guard it and
- * what roles are defined. Aggregated across every `.use(rls(...))` chain in the
- * project — purely descriptive, never the predicate logic.
+ * Statically-discovered `.source(...)` config (plan 077). Only the bits the
+ * advisor lints + DO wiring need are captured; `map`/`tenantBy` are functions and
+ * cannot be serialized, so their presence is recorded as `hasTenantBy` rather than
+ * the function itself.
  */
-interface RlsMetadataIR {
-  /** Every statically-discovered policy `(table, on, procedure)` entry. */
-  policies: RlsPolicyIR[];
-  /** Every statically-discovered role, deduped by name (first declaration wins). */
-  roles: RlsRoleIR[];
+interface ExternalSourceIR {
+  /** The wrangler Hyperdrive binding name. */
+  binding: string;
+  /** Whether a `columns` projection allow-list was given. */
+  columns?: ReadonlyArray<string>;
+  /** `true` when a `reconcileEveryMs` was given — one of the two incremental delete-visibility paths the `external_source_incremental_no_delete_path` lint checks. */
+  hasReconcile?: boolean;
+  /** `true` when a `softDeleteColumn` was given — the other incremental delete-visibility path. */
+  hasSoftDelete?: boolean;
+  /** `true` when a `tenantBy` mapper was given — the tenant-isolation boundary the `external_source_unscoped` lint checks. */
+  hasTenantBy: boolean;
+  /** The `idColumn` literal, when given (defaults to `"id"` at runtime). */
+  idColumn?: string;
+  /** Delete-detection mode literal, when given (`"full-pull"` today). */
+  mode?: string;
+  /** The membership query literal, when statically knowable. */
+  query?: string;
+  /**
+   * `true` when `.source(...)` was present but its argument was **not** a static
+   * object literal (e.g. `.source(buildConfig())`), so none of the fields above
+   * could be read. The source still exists — this flag lets `hasSourcedTables`
+   * (codegen) and the `external_source_*` lints treat it as a source that can't be
+   * verified, instead of mistaking it for no `.source()` at all.
+   */
+  unanalyzable?: boolean;
 }
-/** One statically-discovered `defineStorageRule({ bucket, on, prefix })` entry from a `.use(storageRules(...))` chain. */
-interface StorageRuleIR {
-  bucket: string;
-  /** Relative to `lunora/`. */
-  file: string;
-  on: "delete" | "list" | "read" | "write";
-  /** Optional key-prefix scope; absent ⇒ the whole bucket. */
-  prefix?: string;
-  /** The exported procedure that installed the rule. */
-  procedure: string;
+interface TableIR {
+  /**
+   * `true` when the table chain carried `.commitOrdered()` — every row carries
+   * `_commitSeq`, a per-shard integer allocated once per mutation and strictly
+   * increasing in commit order. Optional: hand-built IR and tables that never
+   * called `.commitOrdered()` default it to `false`.
+   */
+  commitOrdered?: boolean;
+  /**
+   * `true` when that extension was resolved from a package in `node_modules`
+   * rather than from source under `lunora/` (a registry copy-in). Decides
+   * whether the component's module owns a `lunora/<key>/` folder.
+   */
+  extensionFromPackage?: true;
+  /**
+   * The `defineSchemaExtension` key that contributed this table, set when it
+   * arrived through `defineSchema(...).extend(...)`. Absent for a table the app
+   * declared itself.
+   *
+   * Drives the generated `AppTableName` union: an add-on's tables
+   * (`ratelimit_buckets`, …) are real tables and stay in `TableName`, but an app
+   * enumerating "my tables" should not have to know about them.
+   */
+  extensionKey?: string;
+  /**
+   * `true` when the table chain carried `.externallyManaged()` — its rows are
+   * written outside Lunora's discoverable insert path (adapter/migration/
+   * middleware), so advisor insert-path lints skip it. Optional: hand-built
+   * IR and the runtime `fromServerSchema` path default it to `false`.
+   */
+  externallyManaged?: boolean;
+  /**
+   * Set when the chain carried `.source(...)` — the table is materialized from an
+   * external Hyperdrive-backed database by a system poll loop (plan 077). Carries
+   * the statically-knowable bits the advisor lints read; the functions (`map`,
+   * `tenantBy`) are not serialized, only their presence (`hasTenantBy`).
+   */
+  externalSource?: ExternalSourceIR;
+  /** Geospatial indexes declared inline via `.geoIndex(name, …)`. Optional so hand-built IR may omit it (discovery always sets it). */
+  geoIndexes?: ReadonlyArray<GeoIndexIR>;
+  /**
+   * Storage backend for a `.global()` table: `"d1"` (default) or
+   * `"hyperdrive"` (a Postgres/MySQL database via Cloudflare Hyperdrive). Only
+   * meaningful when `shardMode === "global"`; absent for sharded/root tables.
+   *
+   * Read it through `isD1GlobalTable` / `isHyperdriveGlobalTable` rather than
+   * comparing here — discovery normalises the absent case to `"d1"`, and only
+   * those predicates encode which comparison is right for hand-built IR.
+   */
+  globalBackend?: "d1" | "hyperdrive";
+  indexes: ReadonlyArray<IndexIR>;
+  /**
+   * `true` when the table chain carried `.public()` — an explicit opt-OUT of
+   * the schema's `.rls("required")` enforcement for this one table. Optional:
+   * hand-built IR and tables that never called `.public()` default it to
+   * `false`.
+   */
+  isPublic?: boolean;
+  /**
+   * `true` when the table chain carried `.memory()` — its rows are cleared on
+   * every Durable Object cold start and never reach the CDC changelog.
+   * Optional: hand-built IR and tables that never called `.memory()` default it
+   * to `false`.
+   */
+  memory?: boolean;
+  name: string;
+  /** Rank indexes declared inline via `.rankIndex(name, …)`. */
+  rankIndexes: ReadonlyArray<RankIndexIR>;
+  /** Declared relations (via `.relations((r) => …)`), keyed in source order. */
+  relations: ReadonlyArray<RelationIR>;
+  searchIndexes: ReadonlyArray<SearchIndexIR>;
+  shape: Record<string, ValidatorIR>;
+  shardMode: "global" | "root" | {
+    field: string;
+    kind: "shardBy";
+  };
+  /** Set when the chain carried `.softDelete()` — the marker column's name (default `deletedAt`). The column is injected into `shape` so `Doc_*` carries it. */
+  softDelete?: {
+    field: string;
+  };
+  /** Set when the chain carried `.ttl(field, { after? })` — the declarative auto-expiry policy read by the DO alarm sweep. */
+  ttl?: TtlIR;
+  /** Vector indexes declared inline via `.vectorize()` (DSL Shape A). */
+  vectorIndexes: ReadonlyArray<VectorIndexIR>;
+}
+/** The Cloudflare DO data-residency jurisdictions the schema may declare. Canonical literal set for the codegen package. */
+type JurisdictionIR = "eu" | "fedramp" | "us";
+interface SchemaIR {
+  /**
+   * Cloudflare data-residency jurisdiction declared via
+   * `defineSchema(...).jurisdiction("…")`. Emitted into the generated worker's
+   * `createWorker({ jurisdiction })` (and `ctx.scheduler` / `ctx.containers`).
+   * Absent ⇒ un-pinned.
+   */
+  jurisdiction?: JurisdictionIR;
+  /**
+   * `.jurisdiction("…", { pinAuth: true })` — the acknowledgement that
+   * DO-backed auth, unpinned before, moves into the jurisdiction (and so to a
+   * new, empty object until its rows are copied). Without it codegen refuses a
+   * project that has DO-backed auth, and does not pin it.
+   */
+  jurisdictionPinsAuth?: true;
+  /**
+   * Set when `defineSchema(...).rls("required")` was chained onto the schema —
+   * every table's `ctx.db` write path is denied without an RLS-covering
+   * procedure unless the table itself is `.public()` (see {@link TableIR.isPublic}).
+   * Absent when the schema never called `.rls("required")`.
+   */
+  rlsMode?: "required";
+  tables: ReadonlyArray<TableIR>;
+  /** All vector indexes (inline Shape A hoisted + standalone Shape B), flattened. */
+  vectorIndexes: ReadonlyArray<VectorIndexIR>;
 }
 /**
- * Schema-wide storage-access-rule metadata emitted into the generated ShardDO so
- * the studio's read-only inspector can list, per bucket, which operations are
- * gated and under what key prefix. Aggregated across every
- * `.use(storageRules(...))` chain — descriptive only, never the predicate logic.
+ * Statically-read mirror of `@lunora/server`'s `RestCacheConfig`. Every field is
+ * optional because discovery only records literals it could actually read off the
+ * `.expose({ cache: … })` object.
  */
-interface StorageRulesMetadataIR {
-  rules: StorageRuleIR[];
+interface ExposeCacheIR {
+  maxAge?: number;
+  scope?: "private" | "public";
+  staleWhileRevalidate?: number;
+  tag?: string;
+  vary?: string;
 }
 /**
- * A typed REST route declared with the `httpRoute.<verb>("/path")…` builder in
- * `@lunora/server` and mounted on `httpRouter()`. Captured statically from the
- * builder chain so the OpenAPI emitter can render a real `paths` entry: the verb
- * + path become the operation's method + URL, and the accumulated validator maps
- * become its query parameters, path parameters, and request body.
+ * A `defineMigration({...})` declaration discovered in the user's lunora
+ * sources. The emitted `LUNORA_MIGRATIONS` registry keys on {@link MigrationIR.id}; the
+ * import wiring needs {@link MigrationIR.exportName}/{@link MigrationIR.filePath}. The runtime object
+ * carries the authoritative {@link MigrationIR.table}, but the lifted value is
+ * load-bearing at build time: the schema-drift gate matches it against the
+ * tables with breaking drift, so a migration left at `""` covers nothing.
  */
-interface HttpRouteIR {
-  /** `v.*` validators decoding the JSON request body (`.body({...})`), keyed by field. */
-  body: Record<string, ValidatorIR>;
-  /**
-   * Rendered TS type of one SSE chunk — the `R` the `.stream(handler)`
-   * handler yields — inferred from the handler via the type checker. Present
-   * only when {@link HttpRouteIR.stream} is `true`; `"unknown"` when the
-   * checker can't resolve enough context. Feeds the emitted
-   * `HttpStreamRef<Chunk, …>` so the chunk type flows to the client.
-   * @experimental Part of the HTTP-SSE stream surface (the `httpStreams.*` emission).
-   */
-  chunkType?: string;
-  /** Export binding name of the route handler (used only for diagnostics / dedupe). */
+interface MigrationIR {
+  /** Export binding name, used to reference the module member in generated imports. */
   exportName: string;
-  /** Path relative to `<projectRoot>/lunora/` without extension, e.g. "http". */
+  /** Path relative to `<projectRoot>/lunora/` without extension, e.g. "migrations". */
   filePath: string;
-  /** HTTP verb the route binds to (uppercased), e.g. `"GET"`. */
-  method: string;
-  /** The `.output(validator)` return schema when declared; absent ⇒ TS-inferred / best-effort. */
-  output?: ValidatorIR;
-  /** `v.*` validators decoding the hono path params (`.params({...})`), keyed by `:name`. */
-  params: Record<string, ValidatorIR>;
-  /** The route path passed to `httpRoute.<verb>(path)`, e.g. `/api/todos/:id`. */
-  path: string;
-  /** `v.*` validators decoding the URL query string (`.searchParams({...})`), keyed by name. */
-  searchParams: Record<string, ValidatorIR>;
-  /** `true` when declared via the terminal `.stream(...)` (Server-Sent Events) rather than `.handler(...)`. */
-  stream: boolean;
+  /** Stable migration id — the registry key and per-shard run-state key. */
+  id: string;
+  /** Table the migration iterates; `""` when not a static string literal. */
+  table: string;
 }
 /**
- * Per-procedure protective-middleware snapshot, produced by
- * `discoverProcedureMiddleware` for the security lints
- * (`public_mutation_without_ratelimit`, `user_creating_mutation_without_captcha`).
- * Records which `.use(...)` guards a procedure's builder chain carries plus the
- * behavioural facts that decide whether a guard is *expected* (does it write a
- * user/session table, does it send mail). `protectPublic({ rateLimit, captcha })`
- * is unwrapped: the bundle's object-literal keys set `usesRateLimit`/`usesCaptcha`
- * exactly as the individual `.use(rateLimit(...))` / `.use(verifyTurnstile(...))`
- * steps would. Structurally identical to `AdvisorProcedureProtection` so values
- * pass straight through to the advisor without conversion.
+ * One `ctx.db.<table>.findMany({ includeDeleted })` list read whose
+ * `includeDeleted` is either a hardcoded `true` or derived from the handler's
+ * `args` — the `soft_delete_include_deleted_from_args` lint input. The lint joins
+ * `table` against the schema's soft-delete tables and `visibility` against
+ * `.public()` before flagging. Structurally identical to `AdvisorSoftDeleteRead`
+ * so values pass straight through without conversion.
  */
-interface ProcedureMiddlewareIR {
-  /**
-   * `true` when the handler body could be read statically — an inline function
-   * expression/arrow, or a same-file identifier resolved to one. `false` for a
-   * genuinely cross-file handler (an imported function, or an identifier that
-   * doesn't resolve in this file), in which case every behavioural fact below
-   * is `undefined` rather than a false "not observed" — the feeder never saw
-   * the body, so it has nothing to report.
-   */
-  analyzableBody: boolean;
-  /** `true` when the handler (or a helper inside it) references `ctx.mail` / `ctx.email`. `undefined` when `analyzableBody` is `false`. */
-  callsMail?: boolean;
-  /** `true` when the handler emits a structured observability event (`ctx.log` / `ctx.span` / `ctx.trace`). */
-  emitsEvent?: boolean;
-  /** `true` when a `// lunora-advisor-exempt` directive sits above the export. */
-  exempt: boolean;
-  /** The `-- reason` from that directive, or `""`. */
-  exemptReason: string;
-  /** Export binding name of the procedure (e.g. `signUp`). */
+interface SoftDeleteReadIR {
+  /** Export binding name of the procedure performing the read. */
   exportName: string;
-  /** `true` when the handler fans work out to a privileged, cost-bearing dispatch surface (scheduler `runAfter`/`runAt`, a queue producer send, or a workflow create). Feeds the privileged-fanout lint. `undefined` when `analyzableBody` is `false`. */
-  fanOut?: boolean;
   /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /** `true` when the handler wraps work in `try`/`catch`. */
-  handlesErrors?: boolean;
-  /**
-   * `true` when the procedure declares an email-shaped argument (`email`,
-   * `emailAddress`, `userEmail`, …), `false` when it provably declares none,
-   * and **absent** when the argument list can't be read statically (a
-   * `.input(sharedSchema)`, a spread, or a factory whose `args` comes from a
-   * variable). Feeds `signup_mutation_without_disposable_gating`, which can
-   * only be actioned when there is an address to gate — so "unreadable" must
-   * stay distinguishable from "none", or the lint would clear itself on a
-   * registration that may well expose one.
-   */
-  hasEmailArg?: boolean;
-  kind: "action" | "mutation" | "query";
-  /** `true` when the handler reaches an outbound surface (`ctx.fetch`, mail, queues, storage, sql, ai, …) that can fail. */
-  reachesOutbound?: boolean;
-  /** `true` when the handler runs any AI generation, bounded or not. */
-  runsAiGeneration?: boolean;
-  /** `true` when the handler throws a bare `new Error(...)` rather than a coded `LunoraError`. */
-  throwsBareError?: boolean;
-  /** `true` when the handler runs an AI generation (`generateText`/`streamText`/`generateObject`/`streamObject`) with no `maxOutputTokens` bound in its config literal. Feeds the `ai_unbounded_generation_public` lint. `undefined` when `analyzableBody` is `false`. */
-  unboundedAiGeneration?: boolean;
-  /** `true` when the chain carries `.use(verifyTurnstile(...))` or a `protectPublic({ captcha })` bundle. */
-  usesCaptcha: boolean;
-  /** `true` when the chain carries `.use(emailGateMiddleware(...))` (`@lunora/auth`). Feeds the `signup_mutation_without_disposable_gating` lint. */
-  usesEmailGate: boolean;
-  /** `true` when the handler calls `ctx.db.insertManyUnsafe(...)`, bypassing validators and triggers. Feeds the `insert_many_unsafe_user_data` lint. `undefined` when `analyzableBody` is `false`. */
-  usesInsertManyUnsafe?: boolean;
-  /** `true` when the chain carries `.use(mask(...))`. */
-  usesMask: boolean;
-  /** `true` when the chain carries `.use(rateLimit(...))` or a `protectPublic({ rateLimit })` bundle. */
-  usesRateLimit: boolean;
-  /** `true` when the chain carries `.use(rls(...))`. */
-  usesRls: boolean;
+  /** `true` when `includeDeleted` was derived from the handler's `args` (any caller can flip it). */
+  fromArgs: boolean;
+  /** `true` when `includeDeleted` was a hardcoded `true` literal (always resurfaces soft-deleted rows). */
+  hardcodedTrue: boolean;
+  /** 1-based line of the read call. */
+  line: number;
+  /** Table read, or `""` when the table-arg form's first argument wasn't a string literal. */
+  table: string;
   /** `"internal"` for `internalQuery` / `internalMutation` / `internalAction`. */
   visibility: "internal" | "public";
-  /** `true` when the handler inserts into a user/session/account-shaped table. `undefined` when `analyzableBody` is `false`. */
-  writesUserTable?: boolean;
 }
 /**
- * Per-procedure argument-validator snapshot, produced by the
- * argument-validator discoverer for the input-hardening lints
- * (`public_arg_uses_any`, `unbounded_string_arg`). Only public procedures are
- * recorded — internal functions take server-trusted input. Structurally identical
- * to `AdvisorArgumentValidator` so it passes straight through to the advisor
- * without conversion.
+ * One `ctx.db.<table>.findMany({ with: { <rel> } })` relation-hydrating list read
+ * — the `masked_relation_leak_via_with` lint input. Column masking does not
+ * descend into `with`-hydrated relations, so a masked table surfaced only through
+ * a `with` on an unprotected parent read is returned in the clear. The lint
+ * resolves each relation accessor to its target table and joins it against the
+ * discovered mask evidence before flagging. Structurally identical to
+ * `AdvisorRelationLoad` so values pass straight through without conversion.
  */
-interface ArgumentValidatorIR {
-  /** Arg names declared as `v.any()` (unvalidated, untyped input). */
-  anyArgs: string[];
-  /** Export binding name of the procedure (e.g. `updateProfile`). */
+interface RelationLoadIR {
+  /** Export binding name of the procedure performing the read. */
   exportName: string;
   /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /** 1-based line of the registration call, or `0` when unknown. */
+  /** 1-based line of the read call. */
   line: number;
-  /** Arg names declared as `v.string()` with no statically-visible max-length bound. */
-  unboundedStringArgs: string[];
+  /** Parent table the read targets, or `""` when the table-arg form's first argument wasn't a string literal. */
+  parentTable: string;
+  /** Relation accessor names named in the read's `with: { … }` map — matched against the parent table's declared relations. */
+  relations: string[];
+  /** `"internal"` for `internalQuery` / `internalMutation` / `internalAction`. */
+  visibility: "internal" | "public";
 }
 /**
- * One factory/constructor call in `lunora/` whose config object literal a
- * security lint inspects for a present-or-absent key — the shared input for the
- * config-call security lints (payment authorize, inbound-mail verify, rate-limit
- * store, browser private-targets). Structurally identical to `AdvisorConfigCall`
- * so it passes straight through to the advisor without conversion.
+ * One import of a migrated-away platform's SDK still present in `lunora/`
+ * source. Structurally identical to the advisor's `AdvisorStaleMigrationImport`
+ * so it passes through the feeder without conversion.
  */
-interface ConfigCallIR {
-  /** `true` when the config argument was a static object literal the feeder could read. */
-  analyzable: boolean;
-  /** The factory function or constructor name at the call site, e.g. `createPayment` / `RateLimiter`. */
-  callee: string;
-  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
+interface StaleMigrationImportIR {
+  /** Source file relative to the lunora dir, no extension. */
   file: string;
-  /** 1-based line of the call site, or `0` when unknown. */
+  /** 1-based line of the import, or `0` when unknown. */
   line: number;
-  /** Keys present in the config object literal (empty when not `analyzable`). */
-  presentKeys: string[];
-  /** Keys in the config object literal explicitly assigned the literal `true`. */
-  trueKeys: string[];
+  /** The imported module, e.g. `@supabase/supabase-js`. */
+  moduleSpecifier: string;
+  /** Which migration guide covers this platform. */
+  platform: "convex" | "firebase" | "supabase";
+}
+interface FunctionIR {
+  /**
+   * Set when the chain carries `.use(platformAdmin(...))`: only a platform admin
+   * can reach the procedure, so its writes are trusted to name any account.
+   */
+  adminOnly?: true;
+  args: Record<string, ValidatorIR>;
+  exportName: string;
+  /**
+   * Set by the `.expose({ rest: true })` builder modifier (plan 167). When
+   * `rest` is `true` the function is published on the public REST surface, so the
+   * OpenAPI emitter describes it as a real `/_lunora/rest/<namespace>/<fn>` path
+   * (the single source of truth the runtime router also derives from). Absent →
+   * RPC-only (the default; not on the REST surface).
+   *
+   * `cache` mirrors the `RestCacheConfig` the runtime turns into response
+   * headers, so the emitted spec can document the `Cache-Control` a caller will
+   * actually observe. Only statically-readable literal fields are carried; a
+   * computed value is simply absent (the spec under-documents rather than lies).
+   */
+  expose?: {
+    cache?: ExposeCacheIR;
+    rest?: boolean;
+  };
+  /** Path relative to `<projectRoot>/lunora/` without extension, e.g. "messages". */
+  filePath: string;
+  kind: "action" | "mutation" | "query" | "stream";
+  /**
+   * Set on lifecycle hooks (`onConnect`/`onDisconnect`/`onShardInit`/
+   * `onQueryChange`/`onWhisper`): the moment the hook fires on. Such a function
+   * is also an internal registration (so it lands in `LUNORA_FUNCTIONS` for path
+   * dispatch) — a mutation for every moment except `whisper`, which is a query;
+   * emit additionally collects it into the `LUNORA_LIFECYCLE_HOOKS` manifest
+   * keyed by this moment. Absent on ordinary functions.
+   */
+  lifecycle?: "connect" | "disconnect" | "init" | "reactor" | "whisper";
+  /**
+   * The `.output(validator)` declaration, when the chain has one.
+   *
+   * Takes precedence over {@link FunctionIR.returnType} (the handler's
+   * inferred type) for the emitted `FunctionReference`. `.output()` is what
+   * validates at runtime and what a reader takes as the contract, so the two
+   * must agree — see the emit-side note for what went wrong when they did not.
+   */
+  output?: ValidatorIR;
+  /**
+   * Serialized TS source for the handler's return type, with `Promise<T>`
+   * unwrapped so callers see `T` directly. Defaults to `"unknown"` when
+   * ts-morph cannot resolve the type (typically because the consuming
+   * project lacks a tsconfig that can reach `@lunora/server`).
+   */
+  returnType: string;
+  /**
+   * Call surface the function is exposed on. Absent (or `"public"`) means it
+   * lands in the generated `api`; `"internal"` routes it to the separate
+   * `internal` object and is rejected by the DO's external RPC path.
+   */
+  visibility?: "internal" | "public";
 }
 /**
- * One secret-shaped string literal discovered in `lunora/` source — the
- * `hardcoded_secret` lint input. Complements the pre-commit `vis secrets` scan by
- * surfacing the same class of finding in-IDE via the studio Advisors table.
- * Structurally identical to `AdvisorSecretLiteral`.
+ * A `defineShape({...})` declaration discovered in `lunora/shapes.ts`
+ * (local-first sync engine, Phase 7). The emitted `LUNORA_SHAPES` registry keys
+ * on {@link ShapeIR.exportName}; the generated DO's `resolveShape` override
+ * dispatches a `shape_subscribe` to the matching registered shape. Discovery is
+ * marker-driven (the `__lunoraShape` brand) — no field metadata is lifted here
+ * because the runtime object (`columns`/`compileWhere`) carries the authority.
  */
-interface SecretLiteralIR {
-  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
-  file: string;
-  /** Heuristic that matched, e.g. `stripe_live_key` / `aws_access_key` / `pem_private_key` / `high_entropy`. */
-  kind: string;
-  /** 1-based line of the literal, or `0` when unknown. */
-  line: number;
-  /** Redacted preview of the literal (first few chars + length) for the finding detail — never the full secret. */
-  preview: string;
+interface ShapeIR {
+  /**
+   * The shape's `args` validator map — its partition selector. Lifted so
+   * `_generated/collections.ts` can type the selector a caller passes instead of
+   * widening it to `Record<string, unknown>`. `{}` for a parameterless shape.
+   */
+  args: Record<string, ValidatorIR>;
+  /** Export binding name — the shape's registry key and import member. */
+  exportName: string;
+  /** Path relative to `<projectRoot>/lunora/` without extension — always `"shapes"`. */
+  filePath: string;
+  /**
+   * The `table` string literal from the `defineShape({ table })` call, lifted
+   * only for static advisor lints (the runtime object stays authoritative).
+   * `undefined` when `table` is not a plain string literal — lints skip those.
+   */
+  table?: string;
 }
 /**
- * One `ctx.sql.query(text, …)` / `ctx.sql.unsafe(text, …)` call whose `text`
- * argument is built in place rather than passed as a fixed statement — the
- * `sql_injection_risk` lint input. The Hyperdrive driver binds ONLY the `params`
- * array; the `text` string is spliced verbatim into the SQL, so a `text` assembled
- * from a string concatenation or a substitution template literal is an injection
- * vector. A fixed string literal / no-substitution template is safe. Structurally
- * identical to `AdvisorSqlInterpolation`.
+ * The single `defineIdentity({...})` claim contract discovered in
+ * `lunora/identity.ts`. Discovery is **marker-driven** (the `__lunoraIdentity`
+ * brand, exactly like {@link ShapeIR}) — no claim metadata is lifted here
+ * because the emitted `_generated/server.ts` recovers the claim *type* from the
+ * declaration itself (`InferIdentity` over the contract's `typeof`), and the
+ * runtime object (`validate`/`onInvalid`) carries the authority at the boundary.
+ * Exactly one per app; absent ⇒ generated output is byte-identical to today.
  */
-interface SqlInterpolationIR {
-  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
-  file: string;
-  /** 1-based line of the interpolation, or `0` when unknown. */
-  line: number;
-  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
-  scope: CallSiteScope;
+interface IdentityIR {
+  /** Export binding name — the namespace member `_generated/server.ts` reads via `typeof`. */
+  exportName: string;
 }
 /**
- * One `ctx.fetch(url, …)` call inside an action whose URL argument is derived
- * from the handler's `args` — the `action_fetch_ssrf` lint input. `ctx.fetch` is
- * the action-only outbound-request escape hatch with no host allowlist, so a URL
- * assembled from request input is a server-side request forgery vector (cloud
- * metadata endpoints, internal services). Only arg-derived URLs reach here; a
- * fixed literal or a URL built from config/`ctx.*` is not recorded. Structurally
- * identical to `AdvisorArgumentDerivedFetch`.
+ * The single `defineEnv({...})` contract discovered in `lunora/env.ts`. Like
+ * {@link IdentityIR}, only the export binding is lifted — the emitted
+ * `_generated/server.ts` recovers the validated shape from the declaration
+ * itself (`ReturnType` over the accessor's `typeof`), and the generated ShardDO
+ * applies the same accessor to the worker `env` at ctx-build time to populate
+ * `ctx.env`. Exactly one per app; absent ⇒ generated output is byte-identical.
  */
-interface ArgumentDerivedFetchIR {
-  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
-  file: string;
-  /** 1-based line of the `ctx.fetch` call, or `0` when unknown. */
-  line: number;
-  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
-  scope: CallSiteScope;
+interface EnvIR {
+  /** Export binding name — the namespace member `_generated/server.ts` reads via `typeof`. */
+  exportName: string;
 }
 /**
- * One `ctx.kv.<method>(key, …)` call whose namespace key is derived from the
- * handler's `args` with no server-side scoping — the `kv_unscoped_user_key_idor`
- * lint input. Workers KV is a single flat namespace, so a key taken straight from
- * request input lets any caller read, overwrite, or delete another user's entry
- * (IDOR). Only arg-derived, unscoped keys reach here; a fixed literal, or a key
- * prefixed with a server-trusted identity (`${ctx.auth.userId}:…` — references
- * `ctx`, so treated as scoped), is not recorded. `list` is excluded (it takes a
- * prefix, not a per-entry key). Structurally identical to `AdvisorKvKeyAccess`.
+ * A `defineMutator({...})` declaration discovered in `lunora/mutators.ts`
+ * (local-first sync engine, Phase 7). The emitted registry registers the
+ * authoritative `server` impl into the DO's `LUNORA_FUNCTIONS` table (so
+ * `handleRpc` transaction-wraps it) and records its path in
+ * `LUNORA_MUTATOR_PATHS` so the DO's `isCustomMutator` override routes the
+ * client-watermark push protocol. The client `client` impl is split into the
+ * browser bundle separately — only the path crosses to the server side.
  */
-interface KvKeyAccessIR {
-  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
-  file: string;
-  /** 1-based line of the `ctx.kv` call, or `0` when unknown. */
-  line: number;
-  /** The `ctx.kv` method invoked: `get` / `getRaw` / `getWithMetadata` / `put` / `delete`. */
-  method: string;
-  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
-  scope: CallSiteScope;
+interface MutatorIR {
   /**
-   * Visibility of the enclosing procedure. `internal` procedures have no
-   * untrusted caller by construction — see `owner_field_from_args_not_auth`'s
-   * identical split — so `kv_unscoped_user_key_idor` drops the finding to
-   * INFO rather than ERROR there. `undefined` when the access sits outside any
-   * registered procedure the feeder could attribute it to.
+   * The mutator's `args` validator map, parsed exactly as a procedure's is, so
+   * the emitted `api.mutators.<name>` reference carries the arg type a client
+   * `defineMutator` infers instead of restating. `{}` for a parameterless
+   * mutator (or one whose `args` isn't an inline object literal).
    */
-  visibility?: "internal" | "public";
-}
-/**
- * One `ctx.db` write (`insert` / `replace` / `patch` / `insertManyUnsafe`) that sets
- * an ownership / identity column — `userId`, `ownerId`, `tenantId`, and the like —
- * from the handler's `args` instead of the server-trusted identity. The
- * `owner_field_from_args_not_auth` lint input: the ownership column decides who a
- * row belongs to, so a value taken from request input lets any caller write rows
- * owned by another user or tenant (the act-as-any-user / cross-tenant IDOR vector).
- * A column stamped from `ctx.*`, or set to a fixed literal, is not recorded; only an
- * arg-derived identity write reaches here. Structurally identical to
- * `AdvisorOwnerFieldWrite`.
- */
-/**
- * One branching `defineShape({ where })` / `definePolicy({ when })` predicate arm
- * that returns an unrestricted predicate — the `unrestricted_where_branch` lint
- * input. A denial arm must match NO rows (`deny()` / `{ OR: [] }`); `{}` matches
- * every row, so the near-miss silently replicates the whole table.
- */
-interface UnrestrictedWhereBranchIR {
-  /** Export binding name of the shape / policy the predicate belongs to. */
+  args: Record<string, ValidatorIR>;
+  /** Export binding name — the mutator's registry key and import member. */
   exportName: string;
-  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
-  file: string;
-  /** Which unrestricted form was returned. */
-  form: "empty-object" | "undefined";
-  /** The config key carrying the predicate (`where` for a shape, `when` for a policy). */
-  key: string;
-  /** 1-based line of the offending returned expression. */
-  line: number;
-  /** The declaring call (`defineShape` / `definePolicy`). */
-  owner: string;
-}
-interface OwnerFieldWriteIR {
-  /**
-   * Every procedure that reaches the write carries `.use(platformAdmin(...))`
-   * (see {@link FunctionIR.adminOnly}): the caller is a platform admin by design.
-   */
-  adminOnly?: true;
-  /** The identity column being written from `args` (e.g. `userId`). */
-  field: string;
-  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
-  file: string;
-  /**
-   * The handler proves the value it writes equals the server identity before the
-   * write: an `if (<args.field> !== <ctx identity>) throw` (also inside an `&&` or
-   * `||` condition), or an `assert*(...)` call given both the argument and the
-   * identity. The write is then validated, so `owner_field_from_args_not_auth`
-   * declines to report it. Only facts that hold before the write count.
-   */
-  guarded?: true;
-  /** 1-based line of the `ctx.db` write call, or `0` when unknown. */
+  /** Path relative to `<projectRoot>/lunora/` without extension — always `"mutators"`. */
+  filePath: string;
+  /** 1-based line of the `defineMutator(...)` call, for diagnostics and advisor findings. */
   line: number;
-  /** The `ctx.db` write method (`insert` / `replace` / `patch` / `insertManyUnsafe`). */
-  method: string;
   /**
-   * The enclosing `defineMutator` declared this very column as its `owner`, AND
-   * the value written resolves, by symbol, to that same `args[owner]` of the
-   * `server` impl's own 2nd parameter. A nested closure's or a helper's own
-   * `args` (or any binding shadowing it) never qualifies.
-   *
-   * `applyOwnerScope` requires a verified identity, rejects a client-supplied
-   * value that disagrees with it, and overwrites the column with the verified
-   * one before `server` runs — so on this exact shape `args[owner]` IS the
-   * server identity, and it is what the docs prescribe. Recorded rather than
-   * dropped at discovery: the write did happen, and the feeder is otherwise the
-   * only place that knows. `owner_field_from_args_not_auth` is what declines to
-   * report it.
-   *
-   * Deliberately NOT set when only the column NAME matches: `owner: "userId"`
-   * launders `args.userId` and nothing else, so `{ userId: args.targetUserId }`
-   * is a real IDOR and stays reportable.
+   * The ownership column the declaration scopes the write to
+   * (`defineMutator({ owner: "userId" })`), or `undefined` when it declares
+   * none — which is also what the `mutator_without_owner_scope` lint reports,
+   * since an unowned mutator is a public write endpoint. Only a string-literal
+   * `owner` is lifted; a computed one reads as `undefined` rather than guessed.
    */
-  ownerScoped?: true;
-  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
-  scope: CallSiteScope;
+  owner?: string;
   /**
-   * Visibility of the enclosing procedure. `internal` procedures are not
-   * reachable by a caller, so the lint's premise ("any caller can write rows
-   * owned by another user") does not hold there — see
-   * `owner_field_from_args_not_auth`. `undefined` when the write sits outside
-   * any recognised procedure (a bare helper).
+   * Serialized TS source for the authoritative `server` impl's return type,
+   * `Promise<T>` unwrapped. `"unknown"` when ts-morph can't resolve it — same
+   * contract as {@link FunctionIR.returnType}.
    */
-  visibility?: "internal" | "public";
+  returnType: string;
 }
 /**
- * One `ctx.storage.<bucket>.<method>(key, …)` call whose R2 object key is derived
- * from the handler's `args` with no server-side scoping — the
- * `storage_key_from_user_args` lint input. The bucket read/write/URL/delete methods
- * key by their first argument, so an object key taken straight from request input is
- * object-level IDOR (read/overwrite/delete anyone's object). A key referencing a
- * server-trusted `ctx.*` value (e.g. `${ctx.auth.userId}/…`) is treated as scoped
- * and is not recorded; only an arg-derived, `ctx`-free key reaches here.
- * Structurally identical to `AdvisorStorageKeyAccess`.
+ * A whole-row `ctx.db.replace(id, document)` write discovered inside a custom
+ * mutator's inline `server` impl (`lunora/mutators.ts`) — the input the
+ * `mutator_full_row_replace` advisor lint consumes. A `replace` overwrites the
+ * entire row, so a concurrent edit to a different column on a synced table is
+ * clobbered; `ctx.db.patch(id, { field })` merges at the column level instead.
+ * Structurally identical to `AdvisorMutatorWrite` so it passes straight through
+ * to the advisor without conversion, exactly as `InsertWriteIR` does for
+ * `AdvisorInsertWrite`.
  */
-interface StorageKeyAccessIR {
-  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
+interface MutatorWriteIR {
+  /** The mutator export whose `server` impl performs the replace, e.g. `renameChannel`. */
+  exportName: string;
+  /** Openable source path the replace appears in — always `lunora/mutators.ts`. */
   file: string;
-  /** 1-based line of the storage call, or `0` when unknown. */
+  /** 1-based line of the `replace(...)` call. */
   line: number;
-  /** The bucket method invoked with the arg-derived key, e.g. `get` / `put` / `delete` / `download`. */
-  method: string;
-  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
-  scope: CallSiteScope;
-  /**
-   * Visibility of the enclosing procedure. `internal` procedures have no
-   * untrusted caller by construction — see `owner_field_from_args_not_auth`'s
-   * identical split — so `storage_key_from_user_args` drops the finding to
-   * INFO rather than ERROR there. `undefined` when the access sits outside any
-   * registered procedure the feeder could attribute it to.
-   */
-  visibility?: "internal" | "public";
 }
 /**
- * One `ctx.containers.<exportName>.get(name, …)` call whose instance key is derived
- * from the handler's `args` with no server-side scoping — the
- * `container_instance_key_from_user_input` lint input. Each container definition's
- * `.get(name)` accessor routes to one instance per `name`, so a key taken straight from
- * request input lets any caller reach another tenant's container (a cross-tenant IDOR). A
- * fixed literal key, or one derived from a server-trusted identity (`${ctx.auth.userId}` —
- * references `ctx`, so treated as scoped), is not recorded; only an arg-derived, unscoped
- * key reaches here. `.any()`/`.pool()` take no key and are not sinks. Structurally
- * identical to `AdvisorContainerKeyAccess`.
+ * Where a queue or workflow `handler:` passed by reference is declared, when it is
+ * exported from a lunora source file — `defineWorkflow({ handler: onboard })` with
+ * `onboard` exported from `lunora/onboarding/flow.ts` gives
+ * `{ exportName: "onboard", file: "onboarding/flow" }`. The architecture graph
+ * attributes that export's own call sites to the queue or workflow node, so its
+ * calls are not reported as "not a registered function". `exportName` is the
+ * exported name (`export { run as start }` → `start`).
  */
-interface ContainerKeyAccessIR {
+interface HandlerSiteIR {
+  exportName: string;
   /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /** 1-based line of the `ctx.containers.*.get` call, or `0` when unknown. */
-  line: number;
-  /** The container accessor method invoked — always `get`. */
-  method: string;
-  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
-  scope: CallSiteScope;
 }
 /**
- * One `ctx.ai.run(model, …)` call whose model-id argument is derived from the handler's
- * `args` with no server-side scoping — the `ai_raw_run_escape_hatch` lint input.
- * `ctx.ai.run` is the raw Workers AI binding passthrough, bypassing the typed
- * `ctx.ai.model(...)` + AI-SDK layer (`generateText`/`streamText`/…) that caps output and
- * enforces a schema, so an arg-derived model id lets any caller select an arbitrary model.
- * A fixed literal model, or one scoped by a server-trusted `ctx.*` value, is not recorded;
- * only an arg-derived, unscoped model id reaches here (an arg-derived `inputs` argument is
- * normal usage and is never inspected). Structurally identical to `AdvisorAiRawRun`.
+ * A typed REST route declared with the `httpRoute.<verb>("/path")…` builder in
+ * `@lunora/server` and mounted on `httpRouter()`. Captured statically from the
+ * builder chain so the OpenAPI emitter can render a real `paths` entry: the verb
+ * + path become the operation's method + URL, and the accumulated validator maps
+ * become its query parameters, path parameters, and request body.
  */
-interface AiRawRunIR {
-  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
-  file: string;
-  /** 1-based line of the `ctx.ai.run` call, or `0` when unknown. */
-  line: number;
-  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
-  scope: CallSiteScope;
+interface HttpRouteIR {
+  /** `v.*` validators decoding the JSON request body (`.body({...})`), keyed by field. */
+  body: Record<string, ValidatorIR>;
+  /**
+   * Rendered TS type of one SSE chunk — the `R` the `.stream(handler)`
+   * handler yields — inferred from the handler via the type checker. Present
+   * only when {@link HttpRouteIR.stream} is `true`; `"unknown"` when the
+   * checker can't resolve enough context. Feeds the emitted
+   * `HttpStreamRef<Chunk, …>` so the chunk type flows to the client.
+   * @experimental Part of the HTTP-SSE stream surface (the `httpStreams.*` emission).
+   */
+  chunkType?: string;
+  /** Export binding name of the route handler (used only for diagnostics / dedupe). */
+  exportName: string;
+  /** Path relative to `<projectRoot>/lunora/` without extension, e.g. "http". */
+  filePath: string;
+  /** HTTP verb the route binds to (uppercased), e.g. `"GET"`. */
+  method: string;
+  /** The `.output(validator)` return schema when declared; absent ⇒ TS-inferred / best-effort. */
+  output?: ValidatorIR;
+  /** `v.*` validators decoding the hono path params (`.params({...})`), keyed by `:name`. */
+  params: Record<string, ValidatorIR>;
+  /** The route path passed to `httpRoute.<verb>(path)`, e.g. `/api/todos/:id`. */
+  path: string;
+  /** `v.*` validators decoding the URL query string (`.searchParams({...})`), keyed by name. */
+  searchParams: Record<string, ValidatorIR>;
+  /** `true` when declared via the terminal `.stream(...)` (Server-Sent Events) rather than `.handler(...)`. */
+  stream: boolean;
 }
 /**
- * One `ctx.vectors.<method>(indexName, input)` call whose `input.namespace` is derived
- * from the handler's `args` with no server-side scoping — the
- * `vectors_namespace_from_user_input` lint input. A Vectorize namespace partitions one
- * index into isolated sub-collections, so a namespace taken straight from request input
- * lets any caller read or poison another tenant's vectors. A fixed literal namespace, or
- * one prefixed with a server-trusted identity (`${ctx.auth.orgId}` — references `ctx`, so
- * treated as scoped), is not recorded; only an arg-derived, unscoped namespace reaches
- * here. Structurally identical to `AdvisorVectorNamespaceAccess`.
+ * Per-procedure protective-middleware snapshot, produced by
+ * `discoverProcedureMiddleware` for the security lints
+ * (`public_mutation_without_ratelimit`, `user_creating_mutation_without_captcha`).
+ * Records which `.use(...)` guards a procedure's builder chain carries plus the
+ * behavioural facts that decide whether a guard is *expected* (does it write a
+ * user/session table, does it send mail). `protectPublic({ rateLimit, captcha })`
+ * is unwrapped: the bundle's object-literal keys set `usesRateLimit`/`usesCaptcha`
+ * exactly as the individual `.use(rateLimit(...))` / `.use(verifyTurnstile(...))`
+ * steps would. Structurally identical to `AdvisorProcedureProtection` so values
+ * pass straight through to the advisor without conversion.
  */
-interface VectorNamespaceAccessIR {
+interface ProcedureMiddlewareIR {
+  /**
+   * `true` when the handler body could be read statically — an inline function
+   * expression/arrow, or a same-file identifier resolved to one. `false` for a
+   * genuinely cross-file handler (an imported function, or an identifier that
+   * doesn't resolve in this file), in which case every behavioural fact below
+   * is `undefined` rather than a false "not observed" — the feeder never saw
+   * the body, so it has nothing to report.
+   */
+  analyzableBody: boolean;
+  /** `true` when the handler (or a helper inside it) references `ctx.mail` / `ctx.email`. `undefined` when `analyzableBody` is `false`. */
+  callsMail?: boolean;
+  /** `true` when the handler emits a structured observability event (`ctx.log` / `ctx.span` / `ctx.trace`). */
+  emitsEvent?: boolean;
+  /** `true` when a `// lunora-advisor-exempt` directive sits above the export. */
+  exempt: boolean;
+  /** The `-- reason` from that directive, or `""`. */
+  exemptReason: string;
+  /** Export binding name of the procedure (e.g. `signUp`). */
+  exportName: string;
+  /** `true` when the handler fans work out to a privileged, cost-bearing dispatch surface (scheduler `runAfter`/`runAt`, a queue producer send, or a workflow create). Feeds the privileged-fanout lint. `undefined` when `analyzableBody` is `false`. */
+  fanOut?: boolean;
   /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /** 1-based line of the `ctx.vectors` call, or `0` when unknown. */
-  line: number;
-  /** The `ctx.vectors` method invoked: `query` / `upsert` / `upsertNow`. */
-  method: string;
-  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
-  scope: CallSiteScope;
-}
-/**
- * One `ctx.mail`/`ctx.email` `send`/`queue` call whose recipient field (`to`/`cc`/`bcc`)
- * is derived from the handler's `args` with no server-side scoping — the
- * `mail_recipient_from_request_input` lint input. A recipient taken straight from request
- * input turns the deployment into an open relay / spam amplifier (any caller can direct
- * mail to an arbitrary address). A fixed literal recipient, or one scoped by a
- * server-trusted `ctx.*` value (e.g. `ctx.auth.user.email`), is not recorded; only an
- * arg-derived, unscoped recipient reaches here. Structurally identical to
- * `AdvisorMailRecipientAccess`.
- */
-interface MailRecipientAccessIR {
-  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
-  file: string;
-  /** 1-based line of the `ctx.mail`/`ctx.email` call, or `0` when unknown. */
-  line: number;
-  /** The mailer method invoked: `send` / `queue`. */
-  method: string;
-  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
-  scope: CallSiteScope;
+  /** `true` when the handler wraps work in `try`/`catch`. */
+  handlesErrors?: boolean;
+  /**
+   * `true` when the procedure declares an email-shaped argument (`email`,
+   * `emailAddress`, `userEmail`, …), `false` when it provably declares none,
+   * and **absent** when the argument list can't be read statically (a
+   * `.input(sharedSchema)`, a spread, or a factory whose `args` comes from a
+   * variable). Feeds `signup_mutation_without_disposable_gating`, which can
+   * only be actioned when there is an address to gate — so "unreadable" must
+   * stay distinguishable from "none", or the lint would clear itself on a
+   * registration that may well expose one.
+   */
+  hasEmailArg?: boolean;
+  kind: "action" | "mutation" | "query";
+  /** `true` when the handler reaches an outbound surface (`ctx.fetch`, mail, queues, storage, sql, ai, …) that can fail. */
+  reachesOutbound?: boolean;
+  /** `true` when the handler runs any AI generation, bounded or not. */
+  runsAiGeneration?: boolean;
+  /** `true` when the handler throws a bare `new Error(...)` rather than a coded `LunoraError`. */
+  throwsBareError?: boolean;
+  /** `true` when the handler runs an AI generation (`generateText`/`streamText`/`generateObject`/`streamObject`) with no `maxOutputTokens` bound in its config literal. Feeds the `ai_unbounded_generation_public` lint. `undefined` when `analyzableBody` is `false`. */
+  unboundedAiGeneration?: boolean;
+  /** `true` when the chain carries `.use(verifyTurnstile(...))` or a `protectPublic({ captcha })` bundle. */
+  usesCaptcha: boolean;
+  /** `true` when the chain carries `.use(emailGateMiddleware(...))` (`@lunora/auth`). Feeds the `signup_mutation_without_disposable_gating` lint. */
+  usesEmailGate: boolean;
+  /** `true` when the handler calls `ctx.db.insertManyUnsafe(...)`, bypassing validators and triggers. Feeds the `insert_many_unsafe_user_data` lint. `undefined` when `analyzableBody` is `false`. */
+  usesInsertManyUnsafe?: boolean;
+  /** `true` when the chain carries `.use(mask(...))`. */
+  usesMask: boolean;
+  /** `true` when the chain carries `.use(rateLimit(...))` or a `protectPublic({ rateLimit })` bundle. */
+  usesRateLimit: boolean;
+  /** `true` when the chain carries `.use(rls(...))`. */
+  usesRls: boolean;
+  /** `"internal"` for `internalQuery` / `internalMutation` / `internalAction`. */
+  visibility: "internal" | "public";
+  /** `true` when the handler inserts into a user/session/account-shaped table. `undefined` when `analyzableBody` is `false`. */
+  writesUserTable?: boolean;
 }
 /**
- * One `ctx.browser.<method>(url, …)` call whose navigation URL (`arguments[0]`)
- * is derived from the handler's `args` with no server-side scoping — the
- * `browser_user_url_without_allowlist` lint input. The lint additionally
- * cross-references `createBrowser` config-call evidence to suppress findings
- * when the browser is hardened with an `allowedHosts` allowlist or
- * `resolveDns`. Structurally identical to `AdvisorBrowserUrlAccess`.
+ * Per-procedure argument-validator snapshot, produced by the
+ * argument-validator discoverer for the input-hardening lints
+ * (`public_arg_uses_any`, `unbounded_string_arg`). Only public procedures are
+ * recorded — internal functions take server-trusted input. Structurally identical
+ * to `AdvisorArgumentValidator` so it passes straight through to the advisor
+ * without conversion.
  */
-interface BrowserUrlAccessIR {
+interface ArgumentValidatorIR {
+  /** Arg names declared as `v.any()` (unvalidated, untyped input). */
+  anyArgs: string[];
+  /** Export binding name of the procedure (e.g. `updateProfile`). */
+  exportName: string;
   /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /** 1-based line of the `ctx.browser` call, or `0` when unknown. */
+  /** 1-based line of the registration call, or `0` when unknown. */
   line: number;
-  /** The browser method invoked: `content` / `pdf` / `scrape` / `screenshot`. */
-  method: string;
-  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
-  scope: CallSiteScope;
+  /** Arg names declared as `v.string()` with no statically-visible max-length bound. */
+  unboundedStringArgs: string[];
 }
 /**
- * One runtime container-override call: a `<handle>.start({ enableInternet: true, … })`
- * launch override, or a `<handle>.egress.<method>(...)` runtime firewall mutation
- * (`allow` / `deny` / `setAllowed`) — the `container_start_enable_internet_override`
- * and `container_runtime_egress_relaxation` lint input. Both shapes re-open network
- * access the static `defineContainer` declaration (and its `container_public_internet`
- * lint) assumes is locked down. Matched structurally by call shape, independent of the
- * receiver's resolved type. Structurally identical to `AdvisorContainerOverride`.
+ * One factory/constructor call in `lunora/` whose config object literal a
+ * security lint inspects for a present-or-absent key — the shared input for the
+ * config-call security lints (payment authorize, inbound-mail verify, rate-limit
+ * store, browser private-targets). Structurally identical to `AdvisorConfigCall`
+ * so it passes straight through to the advisor without conversion.
  */
-interface ContainerOverrideIR {
-  /** e.g. the egress method name, or `"enableInternet: true"`. */
-  detail: string;
+interface ConfigCallIR {
+  /** `true` when the config argument was a static object literal the feeder could read. */
+  analyzable: boolean;
+  /** The factory function or constructor name at the call site, e.g. `createPayment` / `RateLimiter`. */
+  callee: string;
   /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /** Which override shape matched. */
-  kind: "egress_relaxation" | "enable_internet";
-  /** 1-based line of the call, or `0` when unknown. */
+  /** 1-based line of the call site, or `0` when unknown. */
   line: number;
-  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
-  scope: CallSiteScope;
+  /** Keys present in the config object literal (empty when not `analyzable`). */
+  presentKeys: string[];
+  /** Keys in the config object literal explicitly assigned the literal `true`. */
+  trueKeys: string[];
 }
 /**
- * One `buildImageDeliveryUrl({ key, … })` call (`@lunora/bindings/images`) whose
- * `key` — the CDN transform's source image, an absolute URL or an
- * origin-relative key — is derived from the handler's `args` with no
- * server-side scoping — the `images_url_source_from_user_input` lint input.
- * `ctx.images.transform`/`info` take image *bytes*, never a URL, so they are not
- * sinks; only the `key` of `buildImageDeliveryUrl` accepts a URL-or-key source
- * and is inspected. An arg-derived `key` lets any caller point the CDN's
- * `/cdn-cgi/image/` transform at an attacker-chosen origin (SSRF / open proxy)
- * or at an arbitrary key under the account's own store. A fixed literal, or a
- * key scoped by a server-trusted `ctx.*` value, is not recorded. Structurally
- * identical to `AdvisorImageDeliveryUrlAccess`.
+ * One secret-shaped string literal discovered in `lunora/` source — the
+ * `hardcoded_secret` lint input. Complements the pre-commit `vis secrets` scan by
+ * surfacing the same class of finding in-IDE via the studio Advisors table.
+ * Structurally identical to `AdvisorSecretLiteral`.
  */
-interface ImageDeliveryUrlAccessIR {
+interface SecretLiteralIR {
   /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /** 1-based line of the `buildImageDeliveryUrl` call, or `0` when unknown. */
+  /** Heuristic that matched, e.g. `stripe_live_key` / `aws_access_key` / `pem_private_key` / `high_entropy`. */
+  kind: string;
+  /** 1-based line of the literal, or `0` when unknown. */
   line: number;
-  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
-  scope: CallSiteScope;
+  /** Redacted preview of the literal (first few chars + length) for the finding detail — never the full secret. */
+  preview: string;
 }
 /**
- * One `createAuth({...})` call's configuration snapshot — the shared input for
- * the five `auth_*` security lints (trusted-origins wildcard, CSRF check
- * disabled, secure cookies disabled, email verification disabled, session
- * freshAge zero). Matched by callee NAME (an `import`-agnostic, fail-closed
- * convention the other feeders share), so a re-export or alias still resolves.
- * When the config argument isn't a statically-analyzable object literal (a
- * top-level spread, or not an object literal at all), `analyzable` is `false`
- * and every boolean fact defaults to its SAFE (not-flagged) value — an opaque
- * config can't be relied on either way. Structurally identical to
- * `AdvisorAuthConfig`.
+ * One `ctx.sql.query(text, …)` / `ctx.sql.unsafe(text, …)` call whose `text`
+ * argument is built in place rather than passed as a fixed statement — the
+ * `sql_injection_risk` lint input. The Hyperdrive driver binds ONLY the `params`
+ * array; the `text` string is spliced verbatim into the SQL, so a `text` assembled
+ * from a string concatenation or a substitution template literal is an injection
+ * vector. A fixed string literal / no-substitution template is safe. Structurally
+ * identical to `AdvisorSqlInterpolation`.
  */
-interface AuthConfigIR {
-  /** `true` when the call's config argument was a static object literal the feeder could read. */
-  analyzable: boolean;
-  /** `advanced.disableCSRFCheck === true`. */
-  disableCsrfCheck: boolean;
-  /** `emailAndPassword.enabled === true`. */
-  emailPasswordEnabled: boolean;
+interface SqlInterpolationIR {
   /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /** 1-based line of the `createAuth(...)` call, or `0` when unknown. */
+  /** 1-based line of the interpolation, or `0` when unknown. */
   line: number;
-  /** `emailAndPassword.requireEmailVerification === true` present. */
-  requireEmailVerification: boolean;
-  /** `trustedOrigins` array literal contains a `"*"` element. */
-  /** `plugins` includes `scim(...)` while `database` is a non-transactional Lunora adapter — a combination that throws at runtime. */
-  scimOnNonTransactionalAdapter: boolean;
   /** Who the site runs on behalf of — see {@link CallSiteScope}. */
   scope: CallSiteScope;
-  /** `advanced.useSecureCookies === false`. */
-  secureCookiesDisabled: boolean;
-  /** `session.freshAge === 0` (explicit literal). */
-  sessionFreshAgeZero: boolean;
-  trustedOriginsWildcard: boolean;
 }
 /**
- * One `rateLimit`/`dbRateLimit` middleware call (`@lunora/ratelimit`) whose
- * `key` selector — the per-caller rate-limit sub-key, `(ctx) => string |
- * undefined` — is derived from the handler's `args` with no server-side
- * scoping (no reference to the trusted `ctx` binding anywhere in the selector)
- * — the `ratelimit_key_spoofable_or_global` lint input. A key an attacker
- * controls lets them rotate it per request and bypass the limit entirely,
- * defeating its purpose. A selector scoped by `ctx` (e.g. `ctx.auth.userId`,
- * `ctx.ip`), or one with no `args` reference at all (a fixed/global bucket —
- * the "no key" case this lint deliberately does not flag, to keep it low-FP),
- * is not recorded. Structurally identical to `AdvisorRatelimitKeySelector`.
+ * One `ctx.fetch(url, …)` call inside an action whose URL argument is derived
+ * from the handler's `args` — the `action_fetch_ssrf` lint input. `ctx.fetch` is
+ * the action-only outbound-request escape hatch with no host allowlist, so a URL
+ * assembled from request input is a server-side request forgery vector (cloud
+ * metadata endpoints, internal services). Only arg-derived URLs reach here; a
+ * fixed literal or a URL built from config/`ctx.*` is not recorded. Structurally
+ * identical to `AdvisorArgumentDerivedFetch`.
  */
-interface RatelimitKeySelectorIR {
-  /** The `rateLimit`/`dbRateLimit` callee invoked. */
-  callee: string;
+interface ArgumentDerivedFetchIR {
   /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /** The rate limit's `name` argument (the second positional argument), or `""` when not a string literal. */
-  limitName: string;
-  /** 1-based line of the `rateLimit`/`dbRateLimit` call, or `0` when unknown. */
+  /** 1-based line of the `ctx.fetch` call, or `0` when unknown. */
   line: number;
   /** Who the site runs on behalf of — see {@link CallSiteScope}. */
   scope: CallSiteScope;
 }
 /**
- * One payload-derived privileged dispatch — a `ctx.run`/`context.run` back into a
- * Lunora function from inside a `defineQueue` push handler or a `defineWorkflow`
- * handler, whose args reference the handler's untrusted payload (`context.params`
- * for a workflow, a `for (… of batch.messages)` body for a queue) — the
- * `privileged_dispatch_unvalidated_payload` lint input. Both handler kinds run
- * under the **system identity** (RLS disabled), so forwarding attacker-influenced
- * payload into the dispatch bypasses the target's row policy. The resolved
- * `targetFile`/`targetExport` let the lint join RLS-procedure evidence and fire
- * only for RLS-gated targets. Structurally identical to `AdvisorPrivilegedDispatch`.
+ * One `query` handler whose `return` hands back the raw rows of a table — the
+ * result of a `ctx.db.<table>.findMany()` / `.findFirst()` / `.get()` read, or a
+ * `ctx.db.query("<table>")…collect()` fluent chain — returned directly (or through
+ * one local `const` hop) with no hand-built projection. The
+ * output_projection_missing_on_public_read lint keeps only `visibility ===
+ * "public"` rows with no `.output(...)` / `.use(mask(...))` on the chain, then
+ * joins `table` against the schema and flags one whose columns are PII-named.
+ * Structurally identical to `AdvisorRawRowReturn` so values pass straight through
+ * without conversion.
  */
-interface PrivilegedDispatchIR {
-  /** `"queue"` for a `defineQueue` handler, `"workflow"` for a `defineWorkflow` handler. */
-  dispatchKind: "queue" | "workflow";
+interface RawRowReturnIR {
+  /** Export binding name of the query returning the raw rows. */
+  exportName: string;
   /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /** 1-based line of the dispatch call, or `0` when unknown. */
+  /** 1-based line of the `return` (or concise-body) expression. */
   line: number;
-  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
-  scope: CallSiteScope;
-  /** Export name of the dispatched target (`send` in `api.messages.send`). */
-  targetExport: string;
-  /** File path of the dispatched target relative to `lunora/` (`messages` in `api.messages.send`). */
-  targetFile: string;
+  /** Table whose raw rows are returned, or `""` when the read's table wasn't a string literal. */
+  table: string;
+  /** `true` when the procedure's builder chain carries a `.use(mask(...))` step. */
+  usesMask: boolean;
+  /** `true` when the procedure's builder chain carries an `.output(...)` return-shape projection. */
+  usesOutput: boolean;
+  /** `"internal"` for `internalQuery`; `"public"` for `query`. */
+  visibility: "internal" | "public";
 }
 /**
- * One discovered `httpRoute.<verb>("/admin/…")` route on an admin/privileged-looking
- * path, with whether its builder chain references an auth/admin guard — the
- * `admin_route_without_guard` lint input. Structurally identical to
- * `AdvisorAdminRoute`.
+ * A single cron job lifted from a `cronJobs()` builder in `lunora/crons.ts`.
+ * Mirrors `@lunora/scheduler`'s `CronJob`: {@link CronJobIR.cron} is the compiled
+ * standard cron expression, {@link CronJobIR.functionPath} is the target
+ * `__lunoraRef` (`namespace:fn`), and {@link CronJobIR.args} is the static
+ * argument object passed at registration.
  */
-interface AdminRouteIR {
-  /** Export binding name of the route handler. */
-  exportName: string;
-  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
-  file: string;
-  /** HTTP verb the route binds to (uppercased), e.g. `"POST"`. */
+interface CronJobIR {
+  /** Static args object (source-text JSON), defaults to `{}`. */
+  args: Record<string, unknown>;
+  /** Compiled standard cron expression, e.g. `"0 9 * * *"`. */
+  cron: string;
+  /** Target function ref `namespace:fn`. Present for a function target; absent when {@link CronJobIR.workflow} is set. */
+  functionPath?: string;
+  /** Unique, human-readable job name. */
+  name: string;
+  /**
+   * Set when the job targets a durable workflow (a `lunora/workflows.ts`
+   * export) instead of a function: the workflow's class name (its
+   * `ctx.exports` key) plus its export name. On each fire the worker starts a new workflow
+   * INSTANCE (the {@link CronJobIR.args} become its `params`) rather than
+   * dispatching a one-shot function.
+   */
+  workflow?: {
+    className: string;
+    exportName: string;
+  };
+}
+/** A normalized container image source, as written into `wrangler.jsonc`. */
+type ContainerImageIR = {
+  buildContext: string;
+  dockerfilePath: string;
+  kind: "dockerfile";
+} | {
+  buildDir: string;
+  kind: "build";
+} | {
+  kind: "registry";
+  reference: string;
+};
+/** A `durable_object` container's named image — a Dockerfile or a registry digest, never a Railpack build. */
+type ContainerNamedImageIR = Exclude<ContainerImageIR, {
+  kind: "build";
+}>;
+/** The fields every container carries, whichever scheduling policy it uses. */
+interface ContainerIRBase {
+  /** Durable Object binding name, e.g. `CONTAINER_TRANSCODER`. */
+  bindingName: string;
+  /** Static Dockerfile build args (wrangler `image_vars` / named-image `build_vars`), when declared as literals. */
+  buildArgs?: Record<string, string>;
+  /** Generated DO class name, e.g. `TranscoderContainer`. */
+  className: string;
+  /**
+   * Whether the container may open outbound internet connections, when the
+   * value was a static literal. `undefined` means the field was omitted (the
+   * platform default is `true`) or wasn't a literal. Lifted for the advisor.
+   */
+  enableInternet?: boolean;
+  /** The `lunora/containers.ts` export name, e.g. `transcoder`. */
+  exportName: string;
+  /** Static `instanceType`, when declared (the default size, under `durable_object`). */
+  instanceType?: string | {
+    diskMb?: number;
+    memoryMib?: number;
+    vcpu?: number;
+  };
+  /** Static wrangler `containers[].name` override, when declared. */
+  name?: string;
+  /**
+   * `true` when the definition opts in to the Sandbox SDK helpers
+   * (`defineContainer({ sandbox: true })`). Must be a literal: it decides
+   * whether the generated `containers.ts` exports the sandbox gateways, and
+   * it raises the `containerSandboxTools` platform signal.
+   */
+  sandbox?: boolean;
+  /**
+   * The static `sleepAfter` value, when it was a literal. `undefined` means
+   * omitted (platform default `"10m"`) or non-literal. Lifted for the advisor.
+   */
+  sleepAfter?: number | string;
+}
+/** A container under the default scheduling policy: one application image, a cap, and a rollout. */
+interface DefaultScheduledContainerIR extends ContainerIRBase {
+  /**
+   * Normalized image source: a local Dockerfile (`dockerfile`), a pre-built
+   * registry reference (`registry`), or a Railpack source directory (`build`)
+   * that the deploy step builds and pushes before wrangler runs.
+   */
+  image: ContainerImageIR;
+  /** Static `maxInstances`, when declared. */
+  maxInstances?: number;
+  /** Static rolling-deploy tuning, when declared as literals. */
+  rollout?: {
+    gracePeriodSeconds?: number;
+    stepPercentage?: number;
+  };
+  /** Absent under the default policy — the union's discriminant. */
+  schedulingPolicy?: never;
+}
+/**
+ * A container under the `durable_object` scheduling policy (wrangler
+ * `scheduling_policy`): each instance picks its image and size per start. Also
+ * the `containerRuntimeScheduling` platform signal.
+ */
+interface DurableObjectScheduledContainerIR extends ContainerIRBase {
+  /** The named images an instance can start from (wrangler `containers[].images`). */
+  images?: Record<string, ContainerNamedImageIR>;
+  schedulingPolicy: "durable_object";
+}
+/**
+ * A container lifted from a `defineContainer()` export in
+ * `lunora/containers.ts`, discriminated on its scheduling policy. Carries
+ * everything the emitters and the config layer need to wire wrangler
+ * (`containers[]` + the Durable Object binding + migration class) and the
+ * generated `_generated/containers.ts` DO class. Names are derived via
+ * `@lunora/container`'s shared helpers so codegen and the config layer can
+ * never disagree.
+ */
+type ContainerIR = DefaultScheduledContainerIR | DurableObjectScheduledContainerIR;
+/**
+ * A workflow lifted from a `defineWorkflow()` export in `lunora/workflows.ts`.
+ * Carries what the emitters and the config layer need to wire the wrangler
+ * `workflows[]` entry and the generated `_generated/workflows.ts`
+ * `WorkflowEntrypoint` class. Unlike containers, workflows are NOT Durable
+ * Objects — wrangler gets only a `workflows[]` entry, never a `durable_objects`
+ * binding or a migration class. Names are derived via `@lunora/workflow`'s
+ * shared helpers so codegen and the config layer can never disagree.
+ */
+interface WorkflowIR {
+  /** Generated `WorkflowEntrypoint` class name, e.g. `OrderPipelineWorkflow` — also its `exports` key and `ctx.exports` property. */
+  className: string;
+  /** Static `defaultRetention` literal → `exports.<Class>.default_retention`. */
+  defaultRetention?: {
+    errorRetention?: string;
+    successRetention?: string;
+  };
+  /** The `lunora/workflows.ts` export name, e.g. `orderPipeline`. */
+  exportName: string;
+  /**
+   * The file declaring the `handler:` when it is a function passed by reference
+   * and declared in another file — the file {@link WorkflowIR.steps}' lines are
+   * in. Lunora-relative inside `lunora/`, project-relative outside it.
+   */
+  handlerFile?: string;
+  /** See {@link HandlerSiteIR}. */
+  handlerSite?: HandlerSiteIR;
+  /** Static `limits` literal → `exports.<Class>.limits`. */
+  limits?: {
+    steps?: number;
+  };
+  /**
+   * The stable wrangler `exports.<Class>.name`. Defaults to the kebab-cased export
+   * name (`orderPipeline` → `order-pipeline`); a static `name:` literal in the
+   * definition overrides it.
+   */
+  name: string;
+  /**
+   * Static `schedules` cron literals → `exports.<Class>.schedules`. Each one
+   * starts an instance on Cloudflare; gated by the `workflowSchedules`
+   * capability, since a host that ignores them would never run the workflow.
+   */
+  schedules?: ReadonlyArray<string>;
+  /**
+   * Durable step labels lifted from the handler body — the first string-literal
+   * argument of every `ctx.step.do` / `.sleep` / `.sleepUntil` / `.waitForEvent`
+   * call. Feeds the duplicate-step-name lint, which flags a name used twice
+   * (Cloudflare memoizes by name, so the second call silently returns the
+   * first's cached result). Calls with a non-literal name are omitted (not
+   * statically comparable). A handler passed by reference is followed to its
+   * declaration; the lines are then in {@link WorkflowIR.handlerFile}.
+   */
+  steps: ReadonlyArray<WorkflowStepIR>;
+}
+/**
+ * An agent lifted from a `defineAgent()` export in `lunora/agents.ts`. A
+ * `defineAgent` compiles its durable tool-loop onto a Cloudflare Workflow, so —
+ * like {@link WorkflowIR} — an agent is NOT a Durable Object: wrangler gets only
+ * a `workflows[]` entry, never a `durable_objects` binding or a migration class.
+ * Carries what the emitters and the config layer need to wire the generated
+ * agent `WorkflowEntrypoint` class (e.g. `SupportAgentWorkflow`), the typed
+ * per-agent `ctx.agents` producer, and the reconciled wrangler `workflows[]`
+ * entry. Names are derived via `@lunora/agent`'s shared helpers so codegen and
+ * the config layer can never disagree.
+ */
+interface AgentIR {
+  /** Generated `WorkflowEntrypoint` class name, e.g. `SupportAgentWorkflow` — also its `exports` key and `ctx.exports` property. */
+  className: string;
+  /** The `lunora/agents.ts` export name, e.g. `support`. */
+  exportName: string;
+  /**
+   * The stable wrangler `exports.<Class>.name`. Defaults to the kebab-cased export
+   * name (`support` → `agent-support`); a static `name:` literal in the
+   * definition overrides it.
+   */
+  name: string;
+  /**
+   * Whether the definition declares an `onEmail` mapper on
+   * `defineAgent({ onEmail: … })`. When `true` the emitter wires this agent
+   * onto the worker's top-level `email()` handler (via `@lunora/agent/inbound`)
+   * so inbound mail starts a durable run. Detected by AST PRESENCE — the
+   * closure is never evaluated — and written to IR only when present, so
+   * email-free agents (and agent-free projects) stay byte-identical.
+   */
+  onEmail?: boolean;
+  /**
+   * Whether the definition opted into public run-starts via
+   * `defineAgent({ publicRun: true })` — emitted into the `ctx.agents` wiring
+   * spec so the public `agents:agentRun` mutation can gate on it fail-closed.
+   * Absent (falsy) means server-side starts only; the field is written to IR
+   * only when the literal is `true`, so agent-free and non-opted-in output is
+   * byte-identical.
+   */
+  publicRun?: boolean;
+  /**
+   * Whether the definition opted into a real-time voice session via a `voice`
+   * block on `defineAgent({ voice: … })`. Unlike the durable loop (a Workflow),
+   * the voice path IS a Durable Object — so when this is `true` the emitter
+   * generates the `voiceClassName` `VoiceSessionDO` subclass and the
+   * `api.agents.{name}Voice` client reference, and the config layer reconciles
+   * a `durable_objects` binding (`voiceBindingName`) + `new_sqlite_classes`
+   * migration. Written to IR only when the literal is present, so voice-free
+   * agents (and agent-free projects) stay byte-identical.
+   */
+  voice?: boolean;
+  /** The voice DO's Cloudflare `DurableObjectNamespace` binding name, e.g. `VOICE_SUPPORT`. Present only when `voice`. */
+  voiceBindingName?: string;
+  /** Generated `VoiceSessionDO` subclass name, e.g. `SupportVoiceDO`. Present only when `voice`. */
+  voiceClassName?: string;
+}
+/** One durable step call lifted from a workflow handler body (the use side of {@link WorkflowIR.steps}). */
+interface WorkflowStepIR {
+  /** 1-based line of the durable step call. */
+  line: number;
+  /** The native step method invoked: `do` / `sleep` / `sleepUntil` / `waitForEvent`. */
   method: string;
-  /** The route path, e.g. `/admin/users`. */
-  path: string;
-  /** `true` when the handler body references an auth/session/admin guard (`ctx.auth`, `getSession`, `requireAdmin`, …). */
-  usesGuard: boolean;
+  /** The step's static label (the first string-literal argument). */
+  name: string;
+}
+/**
+ * A queue lifted from a `defineQueue()` export in `lunora/queues.ts`. Carries
+ * what the emitters and the config layer need to wire the typed `ctx.queues`
+ * producer, the generated worker `queue()` dispatch, and the wrangler
+ * `queues.producers[]` / `queues.consumers[]` entries. Like workflows, a queue
+ * is NOT a Durable Object — wrangler gets only `queues.*` entries. Names are
+ * derived via `@lunora/queue`'s shared helpers so codegen and the config layer
+ * can never disagree.
+ */
+interface QueueIR {
+  /** The Cloudflare `Queue` producer binding name, e.g. `QUEUE_EMAIL`. */
+  bindingName: string;
+  /** The `lunora/queues.ts` export name, e.g. `emailQueue`. */
+  exportName: string;
+  /** The declaring file, lunora-relative without `.ts`: `queues`, or `billing/queues` for a module's own. */
+  filePath: string;
+  /** See {@link HandlerSiteIR}. */
+  handlerSite?: HandlerSiteIR;
+  /** How the queue is consumed: `"push"` (a worker `queue()` handler) or `"pull"` (external HTTP). */
+  mode: "pull" | "push";
+  /**
+   * The stable wrangler queue name (`queues.producers[].queue`). Defaults to
+   * the kebab-cased export name (`emailQueue` → `email-queue`); a static
+   * `name:` literal in the definition overrides it.
+   */
+  name: string;
+  /**
+   * Set for a `defineSubscription(topic, …)` export: the `defineTopic` export it
+   * consumes. A subscription is an ordinary push queue everywhere except
+   * `ctx.*` — it is published to through `ctx.topics.<topic>`, never `ctx.queues`.
+   */
+  topic?: string;
+  /** Push-consumer batch/retry tuning, mirrored onto the wrangler `queues.consumers[]` entry. */
+  tuning: {
+    deadLetterQueue?: string;
+    maxBatchSize?: number;
+    maxBatchTimeout?: number;
+    maxConcurrency?: number;
+    maxRetries?: number;
+    retryDelay?: number;
+  };
 }
 /**
- * One tracked `ctx.storage.<bucket>.<method>(...)` upload/signing call — the
- * shared input for the storage config-hygiene security lints
- * (`storage_upload_without_content_type_allowlist`, `storage_upload_without_max_size`,
- * `storage_generate_upload_url_no_content_type_pin`, `storage_presigned_url_for_private_content`).
- * `upload`/`store` carry the `UploadOptions` guards (`allowedContentTypes` /
- * `maxSize`); `generateUploadUrl` carries the signed-PUT `contentType` pin;
- * `getPresignedUrl`/`getSignedUrl` carry a statically-known `expiresInSeconds`
- * literal. `presentKeys` is empty (and `expiresInSeconds` unset) when the
- * options argument was absent, a non-literal, or a spread — see `analyzable`.
- * Structurally identical to `AdvisorStorageUpload`.
+ * A `defineTopic()` export in `lunora/queues.ts`. A topic deploys nothing of its
+ * own: each subscription is a {@link QueueIR} whose `topic` names this export, and
+ * that is the only record of the link (see {@link subscriptionsOf}).
  */
-interface StorageUploadIR {
-  /** `true` when the call's options-object argument (or its deliberate absence) was statically resolvable. */
-  analyzable: boolean;
-  /** Numeric literal value of an `expiresInSeconds` option, when statically known (`getSignedUrl` / `getPresignedUrl` only). */
-  expiresInSeconds?: number;
-  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
-  file: string;
-  /** 1-based line of the call, or `0` when unknown. */
-  line: number;
-  /** The `ctx.storage` method invoked. */
-  method: "generateUploadUrl" | "getPresignedUrl" | "getSignedUrl" | "store" | "upload";
-  /** Options-object keys present at the call site (empty when not `analyzable`, or when no options argument was passed). */
-  presentKeys: string[];
-  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
-  scope: CallSiteScope;
+interface TopicIR {
+  /** The `lunora/queues.ts` export name, e.g. `signups`. */
+  exportName: string;
+  /** The declaring file, as {@link QueueIR.filePath}. */
+  filePath: string;
 }
 /**
- * One discovered `httpAction`/`httpRoute` handler in `lunora/` that performs a
- * side effect (`ctx.runMutation` / `ctx.runAction` / a `ctx.db.{insert,patch,
- * replace,delete,insertManyUnsafe}` write) from the HTTP edge, with whether it
- * reads `ctx.auth` — the `http_action_missing_auth_guard` lint input. A handler
- * that mutates state or dispatches an action without ever consulting the request
- * identity is an unauthenticated write bypassing identity/RLS. Only handlers with
- * a statically-resolvable inline body and `ctx` binding are recorded (fail-safe
- * under-report); read-only handlers are never recorded. Structurally identical to
- * `AdvisorHttpActionGuard`.
+ * A module: a folder under `lunora/` whose `module.ts` default-exports
+ * `defineModule(...)`. Metadata for the Studio catalog, the architecture
+ * manifest and the `cross_module_table_write` lint — it changes no `api.*` path.
  */
-interface HttpActionGuardIR {
-  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
-  file: string;
-  /** Which HTTP surface the handler is: a raw `httpAction` or a typed `httpRoute` route. */
-  kind: "httpAction" | "httpRoute";
-  /** 1-based line of the handler call, or `0` when unknown. */
-  line: number;
-  /** For an `httpRoute`, the uppercased verb (`"POST"`); absent for a raw `httpAction`. */
-  method?: string;
-  /** `true` when the handler reads `ctx.auth` (a direct member access or a `const { auth } = ctx` destructure). */
-  readsAuth: boolean;
-  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
-  scope: CallSiteScope;
-  /** The first side effect found, as a stable label: `runMutation`, `runAction`, or `db.<method>`. */
-  sideEffect: string;
+interface ModuleIR {
+  /** One-line description from `defineModule({ description })`. */
+  description?: string;
+  /**
+   * `true` for an installed component (a `defineSchemaExtension` key merged with
+   * `.extend(...)`) treated as a module: it owns its prefixed tables and the
+   * `lunora/<key>/` folder its copy-in code lives in. Absent for a declared module.
+   */
+  installed?: true;
+  /** The folder path relative to `lunora/`, e.g. `billing` — also the module's name. */
+  name: string;
+  /**
+   * `false` for an installed component shipped as a package: its code is in
+   * `node_modules`, so it owns its tables but no `lunora/<key>/` folder (an app
+   * folder of that name stays the app's). Absent means the module owns its folder.
+   */
+  ownsFolder?: false;
+  /** Tables the module declares it owns (`defineModule({ tables })`); empty when it declares none. */
+  tables: ReadonlyArray<string>;
 }
 /**
- * One response-header write, inside an `httpAction` handler, whose value is derived
- * from raw request input (`request.headers`, `request.url`/query, `await
- * request.json()`) with no CR/LF sanitizer — the
- * `http_action_response_header_injection` lint input. A `Request`-derived string
- * placed verbatim into a response header lets a caller smuggle `\r\n` and inject
- * extra headers or split the response (header injection / response splitting). Only
- * sites whose value is request-tainted AND unguarded are recorded: a value routed
- * through a CR/LF guard (`isSafeHeaderValue`), a URL/URI encoder
- * (`encodeURIComponent`/`encodeURI`), a numeric coercion (`Number`/`parseInt`/
- * `parseFloat`), or `btoa` is treated as safe and never recorded (`String(...)` /
- * `.toString()` are NOT sanitizers — they don't strip CR/LF). Structurally
- * identical to `AdvisorHttpHeaderWrite`.
+ * A sibling Worker the app calls through a Cloudflare service binding, declared in
+ * `lunora.config.*` `services` (plan 457). Becomes a wrangler `services[]` entry,
+ * a typed `ctx.services.<name>` on actions, and a `service` node in the
+ * architecture manifest.
  */
-interface HttpHeaderWriteIR {
-  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
-  file: string;
-  /** The header name being written (`"location"`), or `""` when the key is not a string literal. */
-  headerName: string;
-  /** 1-based line of the request-tainted header value. */
-  line: number;
-  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
-  scope: CallSiteScope;
-  /** How the header was written. */
-  via: "headers-append" | "headers-ctor" | "headers-set" | "response-init";
+interface ServiceBindingIR {
+  /** The `services[].binding` Lunora writes, e.g. `SERVICE_DOCUMENT_PARSER`. */
+  binding: string;
+  /** The exported `WorkerEntrypoint` class the binding targets; absent for the Worker's default export. */
+  entrypoint?: string;
+  /**
+   * The Worker name per `env.<name>` block the service's own wrangler config
+   * sets a `name` in. An environment missing here deploys as wrangler's
+   * default `<worker>-<env>`.
+   */
+  envWorkers: Readonly<Record<string, string>>;
+  /** Absolute path of the service's entry module (its wrangler `main`) — what the RPC type is read from. */
+  main: string;
+  /** The `ctx.services.<name>` key, e.g. `documentParser`. */
+  name: string;
+  /**
+   * The scopes in which the service still serves on `*.workers.dev` with no
+   * route of its own: `""` for the top level, else the environment name.
+   */
+  publicScopes: ReadonlyArray<string>;
+  /**
+   * The `WorkerEntrypoint` class the service is typed — and wired — as an RPC
+   * stub of. Equal to {@link ServiceBindingIR.entrypoint} for an RPC service;
+   * absent for a fetch service, including a named entrypoint declared
+   * `rpc: false`, which is called with plain `fetch` and so needs no import of
+   * the service's sources.
+   */
+  rpcEntrypoint?: string;
+  /** The Worker's own `name` from its wrangler config — the `services[].service` target. */
+  worker: string;
+  /** Absolute path of the service's wrangler config. */
+  wranglerPath: string;
 }
 /**
- * One rate-limit / Turnstile middleware call in `lunora/` — the
- * `ratelimit_middleware_fail_open` lint input. `rateLimit`/`dbRateLimit`
- * (`@lunora/ratelimit`) and `verifyTurnstileMiddleware` (`@lunora/auth`) each
- * accept a `failOpen` escape hatch that admits every request when the
- * limiter/siteverify is unavailable; `failOpen` is `true` only when the options
- * literal set it to the boolean literal `true` (anything else is fail-closed).
- * The lint escalates a fail-open guard to a finding when the guarded procedure
- * (`exportName`/`limitName`) looks auth/payment-sensitive. Structurally
- * identical to `AdvisorFailOpenGuard`.
+ * The feature-flag provider declared by the default export of `lunora/flags.ts`
+ * (`defineFlags({ provider, … })`). Discovery is **metadata-only** — codegen
+ * imports the real module at runtime for the provider value; this IR exists so
+ * the config layer can reconcile/validate the wrangler `flagship` binding when
+ * the app uses Flagship in binding mode. A `custom` provider (any other
+ * OpenFeature factory) carries no binding to reconcile.
  */
-interface FailOpenGuardIR {
-  /** The middleware factory at the call site: `rateLimit` / `dbRateLimit` / `verifyTurnstileMiddleware`. */
-  callee: string;
-  /** `true` only when the options literal set `failOpen: true` as a boolean literal; a non-literal or absent option is treated as fail-closed. */
-  failOpen: boolean;
-  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
-  file: string;
-  /** The rate-limit `name` (second string argument) for `rateLimit`/`dbRateLimit`; `""` for `verifyTurnstileMiddleware`. */
-  limitName: string;
-  /** 1-based line of the middleware call, or `0` when unknown. */
-  line: number;
-  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
-  scope: CallSiteScope;
+interface FlagsIR {
+  /**
+   * The wrangler `flagship[].binding` name — set **only** for a flagship
+   * `provider` in binding mode (`flagshipProvider({ binding: "FLAGS" })`). The
+   * config layer hints/validates a matching `flagship` binding from this.
+   */
+  bindingName?: string;
+  /**
+   * Flagship operating mode — `"binding"` (wrangler binding, needs a
+   * `flagship` entry) or `"http"` (no binding); `undefined` for a `custom`
+   * provider or when the mode can't be read statically.
+   */
+  mode?: "binding" | "http";
+  /** `"flagship"` when the provider is `flagshipProvider(...)`, else `"custom"` (any other OpenFeature provider factory). */
+  provider: "custom" | "flagship";
 }
 /**
- * One `ctx.flags.boolean("key", <boolean-literal>)` read in `lunora/` — the
- * `flag_gates_security_with_unsafe_default` lint input. OpenFeature returns the
- * `defaultValue` when the provider errors, so a fail-open default on a
- * security-shaped key silently opens access during an outage. Only reads with a
- * statically-known string key and boolean-literal default are recorded; the lint
- * owns the security-shape + polarity judgment. Structurally identical to
- * `AdvisorFlagSecurityDefault`.
+ * One `ctx.containers.<exportName>.get(name, …)` call whose instance key is derived
+ * from the handler's `args` with no server-side scoping — the
+ * `container_instance_key_from_user_input` lint input. Each container definition's
+ * `.get(name)` accessor routes to one instance per `name`, so a key taken straight from
+ * request input lets any caller reach another tenant's container (a cross-tenant IDOR). A
+ * fixed literal key, or one derived from a server-trusted identity (`${ctx.auth.userId}` —
+ * references `ctx`, so treated as scoped), is not recorded; only an arg-derived, unscoped
+ * key reaches here. `.any()`/`.pool()` take no key and are not sinks. Structurally
+ * identical to `AdvisorContainerKeyAccess`.
  */
-interface FlagSecurityDefaultIR {
-  /** The boolean-literal default returned on a provider outage (fail-open value). */
-  defaultValue: boolean;
+interface ContainerKeyAccessIR {
   /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /** The flag key — the first string-literal argument of `ctx.flags.boolean`. */
-  key: string;
-  /** 1-based line of the `ctx.flags.boolean` call, or `0` when unknown. */
+  /** 1-based line of the `ctx.containers.*.get` call, or `0` when unknown. */
   line: number;
+  /** The container accessor method invoked — always `get`. */
+  method: string;
   /** Who the site runs on behalf of — see {@link CallSiteScope}. */
   scope: CallSiteScope;
 }
 /**
- * One `ctx.flags` read lexically inside a `query(...)` handler — the
- * `flag_read_in_subscription` advisor lint input. Flag changes append nothing to
- * `__cdc_log`, so a subscribed query is never re-run when a flag flips and keeps
- * serving the branch it last picked; `useFlag` is the reactive path. Structurally
- * identical to the advisor's `AdvisorFlagRead` (same field set) so values pass
- * straight through `lintSchema` without conversion, exactly as `ContextPropertyCallIR` does.
- *
- * Only `query` handlers are recorded — unlike `ContextPropertyCallIR` / `NondeterministicCallIR`
- * there is no `kind` field, because `mutation`/`action` handlers run once and have
- * no subscription staleness to warn about, so the feeder drops them rather than
- * handing the lint rows it would discard.
- */
-interface FlagReadIR {
-  /** The accessed `ctx.flags` surface, e.g. `ctx.flags.boolean` / `ctx.flags.details.string`. */
-  callee: string;
-  /** Export binding name of the query performing the read. */
-  exportName: string;
-  /** Source file relative to `<projectRoot>/lunora/`, without extension (the api namespace). */
-  file: string;
-  /** 1-based line of the read, or `0` when unknown. */
-  line: number;
-}
-/**
- * One `generateText` / `streamText` call in `lunora/` whose `tools` reach a
- * privileged side effect (a DB write, function dispatch, or outbound
- * fetch/mail/queue send). `userInputDerived` records whether the model input
- * (`prompt`/`messages`/`system`) flows from the handler's `args`; the
- * `ai_tool_side_effect_prompt_injection` lint fires only when it does.
- * Structurally identical to `AdvisorAiToolSideEffect`.
+ * One runtime container-override call: a `<handle>.start({ enableInternet: true, … })`
+ * launch override, or a `<handle>.egress.<method>(...)` runtime firewall mutation
+ * (`allow` / `deny` / `setAllowed`) — the `container_start_enable_internet_override`
+ * and `container_runtime_egress_relaxation` lint input. Both shapes re-open network
+ * access the static `defineContainer` declaration (and its `container_public_internet`
+ * lint) assumes is locked down. Matched structurally by call shape, independent of the
+ * receiver's resolved type. Structurally identical to `AdvisorContainerOverride`.
  */
-interface AiToolSideEffectIR {
+interface ContainerOverrideIR {
+  /** e.g. the egress method name, or `"enableInternet: true"`. */
+  detail: string;
   /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /** 1-based line of the generation call, or `0` when unknown. */
-  line: number;
-  /** The generation entrypoint invoked. */
-  method: "generateText" | "streamText";
+  /** Which override shape matched. */
+  kind: "egress_relaxation" | "enable_internet";
+  /** 1-based line of the call, or `0` when unknown. */
+  line: number;
   /** Who the site runs on behalf of — see {@link CallSiteScope}. */
   scope: CallSiteScope;
-  /** The privileged side-effect sink a model-callable tool reaches (`ctx.db.insert`, `ctx.run`, `ctx.fetch`, …). */
-  sideEffect: string;
-  /** `true` when a model-input option is derived from the handler's `args` (a bare `args.x`, or a name destructured from `args`). */
-  userInputDerived: boolean;
 }
 /**
- * One `<receiver>.identity.<key>` claim read in `lunora/`, where `<receiver>` is
- * an RLS/mask policy `auth` (or `ctx.auth`/`context.auth`). `declared` records
- * whether `<key>` is in the app's `defineIdentity({ ... })` contract (or the
- * always-present `userId`); the `identity_undeclared_claim_trusted` lint fires on
- * the undeclared reads. Emitted only when a resolvable identity contract exists.
- * Structurally identical to `AdvisorIdentityClaimRead`.
+ * One `buildImageDeliveryUrl({ key, … })` call (`@lunora/bindings/images`) whose
+ * `key` — the CDN transform's source image, an absolute URL or an
+ * origin-relative key — is derived from the handler's `args` with no
+ * server-side scoping — the `images_url_source_from_user_input` lint input.
+ * `ctx.images.transform`/`info` take image *bytes*, never a URL, so they are not
+ * sinks; only the `key` of `buildImageDeliveryUrl` accepts a URL-or-key source
+ * and is inspected. An arg-derived `key` lets any caller point the CDN's
+ * `/cdn-cgi/image/` transform at an attacker-chosen origin (SSRF / open proxy)
+ * or at an arbitrary key under the account's own store. A fixed literal, or a
+ * key scoped by a server-trusted `ctx.*` value, is not recorded. Structurally
+ * identical to `AdvisorImageDeliveryUrlAccess`.
  */
-interface IdentityClaimReadIR {
-  /** `true` when `key` is a declared claim (in the `defineIdentity` contract, or the always-present `userId`). */
-  declared: boolean;
+interface ImageDeliveryUrlAccessIR {
   /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /** The claim key read off the identity bag. */
-  key: string;
-  /** 1-based line of the read, or `0` when unknown. */
+  /** 1-based line of the `buildImageDeliveryUrl` call, or `0` when unknown. */
   line: number;
   /** Who the site runs on behalf of — see {@link CallSiteScope}. */
   scope: CallSiteScope;
 }
 /**
- * One payment webhook-adapter construction in `lunora/` (`createStripeAdapter` /
- * `createPolarAdapter` / `createAutumnAdapter` / `createDodoPaymentsAdapter`).
- * `toleranceSeconds` carries the statically-known `webhookToleranceSeconds`
- * replay window when it is a plain numeric literal; the payment-webhook
- * wide-tolerance lint fires when it exceeds a conservative ceiling. Structurally
- * identical to `AdvisorPaymentWebhook`.
+ * One `createAuth({...})` call's configuration snapshot — the shared input for
+ * the five `auth_*` security lints (trusted-origins wildcard, CSRF check
+ * disabled, secure cookies disabled, email verification disabled, session
+ * freshAge zero). Matched by callee NAME (an `import`-agnostic, fail-closed
+ * convention the other feeders share), so a re-export or alias still resolves.
+ * When the config argument isn't a statically-analyzable object literal (a
+ * top-level spread, or not an object literal at all), `analyzable` is `false`
+ * and every boolean fact defaults to its SAFE (not-flagged) value — an opaque
+ * config can't be relied on either way. Structurally identical to
+ * `AdvisorAuthConfig`.
  */
-interface PaymentWebhookIR {
-  /** The adapter factory invoked. */
-  callee: "createAutumnAdapter" | "createDodoPaymentsAdapter" | "createPolarAdapter" | "createStripeAdapter";
+interface AuthConfigIR {
+  /** `true` when the call's config argument was a static object literal the feeder could read. */
+  analyzable: boolean;
+  /** `advanced.disableCSRFCheck === true`. */
+  disableCsrfCheck: boolean;
+  /** `emailAndPassword.enabled === true`. */
+  emailPasswordEnabled: boolean;
   /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /** 1-based line of the construction, or `0` when unknown. */
+  /** 1-based line of the `createAuth(...)` call, or `0` when unknown. */
   line: number;
+  /** `emailAndPassword.requireEmailVerification === true` present. */
+  requireEmailVerification: boolean;
+  /** `trustedOrigins` array literal contains a `"*"` element. */
+  /** `plugins` includes `scim(...)` while `database` is a non-transactional Lunora adapter — a combination that throws at runtime. */
+  scimOnNonTransactionalAdapter: boolean;
   /** Who the site runs on behalf of — see {@link CallSiteScope}. */
   scope: CallSiteScope;
-  /** Statically-known `webhookToleranceSeconds` literal, when present and a plain numeric literal. */
-  toleranceSeconds?: number;
+  /** `advanced.useSecureCookies === false`. */
+  secureCookiesDisabled: boolean;
+  /** `session.freshAge === 0` (explicit literal). */
+  sessionFreshAgeZero: boolean;
+  trustedOriginsWildcard: boolean;
 }
 /**
- * One `ctx.db.<table>.findMany({ includeDeleted })` list read whose
- * `includeDeleted` is either a hardcoded `true` or derived from the handler's
- * `args` — the `soft_delete_include_deleted_from_args` lint input. The lint joins
- * `table` against the schema's soft-delete tables and `visibility` against
- * `.public()` before flagging. Structurally identical to `AdvisorSoftDeleteRead`
- * so values pass straight through without conversion.
+ * One discovered `httpRoute.<verb>("/admin/…")` route on an admin/privileged-looking
+ * path, with whether its builder chain references an auth/admin guard — the
+ * `admin_route_without_guard` lint input. Structurally identical to
+ * `AdvisorAdminRoute`.
  */
-interface SoftDeleteReadIR {
-  /** Export binding name of the procedure performing the read. */
+interface AdminRouteIR {
+  /** Export binding name of the route handler. */
   exportName: string;
   /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /** `true` when `includeDeleted` was derived from the handler's `args` (any caller can flip it). */
-  fromArgs: boolean;
-  /** `true` when `includeDeleted` was a hardcoded `true` literal (always resurfaces soft-deleted rows). */
-  hardcodedTrue: boolean;
-  /** 1-based line of the read call. */
-  line: number;
-  /** Table read, or `""` when the table-arg form's first argument wasn't a string literal. */
-  table: string;
-  /** `"internal"` for `internalQuery` / `internalMutation` / `internalAction`. */
-  visibility: "internal" | "public";
+  /** HTTP verb the route binds to (uppercased), e.g. `"POST"`. */
+  method: string;
+  /** The route path, e.g. `/admin/users`. */
+  path: string;
+  /** `true` when the handler body references an auth/session/admin guard (`ctx.auth`, `getSession`, `requireAdmin`, …). */
+  usesGuard: boolean;
 }
 /**
- * One `ctx.db.<table>.findMany({ with: { <rel> } })` relation-hydrating list read
- * — the `masked_relation_leak_via_with` lint input. Column masking does not
- * descend into `with`-hydrated relations, so a masked table surfaced only through
- * a `with` on an unprotected parent read is returned in the clear. The lint
- * resolves each relation accessor to its target table and joins it against the
- * discovered mask evidence before flagging. Structurally identical to
- * `AdvisorRelationLoad` so values pass straight through without conversion.
+ * One committed `wrangler.jsonc` `vars` entry whose value is a plaintext secret —
+ * the `plaintext_secret_in_wrangler_vars` lint input. `vars` are baked into the
+ * deployed Worker in cleartext and checked into source control, so a real API key
+ * / token / private key there ships the secret to every reader of the repo and the
+ * bundle; it belongs in a Secrets Store binding or `wrangler secret put`. Produced
+ * by `@lunora/config` (which reads `wrangler.jsonc`), not a ts-morph feeder —
+ * codegen only passes it through. Structurally identical to `AdvisorWranglerVariable`.
  */
-interface RelationLoadIR {
-  /** Export binding name of the procedure performing the read. */
+interface WranglerVariableIR {
+  /** The `wrangler.jsonc` file the var was read from, relative to the project root. */
+  file: string;
+  /** The offending `vars` key (e.g. `STRIPE_SECRET_KEY`). */
+  key: string;
+  /** Heuristic that matched, e.g. `stripe_live_key` / `private_key` / `secret_named_var`. */
+  kind: string;
+  /** Redacted preview of the value (first few chars + length) for the finding detail — never the full secret. */
+  preview: string;
+}
+/**
+ * One `queues.producers[]` entry of `wrangler.jsonc`, from the top level or an
+ * `env.<name>` block — how codegen learns a queue's per-environment name. Produced
+ * by `@lunora/config` (which reads `wrangler.jsonc`); codegen only matches it to a
+ * declared queue by `binding`.
+ */
+interface WranglerQueueProducerIR {
+  /** The `Queue` producer binding, e.g. `QUEUE_JOBS`. */
+  binding: string;
+  /** The `env.<name>` block the entry sits in; absent for the top level. */
+  env?: string;
+  /** The queue name that binding sends to in that scope, e.g. `jobs-preview`. */
+  queue: string;
+}
+interface ProjectIR {
+  crons: ReadonlyArray<CronJobIR>;
+  functions: ReadonlyArray<FunctionIR>;
+  /** Typed REST routes discovered from `httpRoute.<verb>(...)` builder chains. */
+  httpRoutes: ReadonlyArray<HttpRouteIR>;
+  migrations: ReadonlyArray<MigrationIR>;
+  schema: SchemaIR;
+}
+/**
+ * Per-procedure RLS usage snapshot, produced by `discoverRlsProcedures` for the
+ * `rls_uncovered_table` advisor lint. Structurally identical to
+ * `AdvisorRlsProcedure` (they share the same field set) so values pass straight
+ * through to the advisor without conversion, exactly as `AuthApiCallIR` does for
+ * `AdvisorAuthApiCall`.
+ */
+interface RlsProcedureIR {
+  /** Export binding name of the procedure (e.g. `listDocuments`). */
   exportName: string;
   /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /** 1-based line of the read call. */
-  line: number;
-  /** Parent table the read targets, or `""` when the table-arg form's first argument wasn't a string literal. */
-  parentTable: string;
-  /** Relation accessor names named in the read's `with: { … }` map — matched against the parent table's declared relations. */
-  relations: string[];
+  /**
+   * Table names extracted from the `rls(policies)` array literal. Empty when the
+   * policies argument is not a statically-readable array literal.
+   */
+  rlsTables: string[];
+  /** Tables read by the procedure via `ctx.db.query/findMany/findFirst/…`. */
+  tablesRead: string[];
+  /** Tables written by the procedure via `ctx.db.insert/patch/replace/delete`. */
+  tablesWritten: string[];
+  /** `true` when the procedure's builder chain includes `.use(rls(...))`. */
+  usesRls: boolean;
   /** `"internal"` for `internalQuery` / `internalMutation` / `internalAction`. */
   visibility: "internal" | "public";
 }
 /**
- * One `query` handler whose `return` hands back the raw rows of a table — the
- * result of a `ctx.db.<table>.findMany()` / `.findFirst()` / `.get()` read, or a
- * `ctx.db.query("<table>")…collect()` fluent chain — returned directly (or through
- * one local `const` hop) with no hand-built projection. The
- * `output_projection_missing_on_public_read` lint keeps only `visibility ===
- * "public"` rows with no `.output(...)` / `.use(mask(...))` on the chain, then
- * joins `table` against the schema and flags one whose columns are PII-named.
- * Structurally identical to `AdvisorRawRowReturn` so values pass straight through
- * without conversion.
+ * One procedure reduced to the facts the `mask_uncovered_pii_column` lint needs:
+ * whether its builder chain includes `.use(mask(...))`, which `(table, column)`
+ * pairs that mask declares, and which tables the procedure reads/writes. The
+ * column-level analogue of {@link RlsProcedureIR}. Structurally identical to
+ * `AdvisorMaskProcedure` so values pass straight through without conversion.
  */
-interface RawRowReturnIR {
-  /** Export binding name of the query returning the raw rows. */
+interface MaskProcedureIR {
+  /** Export binding name of the procedure (e.g. `listUsers`). */
   exportName: string;
   /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /** 1-based line of the `return` (or concise-body) expression. */
-  line: number;
-  /** Table whose raw rows are returned, or `""` when the read's table wasn't a string literal. */
-  table: string;
-  /** `true` when the procedure's builder chain carries a `.use(mask(...))` step. */
+  /**
+   * `(table, column)` pairs this procedure's `mask(policies)` object literal
+   * declares. Empty when the policies argument is not a statically-readable
+   * object literal (conservative: `usesMask` is still `true`).
+   */
+  maskColumns: {
+    column: string;
+    table: string;
+  }[];
+  /** Tables read by the procedure via `ctx.db.query/findMany/findFirst/get`. */
+  tablesRead: string[];
+  /** Tables written by the procedure via `ctx.db.insert/patch/replace/delete`. */
+  tablesWritten: string[];
+  /** `true` when the procedure's builder chain includes `.use(mask(...))`. */
   usesMask: boolean;
-  /** `true` when the procedure's builder chain carries an `.output(...)` return-shape projection. */
-  usesOutput: boolean;
-  /** `"internal"` for `internalQuery`; `"public"` for `query`. */
+  /** `"internal"` for `internalQuery` / `internalMutation` / `internalAction`. */
   visibility: "internal" | "public";
 }
 /**
- * One `query`/`mutation` handler that gates a `ctx.db.get`/`patch`/`delete` on a
- * null-checked `ctx.db.normalizeId(table, id)` result — the
- * `normalize_id_used_as_authorization` lint input. `normalizeId` validates an id's
- * structural shape only (it never reads the database), so a non-null result proves
- * the id is well-formed, never that the caller owns the row; gating access on it is
- * an IDOR. The lint owns the negative proof — it keeps only `visibility === "public"`
- * rows with no `.use(rls(...))` and no ownership/identity mention (`mentionsOwnership`),
- * then joins `table` against the schema's RLS mode before flagging. Structurally
- * identical to `AdvisorNormalizeIdAuthorization` so values pass straight through.
+ * One masked column surfaced to the studio's data-browser mask preview: a
+ * `(table, column)` pair plus the declared {@link MaskProcedureIR} strategy so
+ * the preview can pick redact-vs-hash-vs-custom rendering. Aggregated across the
+ * project's `.use(mask(...))` chains by `discoverMaskMetadata`; the descriptive
+ * twin of {@link RlsPolicyIR}. `"custom"` covers any non-string strategy (a
+ * `(value, ctx) => …` function) — its logic is an opaque closure, never read by
+ * the UI; the preview renders a fixed sentinel for it.
+ */
+interface MaskColumnMetadataIR {
+  /** Column the mask policy redacts. */
+  column: string;
+  /** Declared masking strategy: `"redact"`/`"hash"` string literals, else `"custom"` for a `MaskFn`. */
+  strategy: "custom" | "hash" | "redact";
+  /** Logical table the masked column belongs to. */
+  table: string;
+}
+/**
+ * Schema-wide masking metadata the codegen emits into the generated ShardDO so
+ * the studio's data-browser mask toggle can preview what a non-privileged caller
+ * would see. Aggregated across every `.use(mask(...))` chain in the project —
+ * purely descriptive (table + column + strategy), never the masking closure. The
+ * column-level analogue of {@link RlsMetadataIR}.
+ */
+interface MaskMetadataIR {
+  /** Every statically-discovered masked column, deduped by `(table, column)` (first declaration wins). */
+  columns: MaskColumnMetadataIR[];
+}
+/**
+ * One masked column whose `mask(policies)` strategy is a statically-known
+ * literal (`"hash"` or `"redact"`) — the `mask_weak_hash_strategy_on_pii` lint
+ * input. Unlike {@link MaskColumnMetadataIR} (app-wide, deduped by `(table,
+ * column)`, studio-preview evidence), this is per declaration site (file + line
+ * + enclosing export), undeduped, so the lint can point at the exact
+ * `mask(...)` call that applies a weak strategy. A `MaskFn` (custom, non-literal)
+ * strategy carries no lint-relevant signal and is never recorded here.
+ * Structurally identical to `AdvisorMaskStrategy`.
  */
-interface NormalizeIdAuthorizationIR {
-  /** Export binding name of the procedure performing the normalize-then-access. */
+interface MaskStrategyIR {
+  /** Masked column name. */
+  column: string;
+  /** Export binding name of the procedure whose `.use(mask(...))` chain declared this column, or `"<module>"` when declared at file scope. */
   exportName: string;
   /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /** 1-based line of the `ctx.db.normalizeId(...)` call the access is gated on. */
+  /** 1-based line of the masked column's strategy property. */
   line: number;
-  /** `true` when the handler anywhere reads an ownership-named identifier or `ctx.auth`/`ctx.identity`/… — an intervening ownership signal. */
-  mentionsOwnership: boolean;
-  /** The id-first `ctx.db` sink the normalized id reaches. */
-  sinkMethod: "delete" | "get" | "patch";
-  /** Table named in the `normalizeId` call, or `""` when its table argument wasn't a string literal. */
+  /** The statically-known strategy literal: `"hash"` or `"redact"`. */
+  strategy: string;
+  /** Logical table the masked column belongs to. */
   table: string;
-  /** `true` when the procedure's builder chain carries a `.use(rls(...))` step. */
-  usesRls: boolean;
-  /** `"internal"` for `internalQuery`/`internalMutation`; `"public"` for `query`/`mutation`. */
-  visibility: "internal" | "public";
 }
 /**
- * One committed `wrangler.jsonc` `vars` entry whose value is a plaintext secret —
- * the `plaintext_secret_in_wrangler_vars` lint input. `vars` are baked into the
- * deployed Worker in cleartext and checked into source control, so a real API key
- * / token / private key there ships the secret to every reader of the repo and the
- * bundle; it belongs in a Secrets Store binding or `wrangler secret put`. Produced
- * by `@lunora/config` (which reads `wrangler.jsonc`), not a ts-morph feeder —
- * codegen only passes it through. Structurally identical to `AdvisorWranglerVariable`.
+ * One statically-readable policy entry from an `rls([...])` array literal,
+ * surfaced to the studio's read-only RLS inspector via the generated
+ * `rlsPolicies()` hook. Captures the policy's `table` + `on` operation and the
+ * procedure it guards — never the `when` predicate, which is an opaque JS
+ * closure (its logic stays in code, not the UI). Produced by
+ * `discoverRlsProcedures` alongside the lint IR.
  */
-interface WranglerVariableIR {
-  /** The `wrangler.jsonc` file the var was read from, relative to the project root. */
+interface RlsPolicyIR {
+  /** Source file (relative to `lunora/`, without extension) the policy is declared in. */
   file: string;
-  /** The offending `vars` key (e.g. `STRIPE_SECRET_KEY`). */
-  key: string;
-  /** Heuristic that matched, e.g. `stripe_live_key` / `private_key` / `secret_named_var`. */
-  kind: string;
-  /** Redacted preview of the value (first few chars + length) for the finding detail — never the full secret. */
-  preview: string;
+  /** Operation the policy gates: `read` covers get/query/findMany, the rest are writes. */
+  on: "delete" | "insert" | "read" | "update";
+  /** Export name of the procedure whose `.use(rls(...))` chain declared this policy. */
+  procedure: string;
+  /** Logical table the policy applies to. Empty when not a string literal. */
+  table: string;
 }
 /**
- * One `queues.producers[]` entry of `wrangler.jsonc`, from the top level or an
- * `env.<name>` block — how codegen learns a queue's per-environment name. Produced
- * by `@lunora/config` (which reads `wrangler.jsonc`); codegen only matches it to a
- * declared queue by `binding`.
+ * One statically-readable role entry from an `rls(policies, { roles: [...] })`
+ * call, surfaced to the studio's RLS inspector. Captures the role's `name`,
+ * optional `description`, and the names of the permissions it grants (string
+ * literals or `definePermission("name")` calls). Produced by
+ * `discoverRlsProcedures`.
  */
-interface WranglerQueueProducerIR {
-  /** The `Queue` producer binding, e.g. `QUEUE_JOBS`. */
-  binding: string;
-  /** The `env.<name>` block the entry sits in; absent for the top level. */
-  env?: string;
-  /** The queue name that binding sends to in that scope, e.g. `jobs-preview`. */
-  queue: string;
+interface RlsRoleIR {
+  /** Optional human-readable description from `defineRole(name, { description })`. */
+  description?: string;
+  /** Role label attached to the request identity (e.g. `"admin"`). */
+  name: string;
+  /** Permission names this role grants, deduped and in declared order. */
+  permissions: string[];
 }
-interface ProjectIR {
-  crons: ReadonlyArray<CronJobIR>;
-  functions: ReadonlyArray<FunctionIR>;
-  /** Typed REST routes discovered from `httpRoute.<verb>(...)` builder chains. */
-  httpRoutes: ReadonlyArray<HttpRouteIR>;
-  migrations: ReadonlyArray<MigrationIR>;
-  schema: SchemaIR;
+/**
+ * Schema-wide RLS metadata the codegen emits into the generated ShardDO so the
+ * studio's read-only inspector can list, per table, which policies guard it and
+ * what roles are defined. Aggregated across every `.use(rls(...))` chain in the
+ * project — purely descriptive, never the predicate logic.
+ */
+interface RlsMetadataIR {
+  /** Every statically-discovered policy `(table, on, procedure)` entry. */
+  policies: RlsPolicyIR[];
+  /** Every statically-discovered role, deduped by name (first declaration wins). */
+  roles: RlsRoleIR[];
+}
+/** One statically-discovered `defineStorageRule({ bucket, on, prefix })` entry from a `.use(storageRules(...))` chain. */
+interface StorageRuleIR {
+  bucket: string;
+  /** Relative to `lunora/`. */
+  file: string;
+  on: "delete" | "list" | "read" | "write";
+  /** Optional key-prefix scope; absent ⇒ the whole bucket. */
+  prefix?: string;
+  /** The exported procedure that installed the rule. */
+  procedure: string;
 }
 /**
- * One import of a migrated-away platform's SDK still present in `lunora/`
- * source. Structurally identical to the advisor's `AdvisorStaleMigrationImport`
- * so it passes through the feeder without conversion.
+ * Schema-wide storage-access-rule metadata emitted into the generated ShardDO so
+ * the studio's read-only inspector can list, per bucket, which operations are
+ * gated and under what key prefix. Aggregated across every
+ * `.use(storageRules(...))` chain — descriptive only, never the predicate logic.
  */
-interface StaleMigrationImportIR {
-  /** Source file relative to the lunora dir, no extension. */
+interface StorageRulesMetadataIR {
+  rules: StorageRuleIR[];
+}
+/**
+ * One `rateLimit`/`dbRateLimit` middleware call (`@lunora/ratelimit`) whose
+ * `key` selector — the per-caller rate-limit sub-key, `(ctx) => string |
+ * undefined` — is derived from the handler's `args` with no server-side
+ * scoping (no reference to the trusted `ctx` binding anywhere in the selector)
+ * — the `ratelimit_key_spoofable_or_global` lint input. A key an attacker
+ * controls lets them rotate it per request and bypass the limit entirely,
+ * defeating its purpose. A selector scoped by `ctx` (e.g. `ctx.auth.userId`,
+ * `ctx.ip`), or one with no `args` reference at all (a fixed/global bucket —
+ * the "no key" case this lint deliberately does not flag, to keep it low-FP),
+ * is not recorded. Structurally identical to `AdvisorRatelimitKeySelector`.
+ */
+interface RatelimitKeySelectorIR {
+  /** The `rateLimit`/`dbRateLimit` callee invoked. */
+  callee: string;
+  /** Source file relative to `<projectRoot>/lunora/`, without extension. */
   file: string;
-  /** 1-based line of the import, or `0` when unknown. */
+  /** The rate limit's `name` argument (the second positional argument), or `""` when not a string literal. */
+  limitName: string;
+  /** 1-based line of the `rateLimit`/`dbRateLimit` call, or `0` when unknown. */
   line: number;
-  /** The imported module, e.g. `@supabase/supabase-js`. */
-  moduleSpecifier: string;
-  /** Which migration guide covers this platform. */
-  platform: "convex" | "firebase" | "supabase";
+  /** Who the site runs on behalf of — see {@link CallSiteScope}. */
+  scope: CallSiteScope;
 }
 /**
  * Named inputs for {@link lintSchema}. Every feeder is a discrete key rather than
@@ -2506,6 +2570,7 @@ interface LintSchemaOptions {
   containerKeyAccesses?: ReadonlyArray<ContainerKeyAccessIR>;
   containerOverrides?: ReadonlyArray<ContainerOverrideIR>;
   containers?: ReadonlyArray<ContainerIR>;
+  cronTargets?: ReadonlyArray<string>;
   exportSinks?: ReadonlyArray<AdvisorExportSink>;
   failOpenGuards?: ReadonlyArray<FailOpenGuardIR>;
   flagReads?: ReadonlyArray<FlagReadIR>;
@@ -2539,6 +2604,7 @@ interface LintSchemaOptions {
   rawRowReturns?: ReadonlyArray<RawRowReturnIR>;
   relationLoads?: ReadonlyArray<RelationLoadIR>;
   rlsProcedures?: ReadonlyArray<RlsProcedureIR>;
+  rowEffects?: ReadonlyArray<RowEffectIR>;
   schema: SchemaIR;
   secretLiterals?: ReadonlyArray<SecretLiteralIR>;
   shapes?: ReadonlyArray<ShapeIR>;
@@ -3050,67 +3116,6 @@ interface PlatformDiagnostic {
   /** The requested deploy target. */
   target: string;
 }
-/**
- * Committed, tracked baseline file holding the blessed structural schema
- * snapshot the pre-deploy drift gate diffs against. Lives in `lunora/` (NOT the
- * gitignored `_generated/`) so it is committed alongside `schema.ts`. Leading
- * dot keeps it tucked away next to the schema it describes.
- */
-declare const SCHEMA_SNAPSHOT_FILENAME = ".lunora-schema.json";
-/**
- * Walk up from `startPath` until we find a `tsconfig.json` or hit the file
- * system root. Returns the absolute path to the tsconfig, or `undefined`.
- *
- * Exported (see the bottom-of-file `export { findTsconfig }`) so a long-lived
- * caller (the Vite dev-loop's cached-Project invalidation) can ask "which
- * tsconfig would {@link createCodegenProject} resolve right now?" without
- * duplicating the walk — recomputing it per call is a handful of `existsSync`
- * checks, negligible next to a Project rebuild.
- */
-declare const findTsconfig: (startPath: string) => string | undefined;
-/**
- * Construct the ts-morph `Project` codegen discovers over. Prefers the user's
- * `tsconfig.json` (when one is found walking up from `lunoraDirectory`) so
- * cross-file type resolution and path aliases work; falls back to an isolated
- * project otherwise. This is the exact construction {@link runCodegen} uses
- * when no `project` is injected — exported so a long-lived caller (the Vite
- * dev-loop) can build one once and reuse it across runs via
- * {@link refreshCodegenProject} instead of re-parsing the user's whole TS
- * program on every save.
- */
-declare const createCodegenProject: (lunoraDirectory: string) => Project;
-/**
- * Synchronise a reused {@link createCodegenProject} Project with the current
- * on-disk state of `lunoraDirectory`, so the next {@link runCodegen} sees the
- * same files a freshly-constructed Project would — without re-parsing the whole
- * TS program. Adds any on-disk source file the Project doesn't yet have, and
- * `refreshFromFileSystemSync()`es the ones it does (picking up edits); then
- * removes Project source files under `lunoraDirectory` that no longer exist on
- * disk (the classic stale-deleted-file cache bug).
- *
- * Files outside `lunoraDirectory` — e.g. a shared validator or type pulled in
- * via the user's tsconfig — are also `refreshFromFileSystemSync()`ed, but only
- * the ones already loaded into the Project; none are added. `resolveValidatorAlias`
- * (parse-validator.ts) follows `getAliasedSymbol()` across module boundaries, so a
- * validator defined outside `lunoraDirectory` is genuinely read from whatever
- * source the Project currently holds — leaving those files stale made a reused
- * Project (the Vite dev loop) silently disagree with a fresh one (`lunora
- * codegen`) about the same source. `node_modules` is excluded: its `.d.ts` set
- * dominates the file count and never changes mid dev-loop, so refreshing it would
- * reinstate close to the full re-parse cost this cache exists to avoid.
- */
-declare const refreshCodegenProject: (project: Project, lunoraDirectory: string) => void;
-/**
- * Top-level codegen entry. Parses `<projectRoot>/lunora/schema.ts` and every
- * function file under `<projectRoot>/lunora/`, then writes
- * `_generated/{api,server,dataModel}.ts` next to them.
- *
- * When `LUNORA_CODEGEN_TIMING` is set (truthy), a single diagnostic summary
- * line is written to stderr with the total wall time and the discovery-vs-emit
- * split — opt-in instrumentation that is otherwise zero-cost and side-effect-free
- * on the returned {@link CodegenResult}.
- */
-declare const runCodegen: (options: CodegenOptions) => CodegenResult;
 interface CodegenOptions {
   /**
    * Which machine-readable API spec(s) to emit into `_generated/`.
@@ -3331,6 +3336,68 @@ interface CodegenResult {
    */
   writtenFiles: ReadonlyArray<string>;
 }
+/**
+ * Walk up from `startPath` until we find a `tsconfig.json` or hit the file
+ * system root. Returns the absolute path to the tsconfig, or `undefined`.
+ *
+ *
+ * Exported (see the bottom-of-file `export { findTsconfig }`) so a long-lived
+ * caller (the Vite dev-loop's cached-Project invalidation) can ask "which
+ * tsconfig would `createCodegenProject` resolve right now?" without
+ * duplicating the walk — recomputing it per call is a handful of `existsSync`
+ * checks, negligible next to a Project rebuild.
+ */
+declare const findTsconfig: (startPath: string) => string | undefined;
+/**
+ * Construct the ts-morph `Project` codegen discovers over. Prefers the user's
+ * `tsconfig.json` (when one is found walking up from `lunoraDirectory`) so
+ * cross-file type resolution and path aliases work; falls back to an isolated
+ * project otherwise. This is the exact construction `runCodegen` uses
+ * when no `project` is injected — exported so a long-lived caller (the Vite
+ * dev-loop) can build one once and reuse it across runs via
+ * {@link refreshCodegenProject} instead of re-parsing the user's whole TS
+ * program on every save.
+ */
+declare const createCodegenProject: (lunoraDirectory: string) => Project;
+/**
+ * Synchronise a reused `createCodegenProject` Project with the current
+ * on-disk state of `lunoraDirectory`, so the next `runCodegen` sees the
+ * same files a freshly-constructed Project would — without re-parsing the whole
+ * TS program. Adds any on-disk source file the Project doesn't yet have, and
+ * `refreshFromFileSystemSync()`es the ones it does (picking up edits); then
+ * removes Project source files under `lunoraDirectory` that no longer exist on
+ * disk (the classic stale-deleted-file cache bug).
+ *
+ * Files outside `lunoraDirectory` — e.g. a shared validator or type pulled in
+ * via the user's tsconfig — are also `refreshFromFileSystemSync()`ed, but only
+ * the ones already loaded into the Project; none are added. `resolveValidatorAlias`
+ * (parse-validator.ts) follows `getAliasedSymbol()` across module boundaries, so a
+ * validator defined outside `lunoraDirectory` is genuinely read from whatever
+ * source the Project currently holds — leaving those files stale made a reused
+ * Project (the Vite dev loop) silently disagree with a fresh one (`lunora
+ * codegen`) about the same source. `node_modules` is excluded: its `.d.ts` set
+ * dominates the file count and never changes mid dev-loop, so refreshing it would
+ * reinstate close to the full re-parse cost this cache exists to avoid.
+ */
+declare const refreshCodegenProject: (project: Project, lunoraDirectory: string) => void;
+/**
+ * Committed, tracked baseline file holding the blessed structural schema
+ * snapshot the pre-deploy drift gate diffs against. Lives in `lunora/` (NOT the
+ * gitignored `_generated/`) so it is committed alongside `schema.ts`. Leading
+ * dot keeps it tucked away next to the schema it describes.
+ */
+declare const SCHEMA_SNAPSHOT_FILENAME = ".lunora-schema.json";
+/**
+ * Top-level codegen entry. Parses `<projectRoot>/lunora/schema.ts` and every
+ * function file under `<projectRoot>/lunora/`, then writes
+ * `_generated/{api,server,dataModel}.ts` next to them.
+ *
+ * When `LUNORA_CODEGEN_TIMING` is set (truthy), a single diagnostic summary
+ * line is written to stderr with the total wall time and the discovery-vs-emit
+ * split — opt-in instrumentation that is otherwise zero-cost and side-effect-free
+ * on the returned {@link CodegenResult}.
+ */
+declare const runCodegen: (options: CodegenOptions) => CodegenResult;
 declare const sortedUniqueNames: (names: Iterable<string>) => ReadonlyArray<string>;
 /** Deduplicated, sorted names of every ERROR-level advisory in `advisories`. */
 declare const errorAdvisoryNames: (advisories: ReadonlyArray<Pick<Finding, "level" | "name">>) => ReadonlyArray<string>;
@@ -3586,7 +3653,7 @@ declare const readPackageDependencies: (projectRoot: string) => Set<string> | un
  * unfiltered, unindexed `.collect()` is the read `unbounded_collect` exists for
  * — and dropping it here is precisely why nothing could see it.
  */
-declare const discoverQueries: (project: Project, lunoraDirectory: string) => QueryReadIR[];
+declare const discoverQueries: (project: Project, lunoraDirectory: string, functions?: ReadonlyArray<FunctionIR>) => QueryReadIR[];
 /** The file queues are declared in: `lunora/queues.ts`, and the same name directly inside a module folder. */
 declare const QUEUES_FILENAME = "queues.ts";
 /** The queues half of {@link discoverQueueDeclarations} — what the config layer reconciles into wrangler. */