@lunora/codegen 1.0.0-alpha.4 → 1.0.0-alpha.40

package/dist/index.d.ts

@@ -1,5 +1,7 @@
 import { Finding } from '@lunora/advisor';
 export type { Finding } from '@lunora/advisor';
+import { LunoraError } from '@lunora/errors';
+export { MESSAGE_SOLUTIONS as LUNORA_SOLUTION_RULES, type Solution as LunoraSolution, type SolutionRule as LunoraSolutionRule, findSolutionByMessage as findLunoraSolution } from '@lunora/errors';
 import { Node, Project } from 'ts-morph';
 import { StudioFeaturesResult } from '@lunora/do';
 import { Schema } from '@lunora/server';
@@ -25,6 +27,15 @@ interface ValidatorIR {
   bucket?: string;
   /** Column modifiers (`.unique()`, `.default()`, `.nullable()`, …) when present. */
   column?: ColumnMetaIR;
+  /**
+  * `true` when this validator carries a `.check(...)` refinement. The predicate
+  * is a runtime closure the AST→IR step can't represent, so the node keeps its
+  * base `kind` but records the refinement's presence here. The AOT args-validator
+  * compiler declines any node with this flag (compiling it would silently skip
+  * the predicate). `.meta(...)` is pure metadata with no parse effect and does
+  * NOT set this.
+  */
+  hasRefinement?: boolean;
   /** For `v.optional(inner)` / `v.array(inner)`. */
   inner?: ValidatorIR;
   /** For `v.record(key, value)`. */
@@ -100,6 +111,36 @@ interface RelationIR {
   /** Target table name. */
   table: string;
 }
+/**
+* Statically-discovered `.source(...)` config (plan 077). Only the bits the
+* advisor lints + DO wiring need are captured; `map`/`tenantBy` are functions and
+* cannot be serialized, so their presence is recorded as `hasTenantBy` rather than
+* the function itself.
+*/
+interface ExternalSourceIR {
+  /** The wrangler Hyperdrive binding name. */
+  binding: string;
+  /** Whether a `columns` projection allow-list was given. */
+  columns?: ReadonlyArray<string>;
+  /** `true` when a `reconcileEveryMs` was given (the incremental-mode delete-visibility companion). */
+  hasReconcile?: boolean;
+  /** `true` when a `tenantBy` mapper was given — the tenant-isolation boundary the `external_source_unscoped` lint checks. */
+  hasTenantBy: boolean;
+  /** The `idColumn` literal, when given (defaults to `"id"` at runtime). */
+  idColumn?: string;
+  /** Delete-detection mode literal, when given (`"full-pull"` | `"incremental"`). */
+  mode?: string;
+  /** The membership query literal, when statically knowable. */
+  query?: string;
+  /**
+  * `true` when `.source(...)` was present but its argument was **not** a static
+  * object literal (e.g. `.source(buildConfig())`), so none of the fields above
+  * could be read. The source still exists — this flag lets `hasSourcedTables`
+  * (codegen) and the `external_source_*` lints treat it as a source that can't be
+  * verified, instead of mistaking it for no `.source()` at all.
+  */
+  unanalyzable?: boolean;
+}
 interface TableIR {
   /**
   * `true` when the table chain carried `.externallyManaged()` — its rows are
@@ -109,12 +150,26 @@ interface TableIR {
   */
   externallyManaged?: boolean;
   /**
+  * Set when the chain carried `.source(...)` — the table is materialized from an
+  * external Hyperdrive-backed database by a system poll loop (plan 077). Carries
+  * the statically-knowable bits the advisor lints read; the functions (`map`,
+  * `tenantBy`) are not serialized, only their presence (`hasTenantBy`).
+  */
+  externalSource?: ExternalSourceIR;
+  /**
   * Storage backend for a `.global()` table: `"d1"` (default) or
   * `"hyperdrive"` (a Postgres/MySQL database via Cloudflare Hyperdrive). Only
   * meaningful when `shardMode === "global"`; absent for sharded/root tables.
   */
   globalBackend?: "d1" | "hyperdrive";
   indexes: ReadonlyArray<IndexIR>;
+  /**
+  * `true` when the table chain carried `.public()` — an explicit opt-OUT of
+  * the schema's `.rls("required")` enforcement for this one table. Optional:
+  * hand-built IR and tables that never called `.public()` default it to
+  * `false`.
+  */
+  isPublic?: boolean;
   name: string;
   /** Rank indexes declared inline via `.rankIndex(name, …)`. */
   rankIndexes: ReadonlyArray<RankIndexIR>;
@@ -126,10 +181,30 @@ interface TableIR {
     field: string;
     kind: "shardBy";
   };
+  /** Set when the chain carried `.softDelete()` — the marker column's name (default `deletedAt`). The column is injected into `shape` so `Doc_*` carries it. */
+  softDelete?: {
+    field: string;
+  };
   /** Vector indexes declared inline via `.vectorize()` (DSL Shape A). */
   vectorIndexes: ReadonlyArray<VectorIndexIR>;
 }
+/** The Cloudflare DO data-residency jurisdictions the schema may declare. Canonical literal set for the codegen package. */
+type JurisdictionIR = "eu" | "fedramp" | "us";
 interface SchemaIR {
+  /**
+  * Cloudflare data-residency jurisdiction declared via
+  * `defineSchema(...).jurisdiction("…")`. Emitted into the generated worker's
+  * `createWorker({ jurisdiction })` (and `ctx.scheduler` / `ctx.containers`).
+  * Absent ⇒ un-pinned.
+  */
+  jurisdiction?: JurisdictionIR;
+  /**
+  * Set when `defineSchema(...).rls("required")` was chained onto the schema —
+  * every table's `ctx.db` write path is denied without an RLS-covering
+  * procedure unless the table itself is `.public()` (see {@link TableIR.isPublic}).
+  * Absent when the schema never called `.rls("required")`.
+  */
+  rlsMode?: "required";
   tables: ReadonlyArray<TableIR>;
   /** All vector indexes (inline Shape A hoisted + standalone Shape B), flattened. */
   vectorIndexes: ReadonlyArray<VectorIndexIR>;
@@ -179,6 +254,84 @@ interface MigrationIR {
   table: string;
 }
 /**
+* A `defineShape({...})` declaration discovered in `lunora/shapes.ts`
+* (local-first sync engine, Phase 7). The emitted `LUNORA_SHAPES` registry keys
+* on {@link ShapeIR.exportName}; the generated DO's `resolveShape` override
+* dispatches a `shape_subscribe` to the matching registered shape. Discovery is
+* marker-driven (the `__lunoraShape` brand) — no field metadata is lifted here
+* because the runtime object (`columns`/`compileWhere`) carries the authority.
+*/
+interface ShapeIR {
+  /** Export binding name — the shape's registry key and import member. */
+  exportName: string;
+  /** Path relative to `&lt;projectRoot>/lunora/` without extension — always `"shapes"`. */
+  filePath: string;
+  /**
+  * The `table` string literal from the `defineShape({ table })` call, lifted
+  * only for static advisor lints (the runtime object stays authoritative).
+  * `undefined` when `table` is not a plain string literal — lints skip those.
+  */
+  table?: string;
+}
+/**
+* The single `defineIdentity({...})` claim contract discovered in
+* `lunora/identity.ts`. Discovery is **marker-driven** (the `__lunoraIdentity`
+* brand, exactly like {@link ShapeIR}) — no claim metadata is lifted here
+* because the emitted `_generated/server.ts` recovers the claim *type* from the
+* declaration itself (`InferIdentity` over the contract's `typeof`), and the
+* runtime object (`validate`/`onInvalid`) carries the authority at the boundary.
+* Exactly one per app; absent ⇒ generated output is byte-identical to today.
+*/
+interface IdentityIR {
+  /** Export binding name — the namespace member `_generated/server.ts` reads via `typeof`. */
+  exportName: string;
+}
+/**
+* The single `defineEnv({...})` contract discovered in `lunora/env.ts`. Like
+* {@link IdentityIR}, only the export binding is lifted — the emitted
+* `_generated/server.ts` recovers the validated shape from the declaration
+* itself (`ReturnType` over the accessor's `typeof`), and the generated ShardDO
+* applies the same accessor to the worker `env` at ctx-build time to populate
+* `ctx.env`. Exactly one per app; absent ⇒ generated output is byte-identical.
+*/
+interface EnvIR {
+  /** Export binding name — the namespace member `_generated/server.ts` reads via `typeof`. */
+  exportName: string;
+}
+/**
+* A `defineMutator({...})` declaration discovered in `lunora/mutators.ts`
+* (local-first sync engine, Phase 7). The emitted registry registers the
+* authoritative `server` impl into the DO's `LUNORA_FUNCTIONS` table (so
+* `handleRpc` transaction-wraps it) and records its path in
+* `LUNORA_MUTATOR_PATHS` so the DO's `isCustomMutator` override routes the
+* client-watermark push protocol. The client `client` impl is split into the
+* browser bundle separately — only the path crosses to the server side.
+*/
+interface MutatorIR {
+  /** Export binding name — the mutator's registry key and import member. */
+  exportName: string;
+  /** Path relative to `&lt;projectRoot>/lunora/` without extension — always `"mutators"`. */
+  filePath: string;
+}
+/**
+* A whole-row `ctx.db.replace(id, document)` write discovered inside a custom
+* mutator's inline `server` impl (`lunora/mutators.ts`) — the input the
+* `mutator_full_row_replace` advisor lint consumes. A `replace` overwrites the
+* entire row, so a concurrent edit to a different column on a synced table is
+* clobbered; `ctx.db.patch(id, { field })` merges at the column level instead.
+* Structurally identical to `AdvisorMutatorWrite` so it passes straight through
+* to the advisor without conversion, exactly as `InsertWriteIR` does for
+* `AdvisorInsertWrite`.
+*/
+interface MutatorWriteIR {
+  /** The mutator export whose `server` impl performs the replace, e.g. `renameChannel`. */
+  exportName: string;
+  /** Openable source path the replace appears in — always `lunora/mutators.ts`. */
+  file: string;
+  /** 1-based line of the `replace(...)` call. */
+  line: number;
+}
+/**
 * A single cron job lifted from a `cronJobs()` builder in `lunora/crons.ts`.
 * Mirrors `@lunora/scheduler`'s `CronJob`: {@link CronJobIR.cron} is the compiled
 * standard cron expression, {@link CronJobIR.functionPath} is the target
@@ -288,6 +441,79 @@ interface WorkflowIR {
   * definition overrides it.
   */
   name: string;
+  /**
+  * Durable step labels lifted from the handler body — the first string-literal
+  * argument of every `ctx.step.do` / `.sleep` / `.sleepUntil` / `.waitForEvent`
+  * call. Feeds the duplicate-step-name lint, which flags a name used twice
+  * (Cloudflare memoizes by name, so the second call silently returns the
+  * first's cached result). Calls with a non-literal name are omitted (not
+  * statically comparable).
+  */
+  steps: ReadonlyArray<WorkflowStepIR>;
+}
+/** One durable step call lifted from a workflow handler body (the use side of {@link WorkflowIR.steps}). */
+interface WorkflowStepIR {
+  /** 1-based line of the durable step call. */
+  line: number;
+  /** The native step method invoked: `do` / `sleep` / `sleepUntil` / `waitForEvent`. */
+  method: string;
+  /** The step's static label (the first string-literal argument). */
+  name: string;
+}
+/**
+* A queue lifted from a `defineQueue()` export in `lunora/queues.ts`. Carries
+* what the emitters and the config layer need to wire the typed `ctx.queues`
+* producer, the generated worker `queue()` dispatch, and the wrangler
+* `queues.producers[]` / `queues.consumers[]` entries. Like workflows, a queue
+* is NOT a Durable Object — wrangler gets only `queues.*` entries. Names are
+* derived via `@lunora/queue`'s shared helpers so codegen and the config layer
+* can never disagree.
+*/
+interface QueueIR {
+  /** The Cloudflare `Queue` producer binding name, e.g. `QUEUE_EMAIL`. */
+  bindingName: string;
+  /** The `lunora/queues.ts` export name, e.g. `emailQueue`. */
+  exportName: string;
+  /** How the queue is consumed: `"push"` (a worker `queue()` handler) or `"pull"` (external HTTP). */
+  mode: "pull" | "push";
+  /**
+  * The stable wrangler queue name (`queues.producers[].queue`). Defaults to
+  * the kebab-cased export name (`emailQueue` → `email-queue`); a static
+  * `name:` literal in the definition overrides it.
+  */
+  name: string;
+  /** Push-consumer batch/retry tuning, mirrored onto the wrangler `queues.consumers[]` entry. */
+  tuning: {
+    deadLetterQueue?: string;
+    maxBatchSize?: number;
+    maxBatchTimeout?: number;
+    maxRetries?: number;
+    retryDelay?: number;
+  };
+}
+/**
+* The feature-flag provider declared by the default export of `lunora/flags.ts`
+* (`defineFlags({ provider, … })`). Discovery is **metadata-only** — codegen
+* imports the real module at runtime for the provider value; this IR exists so
+* the config layer can reconcile/validate the wrangler `flagship` binding when
+* the app uses Flagship in binding mode. A `custom` provider (any other
+* OpenFeature factory) carries no binding to reconcile.
+*/
+interface FlagsIR {
+  /**
+  * The wrangler `flagship[].binding` name — set **only** for a flagship
+  * `provider` in binding mode (`flagshipProvider({ binding: "FLAGS" })`). The
+  * config layer hints/validates a matching `flagship` binding from this.
+  */
+  bindingName?: string;
+  /**
+  * Flagship operating mode — `"binding"` (wrangler binding, needs a
+  * `flagship` entry) or `"http"` (no binding); `undefined` for a `custom`
+  * provider or when the mode can't be read statically.
+  */
+  mode?: "binding" | "http";
+  /** `"flagship"` when the provider is `flagshipProvider(...)`, else `"custom"` (any other OpenFeature provider factory). */
+  provider: "custom" | "flagship";
 }
 /**
 * A `ctx.workflows.get("name")…` call discovered in a function body — the
@@ -488,6 +714,30 @@ interface MaskMetadataIR {
   columns: MaskColumnMetadataIR[];
 }
 /**
+* One masked column whose `mask(policies)` strategy is a statically-known
+* literal (`"hash"` or `"redact"`) — the `mask_weak_hash_strategy_on_pii` lint
+* input. Unlike {@link MaskColumnMetadataIR} (app-wide, deduped by `(table,
+* column)`, studio-preview evidence), this is per declaration site (file + line
+* + enclosing export), undeduped, so the lint can point at the exact
+* `mask(...)` call that applies a weak strategy. A `MaskFn` (custom, non-literal)
+* strategy carries no lint-relevant signal and is never recorded here.
+* Structurally identical to `AdvisorMaskStrategy`.
+*/
+interface MaskStrategyIR {
+  /** Masked column name. */
+  column: string;
+  /** Export binding name of the procedure whose `.use(mask(...))` chain declared this column, or `"&lt;module>"` when declared at file scope. */
+  exportName: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the masked column's strategy property. */
+  line: number;
+  /** The statically-known strategy literal: `"hash"` or `"redact"`. */
+  strategy: string;
+  /** Logical table the masked column belongs to. */
+  table: string;
+}
+/**
 * One statically-readable policy entry from an `rls([...])` array literal,
 * surfaced to the studio's read-only RLS inspector via the generated
 * `rlsPolicies()` hook. Captures the policy's `table` + `on` operation and the
@@ -596,12 +846,18 @@ interface ProcedureMiddlewareIR {
   callsMail: boolean;
   /** Export binding name of the procedure (e.g. `signUp`). */
   exportName: string;
+  /** `true` when the handler fans work out to a privileged, cost-bearing dispatch surface (scheduler `runAfter`/`runAt`, a queue producer send, or a workflow create). Feeds the privileged-fanout lint. */
+  fanOut: boolean;
   /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
   file: string;
   /** Registration kind — only `mutation`/`action` are write-shaped; `query` is read-only. */
   kind: "action" | "mutation" | "query";
+  /** `true` when the handler runs an AI generation (`generateText`/`streamText`/`generateObject`/`streamObject`) with no `maxOutputTokens` bound in its config literal. Feeds the `ai_unbounded_generation_public` lint. */
+  unboundedAiGeneration: boolean;
   /** `true` when the chain carries `.use(verifyTurnstile(...))` or a `protectPublic({ captcha })` bundle. */
   usesCaptcha: boolean;
+  /** `true` when the handler calls `ctx.db.insertManyUnsafe(...)`, bypassing validators and triggers. Feeds the `insert_many_unsafe_user_data` lint. */
+  usesInsertManyUnsafe: boolean;
   /** `true` when the chain carries `.use(mask(...))`. */
   usesMask: boolean;
   /** `true` when the chain carries `.use(rateLimit(...))` or a `protectPublic({ rateLimit })` bundle. */
@@ -634,6 +890,27 @@ interface ArgumentValidatorIR {
   unboundedStringArgs: string[];
 }
 /**
+* One factory/constructor call in `lunora/` whose config object literal a
+* security lint inspects for a present-or-absent key — the shared input for the
+* config-call security lints (payment authorize, inbound-mail verify, rate-limit
+* store, browser private-targets). Structurally identical to `AdvisorConfigCall`
+* so it passes straight through to the advisor without conversion.
+*/
+interface ConfigCallIR {
+  /** `true` when the config argument was a static object literal the feeder could read. */
+  analyzable: boolean;
+  /** The factory function or constructor name at the call site, e.g. `createPayment` / `RateLimiter`. */
+  callee: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the call site, or `0` when unknown. */
+  line: number;
+  /** Keys present in the config object literal (empty when not `analyzable`). */
+  presentKeys: string[];
+  /** Keys in the config object literal explicitly assigned the literal `true`. */
+  trueKeys: string[];
+}
+/**
 * One secret-shaped string literal discovered in `lunora/` source — the
 * `hardcoded_secret` lint input. Complements the pre-commit `vis secrets` scan by
 * surfacing the same class of finding in-IDE via the studio Advisors table.
@@ -667,6 +944,308 @@ interface SqlInterpolationIR {
   line: number;
 }
 /**
+* One `ctx.fetch(url, …)` call inside an action whose URL argument is derived
+* from the handler's `args` — the `action_fetch_ssrf` lint input. `ctx.fetch` is
+* the action-only outbound-request escape hatch with no host allowlist, so a URL
+* assembled from request input is a server-side request forgery vector (cloud
+* metadata endpoints, internal services). Only arg-derived URLs reach here; a
+* fixed literal or a URL built from config/`ctx.*` is not recorded. Structurally
+* identical to `AdvisorArgumentDerivedFetch`.
+*/
+interface ArgumentDerivedFetchIR {
+  /** Export binding name of the action performing the `ctx.fetch` call. */
+  exportName: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the `ctx.fetch` call, or `0` when unknown. */
+  line: number;
+}
+/**
+* One `ctx.kv.&lt;method>(key, …)` call whose namespace key is derived from the
+* handler's `args` with no server-side scoping — the `kv_unscoped_user_key_idor`
+* lint input. Workers KV is a single flat namespace, so a key taken straight from
+* request input lets any caller read, overwrite, or delete another user's entry
+* (IDOR). Only arg-derived, unscoped keys reach here; a fixed literal, or a key
+* prefixed with a server-trusted identity (`${ctx.auth.userId}:…` — references
+* `ctx`, so treated as scoped), is not recorded. `list` is excluded (it takes a
+* prefix, not a per-entry key). Structurally identical to `AdvisorKvKeyAccess`.
+*/
+interface KvKeyAccessIR {
+  /** Export binding name of the procedure performing the `ctx.kv` access. */
+  exportName: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the `ctx.kv` call, or `0` when unknown. */
+  line: number;
+  /** The `ctx.kv` method invoked: `get` / `getRaw` / `getWithMetadata` / `put` / `delete`. */
+  method: string;
+}
+/**
+* One `ctx.db` write (`insert` / `replace` / `patch` / `insertManyUnsafe`) that sets
+* an ownership / identity column — `userId`, `ownerId`, `tenantId`, and the like —
+* from the handler's `args` instead of the server-trusted identity. The
+* `owner_field_from_args_not_auth` lint input: the ownership column decides who a
+* row belongs to, so a value taken from request input lets any caller write rows
+* owned by another user or tenant (the act-as-any-user / cross-tenant IDOR vector).
+* A column stamped from `ctx.*`, or set to a fixed literal, is not recorded; only an
+* arg-derived identity write reaches here. Structurally identical to
+* `AdvisorOwnerFieldWrite`.
+*/
+interface OwnerFieldWriteIR {
+  /** Export binding name of the procedure performing the write. */
+  exportName: string;
+  /** The identity column being written from `args` (e.g. `userId`). */
+  field: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the `ctx.db` write call, or `0` when unknown. */
+  line: number;
+  /** The `ctx.db` write method (`insert` / `replace` / `patch` / `insertManyUnsafe`). */
+  method: string;
+}
+/**
+* One `ctx.storage.&lt;bucket>.&lt;method>(key, …)` call whose R2 object key is derived
+* from the handler's `args` with no server-side scoping — the
+* `storage_key_from_user_args` lint input. The bucket read/write/URL/delete methods
+* key by their first argument, so an object key taken straight from request input is
+* object-level IDOR (read/overwrite/delete anyone's object). A key referencing a
+* server-trusted `ctx.*` value (e.g. `${ctx.auth.userId}/…`) is treated as scoped
+* and is not recorded; only an arg-derived, `ctx`-free key reaches here.
+* Structurally identical to `AdvisorStorageKeyAccess`.
+*/
+interface StorageKeyAccessIR {
+  /** Export binding name of the procedure performing the storage call. */
+  exportName: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the storage call, or `0` when unknown. */
+  line: number;
+  /** The bucket method invoked with the arg-derived key, e.g. `get` / `put` / `delete` / `download`. */
+  method: string;
+}
+/**
+* One `ctx.containers.&lt;exportName>.get(name, …)` call whose instance key is derived
+* from the handler's `args` with no server-side scoping — the
+* `container_instance_key_from_user_input` lint input. Each container definition's
+* `.get(name)` accessor routes to one instance per `name`, so a key taken straight from
+* request input lets any caller reach another tenant's container (a cross-tenant IDOR). A
+* fixed literal key, or one derived from a server-trusted identity (`${ctx.auth.userId}` —
+* references `ctx`, so treated as scoped), is not recorded; only an arg-derived, unscoped
+* key reaches here. `.any()`/`.pool()` take no key and are not sinks. Structurally
+* identical to `AdvisorContainerKeyAccess`.
+*/
+interface ContainerKeyAccessIR {
+  /** Export binding name of the procedure performing the `ctx.containers` access. */
+  exportName: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the `ctx.containers.*.get` call, or `0` when unknown. */
+  line: number;
+  /** The container accessor method invoked — always `get`. */
+  method: string;
+}
+/**
+* One `ctx.ai.run(model, …)` call whose model-id argument is derived from the handler's
+* `args` with no server-side scoping — the `ai_raw_run_escape_hatch` lint input.
+* `ctx.ai.run` is the raw Workers AI binding passthrough, bypassing the typed
+* `ctx.ai.model(...)` + AI-SDK layer (`generateText`/`streamText`/…) that caps output and
+* enforces a schema, so an arg-derived model id lets any caller select an arbitrary model.
+* A fixed literal model, or one scoped by a server-trusted `ctx.*` value, is not recorded;
+* only an arg-derived, unscoped model id reaches here (an arg-derived `inputs` argument is
+* normal usage and is never inspected). Structurally identical to `AdvisorAiRawRun`.
+*/
+interface AiRawRunIR {
+  /** Export binding name of the procedure performing the `ctx.ai.run` call. */
+  exportName: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the `ctx.ai.run` call, or `0` when unknown. */
+  line: number;
+}
+/**
+* One `ctx.vectors.&lt;method>(indexName, input)` call whose `input.namespace` is derived
+* from the handler's `args` with no server-side scoping — the
+* `vectors_namespace_from_user_input` lint input. A Vectorize namespace partitions one
+* index into isolated sub-collections, so a namespace taken straight from request input
+* lets any caller read or poison another tenant's vectors. A fixed literal namespace, or
+* one prefixed with a server-trusted identity (`${ctx.auth.orgId}` — references `ctx`, so
+* treated as scoped), is not recorded; only an arg-derived, unscoped namespace reaches
+* here. Structurally identical to `AdvisorVectorNamespaceAccess`.
+*/
+interface VectorNamespaceAccessIR {
+  /** Export binding name of the procedure performing the `ctx.vectors` access. */
+  exportName: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the `ctx.vectors` call, or `0` when unknown. */
+  line: number;
+  /** The `ctx.vectors` method invoked: `query` / `upsert` / `upsertMany`. */
+  method: string;
+}
+/**
+* One `ctx.mail`/`ctx.email` `send`/`queue` call whose recipient field (`to`/`cc`/`bcc`)
+* is derived from the handler's `args` with no server-side scoping — the
+* `mail_recipient_from_request_input` lint input. A recipient taken straight from request
+* input turns the deployment into an open relay / spam amplifier (any caller can direct
+* mail to an arbitrary address). A fixed literal recipient, or one scoped by a
+* server-trusted `ctx.*` value (e.g. `ctx.auth.user.email`), is not recorded; only an
+* arg-derived, unscoped recipient reaches here. Structurally identical to
+* `AdvisorMailRecipientAccess`.
+*/
+interface MailRecipientAccessIR {
+  /** Export binding name of the procedure performing the `ctx.mail`/`ctx.email` call. */
+  exportName: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the `ctx.mail`/`ctx.email` call, or `0` when unknown. */
+  line: number;
+  /** The mailer method invoked: `send` / `queue`. */
+  method: string;
+}
+/**
+* One `ctx.browser.&lt;method>(url, …)` call whose navigation URL (`arguments[0]`)
+* is derived from the handler's `args` with no server-side scoping — the
+* `browser_user_url_without_allowlist` lint input. The lint additionally
+* cross-references `createBrowser` config-call evidence to suppress findings
+* when the browser is hardened with an `allowedHosts` allowlist or
+* `resolveDns`. Structurally identical to `AdvisorBrowserUrlAccess`.
+*/
+interface BrowserUrlAccessIR {
+  /** Export binding name of the procedure performing the `ctx.browser` call. */
+  exportName: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the `ctx.browser` call, or `0` when unknown. */
+  line: number;
+  /** The browser method invoked: `content` / `pdf` / `scrape` / `screenshot`. */
+  method: string;
+}
+/**
+* One runtime container-override call: a `&lt;handle>.start({ enableInternet: true, … })`
+* launch override, or a `&lt;handle>.egress.&lt;method>(...)` runtime firewall mutation
+* (`allow` / `deny` / `setAllowed`) — the `container_start_enable_internet_override`
+* and `container_runtime_egress_relaxation` lint input. Both shapes re-open network
+* access the static `defineContainer` declaration (and its `container_public_internet`
+* lint) assumes is locked down. Matched structurally by call shape, independent of the
+* receiver's resolved type. Structurally identical to `AdvisorContainerOverride`.
+*/
+interface ContainerOverrideIR {
+  /** e.g. the egress method name, or `"enableInternet: true"`. */
+  detail: string;
+  /** Export binding name of the procedure performing the call. */
+  exportName: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** Which override shape matched. */
+  kind: "egress_relaxation" | "enable_internet";
+  /** 1-based line of the call, or `0` when unknown. */
+  line: number;
+}
+/**
+* One `buildImageDeliveryUrl({ key, … })` call (`@lunora/bindings/images`) whose
+* `key` — the CDN transform's source image, an absolute URL or an
+* origin-relative key — is derived from the handler's `args` with no
+* server-side scoping — the `images_url_source_from_user_input` lint input.
+* `ctx.images.transform`/`info` take image *bytes*, never a URL, so they are not
+* sinks; only the `key` of `buildImageDeliveryUrl` accepts a URL-or-key source
+* and is inspected. An arg-derived `key` lets any caller point the CDN's
+* `/cdn-cgi/image/` transform at an attacker-chosen origin (SSRF / open proxy)
+* or at an arbitrary key under the account's own store. A fixed literal, or a
+* key scoped by a server-trusted `ctx.*` value, is not recorded. Structurally
+* identical to `AdvisorImageDeliveryUrlAccess`.
+*/
+interface ImageDeliveryUrlAccessIR {
+  /** Export binding name of the procedure performing the `buildImageDeliveryUrl` call. */
+  exportName: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the `buildImageDeliveryUrl` call, or `0` when unknown. */
+  line: number;
+}
+/**
+* One `createAuth({...})` call's configuration snapshot — the shared input for
+* the five `auth_*` security lints (trusted-origins wildcard, CSRF check
+* disabled, secure cookies disabled, email verification disabled, session
+* freshAge zero). Matched by callee NAME (an `import`-agnostic, fail-closed
+* convention the other feeders share), so a re-export or alias still resolves.
+* When the config argument isn't a statically-analyzable object literal (a
+* top-level spread, or not an object literal at all), `analyzable` is `false`
+* and every boolean fact defaults to its SAFE (not-flagged) value — an opaque
+* config can't be relied on either way. Structurally identical to
+* `AdvisorAuthConfig`.
+*/
+interface AuthConfigIR {
+  /** `true` when the call's config argument was a static object literal the feeder could read. */
+  analyzable: boolean;
+  /** `advanced.disableCSRFCheck === true`. */
+  disableCsrfCheck: boolean;
+  /** `emailAndPassword.enabled === true`. */
+  emailPasswordEnabled: boolean;
+  /** Export binding name enclosing the `createAuth(...)` call. */
+  exportName: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the `createAuth(...)` call, or `0` when unknown. */
+  line: number;
+  /** `emailAndPassword.requireEmailVerification === true` present. */
+  requireEmailVerification: boolean;
+  /** `advanced.useSecureCookies === false`. */
+  secureCookiesDisabled: boolean;
+  /** `session.freshAge === 0` (explicit literal). */
+  sessionFreshAgeZero: boolean;
+  /** `trustedOrigins` array literal contains a `"*"` element. */
+  trustedOriginsWildcard: boolean;
+}
+/**
+* One `rateLimit`/`dbRateLimit` middleware call (`@lunora/ratelimit`) whose
+* `key` selector — the per-caller rate-limit sub-key, `(ctx) => string |
+* undefined` — is derived from the handler's `args` with no server-side
+* scoping (no reference to the trusted `ctx` binding anywhere in the selector)
+* — the `ratelimit_key_spoofable_or_global` lint input. A key an attacker
+* controls lets them rotate it per request and bypass the limit entirely,
+* defeating its purpose. A selector scoped by `ctx` (e.g. `ctx.auth.userId`,
+* `ctx.ip`), or one with no `args` reference at all (a fixed/global bucket —
+* the "no key" case this lint deliberately does not flag, to keep it low-FP),
+* is not recorded. Structurally identical to `AdvisorRatelimitKeySelector`.
+*/
+interface RatelimitKeySelectorIR {
+  /** The `rateLimit`/`dbRateLimit` callee invoked. */
+  callee: string;
+  /** Export binding name of the procedure whose `.use(...)` chain carries the call. */
+  exportName: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** The rate limit's `name` argument (the second positional argument), or `""` when not a string literal. */
+  limitName: string;
+  /** 1-based line of the `rateLimit`/`dbRateLimit` call, or `0` when unknown. */
+  line: number;
+}
+/**
+* One payload-derived privileged dispatch — a `ctx.run`/`context.run` back into a
+* Lunora function from inside a `defineQueue` push handler or a `defineWorkflow`
+* handler, whose args reference the handler's untrusted payload (`context.params`
+* for a workflow, a `for (… of batch.messages)` body for a queue) — the
+* `privileged_dispatch_unvalidated_payload` lint input. Both handler kinds run
+* under the **system identity** (RLS disabled), so forwarding attacker-influenced
+* payload into the dispatch bypasses the target's row policy. The resolved
+* `targetFile`/`targetExport` let the lint join RLS-procedure evidence and fire
+* only for RLS-gated targets. Structurally identical to `AdvisorPrivilegedDispatch`.
+*/
+interface PrivilegedDispatchIR {
+  /** `"queue"` for a `defineQueue` handler, `"workflow"` for a `defineWorkflow` handler. */
+  dispatchKind: "queue" | "workflow";
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** Export binding name of the handler performing the dispatch. */
+  handlerExport: string;
+  /** 1-based line of the dispatch call, or `0` when unknown. */
+  line: number;
+  /** Export name of the dispatched target (`send` in `api.messages.send`). */
+  targetExport: string;
+  /** File path of the dispatched target relative to `lunora/` (`messages` in `api.messages.send`). */
+  targetFile: string;
+}
+/**
 * One discovered `httpRoute.&lt;verb>("/admin/…")` route on an admin/privileged-looking
 * path, with whether its builder chain references an auth/admin guard — the
 * `admin_route_without_guard` lint input. Structurally identical to
@@ -684,6 +1263,317 @@ interface AdminRouteIR {
   /** `true` when the handler body references an auth/session/admin guard (`ctx.auth`, `getSession`, `requireAdmin`, …). */
   usesGuard: boolean;
 }
+/**
+* One tracked `ctx.storage.&lt;bucket>.&lt;method>(...)` upload/signing call — the
+* shared input for the storage config-hygiene security lints
+* (`storage_upload_without_content_type_allowlist`, `storage_upload_without_max_size`,
+* `storage_generate_upload_url_no_content_type_pin`, `storage_presigned_url_for_private_content`).
+* `upload`/`store` carry the `UploadOptions` guards (`allowedContentTypes` /
+* `maxSize`); `generateUploadUrl` carries the signed-PUT `contentType` pin;
+* `getPresignedUrl`/`getSignedUrl` carry a statically-known `expiresInSeconds`
+* literal. `presentKeys` is empty (and `expiresInSeconds` unset) when the
+* options argument was absent, a non-literal, or a spread — see `analyzable`.
+* Structurally identical to `AdvisorStorageUpload`.
+*/
+interface StorageUploadIR {
+  /** `true` when the call's options-object argument (or its deliberate absence) was statically resolvable. */
+  analyzable: boolean;
+  /** Numeric literal value of an `expiresInSeconds` option, when statically known (`getSignedUrl` / `getPresignedUrl` only). */
+  expiresInSeconds?: number;
+  /** Export binding name of the procedure performing the call. */
+  exportName: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the call, or `0` when unknown. */
+  line: number;
+  /** The `ctx.storage` method invoked. */
+  method: "generateUploadUrl" | "getPresignedUrl" | "getSignedUrl" | "store" | "upload";
+  /** Options-object keys present at the call site (empty when not `analyzable`, or when no options argument was passed). */
+  presentKeys: string[];
+}
+/**
+* One discovered `httpAction`/`httpRoute` handler in `lunora/` that performs a
+* side effect (`ctx.runMutation` / `ctx.runAction` / a `ctx.db.{insert,patch,
+* replace,delete,insertManyUnsafe}` write) from the HTTP edge, with whether it
+* reads `ctx.auth` — the `http_action_missing_auth_guard` lint input. A handler
+* that mutates state or dispatches an action without ever consulting the request
+* identity is an unauthenticated write bypassing identity/RLS. Only handlers with
+* a statically-resolvable inline body and `ctx` binding are recorded (fail-safe
+* under-report); read-only handlers are never recorded. Structurally identical to
+* `AdvisorHttpActionGuard`.
+*/
+interface HttpActionGuardIR {
+  /** Export binding name of the handler (or `"&lt;module>"` when mounted inline / not a named binding). */
+  exportName: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** Which HTTP surface the handler is: a raw `httpAction` or a typed `httpRoute` route. */
+  kind: "httpAction" | "httpRoute";
+  /** 1-based line of the handler call, or `0` when unknown. */
+  line: number;
+  /** For an `httpRoute`, the uppercased verb (`"POST"`); absent for a raw `httpAction`. */
+  method?: string;
+  /** `true` when the handler reads `ctx.auth` (a direct member access or a `const { auth } = ctx` destructure). */
+  readsAuth: boolean;
+  /** The first side effect found, as a stable label: `runMutation`, `runAction`, or `db.&lt;method>`. */
+  sideEffect: string;
+}
+/**
+* One response-header write, inside an `httpAction` handler, whose value is derived
+* from raw request input (`request.headers`, `request.url`/query, `await
+* request.json()`) with no CR/LF sanitizer — the
+* `http_action_response_header_injection` lint input. A `Request`-derived string
+* placed verbatim into a response header lets a caller smuggle `\r\n` and inject
+* extra headers or split the response (header injection / response splitting). Only
+* sites whose value is request-tainted AND unguarded are recorded: a value routed
+* through a CR/LF guard (`isSafeHeaderValue`), a URL/URI encoder
+* (`encodeURIComponent`/`encodeURI`), a numeric coercion (`Number`/`parseInt`/
+* `parseFloat`), or `btoa` is treated as safe and never recorded (`String(...)` /
+* `.toString()` are NOT sanitizers — they don't strip CR/LF). Structurally
+* identical to `AdvisorHttpHeaderWrite`.
+*/
+interface HttpHeaderWriteIR {
+  /** Export binding name of the enclosing handler, or `"&lt;module>"` when mounted inline. */
+  exportName: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** The header name being written (`"location"`), or `""` when the key is not a string literal. */
+  headerName: string;
+  /** 1-based line of the request-tainted header value. */
+  line: number;
+  /** How the header was written. */
+  via: "headers-append" | "headers-ctor" | "headers-set" | "response-init";
+}
+/**
+* One rate-limit / Turnstile middleware call in `lunora/` — the
+* `ratelimit_middleware_fail_open` lint input. `rateLimit`/`dbRateLimit`
+* (`@lunora/ratelimit`) and `verifyTurnstileMiddleware` (`@lunora/auth`) each
+* accept a `failOpen` escape hatch that admits every request when the
+* limiter/siteverify is unavailable; `failOpen` is `true` only when the options
+* literal set it to the boolean literal `true` (anything else is fail-closed).
+* The lint escalates a fail-open guard to a finding when the guarded procedure
+* (`exportName`/`limitName`) looks auth/payment-sensitive. Structurally
+* identical to `AdvisorFailOpenGuard`.
+*/
+interface FailOpenGuardIR {
+  /** The middleware factory at the call site: `rateLimit` / `dbRateLimit` / `verifyTurnstileMiddleware`. */
+  callee: string;
+  /** Export binding name of the procedure the guard is attached to, or `"&lt;module>"` at file scope. */
+  exportName: string;
+  /** `true` only when the options literal set `failOpen: true` as a boolean literal; a non-literal or absent option is treated as fail-closed. */
+  failOpen: boolean;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** The rate-limit `name` (second string argument) for `rateLimit`/`dbRateLimit`; `""` for `verifyTurnstileMiddleware`. */
+  limitName: string;
+  /** 1-based line of the middleware call, or `0` when unknown. */
+  line: number;
+}
+/**
+* One `ctx.flags.boolean("key", &lt;boolean-literal>)` read in `lunora/` — the
+* `flag_gates_security_with_unsafe_default` lint input. OpenFeature returns the
+* `defaultValue` when the provider errors, so a fail-open default on a
+* security-shaped key silently opens access during an outage. Only reads with a
+* statically-known string key and boolean-literal default are recorded; the lint
+* owns the security-shape + polarity judgment. Structurally identical to
+* `AdvisorFlagSecurityDefault`.
+*/
+interface FlagSecurityDefaultIR {
+  /** The boolean-literal default returned on a provider outage (fail-open value). */
+  defaultValue: boolean;
+  /** Export binding name of the procedure performing the flag read, or `"&lt;module>"` at file scope. */
+  exportName: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** The flag key — the first string-literal argument of `ctx.flags.boolean`. */
+  key: string;
+  /** 1-based line of the `ctx.flags.boolean` call, or `0` when unknown. */
+  line: number;
+}
+/**
+* One `generateText` / `streamText` call in `lunora/` whose `tools` reach a
+* privileged side effect (a DB write, function dispatch, or outbound
+* fetch/mail/queue send). `userInputDerived` records whether the model input
+* (`prompt`/`messages`/`system`) flows from the handler's `args`; the
+* `ai_tool_side_effect_prompt_injection` lint fires only when it does.
+* Structurally identical to `AdvisorAiToolSideEffect`.
+*/
+interface AiToolSideEffectIR {
+  /** Export binding name of the procedure performing the call. */
+  exportName: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the generation call, or `0` when unknown. */
+  line: number;
+  /** The generation entrypoint invoked. */
+  method: "generateText" | "streamText";
+  /** The privileged side-effect sink a model-callable tool reaches (`ctx.db.insert`, `ctx.run`, `ctx.fetch`, …). */
+  sideEffect: string;
+  /** `true` when a model-input option is derived from the handler's `args` (a bare `args.x`, or a name destructured from `args`). */
+  userInputDerived: boolean;
+}
+/**
+* One `&lt;receiver>.identity.&lt;key>` claim read in `lunora/`, where `&lt;receiver>` is
+* an RLS/mask policy `auth` (or `ctx.auth`/`context.auth`). `declared` records
+* whether `&lt;key>` is in the app's `defineIdentity({ ... })` contract (or the
+* always-present `userId`); the `identity_undeclared_claim_trusted` lint fires on
+* the undeclared reads. Emitted only when a resolvable identity contract exists.
+* Structurally identical to `AdvisorIdentityClaimRead`.
+*/
+interface IdentityClaimReadIR {
+  /** `true` when `key` is a declared claim (in the `defineIdentity` contract, or the always-present `userId`). */
+  declared: boolean;
+  /** Export binding name of the enclosing declaration (`&lt;module>` at file scope). */
+  exportName: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** The claim key read off the identity bag. */
+  key: string;
+  /** 1-based line of the read, or `0` when unknown. */
+  line: number;
+}
+/**
+* One payment webhook-adapter construction in `lunora/` (`createStripeAdapter` /
+* `createPolarAdapter` / `createAutumnAdapter` / `createDodoPaymentsAdapter`).
+* `toleranceSeconds` carries the statically-known `webhookToleranceSeconds`
+* replay window when it is a plain numeric literal; the payment-webhook
+* wide-tolerance lint fires when it exceeds a conservative ceiling. Structurally
+* identical to `AdvisorPaymentWebhook`.
+*/
+interface PaymentWebhookIR {
+  /** The adapter factory invoked. */
+  callee: "createAutumnAdapter" | "createDodoPaymentsAdapter" | "createPolarAdapter" | "createStripeAdapter";
+  /** Export binding name of the enclosing declaration (`&lt;module>` at file scope). */
+  exportName: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the construction, or `0` when unknown. */
+  line: number;
+  /** Statically-known `webhookToleranceSeconds` literal, when present and a plain numeric literal. */
+  toleranceSeconds?: number;
+}
+/**
+* One `ctx.db.&lt;table>.findMany({ includeDeleted })` list read whose
+* `includeDeleted` is either a hardcoded `true` or derived from the handler's
+* `args` — the `soft_delete_include_deleted_from_args` lint input. The lint joins
+* `table` against the schema's soft-delete tables and `visibility` against
+* `.public()` before flagging. Structurally identical to `AdvisorSoftDeleteRead`
+* so values pass straight through without conversion.
+*/
+interface SoftDeleteReadIR {
+  /** Export binding name of the procedure performing the read. */
+  exportName: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** `true` when `includeDeleted` was derived from the handler's `args` (any caller can flip it). */
+  fromArgs: boolean;
+  /** `true` when `includeDeleted` was a hardcoded `true` literal (always resurfaces soft-deleted rows). */
+  hardcodedTrue: boolean;
+  /** 1-based line of the read call. */
+  line: number;
+  /** Table read, or `""` when the table-arg form's first argument wasn't a string literal. */
+  table: string;
+  /** `"internal"` for `internalQuery` / `internalMutation` / `internalAction`. */
+  visibility: "internal" | "public";
+}
+/**
+* One `ctx.db.&lt;table>.findMany({ with: { &lt;rel> } })` relation-hydrating list read
+* — the `masked_relation_leak_via_with` lint input. Column masking does not
+* descend into `with`-hydrated relations, so a masked table surfaced only through
+* a `with` on an unprotected parent read is returned in the clear. The lint
+* resolves each relation accessor to its target table and joins it against the
+* discovered mask evidence before flagging. Structurally identical to
+* `AdvisorRelationLoad` so values pass straight through without conversion.
+*/
+interface RelationLoadIR {
+  /** Export binding name of the procedure performing the read. */
+  exportName: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the read call. */
+  line: number;
+  /** Parent table the read targets, or `""` when the table-arg form's first argument wasn't a string literal. */
+  parentTable: string;
+  /** Relation accessor names named in the read's `with: { … }` map — matched against the parent table's declared relations. */
+  relations: string[];
+  /** `"internal"` for `internalQuery` / `internalMutation` / `internalAction`. */
+  visibility: "internal" | "public";
+}
+/**
+* One `query` handler whose `return` hands back the raw rows of a table — the
+* result of a `ctx.db.&lt;table>.findMany()` / `.findFirst()` / `.get()` read, or a
+* `ctx.db.query("&lt;table>")…collect()` fluent chain — returned directly (or through
+* one local `const` hop) with no hand-built projection. The
+* `output_projection_missing_on_public_read` lint keeps only `visibility ===
+* "public"` rows with no `.output(...)` / `.use(mask(...))` on the chain, then
+* joins `table` against the schema and flags one whose columns are PII-named.
+* Structurally identical to `AdvisorRawRowReturn` so values pass straight through
+* without conversion.
+*/
+interface RawRowReturnIR {
+  /** Export binding name of the query returning the raw rows. */
+  exportName: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the `return` (or concise-body) expression. */
+  line: number;
+  /** Table whose raw rows are returned, or `""` when the read's table wasn't a string literal. */
+  table: string;
+  /** `true` when the procedure's builder chain carries a `.use(mask(...))` step. */
+  usesMask: boolean;
+  /** `true` when the procedure's builder chain carries an `.output(...)` return-shape projection. */
+  usesOutput: boolean;
+  /** `"internal"` for `internalQuery`; `"public"` for `query`. */
+  visibility: "internal" | "public";
+}
+/**
+* One `query`/`mutation` handler that gates a `ctx.db.get`/`patch`/`delete` on a
+* null-checked `ctx.db.normalizeId(table, id)` result — the
+* `normalize_id_used_as_authorization` lint input. `normalizeId` validates an id's
+* structural shape only (it never reads the database), so a non-null result proves
+* the id is well-formed, never that the caller owns the row; gating access on it is
+* an IDOR. The lint owns the negative proof — it keeps only `visibility === "public"`
+* rows with no `.use(rls(...))` and no ownership/identity mention (`mentionsOwnership`),
+* then joins `table` against the schema's RLS mode before flagging. Structurally
+* identical to `AdvisorNormalizeIdAuthorization` so values pass straight through.
+*/
+interface NormalizeIdAuthorizationIR {
+  /** Export binding name of the procedure performing the normalize-then-access. */
+  exportName: string;
+  /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
+  file: string;
+  /** 1-based line of the `ctx.db.normalizeId(...)` call the access is gated on. */
+  line: number;
+  /** `true` when the handler anywhere reads an ownership-named identifier or `ctx.auth`/`ctx.identity`/… — an intervening ownership signal. */
+  mentionsOwnership: boolean;
+  /** The id-first `ctx.db` sink the normalized id reaches. */
+  sinkMethod: "delete" | "get" | "patch";
+  /** Table named in the `normalizeId` call, or `""` when its table argument wasn't a string literal. */
+  table: string;
+  /** `true` when the procedure's builder chain carries a `.use(rls(...))` step. */
+  usesRls: boolean;
+  /** `"internal"` for `internalQuery`/`internalMutation`; `"public"` for `query`/`mutation`. */
+  visibility: "internal" | "public";
+}
+/**
+* One committed `wrangler.jsonc` `vars` entry whose value is a plaintext secret —
+* the `plaintext_secret_in_wrangler_vars` lint input. `vars` are baked into the
+* deployed Worker in cleartext and checked into source control, so a real API key
+* / token / private key there ships the secret to every reader of the repo and the
+* bundle; it belongs in a Secrets Store binding or `wrangler secret put`. Produced
+* by `@lunora/config` (which reads `wrangler.jsonc`), not a ts-morph feeder —
+* codegen only passes it through. Structurally identical to `AdvisorWranglerVariable`.
+*/
+interface WranglerVariableIR {
+  /** The `wrangler.jsonc` file the var was read from, relative to the project root. */
+  file: string;
+  /** The offending `vars` key (e.g. `STRIPE_SECRET_KEY`). */
+  key: string;
+  /** Heuristic that matched, e.g. `stripe_live_key` / `private_key` / `secret_named_var`. */
+  kind: string;
+  /** Redacted preview of the value (first few chars + length) for the finding detail — never the full secret. */
+  preview: string;
+}
 interface ProjectIR {
   crons: ReadonlyArray<CronJobIR>;
   functions: ReadonlyArray<FunctionIR>;
@@ -696,17 +1586,78 @@ interface ProjectIR {
 * Run the static lints against a discovered {@link SchemaIR} and the reads/writes/calls
 * found in function bodies: query reads feed `filter_without_index`, insert writes
 * feed `table_without_insert`, authApi calls feed `auth_api_call_without_headers`,
-* rls procedure snapshots feed `rls_uncovered_table`, and mask procedure
-* snapshots feed `mask_uncovered_pii_column`; declared containers
-* feed the `container_*` lints; declared workflows + `ctx.workflows.get(...)` call
-* sites feed the `workflow_unused` / `workflow_unknown_target` lints; non-deterministic
+* rls procedure snapshots feed `rls_uncovered_table`, mask procedure
+* snapshots feed `mask_uncovered_pii_column`, and per-column mask strategies
+* feed `mask_weak_hash_strategy_on_pii`; declared containers
+* feed the `container_*` lints; declared workflows (with their durable step labels)
+* + `ctx.workflows.get(...)` call sites feed the `workflow_unused` /
+* `workflow_unknown_target` / duplicate-step-name lints; non-deterministic
 * calls inside query/mutation handlers feed the `nondeterministic_query_mutation` lint
 * (all default empty for callers that don't analyze functions/containers/workflows).
 * The IR types are structurally identical to the advisor's evidence types so they
 * pass straight through without conversion. Returns the findings; surfacing them
 * (console, error overlay, studio Advisors table) is the caller's choice.
 */
-declare const lintSchema: (schema: SchemaIR, queries?: ReadonlyArray<QueryReadIR>, inserts?: ReadonlyArray<InsertWriteIR>, authApiCalls?: ReadonlyArray<AuthApiCallIR>, rlsProcedures?: ReadonlyArray<RlsProcedureIR>, containers?: ReadonlyArray<ContainerIR>, workflows?: ReadonlyArray<WorkflowIR>, workflowCalls?: ReadonlyArray<WorkflowCallIR>, maskProcedures?: ReadonlyArray<MaskProcedureIR>, nondeterministicCalls?: ReadonlyArray<NondeterministicCallIR>, procedureProtections?: ReadonlyArray<ProcedureMiddlewareIR>, argumentValidators?: ReadonlyArray<ArgumentValidatorIR>, secretLiterals?: ReadonlyArray<SecretLiteralIR>, sqlInterpolations?: ReadonlyArray<SqlInterpolationIR>, adminRoutes?: ReadonlyArray<AdminRouteIR>, r2sqlCalls?: ReadonlyArray<R2sqlCallIR>) => Finding[];
+/**
+* Named inputs for {@link lintSchema}. Every feeder is a discrete key rather than
+* a positional argument: the feeder list grows every few releases and many IR
+* types are structurally similar (`{file, exportName, line}`-shaped evidence),
+* so a positional call was a silent-transposition hazard — swapping two adjacent
+* arguments could typecheck yet feed the wrong evidence to the wrong lint and
+* corrupt a security advisory. `schema` is the only required field; every other
+* feeder defaults to "not analyzed" when omitted.
+*/
+interface LintSchemaOptions {
+  adminRoutes?: ReadonlyArray<AdminRouteIR>;
+  aiRawRuns?: ReadonlyArray<AiRawRunIR>;
+  aiToolSideEffects?: ReadonlyArray<AiToolSideEffectIR>;
+  argumentDerivedFetches?: ReadonlyArray<ArgumentDerivedFetchIR>;
+  argumentValidators?: ReadonlyArray<ArgumentValidatorIR>;
+  authApiCalls?: ReadonlyArray<AuthApiCallIR>;
+  authConfigs?: ReadonlyArray<AuthConfigIR>;
+  browserUrlAccesses?: ReadonlyArray<BrowserUrlAccessIR>;
+  configCalls?: ReadonlyArray<ConfigCallIR>;
+  containerKeyAccesses?: ReadonlyArray<ContainerKeyAccessIR>;
+  containerOverrides?: ReadonlyArray<ContainerOverrideIR>;
+  containers?: ReadonlyArray<ContainerIR>;
+  failOpenGuards?: ReadonlyArray<FailOpenGuardIR>;
+  flagSecurityDefaults?: ReadonlyArray<FlagSecurityDefaultIR>;
+  httpActionGuards?: ReadonlyArray<HttpActionGuardIR>;
+  httpHeaderWrites?: ReadonlyArray<HttpHeaderWriteIR>;
+  identityClaimReads?: ReadonlyArray<IdentityClaimReadIR>;
+  imageDeliveryUrlAccesses?: ReadonlyArray<ImageDeliveryUrlAccessIR>;
+  inserts?: ReadonlyArray<InsertWriteIR>;
+  kvKeyAccesses?: ReadonlyArray<KvKeyAccessIR>;
+  mailRecipientAccesses?: ReadonlyArray<MailRecipientAccessIR>;
+  maskProcedures?: ReadonlyArray<MaskProcedureIR>;
+  maskStrategies?: ReadonlyArray<MaskStrategyIR>;
+  mutatorWrites?: ReadonlyArray<MutatorWriteIR>;
+  nondeterministicCalls?: ReadonlyArray<NondeterministicCallIR>;
+  normalizeIdAuthorizations?: ReadonlyArray<NormalizeIdAuthorizationIR>;
+  ownerFieldWrites?: ReadonlyArray<OwnerFieldWriteIR>;
+  paymentWebhooks?: ReadonlyArray<PaymentWebhookIR>;
+  privilegedDispatches?: ReadonlyArray<PrivilegedDispatchIR>;
+  procedureProtections?: ReadonlyArray<ProcedureMiddlewareIR>;
+  queries?: ReadonlyArray<QueryReadIR>;
+  queues?: ReadonlyArray<QueueIR>;
+  r2sqlCalls?: ReadonlyArray<R2sqlCallIR>;
+  ratelimitKeySelectors?: ReadonlyArray<RatelimitKeySelectorIR>;
+  rawRowReturns?: ReadonlyArray<RawRowReturnIR>;
+  relationLoads?: ReadonlyArray<RelationLoadIR>;
+  rlsProcedures?: ReadonlyArray<RlsProcedureIR>;
+  schema: SchemaIR;
+  secretLiterals?: ReadonlyArray<SecretLiteralIR>;
+  shapes?: ReadonlyArray<ShapeIR>;
+  softDeleteReads?: ReadonlyArray<SoftDeleteReadIR>;
+  sqlInterpolations?: ReadonlyArray<SqlInterpolationIR>;
+  storageKeyAccesses?: ReadonlyArray<StorageKeyAccessIR>;
+  storageUploads?: ReadonlyArray<StorageUploadIR>;
+  vectorNamespaceAccesses?: ReadonlyArray<VectorNamespaceAccessIR>;
+  workflowCalls?: ReadonlyArray<WorkflowCallIR>;
+  workflows?: ReadonlyArray<WorkflowIR>;
+  wranglerVariables?: ReadonlyArray<WranglerVariableIR>;
+}
+declare const lintSchema: (options: LintSchemaOptions) => Finding[];
 /**
 * Render advisor findings as a single multi-line string for console surfacing:
 * a one-line summary header followed by one `[LEVEL] name: detail` line per
@@ -716,10 +1667,12 @@ declare const formatAdvisories: (findings: ReadonlyArray<Finding>) => string;
 /**
 * An error thrown by codegen discovery when the user's schema or function
 * source has a structural problem that can be pinpointed to a specific source
-* location. The `file`, `line`, and `column` properties mirror what Vite's
-* error-overlay `loc` field expects so the browser can display the exact spot.
+* location. A `LunoraError` subclass (`code: "CODEGEN_DIAGNOSTIC"`); the `file`,
+* `line`, and `column` properties (also passed through as the base `loc`) mirror
+* what Vite's error-overlay `loc` field expects so the browser can display the
+* exact spot.
 */
-declare class CodegenDiagnosticError extends Error {
+declare class CodegenDiagnosticError extends LunoraError {
   readonly column: number;
   readonly file: string;
   readonly line: number;
@@ -731,8 +1684,14 @@ declare class CodegenDiagnosticError extends Error {
 * ts-morph `Node`'s position in its source file.
 *
 * Message format: `@lunora/codegen: &lt;detail> (&lt;file>:&lt;line>:&lt;column>)`
+*
+* `meta` is merged onto the returned error for callers that also carry the
+* project-wide `LunoraError` envelope (`code`/`name`/`status`) — it never
+* touches `file`/`line`/`column`, and the error stays an instance of
+* {@link CodegenDiagnosticError} so the Vite overlay's `instanceof` location
+* lookup is unaffected.
 */
-declare const diagnosticAt: (node: Node, detail: string) => CodegenDiagnosticError;
+declare const diagnosticAt: (node: Node, detail: string, meta?: Record<string, unknown>) => CodegenDiagnosticError;
 /**
 * Discover `ctx.authApi.&lt;method>(...)` (and bare `authApi.&lt;method>(...)`) calls
 * under the lunora source directory and attribute each to the exported function
@@ -758,6 +1717,21 @@ declare const discoverContainers: (project: Project, lunoraDirectory: string) =>
 * workflow start. Names must be unique across the project.
 */
 declare const discoverCrons: (project: Project, lunoraDirectory: string, workflows?: ReadonlyArray<WorkflowIR>) => CronJobIR[];
+/** The only file a feature-flag provider may be declared in — mirrors `lunora/queues.ts`. */
+declare const FLAGS_FILENAME = "flags.ts";
+/** One statically-discovered flag read: the key plus the value type its `ctx.flags.&lt;type>` call implies. */
+
+/**
+* Discover the feature-flag provider a project declares in `lunora/flags.ts`.
+* Returns `undefined` when the file doesn't exist (the app has no flags). The
+* read is metadata-only and lenient: codegen wires `ctx.flags` purely from the
+* file's *existence* (`run-codegen.ts`) and imports the real module for the
+* provider value — this IR exists solely so the config layer can reconcile the
+* wrangler `flagship` binding for the Flagship binding-mode provider. Anything
+* it can't read statically degrades to a `custom` provider (no binding), never
+* a thrown error.
+*/
+declare const discoverFlags: (project: Project, lunoraDirectory: string) => FlagsIR | undefined;
 /**
 * Scan all .ts files under `lunoraDir` (skipping `_generated/` and `schema.ts`)
 * for top-level `export const x = query/mutation/action({...})` registrations.
@@ -800,6 +1774,23 @@ declare const discoverMaskProcedures: (project: Project, lunoraDirectory: string
 * key); `table` is best-effort and left `""` when not a literal.
 */
 declare const discoverMigrations: (project: Project, lunoraDirectory: string) => MigrationIR[];
+/** The only file custom mutators may be declared in — mirrors `lunora/queues.ts`. */
+declare const MUTATORS_FILENAME = "mutators.ts";
+/**
+* Decide whether a call's callee is `defineMutator` — either the bare imported
+* identifier (`defineMutator(...)`) or a namespace member access
+* (`server.defineMutator(...)`). Both are valid ES module syntax, so discovery
+* must see mutators declared either way.
+*/
+
+/**
+* Discover every custom mutator the project declares: exported
+* `defineMutator()` calls in `lunora/mutators.ts`. Returns `[]` when the file
+* doesn't exist. Only the export binding is lifted — the runtime object carries
+* the authoritative `server` impl + `handler`, so codegen never evaluates the
+* body. The client `client` impl is split into the browser bundle separately.
+*/
+declare const discoverMutators: (project: Project, lunoraDirectory: string) => MutatorIR[];
 /**
 * Discover non-deterministic API calls (`Date.now`, `new Date()`, `Date()`,
 * `Math.random`, `crypto.randomUUID`, `crypto.getRandomValues` — including
@@ -823,6 +1814,15 @@ declare const discoverNondeterministicCalls: (project: Project, lunoraDirectory:
 * dropping the rest keeps the lint input small.
 */
 declare const discoverQueries: (project: Project, lunoraDirectory: string) => QueryReadIR[];
+/** The only file queues may be declared in — mirrors `lunora/workflows.ts`. */
+declare const QUEUES_FILENAME = "queues.ts";
+/**
+* Discover every queue the project declares: exported `defineQueue()` calls in
+* `lunora/queues.ts`. Returns `[]` when the file doesn't exist. Only the
+* wrangler-relevant literals (`name`/`mode`/batch tuning) are read; the handler
+* body is runtime-only, so codegen never evaluates it.
+*/
+declare const discoverQueues: (project: Project, lunoraDirectory: string) => QueueIR[];
 /**
 * Discover `ctx.r2sql` accesses lexically inside the handler body of every
 * exported `query(...)` / `mutation(...)` registration under the lunora source
@@ -855,7 +1855,17 @@ declare const discoverRlsMetadata: (project: Project, lunoraDirectory: string) =
 * Load `&lt;projectRoot>/lunora/schema.ts`, find `defineSchema({...})`, and
 * return a structural IR. Throws if the file or call cannot be found.
 */
-declare const discoverSchema: (project: Project, schemaPath: string) => SchemaIR;
+declare const discoverSchema: (project: Project, schemaPath: string, projectRoot?: string) => SchemaIR;
+/** The only file shapes may be declared in — mirrors `lunora/queues.ts`. */
+declare const SHAPES_FILENAME = "shapes.ts";
+/**
+* Discover every replication shape the project declares: exported
+* `defineShape()` calls in `lunora/shapes.ts`. Returns `[]` when the file
+* doesn't exist. Only the export binding is lifted — the runtime object carries
+* the authoritative `table`/`columns`/`compileWhere`, so codegen never
+* evaluates the predicate.
+*/
+declare const discoverShapes: (project: Project, lunoraDirectory: string) => ShapeIR[];
 /**
 * Aggregate the schema-wide storage-rule metadata the studio's inspector reads:
 * every statically-discovered `(bucket, on, prefix, procedure)` entry across all
@@ -894,24 +1904,69 @@ declare const emitApi: (functions: ReadonlyArray<FunctionIR>, workflows?: Readon
 * Returns `""` when `@lunora/seed` is not a declared dependency, so projects
 * that don't use it keep a clean `_generated/` and never import the package.
 */
+
+/**
+* Emit `_generated/collections.ts` — one TanStack DB collection factory per
+* `defineShape` in `lunora/shapes.ts` (the local-first partial-replication
+* surface). Each factory builds a live collection that syncs its shape's rowset
+* through the client's poke protocol (`subscribeShape`), so an app feeds the
+* result straight to `useLiveQuery`.
+*
+* Returns `""` (so `writeIfPresent` skips the file) unless the project both
+* declares shapes AND installs `@lunora/db` — the add-on that ships
+* `lunoraCollectionOptions`. `@lunora/db` stays a scoped install even under the
+* `lunorash` umbrella (an opt-in add-on, like `@lunora/auth`), so its import is
+* always `@lunora/db/collections`; only the in-umbrella `@lunora/client` import
+* is remapped to `lunorash/client`.
+*/
+declare const emitCollections: (shapes: ReadonlyArray<ShapeIR>, hasDatabase: boolean, useUmbrella?: boolean) => string;
 interface EmitServerOptions {
   containers?: ReadonlyArray<ContainerIR>;
+  /**
+  * The single `defineEnv(...)` contract declared in `lunora/env.ts`. When
+  * present, `ctx.env` is typed as the validated `InferEnv` shape (recovered
+  * via `ReturnType` over the accessor's `typeof`). `undefined` leaves `ctx.env`
+  * the base optional binding record — byte-identical to today.
+  */
+  env?: EnvIR;
+  /**
+  * A `lunora/` source reads `ctx.access` — wires the verified Cloudflare Access
+  * facade (`@lunora/cloudflare-access/context`) onto every ctx. Distinct from
+  * `emitApp`'s `hasAccess` (which gates the worker's `.access()` resolveIdentity
+  * method); this one gates the per-request `ctx.access` read surface.
+  */
+  hasAccessFacade?: boolean;
   hasAi?: boolean;
-  /** A `lunora/` source uses `@lunora/analytics` / `ctx.analytics` — wires the write helper onto every ctx. */
+  /** A `lunora/` source uses `@lunora/bindings/analytics` / `ctx.analytics` — wires the write helper onto every ctx. */
   hasAnalytics?: boolean;
   /** A `lunora/` source uses `@lunora/browser` / `ctx.browser` — wires `ctx.browser` onto ActionCtx only. */
   hasBrowser?: boolean;
+  /** The project declares `lunora/flags.ts` — wires `ctx.flags` (OpenFeature) onto every ctx. */
+  hasFlags?: boolean;
   /** A `lunora/` source uses `@lunora/hyperdrive` / `ctx.sql` — wires `ctx.sql` onto ActionCtx only. */
   hasHyperdrive?: boolean;
-  /** A `lunora/` source uses `@lunora/images` / `ctx.images` — wires `ctx.images` onto ActionCtx only. */
+  /** A `lunora/` source uses `@lunora/bindings/images` / `ctx.images` — wires `ctx.images` onto ActionCtx only. */
   hasImages?: boolean;
-  /** A `lunora/` source uses `@lunora/kv` / `ctx.kv` — wires `ctx.kv` onto every ctx. */
+  /** A `lunora/` source uses `@lunora/bindings/kv` / `ctx.kv` — wires `ctx.kv` onto every ctx. */
   hasKv?: boolean;
   hasPayments?: boolean;
-  /** A `lunora/` source uses `@lunora/pipelines` / `ctx.pipelines` — wires `ctx.pipelines` onto ActionCtx only. */
+  /** A `lunora/` source uses `@lunora/bindings/pipelines` / `ctx.pipelines` — wires `ctx.pipelines` onto ActionCtx only. */
   hasPipelines?: boolean;
-  /** A `lunora/` source uses `@lunora/r2sql` / `ctx.r2sql` — wires `ctx.r2sql` onto ActionCtx only. */
+  /** A `lunora/` source uses `@lunora/bindings/r2sql` / `ctx.r2sql` — wires `ctx.r2sql` onto ActionCtx only. */
   hasR2sql?: boolean;
+  /** A `lunora/` source uses `@lunora/x402/pay` / `ctx.x402` — wires the agent-wallet pay rail onto ActionCtx only. */
+  hasX402?: boolean;
+  /**
+  * The single `defineIdentity(...)` claim contract declared in
+  * `lunora/identity.ts` (Plan 080). When present, `ctx.auth.getIdentity()`,
+  * the RLS policy `ctx.auth.identity`, and the shard-authorization hooks
+  * narrow to the declared shape (recovered via `InferIdentity` over the
+  * contract's `typeof`). `undefined` keeps the identity an untyped bag —
+  * byte-identical to today.
+  */
+  identity?: IdentityIR;
+  /** Queues declared via `defineQueue` exports — wires the typed `ctx.queues` producers onto Mutation/Action contexts. */
+  queues?: ReadonlyArray<QueueIR>;
   schema?: SchemaIR;
   storageRuleBuckets?: ReadonlyArray<string>;
   /** The project depends on the `lunora` umbrella — import base packages via its subpaths. */
@@ -920,21 +1975,27 @@ interface EmitServerOptions {
 }
 declare const emitServer: ({
   containers,
+  env,
+  hasAccessFacade,
   hasAi,
   hasAnalytics,
   hasBrowser,
+  hasFlags,
   hasHyperdrive,
   hasImages,
   hasKv,
   hasPayments,
   hasPipelines,
   hasR2sql,
+  hasX402,
+  identity,
+  queues,
   schema,
   storageRuleBuckets,
   useUmbrella,
   workflows
 }?: EmitServerOptions) => string;
-declare const emitFunctions: (functions: ReadonlyArray<FunctionIR>, migrations?: ReadonlyArray<MigrationIR>) => string;
+declare const emitFunctions: (functions: ReadonlyArray<FunctionIR>, migrations?: ReadonlyArray<MigrationIR>, useUmbrella?: boolean, mutators?: ReadonlyArray<MutatorIR>, shapes?: ReadonlyArray<ShapeIR>) => string;
 /**
 * Storage-column map per table for the file browser: `{ table: [field, …] }` for
 * every field declared `v.storage(...)` (unwrapping `v.optional(...)`). The
@@ -952,7 +2013,7 @@ declare const emitFunctions: (functions: ReadonlyArray<FunctionIR>, migrations?:
 * `containers[].class_name` to be exported by the deployed worker. Returns ""
 * when the project declares no containers (the file is not written then).
 */
-declare const emitContainers: (containers: ReadonlyArray<ContainerIR>) => string;
+declare const emitContainers: (containers: ReadonlyArray<ContainerIR>, jurisdiction?: JurisdictionIR) => string;
 /**
 * Emit `_generated/workflows.ts` — one `WorkflowEntrypoint` class per
 * `defineWorkflow` export, each a thin subclass of `LunoraWorkflow`
@@ -962,14 +2023,33 @@ declare const emitContainers: (containers: ReadonlyArray<ContainerIR>) => string
 * when the project declares no workflows (the file is not written then).
 */
 declare const emitWorkflows: (workflows: ReadonlyArray<WorkflowIR>) => string;
+/**
+* Emit `_generated/queues.ts` — the push-consumer registry the worker `queue()`
+* handler dispatches through. Maps each push queue's stable wrangler name (which
+* `batch.queue` carries) to its `defineQueue` definition + export name. Pull
+* queues are consumed by an external worker, so they carry no handler and are
+* omitted here. Returns "" (and the file is not written) when no push queues are
+* declared — a pull-only or queue-free app keeps a clean `_generated/`.
+*/
 interface EmitShardOptions {
   advisories?: ReadonlyArray<Finding>;
   containers?: ReadonlyArray<ContainerIR>;
+  /** The single `defineEnv(...)` contract declared in `lunora/env.ts` — applies the accessor to the worker `env` to populate `ctx.env`. */
+  env?: EnvIR;
+  /** Statically-discovered `ctx.flags.&lt;type>("key")` reads — the studio Flags page + reactive evaluation iterate these. */
+  flagKeys?: ReadonlyArray<{
+    key: string;
+    type: "boolean" | "number" | "object" | "string";
+  }>;
+  /** A `lunora/` source reads `ctx.access` — wires the verified Cloudflare Access facade onto every ctx. */
+  hasAccessFacade?: boolean;
   hasAi?: boolean;
   /** A `lunora/` source reads `ctx.analytics` — wires the Analytics Engine write helper onto every ctx. */
   hasAnalytics?: boolean;
   /** A `lunora/` source reads `ctx.browser` — wires `ctx.browser` onto the ActionCtx only. */
   hasBrowser?: boolean;
+  /** The project declares `lunora/flags.ts` — wires `ctx.flags` (OpenFeature) onto every ctx. */
+  hasFlags?: boolean;
   /** A `lunora/` source reads `ctx.sql` (Hyperdrive) — wires `ctx.sql` onto the ActionCtx only. */
   hasHyperdrive?: boolean;
   /** A `lunora/` source reads `ctx.images` — wires `ctx.images` onto the ActionCtx only. */
@@ -977,11 +2057,21 @@ interface EmitShardOptions {
   /** A `lunora/` source reads `ctx.kv` — wires `ctx.kv` onto every ctx. */
   hasKv?: boolean;
   hasPayments?: boolean;
+  /** A `lunora/` source reads `ctx.pipelines` — wires `ctx.pipelines` onto the ActionCtx only. */
+  hasPipelines?: boolean;
   /** A `lunora/` source reads `ctx.r2sql` (R2 SQL) — wires `ctx.r2sql` onto the ActionCtx only. */
   hasR2sql?: boolean;
+  /** A `lunora/` source reads `ctx.x402` — wires the agent-wallet pay rail onto the ActionCtx only. */
+  hasX402?: boolean;
   maskMetadata?: MaskMetadataIR;
+  /** Custom mutators declared via `defineMutator` in `lunora/mutators.ts` — wires the `isCustomMutator` push-protocol override. */
+  mutators?: ReadonlyArray<MutatorIR>;
+  /** Queues declared via `defineQueue` exports in `lunora/queues.ts` — wires the typed `ctx.queues` producers. */
+  queues?: ReadonlyArray<QueueIR>;
   rlsMetadata?: RlsMetadataIR;
   schema: SchemaIR;
+  /** Replication shapes declared via `defineShape` in `lunora/shapes.ts` — wires the `resolveShape` subscription override. */
+  shapes?: ReadonlyArray<ShapeIR>;
   storageRules?: StorageRulesMetadataIR;
   studioFeatures?: StudioFeaturesResult;
   /** The project depends on the `lunora` umbrella — import base packages via its subpaths. */
@@ -991,17 +2081,26 @@ interface EmitShardOptions {
 declare const emitShard: ({
   advisories,
   containers,
+  env,
+  flagKeys,
+  hasAccessFacade,
   hasAi,
   hasAnalytics,
   hasBrowser,
+  hasFlags,
   hasHyperdrive,
   hasImages,
   hasKv,
   hasPayments,
+  hasPipelines,
   hasR2sql,
+  hasX402,
   maskMetadata,
+  mutators,
+  queues,
   rlsMetadata,
   schema,
+  shapes,
   storageRules,
   studioFeatures,
   useUmbrella,
@@ -1066,9 +2165,11 @@ declare const emitVectors: (vectorIndexes: ReadonlyArray<VectorIndexIR>) => stri
 declare const emitWranglerCronTriggers: (crons: ReadonlyArray<CronJobIR>) => string[];
 /** Which capability methods the generated `defineApp` builder exposes — one flag per package-backed feature the app actually uses. */
 interface EmitAppOptions {
+  /** App depends on `@lunora/cloudflare-access` → emit `.access()` (wire the Cloudflare Access `resolveIdentity`, composed ahead of `@lunora/auth` when both are present). */
+  hasAccess: boolean;
   /** App uses `@lunora/ai` / `ctx.ai` → emit `.ai()` (override the Workers AI binding backing `ctx.ai`). */
   hasAi: boolean;
-  /** App uses `@lunora/analytics` / `ctx.analytics` → emit `.analytics()` (override the dataset backing `ctx.analytics`). */
+  /** App uses `@lunora/bindings/analytics` / `ctx.analytics` → emit `.analytics()` (override the dataset backing `ctx.analytics`). */
   hasAnalytics: boolean;
   /** App depends on `@lunora/auth` → emit `.auth()` + the lazy build/migrate dance. */
   hasAuth: boolean;
@@ -1082,13 +2183,15 @@ interface EmitAppOptions {
   hasHyperdrive: boolean;
   /** Schema declares **Hyperdrive-backed** `.global({ backend: "hyperdrive" })` tables → emit `.hyperdriveGlobal()` (reactive Postgres/MySQL ctx-db over Hyperdrive). */
   hasHyperdriveGlobal: boolean;
-  /** App uses `@lunora/images` / `ctx.images` → emit `.images()`. */
+  /** App uses `@lunora/bindings/images` / `ctx.images` → emit `.images()`. */
   hasImages: boolean;
-  /** App uses `@lunora/kv` / `ctx.kv` → emit `.kv()`. */
+  /** App uses `@lunora/bindings/kv` / `ctx.kv` → emit `.kv()`. */
   hasKv: boolean;
   /** App uses `@lunora/payment` / `ctx.payments` → emit `.payment()`. */
   hasPayments: boolean;
-  /** App uses `@lunora/r2sql` / `ctx.r2sql` → emit `.r2sql()`. */
+  /** App declares push queues (`defineQueue`) → wire `LUNORA_QUEUE_REGISTRY` into the worker's `queue()` consumer entry. */
+  hasQueue: boolean;
+  /** App uses `@lunora/bindings/r2sql` / `ctx.r2sql` → emit `.r2sql()`. */
   hasR2sql: boolean;
   /** App imports `@lunora/scheduler` / declares crons → emit `.scheduler()`. */
   hasScheduler: boolean;
@@ -1098,6 +2201,12 @@ interface EmitAppOptions {
   hasVectors: boolean;
   /** App declares Cloudflare Workflows (`defineWorkflow`) → wire `options.workflowsClient` so the studio's workflow-instance proxy can reach the CF REST API. */
   hasWorkflow: boolean;
+  /** App uses `@lunora/x402/pay` / `ctx.x402` → emit `.x402()` (wire the agent-wallet pay rail). */
+  hasX402: boolean;
+  /** The single `defineIdentity(...)` contract in `lunora/identity.ts` (Plan 080) → import it as a VALUE and wire `options.identity`, so the runtime trust boundary validates every resolved identity before it becomes `ctx.auth`. `undefined` ⇒ no wiring, byte-identical output. */
+  identity?: IdentityIR;
+  /** Schema declares `.jurisdiction("…")` → pin every DO the worker reaches (shards, fan-out, scheduler, containers) to the Cloudflare data-residency jurisdiction. */
+  jurisdiction?: JurisdictionIR;
   /** Project depends on the unscoped `lunorash` umbrella → import the runtime via `lunorash/runtime` instead of `@lunora/runtime`. */
   useUmbrella: boolean;
   /** An OpenAPI spec is emitted (`openapi.ts`) → wire `openApiSpec` into the worker. */
@@ -1242,6 +2351,19 @@ interface TableSnapshot {
 }
 /** The committed baseline — a deterministic structural view of the whole schema. */
 interface SchemaSnapshot {
+  /**
+  * Cloudflare DO data-residency jurisdiction declared via `.jurisdiction("…")`,
+  * or absent. Tracked because changing it strands all existing Durable Object
+  * data (a DO name maps to a different ID per jurisdiction). Optional, so old
+  * baselines written before this field parse cleanly (absent ⇒ undefined).
+  *
+  * Typed as a plain `string` (not the authoring union) on purpose: this is
+  * STORED data that a newer Lunora may have written with a jurisdiction this
+  * version doesn't yet know. Preserving the raw value keeps the breaking
+  * `changedJurisdiction` diff correct under a downgrade — coercing an unknown
+  * value to `undefined` would fail OPEN and hide the most destructive change.
+  */
+  jurisdiction?: string;
   /** Sorted list of every declared `defineMigration` id at capture time. */
   migrationIds: ReadonlyArray<string>;
   /** Table name → {@link TableSnapshot}, keys sorted for stable serialization. */
@@ -1255,7 +2377,7 @@ interface DriftChange {
   /** Human-readable, actionable description (used in the gate message). */
   summary: string;
   /** A machine-readable change discriminator. */
-  type: "addedIndex" | "addedOptionalField" | "addedRelation" | "addedRequiredField" | "addedTable" | "changedFieldKind" | "changedIndex" | "changedShardMode" | "fieldOptionalToRequired" | "fieldRequiredToOptional" | "removedField" | "removedIndex" | "removedRelation" | "removedTable";
+  type: "addedIndex" | "addedOptionalField" | "addedRelation" | "addedRequiredField" | "addedTable" | "changedJurisdiction" | "changedFieldKind" | "changedIndex" | "changedShardMode" | "fieldOptionalToRequired" | "fieldRequiredToOptional" | "removedField" | "removedIndex" | "removedRelation" | "removedTable";
 }
 /** The result of diffing two snapshots: every classified change. */
 interface SchemaDrift {
@@ -1276,8 +2398,8 @@ declare const serializeSchemaSnapshot: (snapshot: SchemaSnapshot) => string;
 * treat a corrupt baseline as a hard error rather than silently degrading to a
 * "first capture" that would mask drift and then overwrite the bad file.
 */
-declare class SchemaSnapshotParseError extends Error {
-  override readonly name = "SchemaSnapshotParseError";
+declare class SchemaSnapshotParseError extends LunoraError {
+  constructor(message: string);
 }
 /**
 * Parse a committed snapshot file. Returns `undefined` ONLY when the content is
@@ -1357,6 +2479,11 @@ declare const refreshCodegenProject: (project: Project, lunoraDirectory: string)
 * Top-level codegen entry. Parses `&lt;projectRoot>/lunora/schema.ts` and every
 * function file under `&lt;projectRoot>/lunora/`, then writes
 * `_generated/{api,server,dataModel}.ts` next to them.
+*
+* When `LUNORA_CODEGEN_TIMING` is set (truthy), a single diagnostic summary
+* line is written to stderr with the total wall time and the discovery-vs-emit
+* split — opt-in instrumentation that is otherwise zero-cost and side-effect-free
+* on the returned {@link CodegenResult}.
 */
 declare const runCodegen: (options: CodegenOptions) => CodegenResult;
 interface CodegenOptions {
@@ -1407,6 +2534,14 @@ interface CodegenOptions {
   * a breaking change. Ignored when `dryRun` is true.
   */
   updateSchemaBaseline?: boolean;
+  /**
+  * Committed `wrangler.jsonc` `vars` entries that hold plaintext secrets — the
+  * `plaintext_secret_in_wrangler_vars` lint input. Produced by `@lunora/config`
+  * (which reads `wrangler.jsonc`) and threaded through by the CLI / Vite plugin;
+  * codegen only forwards it to the advisor. Absent when no wrangler config is
+  * present or the caller doesn't scan it.
+  */
+  wranglerVariables?: ReadonlyArray<WranglerVariableIR>;
 }
 interface CodegenResult {
   /**
@@ -1433,6 +2568,8 @@ interface CodegenResult {
   generated: {
     api: string; /** Fluent worker-composition builder (`_generated/app.ts`) — `defineApp()`. Always written. */
     app: string;
+    /** Partial-replication collection factories (`_generated/collections.ts`); `""` (and not written) unless the project declares shapes and installs `@lunora/db`. */
+    collections: string;
     /** Container DO classes (`_generated/containers.ts`); `""` (and not written) when no containers are declared. */
     containers: string;
     crons: string;
@@ -1457,6 +2594,8 @@ interface CodegenResult {
     * `apiSpec` includes `openrpc`.
     */
     openRpcModule: string;
+    /** Push-consumer queue registry (`_generated/queues.ts`); `""` (and not written) when no push queues are declared. */
+    queues: string;
     /** Project-bound seed client (`_generated/seed.ts`); `""` (and not written) when `@lunora/seed` is not a declared dependency. */
     seed: string;
     server: string;
@@ -1467,6 +2606,13 @@ interface CodegenResult {
   };
   outputDirectory: string;
   /**
+  * Queues discovered from `defineQueue` exports in `lunora/queues.ts` — the
+  * list the config layer reconciles into wrangler's `queues.producers[]` /
+  * `queues.consumers[]`. Queues are NOT Durable Objects, so this adds no
+  * binding or migration. Empty when the project declares no queues.
+  */
+  queues: ReadonlyArray<QueueIR>;
+  /**
   * The CURRENT structural schema snapshot computed this run (tables + field
   * kinds/optionality + indexes/relations/shard mode + declared migration ids).
   * The pre-deploy drift gate diffs this against the committed baseline read
@@ -1510,5 +2656,9 @@ declare const validatorIrToJsonSchema: (validator: ValidatorIR) => JsonSchema;
 * the contract; clients switch on `error.code`. Kept sorted for stable output.
 */
 declare const LUNORA_ERROR_CODES: ReadonlyArray<string>;
+/** The matching secret rule's `kind` for a string value, or `undefined` when none matches. */
+declare const secretKindOf: (value: string) => string | undefined;
+/** A redacted preview of a secret value — first 4 chars plus its length, never the full value. */
+declare const redact: (value: string) => string;
 declare const VERSION = "0.0.0";
-export { type AuthApiCallIR, CONTAINERS_FILENAME, CodegenDiagnosticError, type CodegenOptions, type CodegenResult, type ContainerIR, type CronJobIR, type DriftChange, type EmitAppOptions, type FieldSnapshot, type FunctionIR, GENERATED_HEADER, type HttpRouteIR, type IndexIR, type IndexSnapshot, type InsertWriteIR, LUNORA_ERROR_CODES, type MaskProcedureIR, type MigrationIR, OPENRPC_VERSION, type OpenApiEmitInput, type OpenRpcEmitInput, type ProjectIR, type QueryReadIR, type R2sqlCallIR, type RelationSnapshot, type RlsMetadataIR, type RlsPolicyIR, type RlsProcedureIR, type RlsRoleIR, SCHEMA_SNAPSHOT_FILENAME, SCHEMA_SNAPSHOT_VERSION, type SchemaDrift, type SchemaDriftDecision, type SchemaIR, type SchemaSnapshot, SchemaSnapshotParseError, type StorageRuleIR, type StorageRulesMetadataIR, type TableIR, type TableSnapshot, VERSION, type ValidatorIR, type VectorIndexIR, WORKFLOWS_FILENAME, type WorkflowIR, buildOpenApiDocument, buildOpenRpcDocument, buildSchemaSnapshot, createCodegenProject, diagnosticAt, diffSchemaSnapshots, discoverAuthApiCalls, discoverContainers, discoverCrons, discoverFunctions, discoverHttpRoutes, discoverInserts, discoverMaskProcedures, discoverMigrations, discoverNondeterministicCalls, discoverQueries, discoverR2sqlCalls, discoverRlsMetadata, discoverRlsProcedures, discoverSchema, discoverStorageRulesMetadata, discoverWorkflows, emitApi, emitApp, emitContainers, emitCrons, emitDataModel, emitDrizzleSchema, emitFunctions, emitOpenApi, emitOpenApiModule, emitOpenRpc, emitOpenRpcModule, emitServer, emitShard, emitVectors, emitWorkflows, emitWranglerCronTriggers, evaluateSchemaDrift, formatAdvisories, lintSchema, parseSchemaSnapshot, refreshCodegenProject, runCodegen, schemaFromIr, serializeSchemaSnapshot, validatorIrToJsonSchema };
+export { type AuthApiCallIR, CONTAINERS_FILENAME, CodegenDiagnosticError, type CodegenOptions, type CodegenResult, type ContainerIR, type CronJobIR, type DriftChange, type EmitAppOptions, FLAGS_FILENAME, type FieldSnapshot, type FlagsIR, type FunctionIR, GENERATED_HEADER, type HttpRouteIR, type IndexIR, type IndexSnapshot, type InsertWriteIR, LUNORA_ERROR_CODES, type LintSchemaOptions, MUTATORS_FILENAME, type MaskProcedureIR, type MigrationIR, type MutatorIR, OPENRPC_VERSION, type OpenApiEmitInput, type OpenRpcEmitInput, type ProjectIR, QUEUES_FILENAME, type QueryReadIR, type QueueIR, type R2sqlCallIR, type RelationSnapshot, type RlsMetadataIR, type RlsPolicyIR, type RlsProcedureIR, type RlsRoleIR, SCHEMA_SNAPSHOT_FILENAME, SCHEMA_SNAPSHOT_VERSION, SHAPES_FILENAME, type SchemaDrift, type SchemaDriftDecision, type SchemaIR, type SchemaSnapshot, SchemaSnapshotParseError, type ShapeIR, type StorageRuleIR, type StorageRulesMetadataIR, type TableIR, type TableSnapshot, VERSION, type ValidatorIR, type VectorIndexIR, WORKFLOWS_FILENAME, type WorkflowIR, type WranglerVariableIR, buildOpenApiDocument, buildOpenRpcDocument, buildSchemaSnapshot, createCodegenProject, diagnosticAt, diffSchemaSnapshots, discoverAuthApiCalls, discoverContainers, discoverCrons, discoverFlags, discoverFunctions, discoverHttpRoutes, discoverInserts, discoverMaskProcedures, discoverMigrations, discoverMutators, discoverNondeterministicCalls, discoverQueries, discoverQueues, discoverR2sqlCalls, discoverRlsMetadata, discoverRlsProcedures, discoverSchema, discoverShapes, discoverStorageRulesMetadata, discoverWorkflows, emitApi, emitApp, emitCollections, emitContainers, emitCrons, emitDataModel, emitDrizzleSchema, emitFunctions, emitOpenApi, emitOpenApiModule, emitOpenRpc, emitOpenRpcModule, emitServer, emitShard, emitVectors, emitWorkflows, emitWranglerCronTriggers, evaluateSchemaDrift, formatAdvisories, lintSchema, parseSchemaSnapshot, redact, refreshCodegenProject, runCodegen, schemaFromIr, secretKindOf, serializeSchemaSnapshot, validatorIrToJsonSchema };