@lunora/codegen 1.0.0-alpha.45 → 1.0.0-alpha.47

package/dist/index.d.mts

@@ -7,10 +7,10 @@ import { StudioFeaturesResult } from '@lunora/do';
 import { Schema } from '@lunora/server';
 import { JsonSchema } from '@lunora/values';
 /**
-* AST-observable subset of a column's modifier chain (`.unique()`, `.default()`,
-* …). Function-valued modifiers (`.$defaultFn`/`.$onUpdateFn`) can't be
-* serialized, so only their *presence* is recorded.
-*/
+ * AST-observable subset of a column's modifier chain (`.unique()`, `.default()`,
+ * …). Function-valued modifiers (`.$defaultFn`/`.$onUpdateFn`) can't be
+ * serialized, so only their *presence* is recorded.
+ */
 interface ColumnMetaIR {
   /** `.default(...)` or `.$defaultFn(...)` present — field is optional on insert. */
   hasDefault?: boolean;
@@ -28,13 +28,13 @@ interface ValidatorIR {
   /** Column modifiers (`.unique()`, `.default()`, `.nullable()`, …) when present. */
   column?: ColumnMetaIR;
   /**
-  * `true` when this validator carries a `.check(...)` refinement. The predicate
-  * is a runtime closure the AST→IR step can't represent, so the node keeps its
-  * base `kind` but records the refinement's presence here. The AOT args-validator
-  * compiler declines any node with this flag (compiling it would silently skip
-  * the predicate). `.meta(...)` is pure metadata with no parse effect and does
-  * NOT set this.
-  */
+   * `true` when this validator carries a `.check(...)` refinement. The predicate
+   * is a runtime closure the AST→IR step can't represent, so the node keeps its
+   * base `kind` but records the refinement's presence here. The AOT args-validator
+   * compiler declines any node with this flag (compiling it would silently skip
+   * the predicate). `.meta(...)` is pure metadata with no parse effect and does
+   * NOT set this.
+   */
   hasRefinement?: boolean;
   /** For `v.optional(inner)` / `v.array(inner)`. */
   inner?: ValidatorIR;
@@ -78,19 +78,19 @@ interface VectorIndexIR {
   table: string;
 }
 /**
-* One ordering key on a rank index's `sortBy`: the column and direction.
-* Mirrors the runtime `RankSortKey` (defaults `direction` to `"asc"`).
-*/
+ * One ordering key on a rank index's `sortBy`: the column and direction.
+ * Mirrors the runtime `RankSortKey` (defaults `direction` to `"asc"`).
+ */
 interface RankSortKeyIR {
   direction: "asc" | "desc";
   field: string;
 }
 /**
-* A `.rankIndex(name, { sortBy, partitionBy?, where? })` declaration. The owning
-* table is always the table the index is declared on, so — unlike a vector index
-* — there is no separate `on`/`table` reference to carry: it rides along on its
-* {@link TableIR}. Only the fields needed for type emission are captured.
-*/
+ * A `.rankIndex(name, { sortBy, partitionBy?, where? })` declaration. The owning
+ * table is always the table the index is declared on, so — unlike a vector index
+ * — there is no separate `on`/`table` reference to carry: it rides along on its
+ * {@link TableIR}. Only the fields needed for type emission are captured.
+ */
 interface RankIndexIR {
   name: string;
   /** Columns scoping each ranking; omitted ⇒ one global rank over the table. */
@@ -112,11 +112,11 @@ interface RelationIR {
   table: string;
 }
 /**
-* Statically-discovered `.source(...)` config (plan 077). Only the bits the
-* advisor lints + DO wiring need are captured; `map`/`tenantBy` are functions and
-* cannot be serialized, so their presence is recorded as `hasTenantBy` rather than
-* the function itself.
-*/
+ * Statically-discovered `.source(...)` config (plan 077). Only the bits the
+ * advisor lints + DO wiring need are captured; `map`/`tenantBy` are functions and
+ * cannot be serialized, so their presence is recorded as `hasTenantBy` rather than
+ * the function itself.
+ */
 interface ExternalSourceIR {
   /** The wrangler Hyperdrive binding name. */
   binding: string;
@@ -135,42 +135,42 @@ interface ExternalSourceIR {
   /** The membership query literal, when statically knowable. */
   query?: string;
   /**
-  * `true` when `.source(...)` was present but its argument was **not** a static
-  * object literal (e.g. `.source(buildConfig())`), so none of the fields above
-  * could be read. The source still exists — this flag lets `hasSourcedTables`
-  * (codegen) and the `external_source_*` lints treat it as a source that can't be
-  * verified, instead of mistaking it for no `.source()` at all.
-  */
+   * `true` when `.source(...)` was present but its argument was **not** a static
+   * object literal (e.g. `.source(buildConfig())`), so none of the fields above
+   * could be read. The source still exists — this flag lets `hasSourcedTables`
+   * (codegen) and the `external_source_*` lints treat it as a source that can't be
+   * verified, instead of mistaking it for no `.source()` at all.
+   */
   unanalyzable?: boolean;
 }
 interface TableIR {
   /**
-  * `true` when the table chain carried `.externallyManaged()` — its rows are
-  * written outside Lunora's discoverable insert path (adapter/migration/
-  * middleware), so advisor insert-path lints skip it. Optional: hand-built
-  * IR and the runtime `fromServerSchema` path default it to `false`.
-  */
+   * `true` when the table chain carried `.externallyManaged()` — its rows are
+   * written outside Lunora's discoverable insert path (adapter/migration/
+   * middleware), so advisor insert-path lints skip it. Optional: hand-built
+   * IR and the runtime `fromServerSchema` path default it to `false`.
+   */
   externallyManaged?: boolean;
   /**
-  * Set when the chain carried `.source(...)` — the table is materialized from an
-  * external Hyperdrive-backed database by a system poll loop (plan 077). Carries
-  * the statically-knowable bits the advisor lints read; the functions (`map`,
-  * `tenantBy`) are not serialized, only their presence (`hasTenantBy`).
-  */
+   * Set when the chain carried `.source(...)` — the table is materialized from an
+   * external Hyperdrive-backed database by a system poll loop (plan 077). Carries
+   * the statically-knowable bits the advisor lints read; the functions (`map`,
+   * `tenantBy`) are not serialized, only their presence (`hasTenantBy`).
+   */
   externalSource?: ExternalSourceIR;
   /**
-  * Storage backend for a `.global()` table: `"d1"` (default) or
-  * `"hyperdrive"` (a Postgres/MySQL database via Cloudflare Hyperdrive). Only
-  * meaningful when `shardMode === "global"`; absent for sharded/root tables.
-  */
+   * Storage backend for a `.global()` table: `"d1"` (default) or
+   * `"hyperdrive"` (a Postgres/MySQL database via Cloudflare Hyperdrive). Only
+   * meaningful when `shardMode === "global"`; absent for sharded/root tables.
+   */
   globalBackend?: "d1" | "hyperdrive";
   indexes: ReadonlyArray<IndexIR>;
   /**
-  * `true` when the table chain carried `.public()` — an explicit opt-OUT of
-  * the schema's `.rls("required")` enforcement for this one table. Optional:
-  * hand-built IR and tables that never called `.public()` default it to
-  * `false`.
-  */
+   * `true` when the table chain carried `.public()` — an explicit opt-OUT of
+   * the schema's `.rls("required")` enforcement for this one table. Optional:
+   * hand-built IR and tables that never called `.public()` default it to
+   * `false`.
+   */
   isPublic?: boolean;
   name: string;
   /** Rank indexes declared inline via `.rankIndex(name, …)`. */
@@ -194,18 +194,18 @@ interface TableIR {
 type JurisdictionIR = "eu" | "fedramp" | "us";
 interface SchemaIR {
   /**
-  * Cloudflare data-residency jurisdiction declared via
-  * `defineSchema(...).jurisdiction("…")`. Emitted into the generated worker's
-  * `createWorker({ jurisdiction })` (and `ctx.scheduler` / `ctx.containers`).
-  * Absent ⇒ un-pinned.
-  */
+   * Cloudflare data-residency jurisdiction declared via
+   * `defineSchema(...).jurisdiction("…")`. Emitted into the generated worker's
+   * `createWorker({ jurisdiction })` (and `ctx.scheduler` / `ctx.containers`).
+   * Absent ⇒ un-pinned.
+   */
   jurisdiction?: JurisdictionIR;
   /**
-  * Set when `defineSchema(...).rls("required")` was chained onto the schema —
-  * every table's `ctx.db` write path is denied without an RLS-covering
-  * procedure unless the table itself is `.public()` (see {@link TableIR.isPublic}).
-  * Absent when the schema never called `.rls("required")`.
-  */
+   * Set when `defineSchema(...).rls("required")` was chained onto the schema —
+   * every table's `ctx.db` write path is denied without an RLS-covering
+   * procedure unless the table itself is `.public()` (see {@link TableIR.isPublic}).
+   * Absent when the schema never called `.rls("required")`.
+   */
   rlsMode?: "required";
   tables: ReadonlyArray<TableIR>;
   /** All vector indexes (inline Shape A hoisted + standalone Shape B), flattened. */
@@ -218,33 +218,33 @@ interface FunctionIR {
   filePath: string;
   kind: "action" | "mutation" | "query" | "stream";
   /**
-  * Set on connection-lifecycle hooks (`onConnect`/`onDisconnect`): the socket
-  * side the hook fires on. Such a function is also an internal mutation (so it
-  * lands in `LUNORA_FUNCTIONS` for path dispatch); emit additionally collects
-  * it into the `LUNORA_LIFECYCLE_HOOKS` manifest keyed by this side. Absent on
-  * ordinary functions.
-  */
+   * Set on connection-lifecycle hooks (`onConnect`/`onDisconnect`): the socket
+   * side the hook fires on. Such a function is also an internal mutation (so it
+   * lands in `LUNORA_FUNCTIONS` for path dispatch); emit additionally collects
+   * it into the `LUNORA_LIFECYCLE_HOOKS` manifest keyed by this side. Absent on
+   * ordinary functions.
+   */
   lifecycle?: "connect" | "disconnect";
   /**
-  * Serialized TS source for the handler's return type, with `Promise&lt;T>`
-  * unwrapped so callers see `T` directly. Defaults to `"unknown"` when
-  * ts-morph cannot resolve the type (typically because the consuming
-  * project lacks a tsconfig that can reach `@lunora/server`).
-  */
+   * Serialized TS source for the handler's return type, with `Promise&lt;T>`
+   * unwrapped so callers see `T` directly. Defaults to `"unknown"` when
+   * ts-morph cannot resolve the type (typically because the consuming
+   * project lacks a tsconfig that can reach `@lunora/server`).
+   */
   returnType: string;
   /**
-  * Call surface the function is exposed on. Absent (or `"public"`) means it
-  * lands in the generated `api`; `"internal"` routes it to the separate
-  * `internal` object and is rejected by the DO's external RPC path.
-  */
+   * Call surface the function is exposed on. Absent (or `"public"`) means it
+   * lands in the generated `api`; `"internal"` routes it to the separate
+   * `internal` object and is rejected by the DO's external RPC path.
+   */
   visibility?: "internal" | "public";
 }
 /**
-* A `defineMigration({...})` declaration discovered in the user's lunora
-* sources. The emitted `LUNORA_MIGRATIONS` registry keys on {@link MigrationIR.id}; the
-* import wiring needs {@link MigrationIR.exportName}/{@link MigrationIR.filePath}. {@link MigrationIR.table} is
-* informational (the runtime object carries the authoritative value).
-*/
+ * A `defineMigration({...})` declaration discovered in the user's lunora
+ * sources. The emitted `LUNORA_MIGRATIONS` registry keys on {@link MigrationIR.id}; the
+ * import wiring needs {@link MigrationIR.exportName}/{@link MigrationIR.filePath}. {@link MigrationIR.table} is
+ * informational (the runtime object carries the authoritative value).
+ */
 interface MigrationIR {
   /** Export binding name, used to reference the module member in generated imports. */
   exportName: string;
@@ -256,59 +256,59 @@ interface MigrationIR {
   table: string;
 }
 /**
-* A `defineShape({...})` declaration discovered in `lunora/shapes.ts`
-* (local-first sync engine, Phase 7). The emitted `LUNORA_SHAPES` registry keys
-* on {@link ShapeIR.exportName}; the generated DO's `resolveShape` override
-* dispatches a `shape_subscribe` to the matching registered shape. Discovery is
-* marker-driven (the `__lunoraShape` brand) — no field metadata is lifted here
-* because the runtime object (`columns`/`compileWhere`) carries the authority.
-*/
+ * A `defineShape({...})` declaration discovered in `lunora/shapes.ts`
+ * (local-first sync engine, Phase 7). The emitted `LUNORA_SHAPES` registry keys
+ * on {@link ShapeIR.exportName}; the generated DO's `resolveShape` override
+ * dispatches a `shape_subscribe` to the matching registered shape. Discovery is
+ * marker-driven (the `__lunoraShape` brand) — no field metadata is lifted here
+ * because the runtime object (`columns`/`compileWhere`) carries the authority.
+ */
 interface ShapeIR {
   /** Export binding name — the shape's registry key and import member. */
   exportName: string;
   /** Path relative to `&lt;projectRoot>/lunora/` without extension — always `"shapes"`. */
   filePath: string;
   /**
-  * The `table` string literal from the `defineShape({ table })` call, lifted
-  * only for static advisor lints (the runtime object stays authoritative).
-  * `undefined` when `table` is not a plain string literal — lints skip those.
-  */
+   * The `table` string literal from the `defineShape({ table })` call, lifted
+   * only for static advisor lints (the runtime object stays authoritative).
+   * `undefined` when `table` is not a plain string literal — lints skip those.
+   */
   table?: string;
 }
 /**
-* The single `defineIdentity({...})` claim contract discovered in
-* `lunora/identity.ts`. Discovery is **marker-driven** (the `__lunoraIdentity`
-* brand, exactly like {@link ShapeIR}) — no claim metadata is lifted here
-* because the emitted `_generated/server.ts` recovers the claim *type* from the
-* declaration itself (`InferIdentity` over the contract's `typeof`), and the
-* runtime object (`validate`/`onInvalid`) carries the authority at the boundary.
-* Exactly one per app; absent ⇒ generated output is byte-identical to today.
-*/
+ * The single `defineIdentity({...})` claim contract discovered in
+ * `lunora/identity.ts`. Discovery is **marker-driven** (the `__lunoraIdentity`
+ * brand, exactly like {@link ShapeIR}) — no claim metadata is lifted here
+ * because the emitted `_generated/server.ts` recovers the claim *type* from the
+ * declaration itself (`InferIdentity` over the contract's `typeof`), and the
+ * runtime object (`validate`/`onInvalid`) carries the authority at the boundary.
+ * Exactly one per app; absent ⇒ generated output is byte-identical to today.
+ */
 interface IdentityIR {
   /** Export binding name — the namespace member `_generated/server.ts` reads via `typeof`. */
   exportName: string;
 }
 /**
-* The single `defineEnv({...})` contract discovered in `lunora/env.ts`. Like
-* {@link IdentityIR}, only the export binding is lifted — the emitted
-* `_generated/server.ts` recovers the validated shape from the declaration
-* itself (`ReturnType` over the accessor's `typeof`), and the generated ShardDO
-* applies the same accessor to the worker `env` at ctx-build time to populate
-* `ctx.env`. Exactly one per app; absent ⇒ generated output is byte-identical.
-*/
+ * The single `defineEnv({...})` contract discovered in `lunora/env.ts`. Like
+ * {@link IdentityIR}, only the export binding is lifted — the emitted
+ * `_generated/server.ts` recovers the validated shape from the declaration
+ * itself (`ReturnType` over the accessor's `typeof`), and the generated ShardDO
+ * applies the same accessor to the worker `env` at ctx-build time to populate
+ * `ctx.env`. Exactly one per app; absent ⇒ generated output is byte-identical.
+ */
 interface EnvIR {
   /** Export binding name — the namespace member `_generated/server.ts` reads via `typeof`. */
   exportName: string;
 }
 /**
-* A `defineMutator({...})` declaration discovered in `lunora/mutators.ts`
-* (local-first sync engine, Phase 7). The emitted registry registers the
-* authoritative `server` impl into the DO's `LUNORA_FUNCTIONS` table (so
-* `handleRpc` transaction-wraps it) and records its path in
-* `LUNORA_MUTATOR_PATHS` so the DO's `isCustomMutator` override routes the
-* client-watermark push protocol. The client `client` impl is split into the
-* browser bundle separately — only the path crosses to the server side.
-*/
+ * A `defineMutator({...})` declaration discovered in `lunora/mutators.ts`
+ * (local-first sync engine, Phase 7). The emitted registry registers the
+ * authoritative `server` impl into the DO's `LUNORA_FUNCTIONS` table (so
+ * `handleRpc` transaction-wraps it) and records its path in
+ * `LUNORA_MUTATOR_PATHS` so the DO's `isCustomMutator` override routes the
+ * client-watermark push protocol. The client `client` impl is split into the
+ * browser bundle separately — only the path crosses to the server side.
+ */
 interface MutatorIR {
   /** Export binding name — the mutator's registry key and import member. */
   exportName: string;
@@ -316,15 +316,15 @@ interface MutatorIR {
   filePath: string;
 }
 /**
-* A whole-row `ctx.db.replace(id, document)` write discovered inside a custom
-* mutator's inline `server` impl (`lunora/mutators.ts`) — the input the
-* `mutator_full_row_replace` advisor lint consumes. A `replace` overwrites the
-* entire row, so a concurrent edit to a different column on a synced table is
-* clobbered; `ctx.db.patch(id, { field })` merges at the column level instead.
-* Structurally identical to `AdvisorMutatorWrite` so it passes straight through
-* to the advisor without conversion, exactly as `InsertWriteIR` does for
-* `AdvisorInsertWrite`.
-*/
+ * A whole-row `ctx.db.replace(id, document)` write discovered inside a custom
+ * mutator's inline `server` impl (`lunora/mutators.ts`) — the input the
+ * `mutator_full_row_replace` advisor lint consumes. A `replace` overwrites the
+ * entire row, so a concurrent edit to a different column on a synced table is
+ * clobbered; `ctx.db.patch(id, { field })` merges at the column level instead.
+ * Structurally identical to `AdvisorMutatorWrite` so it passes straight through
+ * to the advisor without conversion, exactly as `InsertWriteIR` does for
+ * `AdvisorInsertWrite`.
+ */
 interface MutatorWriteIR {
   /** The mutator export whose `server` impl performs the replace, e.g. `renameChannel`. */
   exportName: string;
@@ -334,12 +334,12 @@ interface MutatorWriteIR {
   line: number;
 }
 /**
-* A single cron job lifted from a `cronJobs()` builder in `lunora/crons.ts`.
-* Mirrors `@lunora/scheduler`'s `CronJob`: {@link CronJobIR.cron} is the compiled
-* standard cron expression, {@link CronJobIR.functionPath} is the target
-* `__lunoraRef` (`namespace:fn`), and {@link CronJobIR.args} is the static
-* argument object passed at registration.
-*/
+ * A single cron job lifted from a `cronJobs()` builder in `lunora/crons.ts`.
+ * Mirrors `@lunora/scheduler`'s `CronJob`: {@link CronJobIR.cron} is the compiled
+ * standard cron expression, {@link CronJobIR.functionPath} is the target
+ * `__lunoraRef` (`namespace:fn`), and {@link CronJobIR.args} is the static
+ * argument object passed at registration.
+ */
 interface CronJobIR {
   /** Static args object (source-text JSON), defaults to `{}`. */
   args: Record<string, unknown>;
@@ -350,25 +350,25 @@ interface CronJobIR {
   /** Unique, human-readable job name. */
   name: string;
   /**
-  * Set when the job targets a durable workflow (a `lunora/workflows.ts`
-  * export) instead of a function: the workflow's `WORKFLOW_*` binding name
-  * plus its export name. On each fire the worker starts a new workflow
-  * INSTANCE (the {@link CronJobIR.args} become its `params`) rather than
-  * dispatching a one-shot function.
-  */
+   * Set when the job targets a durable workflow (a `lunora/workflows.ts`
+   * export) instead of a function: the workflow's `WORKFLOW_*` binding name
+   * plus its export name. On each fire the worker starts a new workflow
+   * INSTANCE (the {@link CronJobIR.args} become its `params`) rather than
+   * dispatching a one-shot function.
+   */
   workflow?: {
     binding: string;
     exportName: string;
   };
 }
 /**
-* A container lifted from a `defineContainer()` export in
-* `lunora/containers.ts`. Carries everything the emitters and the config layer
-* need to wire wrangler (`containers[]` + the Durable Object binding +
-* migration class) and the generated `_generated/containers.ts` DO class.
-* Names are derived via `@lunora/container`'s shared helpers so codegen and
-* the config layer can never disagree.
-*/
+ * A container lifted from a `defineContainer()` export in
+ * `lunora/containers.ts`. Carries everything the emitters and the config layer
+ * need to wire wrangler (`containers[]` + the Durable Object binding +
+ * migration class) and the generated `_generated/containers.ts` DO class.
+ * Names are derived via `@lunora/container`'s shared helpers so codegen and
+ * the config layer can never disagree.
+ */
 interface ContainerIR {
   /** Durable Object binding name, e.g. `CONTAINER_TRANSCODER`. */
   bindingName: string;
@@ -377,18 +377,18 @@ interface ContainerIR {
   /** Generated DO class name, e.g. `TranscoderContainer`. */
   className: string;
   /**
-  * Whether the container may open outbound internet connections, when the
-  * value was a static literal. `undefined` means the field was omitted (the
-  * platform default is `true`) or wasn't a literal. Lifted for the advisor.
-  */
+   * Whether the container may open outbound internet connections, when the
+   * value was a static literal. `undefined` means the field was omitted (the
+   * platform default is `true`) or wasn't a literal. Lifted for the advisor.
+   */
   enableInternet?: boolean;
   /** The `lunora/containers.ts` export name, e.g. `transcoder`. */
   exportName: string;
   /**
-  * Normalized image source: a local Dockerfile (`dockerfile`), a pre-built
-  * registry reference (`registry`), or a Railpack source directory (`build`)
-  * that the deploy step builds and pushes before wrangler runs.
-  */
+   * Normalized image source: a local Dockerfile (`dockerfile`), a pre-built
+   * registry reference (`registry`), or a Railpack source directory (`build`)
+   * that the deploy step builds and pushes before wrangler runs.
+   */
   image: {
     buildContext: string;
     dockerfilePath: string;
@@ -416,20 +416,20 @@ interface ContainerIR {
     stepPercentage?: number;
   };
   /**
-  * The static `sleepAfter` value, when it was a literal. `undefined` means
-  * omitted (platform default `"10m"`) or non-literal. Lifted for the advisor.
-  */
+   * The static `sleepAfter` value, when it was a literal. `undefined` means
+   * omitted (platform default `"10m"`) or non-literal. Lifted for the advisor.
+   */
   sleepAfter?: number | string;
 }
 /**
-* A workflow lifted from a `defineWorkflow()` export in `lunora/workflows.ts`.
-* Carries what the emitters and the config layer need to wire the wrangler
-* `workflows[]` entry and the generated `_generated/workflows.ts`
-* `WorkflowEntrypoint` class. Unlike containers, workflows are NOT Durable
-* Objects — wrangler gets only a `workflows[]` entry, never a `durable_objects`
-* binding or a migration class. Names are derived via `@lunora/workflow`'s
-* shared helpers so codegen and the config layer can never disagree.
-*/
+ * A workflow lifted from a `defineWorkflow()` export in `lunora/workflows.ts`.
+ * Carries what the emitters and the config layer need to wire the wrangler
+ * `workflows[]` entry and the generated `_generated/workflows.ts`
+ * `WorkflowEntrypoint` class. Unlike containers, workflows are NOT Durable
+ * Objects — wrangler gets only a `workflows[]` entry, never a `durable_objects`
+ * binding or a migration class. Names are derived via `@lunora/workflow`'s
+ * shared helpers so codegen and the config layer can never disagree.
+ */
 interface WorkflowIR {
   /** The Cloudflare `Workflow` binding name, e.g. `WORKFLOW_ORDER_PIPELINE`. */
   bindingName: string;
@@ -438,32 +438,32 @@ interface WorkflowIR {
   /** The `lunora/workflows.ts` export name, e.g. `orderPipeline`. */
   exportName: string;
   /**
-  * The stable wrangler `workflows[].name`. Defaults to the kebab-cased export
-  * name (`orderPipeline` → `order-pipeline`); a static `name:` literal in the
-  * definition overrides it.
-  */
+   * The stable wrangler `workflows[].name`. Defaults to the kebab-cased export
+   * name (`orderPipeline` → `order-pipeline`); a static `name:` literal in the
+   * definition overrides it.
+   */
   name: string;
   /**
-  * Durable step labels lifted from the handler body — the first string-literal
-  * argument of every `ctx.step.do` / `.sleep` / `.sleepUntil` / `.waitForEvent`
-  * call. Feeds the duplicate-step-name lint, which flags a name used twice
-  * (Cloudflare memoizes by name, so the second call silently returns the
-  * first's cached result). Calls with a non-literal name are omitted (not
-  * statically comparable).
-  */
+   * Durable step labels lifted from the handler body — the first string-literal
+   * argument of every `ctx.step.do` / `.sleep` / `.sleepUntil` / `.waitForEvent`
+   * call. Feeds the duplicate-step-name lint, which flags a name used twice
+   * (Cloudflare memoizes by name, so the second call silently returns the
+   * first's cached result). Calls with a non-literal name are omitted (not
+   * statically comparable).
+   */
   steps: ReadonlyArray<WorkflowStepIR>;
 }
 /**
-* An agent lifted from a `defineAgent()` export in `lunora/agents.ts`. A
-* `defineAgent` compiles its durable tool-loop onto a Cloudflare Workflow, so —
-* like {@link WorkflowIR} — an agent is NOT a Durable Object: wrangler gets only
-* a `workflows[]` entry, never a `durable_objects` binding or a migration class.
-* Carries what the emitters and the config layer need to wire the generated
-* agent `WorkflowEntrypoint` class (e.g. `SupportAgentWorkflow`), the typed
-* per-agent `ctx.agents` producer, and the reconciled wrangler `workflows[]`
-* entry. Names are derived via `@lunora/agent`'s shared helpers so codegen and
-* the config layer can never disagree.
-*/
+ * An agent lifted from a `defineAgent()` export in `lunora/agents.ts`. A
+ * `defineAgent` compiles its durable tool-loop onto a Cloudflare Workflow, so —
+ * like {@link WorkflowIR} — an agent is NOT a Durable Object: wrangler gets only
+ * a `workflows[]` entry, never a `durable_objects` binding or a migration class.
+ * Carries what the emitters and the config layer need to wire the generated
+ * agent `WorkflowEntrypoint` class (e.g. `SupportAgentWorkflow`), the typed
+ * per-agent `ctx.agents` producer, and the reconciled wrangler `workflows[]`
+ * entry. Names are derived via `@lunora/agent`'s shared helpers so codegen and
+ * the config layer can never disagree.
+ */
 interface AgentIR {
   /** The Cloudflare `Workflow` binding name, e.g. `AGENT_SUPPORT`. */
   bindingName: string;
@@ -472,39 +472,39 @@ interface AgentIR {
   /** The `lunora/agents.ts` export name, e.g. `support`. */
   exportName: string;
   /**
-  * The stable wrangler `workflows[].name`. Defaults to the kebab-cased export
-  * name (`support` → `agent-support`); a static `name:` literal in the
-  * definition overrides it.
-  */
+   * The stable wrangler `workflows[].name`. Defaults to the kebab-cased export
+   * name (`support` → `agent-support`); a static `name:` literal in the
+   * definition overrides it.
+   */
   name: string;
   /**
-  * Whether the definition declares an `onEmail` mapper on
-  * `defineAgent({ onEmail: … })`. When `true` the emitter wires this agent
-  * onto the worker's top-level `email()` handler (via `@lunora/agent/inbound`)
-  * so inbound mail starts a durable run. Detected by AST PRESENCE — the
-  * closure is never evaluated — and written to IR only when present, so
-  * email-free agents (and agent-free projects) stay byte-identical.
-  */
+   * Whether the definition declares an `onEmail` mapper on
+   * `defineAgent({ onEmail: … })`. When `true` the emitter wires this agent
+   * onto the worker's top-level `email()` handler (via `@lunora/agent/inbound`)
+   * so inbound mail starts a durable run. Detected by AST PRESENCE — the
+   * closure is never evaluated — and written to IR only when present, so
+   * email-free agents (and agent-free projects) stay byte-identical.
+   */
   onEmail?: boolean;
   /**
-  * Whether the definition opted into public run-starts via
-  * `defineAgent({ publicRun: true })` — emitted into the `ctx.agents` wiring
-  * spec so the public `agents:agentRun` mutation can gate on it fail-closed.
-  * Absent (falsy) means server-side starts only; the field is written to IR
-  * only when the literal is `true`, so agent-free and non-opted-in output is
-  * byte-identical.
-  */
+   * Whether the definition opted into public run-starts via
+   * `defineAgent({ publicRun: true })` — emitted into the `ctx.agents` wiring
+   * spec so the public `agents:agentRun` mutation can gate on it fail-closed.
+   * Absent (falsy) means server-side starts only; the field is written to IR
+   * only when the literal is `true`, so agent-free and non-opted-in output is
+   * byte-identical.
+   */
   publicRun?: boolean;
   /**
-  * Whether the definition opted into a real-time voice session via a `voice`
-  * block on `defineAgent({ voice: … })`. Unlike the durable loop (a Workflow),
-  * the voice path IS a Durable Object — so when this is `true` the emitter
-  * generates the `voiceClassName` `VoiceSessionDO` subclass and the
-  * `api.agents.{name}Voice` client reference, and the config layer reconciles
-  * a `durable_objects` binding (`voiceBindingName`) + `new_sqlite_classes`
-  * migration. Written to IR only when the literal is present, so voice-free
-  * agents (and agent-free projects) stay byte-identical.
-  */
+   * Whether the definition opted into a real-time voice session via a `voice`
+   * block on `defineAgent({ voice: … })`. Unlike the durable loop (a Workflow),
+   * the voice path IS a Durable Object — so when this is `true` the emitter
+   * generates the `voiceClassName` `VoiceSessionDO` subclass and the
+   * `api.agents.{name}Voice` client reference, and the config layer reconciles
+   * a `durable_objects` binding (`voiceBindingName`) + `new_sqlite_classes`
+   * migration. Written to IR only when the literal is present, so voice-free
+   * agents (and agent-free projects) stay byte-identical.
+   */
   voice?: boolean;
   /** The voice DO's Cloudflare `DurableObjectNamespace` binding name, e.g. `VOICE_SUPPORT`. Present only when `voice`. */
   voiceBindingName?: string;
@@ -521,14 +521,14 @@ interface WorkflowStepIR {
   name: string;
 }
 /**
-* A queue lifted from a `defineQueue()` export in `lunora/queues.ts`. Carries
-* what the emitters and the config layer need to wire the typed `ctx.queues`
-* producer, the generated worker `queue()` dispatch, and the wrangler
-* `queues.producers[]` / `queues.consumers[]` entries. Like workflows, a queue
-* is NOT a Durable Object — wrangler gets only `queues.*` entries. Names are
-* derived via `@lunora/queue`'s shared helpers so codegen and the config layer
-* can never disagree.
-*/
+ * A queue lifted from a `defineQueue()` export in `lunora/queues.ts`. Carries
+ * what the emitters and the config layer need to wire the typed `ctx.queues`
+ * producer, the generated worker `queue()` dispatch, and the wrangler
+ * `queues.producers[]` / `queues.consumers[]` entries. Like workflows, a queue
+ * is NOT a Durable Object — wrangler gets only `queues.*` entries. Names are
+ * derived via `@lunora/queue`'s shared helpers so codegen and the config layer
+ * can never disagree.
+ */
 interface QueueIR {
   /** The Cloudflare `Queue` producer binding name, e.g. `QUEUE_EMAIL`. */
   bindingName: string;
@@ -537,10 +537,10 @@ interface QueueIR {
   /** How the queue is consumed: `"push"` (a worker `queue()` handler) or `"pull"` (external HTTP). */
   mode: "pull" | "push";
   /**
-  * The stable wrangler queue name (`queues.producers[].queue`). Defaults to
-  * the kebab-cased export name (`emailQueue` → `email-queue`); a static
-  * `name:` literal in the definition overrides it.
-  */
+   * The stable wrangler queue name (`queues.producers[].queue`). Defaults to
+   * the kebab-cased export name (`emailQueue` → `email-queue`); a static
+   * `name:` literal in the definition overrides it.
+   */
   name: string;
   /** Push-consumer batch/retry tuning, mirrored onto the wrangler `queues.consumers[]` entry. */
   tuning: {
@@ -552,38 +552,38 @@ interface QueueIR {
   };
 }
 /**
-* The feature-flag provider declared by the default export of `lunora/flags.ts`
-* (`defineFlags({ provider, … })`). Discovery is **metadata-only** — codegen
-* imports the real module at runtime for the provider value; this IR exists so
-* the config layer can reconcile/validate the wrangler `flagship` binding when
-* the app uses Flagship in binding mode. A `custom` provider (any other
-* OpenFeature factory) carries no binding to reconcile.
-*/
+ * The feature-flag provider declared by the default export of `lunora/flags.ts`
+ * (`defineFlags({ provider, … })`). Discovery is **metadata-only** — codegen
+ * imports the real module at runtime for the provider value; this IR exists so
+ * the config layer can reconcile/validate the wrangler `flagship` binding when
+ * the app uses Flagship in binding mode. A `custom` provider (any other
+ * OpenFeature factory) carries no binding to reconcile.
+ */
 interface FlagsIR {
   /**
-  * The wrangler `flagship[].binding` name — set **only** for a flagship
-  * `provider` in binding mode (`flagshipProvider({ binding: "FLAGS" })`). The
-  * config layer hints/validates a matching `flagship` binding from this.
-  */
+   * The wrangler `flagship[].binding` name — set **only** for a flagship
+   * `provider` in binding mode (`flagshipProvider({ binding: "FLAGS" })`). The
+   * config layer hints/validates a matching `flagship` binding from this.
+   */
   bindingName?: string;
   /**
-  * Flagship operating mode — `"binding"` (wrangler binding, needs a
-  * `flagship` entry) or `"http"` (no binding); `undefined` for a `custom`
-  * provider or when the mode can't be read statically.
-  */
+   * Flagship operating mode — `"binding"` (wrangler binding, needs a
+   * `flagship` entry) or `"http"` (no binding); `undefined` for a `custom`
+   * provider or when the mode can't be read statically.
+   */
   mode?: "binding" | "http";
   /** `"flagship"` when the provider is `flagshipProvider(...)`, else `"custom"` (any other OpenFeature provider factory). */
   provider: "custom" | "flagship";
 }
 /**
-* A `ctx.workflows.get("name")…` call discovered in a function body — the
-* use-site analog of {@link WorkflowIR} (which is the declaration side). Feeds
-* the `workflow_unused` lint (a declared workflow with zero call sites) and the
-* `workflow_unknown_target` lint (a `.get("x")` whose `x` isn't declared — a
-* typo catcher). {@link WorkflowCallIR.workflow} is `""` when the `get(...)`
-* argument is not a string literal (a dynamic name — which suppresses the
-* unused-workflow heuristic rather than producing a false positive).
-*/
+ * A `ctx.workflows.get("name")…` call discovered in a function body — the
+ * use-site analog of {@link WorkflowIR} (which is the declaration side). Feeds
+ * the `workflow_unused` lint (a declared workflow with zero call sites) and the
+ * `workflow_unknown_target` lint (a `.get("x")` whose `x` isn't declared — a
+ * typo catcher). {@link WorkflowCallIR.workflow} is `""` when the `get(...)`
+ * argument is not a string literal (a dynamic name — which suppresses the
+ * unused-workflow heuristic rather than producing a false positive).
+ */
 interface WorkflowCallIR {
   /** Export binding name of the function performing the call, e.g. `create`. */
   exportName: string;
@@ -595,11 +595,11 @@ interface WorkflowCallIR {
   workflow: string;
 }
 /**
-* A `ctx.db.query("table")…` read discovered in a function body, reduced to what
-* the `filter_without_index` advisor lint needs: which table, whether the chain
-* narrows with an index, and whether it filters. `table` is `""` when the
-* `query(...)` argument is not a string literal (a dynamic table — not lintable).
-*/
+ * A `ctx.db.query("table")…` read discovered in a function body, reduced to what
+ * the `filter_without_index` advisor lint needs: which table, whether the chain
+ * narrows with an index, and whether it filters. `table` is `""` when the
+ * `query(...)` argument is not a string literal (a dynamic table — not lintable).
+ */
 interface QueryReadIR {
   /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
   file: string;
@@ -613,12 +613,12 @@ interface QueryReadIR {
   table: string;
 }
 /**
-* A `ctx.authApi.&lt;method>(...)` call discovered in a function body, attributed
-* to the exported function (and its file = api namespace) that performs it.
-* Structurally identical to `AdvisorAuthApiCall` so it passes straight through
-* to the advisor lint without conversion, exactly as `InsertWriteIR` does for
-* `AdvisorInsertWrite`.
-*/
+ * A `ctx.authApi.&lt;method>(...)` call discovered in a function body, attributed
+ * to the exported function (and its file = api namespace) that performs it.
+ * Structurally identical to `AdvisorAuthApiCall` so it passes straight through
+ * to the advisor lint without conversion, exactly as `InsertWriteIR` does for
+ * `AdvisorInsertWrite`.
+ */
 interface AuthApiCallIR {
   /** Export binding name of the function performing the call, e.g. "createOrg". */
   exportName: string;
@@ -632,12 +632,12 @@ interface AuthApiCallIR {
   method: string;
 }
 /**
-* A `ctx.db.insert("table", …)` write discovered in a function body, attributed
-* to the exported function (and its file = api namespace) that performs it — the
-* write-side analog of {@link QueryReadIR}. Lets tooling wire a table's write
-* action by behavior (which function inserts into it) rather than by naming.
-* {@link InsertWriteIR.table} is `""` when the argument is not a string literal.
-*/
+ * A `ctx.db.insert("table", …)` write discovered in a function body, attributed
+ * to the exported function (and its file = api namespace) that performs it — the
+ * write-side analog of {@link QueryReadIR}. Lets tooling wire a table's write
+ * action by behavior (which function inserts into it) rather than by naming.
+ * {@link InsertWriteIR.table} is `""` when the argument is not a string literal.
+ */
 interface InsertWriteIR {
   /** Export binding name of the function performing the insert, e.g. "send". */
   exportName: string;
@@ -649,14 +649,14 @@ interface InsertWriteIR {
   table: string;
 }
 /**
-* A non-deterministic API call (`Date.now`, `Math.random`, `crypto.randomUUID`,
-* `crypto.getRandomValues`, `fetch`) discovered lexically inside a `query(...)`
-* or `mutation(...)` handler body — the `nondeterministic_query_mutation` lint
-* input. Structurally identical to `AdvisorNondeterministicCall` so values pass
-* straight through to the advisor without conversion, exactly as `AuthApiCallIR`
-* does for `AdvisorAuthApiCall`. `action(...)` handlers are never recorded —
-* actions are the determinism escape hatch.
-*/
+ * A non-deterministic API call (`Date.now`, `Math.random`, `crypto.randomUUID`,
+ * `crypto.getRandomValues`, `fetch`) discovered lexically inside a `query(...)`
+ * or `mutation(...)` handler body — the `nondeterministic_query_mutation` lint
+ * input. Structurally identical to `AdvisorNondeterministicCall` so values pass
+ * straight through to the advisor without conversion, exactly as `AuthApiCallIR`
+ * does for `AdvisorAuthApiCall`. `action(...)` handlers are never recorded —
+ * actions are the determinism escape hatch.
+ */
 interface NondeterministicCallIR {
   /** The non-deterministic API invoked, e.g. `Date.now` / `Math.random` / `crypto.randomUUID` / `fetch`. */
   callee: string;
@@ -670,13 +670,13 @@ interface NondeterministicCallIR {
   line: number;
 }
 /**
-* One `ctx.r2sql` access lexically inside a `query`/`mutation` handler — the
-* `r2sql_outside_action` advisor lint input. Structurally identical to the
-* advisor's `AdvisorR2sqlCall` (same field set) so values pass straight through
-* `lintSchema` without conversion, exactly as `NondeterministicCallIR` does.
-* Only `query`/`mutation` handlers are recorded; `action(...)` is the intended
-* home for `ctx.r2sql` and is skipped.
-*/
+ * One `ctx.r2sql` access lexically inside a `query`/`mutation` handler — the
+ * `r2sql_outside_action` advisor lint input. Structurally identical to the
+ * advisor's `AdvisorR2sqlCall` (same field set) so values pass straight through
+ * `lintSchema` without conversion, exactly as `NondeterministicCallIR` does.
+ * Only `query`/`mutation` handlers are recorded; `action(...)` is the intended
+ * home for `ctx.r2sql` and is skipped.
+ */
 interface R2sqlCallIR {
   /** The accessed `ctx.r2sql` surface, e.g. `ctx.r2sql.query` / `ctx.r2sql.from`. */
   callee: string;
@@ -690,21 +690,21 @@ interface R2sqlCallIR {
   line: number;
 }
 /**
-* Per-procedure RLS usage snapshot, produced by `discoverRlsProcedures` for the
-* `rls_uncovered_table` advisor lint. Structurally identical to
-* `AdvisorRlsProcedure` (they share the same field set) so values pass straight
-* through to the advisor without conversion, exactly as `AuthApiCallIR` does for
-* `AdvisorAuthApiCall`.
-*/
+ * Per-procedure RLS usage snapshot, produced by `discoverRlsProcedures` for the
+ * `rls_uncovered_table` advisor lint. Structurally identical to
+ * `AdvisorRlsProcedure` (they share the same field set) so values pass straight
+ * through to the advisor without conversion, exactly as `AuthApiCallIR` does for
+ * `AdvisorAuthApiCall`.
+ */
 interface RlsProcedureIR {
   /** Export binding name of the procedure (e.g. `listDocuments`). */
   exportName: string;
   /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
   file: string;
   /**
-  * Table names extracted from the `rls(policies)` array literal. Empty when the
-  * policies argument is not a statically-readable array literal.
-  */
+   * Table names extracted from the `rls(policies)` array literal. Empty when the
+   * policies argument is not a statically-readable array literal.
+   */
   rlsTables: string[];
   /** Tables read by the procedure via `ctx.db.query/findMany/findFirst/…`. */
   tablesRead: string[];
@@ -716,22 +716,22 @@ interface RlsProcedureIR {
   visibility: "internal" | "public";
 }
 /**
-* One procedure reduced to the facts the `mask_uncovered_pii_column` lint needs:
-* whether its builder chain includes `.use(mask(...))`, which `(table, column)`
-* pairs that mask declares, and which tables the procedure reads/writes. The
-* column-level analogue of {@link RlsProcedureIR}. Structurally identical to
-* `AdvisorMaskProcedure` so values pass straight through without conversion.
-*/
+ * One procedure reduced to the facts the `mask_uncovered_pii_column` lint needs:
+ * whether its builder chain includes `.use(mask(...))`, which `(table, column)`
+ * pairs that mask declares, and which tables the procedure reads/writes. The
+ * column-level analogue of {@link RlsProcedureIR}. Structurally identical to
+ * `AdvisorMaskProcedure` so values pass straight through without conversion.
+ */
 interface MaskProcedureIR {
   /** Export binding name of the procedure (e.g. `listUsers`). */
   exportName: string;
   /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
   file: string;
   /**
-  * `(table, column)` pairs this procedure's `mask(policies)` object literal
-  * declares. Empty when the policies argument is not a statically-readable
-  * object literal (conservative: `usesMask` is still `true`).
-  */
+   * `(table, column)` pairs this procedure's `mask(policies)` object literal
+   * declares. Empty when the policies argument is not a statically-readable
+   * object literal (conservative: `usesMask` is still `true`).
+   */
   maskColumns: {
     column: string;
     table: string;
@@ -746,14 +746,14 @@ interface MaskProcedureIR {
   visibility: "internal" | "public";
 }
 /**
-* One masked column surfaced to the studio's data-browser mask preview: a
-* `(table, column)` pair plus the declared {@link MaskProcedureIR} strategy so
-* the preview can pick redact-vs-hash-vs-custom rendering. Aggregated across the
-* project's `.use(mask(...))` chains by `discoverMaskMetadata`; the descriptive
-* twin of {@link RlsPolicyIR}. `"custom"` covers any non-string strategy (a
-* `(value, ctx) => …` function) — its logic is an opaque closure, never read by
-* the UI; the preview renders a fixed sentinel for it.
-*/
+ * One masked column surfaced to the studio's data-browser mask preview: a
+ * `(table, column)` pair plus the declared {@link MaskProcedureIR} strategy so
+ * the preview can pick redact-vs-hash-vs-custom rendering. Aggregated across the
+ * project's `.use(mask(...))` chains by `discoverMaskMetadata`; the descriptive
+ * twin of {@link RlsPolicyIR}. `"custom"` covers any non-string strategy (a
+ * `(value, ctx) => …` function) — its logic is an opaque closure, never read by
+ * the UI; the preview renders a fixed sentinel for it.
+ */
 interface MaskColumnMetadataIR {
   /** Column the mask policy redacts. */
   column: string;
@@ -763,26 +763,26 @@ interface MaskColumnMetadataIR {
   table: string;
 }
 /**
-* Schema-wide masking metadata the codegen emits into the generated ShardDO so
-* the studio's data-browser mask toggle can preview what a non-privileged caller
-* would see. Aggregated across every `.use(mask(...))` chain in the project —
-* purely descriptive (table + column + strategy), never the masking closure. The
-* column-level analogue of {@link RlsMetadataIR}.
-*/
+ * Schema-wide masking metadata the codegen emits into the generated ShardDO so
+ * the studio's data-browser mask toggle can preview what a non-privileged caller
+ * would see. Aggregated across every `.use(mask(...))` chain in the project —
+ * purely descriptive (table + column + strategy), never the masking closure. The
+ * column-level analogue of {@link RlsMetadataIR}.
+ */
 interface MaskMetadataIR {
   /** Every statically-discovered masked column, deduped by `(table, column)` (first declaration wins). */
   columns: MaskColumnMetadataIR[];
 }
 /**
-* One masked column whose `mask(policies)` strategy is a statically-known
-* literal (`"hash"` or `"redact"`) — the `mask_weak_hash_strategy_on_pii` lint
-* input. Unlike {@link MaskColumnMetadataIR} (app-wide, deduped by `(table,
-* column)`, studio-preview evidence), this is per declaration site (file + line
-* + enclosing export), undeduped, so the lint can point at the exact
-* `mask(...)` call that applies a weak strategy. A `MaskFn` (custom, non-literal)
-* strategy carries no lint-relevant signal and is never recorded here.
-* Structurally identical to `AdvisorMaskStrategy`.
-*/
+ * One masked column whose `mask(policies)` strategy is a statically-known
+ * literal (`"hash"` or `"redact"`) — the `mask_weak_hash_strategy_on_pii` lint
+ * input. Unlike {@link MaskColumnMetadataIR} (app-wide, deduped by `(table,
+ * column)`, studio-preview evidence), this is per declaration site (file + line
+ * + enclosing export), undeduped, so the lint can point at the exact
+ * `mask(...)` call that applies a weak strategy. A `MaskFn` (custom, non-literal)
+ * strategy carries no lint-relevant signal and is never recorded here.
+ * Structurally identical to `AdvisorMaskStrategy`.
+ */
 interface MaskStrategyIR {
   /** Masked column name. */
   column: string;
@@ -798,13 +798,13 @@ interface MaskStrategyIR {
   table: string;
 }
 /**
-* One statically-readable policy entry from an `rls([...])` array literal,
-* surfaced to the studio's read-only RLS inspector via the generated
-* `rlsPolicies()` hook. Captures the policy's `table` + `on` operation and the
-* procedure it guards — never the `when` predicate, which is an opaque JS
-* closure (its logic stays in code, not the UI). Produced by
-* `discoverRlsProcedures` alongside the lint IR.
-*/
+ * One statically-readable policy entry from an `rls([...])` array literal,
+ * surfaced to the studio's read-only RLS inspector via the generated
+ * `rlsPolicies()` hook. Captures the policy's `table` + `on` operation and the
+ * procedure it guards — never the `when` predicate, which is an opaque JS
+ * closure (its logic stays in code, not the UI). Produced by
+ * `discoverRlsProcedures` alongside the lint IR.
+ */
 interface RlsPolicyIR {
   /** Source file (relative to `lunora/`, without extension) the policy is declared in. */
   file: string;
@@ -816,12 +816,12 @@ interface RlsPolicyIR {
   table: string;
 }
 /**
-* One statically-readable role entry from an `rls(policies, { roles: [...] })`
-* call, surfaced to the studio's RLS inspector. Captures the role's `name`,
-* optional `description`, and the names of the permissions it grants (string
-* literals or `definePermission("name")` calls). Produced by
-* `discoverRlsProcedures`.
-*/
+ * One statically-readable role entry from an `rls(policies, { roles: [...] })`
+ * call, surfaced to the studio's RLS inspector. Captures the role's `name`,
+ * optional `description`, and the names of the permissions it grants (string
+ * literals or `definePermission("name")` calls). Produced by
+ * `discoverRlsProcedures`.
+ */
 interface RlsRoleIR {
   /** Optional human-readable description from `defineRole(name, { description })`. */
   description?: string;
@@ -831,11 +831,11 @@ interface RlsRoleIR {
   permissions: string[];
 }
 /**
-* Schema-wide RLS metadata the codegen emits into the generated ShardDO so the
-* studio's read-only inspector can list, per table, which policies guard it and
-* what roles are defined. Aggregated across every `.use(rls(...))` chain in the
-* project — purely descriptive, never the predicate logic.
-*/
+ * Schema-wide RLS metadata the codegen emits into the generated ShardDO so the
+ * studio's read-only inspector can list, per table, which policies guard it and
+ * what roles are defined. Aggregated across every `.use(rls(...))` chain in the
+ * project — purely descriptive, never the predicate logic.
+ */
 interface RlsMetadataIR {
   /** Every statically-discovered policy `(table, on, procedure)` entry. */
   policies: RlsPolicyIR[];
@@ -854,32 +854,32 @@ interface StorageRuleIR {
   procedure: string;
 }
 /**
-* Schema-wide storage-access-rule metadata emitted into the generated ShardDO so
-* the studio's read-only inspector can list, per bucket, which operations are
-* gated and under what key prefix. Aggregated across every
-* `.use(storageRules(...))` chain — descriptive only, never the predicate logic.
-*/
+ * Schema-wide storage-access-rule metadata emitted into the generated ShardDO so
+ * the studio's read-only inspector can list, per bucket, which operations are
+ * gated and under what key prefix. Aggregated across every
+ * `.use(storageRules(...))` chain — descriptive only, never the predicate logic.
+ */
 interface StorageRulesMetadataIR {
   rules: StorageRuleIR[];
 }
 /**
-* A typed REST route declared with the `httpRoute.&lt;verb>("/path")…` builder in
-* `@lunora/server` and mounted on `httpRouter()`. Captured statically from the
-* builder chain so the OpenAPI emitter can render a real `paths` entry: the verb
-* + path become the operation's method + URL, and the accumulated validator maps
-* become its query parameters, path parameters, and request body.
-*/
+ * A typed REST route declared with the `httpRoute.&lt;verb>("/path")…` builder in
+ * `@lunora/server` and mounted on `httpRouter()`. Captured statically from the
+ * builder chain so the OpenAPI emitter can render a real `paths` entry: the verb
+ * + path become the operation's method + URL, and the accumulated validator maps
+ * become its query parameters, path parameters, and request body.
+ */
 interface HttpRouteIR {
   /** `v.*` validators decoding the JSON request body (`.body({...})`), keyed by field. */
   body: Record<string, ValidatorIR>;
   /**
-  * Rendered TS type of one SSE chunk — the `R` the `.stream(handler)`
-  * handler yields — inferred from the handler via the type checker. Present
-  * only when {@link HttpRouteIR.stream} is `true`; `"unknown"` when the
-  * checker can't resolve enough context. Feeds the emitted
-  * `HttpStreamRef&lt;Chunk, …>` so the chunk type flows to the client.
-  * @experimental Part of the HTTP-SSE stream surface (the `httpStreams.*` emission).
-  */
+   * Rendered TS type of one SSE chunk — the `R` the `.stream(handler)`
+   * handler yields — inferred from the handler via the type checker. Present
+   * only when {@link HttpRouteIR.stream} is `true`; `"unknown"` when the
+   * checker can't resolve enough context. Feeds the emitted
+   * `HttpStreamRef&lt;Chunk, …>` so the chunk type flows to the client.
+   * @experimental Part of the HTTP-SSE stream surface (the `httpStreams.*` emission).
+   */
   chunkType?: string;
   /** Export binding name of the route handler (used only for diagnostics / dedupe). */
   exportName: string;
@@ -899,17 +899,17 @@ interface HttpRouteIR {
   stream: boolean;
 }
 /**
-* Per-procedure protective-middleware snapshot, produced by
-* `discoverProcedureMiddleware` for the security lints
-* (`public_mutation_without_ratelimit`, `user_creating_mutation_without_captcha`).
-* Records which `.use(...)` guards a procedure's builder chain carries plus the
-* behavioural facts that decide whether a guard is *expected* (does it write a
-* user/session table, does it send mail). `protectPublic({ rateLimit, captcha })`
-* is unwrapped: the bundle's object-literal keys set `usesRateLimit`/`usesCaptcha`
-* exactly as the individual `.use(rateLimit(...))` / `.use(verifyTurnstile(...))`
-* steps would. Structurally identical to `AdvisorProcedureProtection` so values
-* pass straight through to the advisor without conversion.
-*/
+ * Per-procedure protective-middleware snapshot, produced by
+ * `discoverProcedureMiddleware` for the security lints
+ * (`public_mutation_without_ratelimit`, `user_creating_mutation_without_captcha`).
+ * Records which `.use(...)` guards a procedure's builder chain carries plus the
+ * behavioural facts that decide whether a guard is *expected* (does it write a
+ * user/session table, does it send mail). `protectPublic({ rateLimit, captcha })`
+ * is unwrapped: the bundle's object-literal keys set `usesRateLimit`/`usesCaptcha`
+ * exactly as the individual `.use(rateLimit(...))` / `.use(verifyTurnstile(...))`
+ * steps would. Structurally identical to `AdvisorProcedureProtection` so values
+ * pass straight through to the advisor without conversion.
+ */
 interface ProcedureMiddlewareIR {
   /** `true` when the handler (or a helper inside it) references `ctx.mail` / `ctx.email`. */
   callsMail: boolean;
@@ -939,13 +939,13 @@ interface ProcedureMiddlewareIR {
   writesUserTable: boolean;
 }
 /**
-* Per-procedure argument-validator snapshot, produced by the
-* argument-validator discoverer for the input-hardening lints
-* (`public_arg_uses_any`, `unbounded_string_arg`). Only public procedures are
-* recorded — internal functions take server-trusted input. Structurally identical
-* to `AdvisorArgumentValidator` so it passes straight through to the advisor
-* without conversion.
-*/
+ * Per-procedure argument-validator snapshot, produced by the
+ * argument-validator discoverer for the input-hardening lints
+ * (`public_arg_uses_any`, `unbounded_string_arg`). Only public procedures are
+ * recorded — internal functions take server-trusted input. Structurally identical
+ * to `AdvisorArgumentValidator` so it passes straight through to the advisor
+ * without conversion.
+ */
 interface ArgumentValidatorIR {
   /** Arg names declared as `v.any()` (unvalidated, untyped input). */
   anyArgs: string[];
@@ -959,12 +959,12 @@ interface ArgumentValidatorIR {
   unboundedStringArgs: string[];
 }
 /**
-* One factory/constructor call in `lunora/` whose config object literal a
-* security lint inspects for a present-or-absent key — the shared input for the
-* config-call security lints (payment authorize, inbound-mail verify, rate-limit
-* store, browser private-targets). Structurally identical to `AdvisorConfigCall`
-* so it passes straight through to the advisor without conversion.
-*/
+ * One factory/constructor call in `lunora/` whose config object literal a
+ * security lint inspects for a present-or-absent key — the shared input for the
+ * config-call security lints (payment authorize, inbound-mail verify, rate-limit
+ * store, browser private-targets). Structurally identical to `AdvisorConfigCall`
+ * so it passes straight through to the advisor without conversion.
+ */
 interface ConfigCallIR {
   /** `true` when the config argument was a static object literal the feeder could read. */
   analyzable: boolean;
@@ -980,11 +980,11 @@ interface ConfigCallIR {
   trueKeys: string[];
 }
 /**
-* One secret-shaped string literal discovered in `lunora/` source — the
-* `hardcoded_secret` lint input. Complements the pre-commit `vis secrets` scan by
-* surfacing the same class of finding in-IDE via the studio Advisors table.
-* Structurally identical to `AdvisorSecretLiteral`.
-*/
+ * One secret-shaped string literal discovered in `lunora/` source — the
+ * `hardcoded_secret` lint input. Complements the pre-commit `vis secrets` scan by
+ * surfacing the same class of finding in-IDE via the studio Advisors table.
+ * Structurally identical to `AdvisorSecretLiteral`.
+ */
 interface SecretLiteralIR {
   /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
   file: string;
@@ -996,14 +996,14 @@ interface SecretLiteralIR {
   preview: string;
 }
 /**
-* One `ctx.sql.query(text, …)` / `ctx.sql.unsafe(text, …)` call whose `text`
-* argument is built in place rather than passed as a fixed statement — the
-* `sql_injection_risk` lint input. The Hyperdrive driver binds ONLY the `params`
-* array; the `text` string is spliced verbatim into the SQL, so a `text` assembled
-* from a string concatenation or a substitution template literal is an injection
-* vector. A fixed string literal / no-substitution template is safe. Structurally
-* identical to `AdvisorSqlInterpolation`.
-*/
+ * One `ctx.sql.query(text, …)` / `ctx.sql.unsafe(text, …)` call whose `text`
+ * argument is built in place rather than passed as a fixed statement — the
+ * `sql_injection_risk` lint input. The Hyperdrive driver binds ONLY the `params`
+ * array; the `text` string is spliced verbatim into the SQL, so a `text` assembled
+ * from a string concatenation or a substitution template literal is an injection
+ * vector. A fixed string literal / no-substitution template is safe. Structurally
+ * identical to `AdvisorSqlInterpolation`.
+ */
 interface SqlInterpolationIR {
   /** Export binding name of the procedure performing the `ctx.sql` call. */
   exportName: string;
@@ -1013,14 +1013,14 @@ interface SqlInterpolationIR {
   line: number;
 }
 /**
-* One `ctx.fetch(url, …)` call inside an action whose URL argument is derived
-* from the handler's `args` — the `action_fetch_ssrf` lint input. `ctx.fetch` is
-* the action-only outbound-request escape hatch with no host allowlist, so a URL
-* assembled from request input is a server-side request forgery vector (cloud
-* metadata endpoints, internal services). Only arg-derived URLs reach here; a
-* fixed literal or a URL built from config/`ctx.*` is not recorded. Structurally
-* identical to `AdvisorArgumentDerivedFetch`.
-*/
+ * One `ctx.fetch(url, …)` call inside an action whose URL argument is derived
+ * from the handler's `args` — the `action_fetch_ssrf` lint input. `ctx.fetch` is
+ * the action-only outbound-request escape hatch with no host allowlist, so a URL
+ * assembled from request input is a server-side request forgery vector (cloud
+ * metadata endpoints, internal services). Only arg-derived URLs reach here; a
+ * fixed literal or a URL built from config/`ctx.*` is not recorded. Structurally
+ * identical to `AdvisorArgumentDerivedFetch`.
+ */
 interface ArgumentDerivedFetchIR {
   /** Export binding name of the action performing the `ctx.fetch` call. */
   exportName: string;
@@ -1030,15 +1030,15 @@ interface ArgumentDerivedFetchIR {
   line: number;
 }
 /**
-* One `ctx.kv.&lt;method>(key, …)` call whose namespace key is derived from the
-* handler's `args` with no server-side scoping — the `kv_unscoped_user_key_idor`
-* lint input. Workers KV is a single flat namespace, so a key taken straight from
-* request input lets any caller read, overwrite, or delete another user's entry
-* (IDOR). Only arg-derived, unscoped keys reach here; a fixed literal, or a key
-* prefixed with a server-trusted identity (`${ctx.auth.userId}:…` — references
-* `ctx`, so treated as scoped), is not recorded. `list` is excluded (it takes a
-* prefix, not a per-entry key). Structurally identical to `AdvisorKvKeyAccess`.
-*/
+ * One `ctx.kv.&lt;method>(key, …)` call whose namespace key is derived from the
+ * handler's `args` with no server-side scoping — the `kv_unscoped_user_key_idor`
+ * lint input. Workers KV is a single flat namespace, so a key taken straight from
+ * request input lets any caller read, overwrite, or delete another user's entry
+ * (IDOR). Only arg-derived, unscoped keys reach here; a fixed literal, or a key
+ * prefixed with a server-trusted identity (`${ctx.auth.userId}:…` — references
+ * `ctx`, so treated as scoped), is not recorded. `list` is excluded (it takes a
+ * prefix, not a per-entry key). Structurally identical to `AdvisorKvKeyAccess`.
+ */
 interface KvKeyAccessIR {
   /** Export binding name of the procedure performing the `ctx.kv` access. */
   exportName: string;
@@ -1050,16 +1050,16 @@ interface KvKeyAccessIR {
   method: string;
 }
 /**
-* One `ctx.db` write (`insert` / `replace` / `patch` / `insertManyUnsafe`) that sets
-* an ownership / identity column — `userId`, `ownerId`, `tenantId`, and the like —
-* from the handler's `args` instead of the server-trusted identity. The
-* `owner_field_from_args_not_auth` lint input: the ownership column decides who a
-* row belongs to, so a value taken from request input lets any caller write rows
-* owned by another user or tenant (the act-as-any-user / cross-tenant IDOR vector).
-* A column stamped from `ctx.*`, or set to a fixed literal, is not recorded; only an
-* arg-derived identity write reaches here. Structurally identical to
-* `AdvisorOwnerFieldWrite`.
-*/
+ * One `ctx.db` write (`insert` / `replace` / `patch` / `insertManyUnsafe`) that sets
+ * an ownership / identity column — `userId`, `ownerId`, `tenantId`, and the like —
+ * from the handler's `args` instead of the server-trusted identity. The
+ * `owner_field_from_args_not_auth` lint input: the ownership column decides who a
+ * row belongs to, so a value taken from request input lets any caller write rows
+ * owned by another user or tenant (the act-as-any-user / cross-tenant IDOR vector).
+ * A column stamped from `ctx.*`, or set to a fixed literal, is not recorded; only an
+ * arg-derived identity write reaches here. Structurally identical to
+ * `AdvisorOwnerFieldWrite`.
+ */
 interface OwnerFieldWriteIR {
   /** Export binding name of the procedure performing the write. */
   exportName: string;
@@ -1073,15 +1073,15 @@ interface OwnerFieldWriteIR {
   method: string;
 }
 /**
-* One `ctx.storage.&lt;bucket>.&lt;method>(key, …)` call whose R2 object key is derived
-* from the handler's `args` with no server-side scoping — the
-* `storage_key_from_user_args` lint input. The bucket read/write/URL/delete methods
-* key by their first argument, so an object key taken straight from request input is
-* object-level IDOR (read/overwrite/delete anyone's object). A key referencing a
-* server-trusted `ctx.*` value (e.g. `${ctx.auth.userId}/…`) is treated as scoped
-* and is not recorded; only an arg-derived, `ctx`-free key reaches here.
-* Structurally identical to `AdvisorStorageKeyAccess`.
-*/
+ * One `ctx.storage.&lt;bucket>.&lt;method>(key, …)` call whose R2 object key is derived
+ * from the handler's `args` with no server-side scoping — the
+ * `storage_key_from_user_args` lint input. The bucket read/write/URL/delete methods
+ * key by their first argument, so an object key taken straight from request input is
+ * object-level IDOR (read/overwrite/delete anyone's object). A key referencing a
+ * server-trusted `ctx.*` value (e.g. `${ctx.auth.userId}/…`) is treated as scoped
+ * and is not recorded; only an arg-derived, `ctx`-free key reaches here.
+ * Structurally identical to `AdvisorStorageKeyAccess`.
+ */
 interface StorageKeyAccessIR {
   /** Export binding name of the procedure performing the storage call. */
   exportName: string;
@@ -1093,16 +1093,16 @@ interface StorageKeyAccessIR {
   method: string;
 }
 /**
-* One `ctx.containers.&lt;exportName>.get(name, …)` call whose instance key is derived
-* from the handler's `args` with no server-side scoping — the
-* `container_instance_key_from_user_input` lint input. Each container definition's
-* `.get(name)` accessor routes to one instance per `name`, so a key taken straight from
-* request input lets any caller reach another tenant's container (a cross-tenant IDOR). A
-* fixed literal key, or one derived from a server-trusted identity (`${ctx.auth.userId}` —
-* references `ctx`, so treated as scoped), is not recorded; only an arg-derived, unscoped
-* key reaches here. `.any()`/`.pool()` take no key and are not sinks. Structurally
-* identical to `AdvisorContainerKeyAccess`.
-*/
+ * One `ctx.containers.&lt;exportName>.get(name, …)` call whose instance key is derived
+ * from the handler's `args` with no server-side scoping — the
+ * `container_instance_key_from_user_input` lint input. Each container definition's
+ * `.get(name)` accessor routes to one instance per `name`, so a key taken straight from
+ * request input lets any caller reach another tenant's container (a cross-tenant IDOR). A
+ * fixed literal key, or one derived from a server-trusted identity (`${ctx.auth.userId}` —
+ * references `ctx`, so treated as scoped), is not recorded; only an arg-derived, unscoped
+ * key reaches here. `.any()`/`.pool()` take no key and are not sinks. Structurally
+ * identical to `AdvisorContainerKeyAccess`.
+ */
 interface ContainerKeyAccessIR {
   /** Export binding name of the procedure performing the `ctx.containers` access. */
   exportName: string;
@@ -1114,15 +1114,15 @@ interface ContainerKeyAccessIR {
   method: string;
 }
 /**
-* One `ctx.ai.run(model, …)` call whose model-id argument is derived from the handler's
-* `args` with no server-side scoping — the `ai_raw_run_escape_hatch` lint input.
-* `ctx.ai.run` is the raw Workers AI binding passthrough, bypassing the typed
-* `ctx.ai.model(...)` + AI-SDK layer (`generateText`/`streamText`/…) that caps output and
-* enforces a schema, so an arg-derived model id lets any caller select an arbitrary model.
-* A fixed literal model, or one scoped by a server-trusted `ctx.*` value, is not recorded;
-* only an arg-derived, unscoped model id reaches here (an arg-derived `inputs` argument is
-* normal usage and is never inspected). Structurally identical to `AdvisorAiRawRun`.
-*/
+ * One `ctx.ai.run(model, …)` call whose model-id argument is derived from the handler's
+ * `args` with no server-side scoping — the `ai_raw_run_escape_hatch` lint input.
+ * `ctx.ai.run` is the raw Workers AI binding passthrough, bypassing the typed
+ * `ctx.ai.model(...)` + AI-SDK layer (`generateText`/`streamText`/…) that caps output and
+ * enforces a schema, so an arg-derived model id lets any caller select an arbitrary model.
+ * A fixed literal model, or one scoped by a server-trusted `ctx.*` value, is not recorded;
+ * only an arg-derived, unscoped model id reaches here (an arg-derived `inputs` argument is
+ * normal usage and is never inspected). Structurally identical to `AdvisorAiRawRun`.
+ */
 interface AiRawRunIR {
   /** Export binding name of the procedure performing the `ctx.ai.run` call. */
   exportName: string;
@@ -1132,15 +1132,15 @@ interface AiRawRunIR {
   line: number;
 }
 /**
-* One `ctx.vectors.&lt;method>(indexName, input)` call whose `input.namespace` is derived
-* from the handler's `args` with no server-side scoping — the
-* `vectors_namespace_from_user_input` lint input. A Vectorize namespace partitions one
-* index into isolated sub-collections, so a namespace taken straight from request input
-* lets any caller read or poison another tenant's vectors. A fixed literal namespace, or
-* one prefixed with a server-trusted identity (`${ctx.auth.orgId}` — references `ctx`, so
-* treated as scoped), is not recorded; only an arg-derived, unscoped namespace reaches
-* here. Structurally identical to `AdvisorVectorNamespaceAccess`.
-*/
+ * One `ctx.vectors.&lt;method>(indexName, input)` call whose `input.namespace` is derived
+ * from the handler's `args` with no server-side scoping — the
+ * `vectors_namespace_from_user_input` lint input. A Vectorize namespace partitions one
+ * index into isolated sub-collections, so a namespace taken straight from request input
+ * lets any caller read or poison another tenant's vectors. A fixed literal namespace, or
+ * one prefixed with a server-trusted identity (`${ctx.auth.orgId}` — references `ctx`, so
+ * treated as scoped), is not recorded; only an arg-derived, unscoped namespace reaches
+ * here. Structurally identical to `AdvisorVectorNamespaceAccess`.
+ */
 interface VectorNamespaceAccessIR {
   /** Export binding name of the procedure performing the `ctx.vectors` access. */
   exportName: string;
@@ -1152,15 +1152,15 @@ interface VectorNamespaceAccessIR {
   method: string;
 }
 /**
-* One `ctx.mail`/`ctx.email` `send`/`queue` call whose recipient field (`to`/`cc`/`bcc`)
-* is derived from the handler's `args` with no server-side scoping — the
-* `mail_recipient_from_request_input` lint input. A recipient taken straight from request
-* input turns the deployment into an open relay / spam amplifier (any caller can direct
-* mail to an arbitrary address). A fixed literal recipient, or one scoped by a
-* server-trusted `ctx.*` value (e.g. `ctx.auth.user.email`), is not recorded; only an
-* arg-derived, unscoped recipient reaches here. Structurally identical to
-* `AdvisorMailRecipientAccess`.
-*/
+ * One `ctx.mail`/`ctx.email` `send`/`queue` call whose recipient field (`to`/`cc`/`bcc`)
+ * is derived from the handler's `args` with no server-side scoping — the
+ * `mail_recipient_from_request_input` lint input. A recipient taken straight from request
+ * input turns the deployment into an open relay / spam amplifier (any caller can direct
+ * mail to an arbitrary address). A fixed literal recipient, or one scoped by a
+ * server-trusted `ctx.*` value (e.g. `ctx.auth.user.email`), is not recorded; only an
+ * arg-derived, unscoped recipient reaches here. Structurally identical to
+ * `AdvisorMailRecipientAccess`.
+ */
 interface MailRecipientAccessIR {
   /** Export binding name of the procedure performing the `ctx.mail`/`ctx.email` call. */
   exportName: string;
@@ -1172,13 +1172,13 @@ interface MailRecipientAccessIR {
   method: string;
 }
 /**
-* One `ctx.browser.&lt;method>(url, …)` call whose navigation URL (`arguments[0]`)
-* is derived from the handler's `args` with no server-side scoping — the
-* `browser_user_url_without_allowlist` lint input. The lint additionally
-* cross-references `createBrowser` config-call evidence to suppress findings
-* when the browser is hardened with an `allowedHosts` allowlist or
-* `resolveDns`. Structurally identical to `AdvisorBrowserUrlAccess`.
-*/
+ * One `ctx.browser.&lt;method>(url, …)` call whose navigation URL (`arguments[0]`)
+ * is derived from the handler's `args` with no server-side scoping — the
+ * `browser_user_url_without_allowlist` lint input. The lint additionally
+ * cross-references `createBrowser` config-call evidence to suppress findings
+ * when the browser is hardened with an `allowedHosts` allowlist or
+ * `resolveDns`. Structurally identical to `AdvisorBrowserUrlAccess`.
+ */
 interface BrowserUrlAccessIR {
   /** Export binding name of the procedure performing the `ctx.browser` call. */
   exportName: string;
@@ -1190,14 +1190,14 @@ interface BrowserUrlAccessIR {
   method: string;
 }
 /**
-* One runtime container-override call: a `&lt;handle>.start({ enableInternet: true, … })`
-* launch override, or a `&lt;handle>.egress.&lt;method>(...)` runtime firewall mutation
-* (`allow` / `deny` / `setAllowed`) — the `container_start_enable_internet_override`
-* and `container_runtime_egress_relaxation` lint input. Both shapes re-open network
-* access the static `defineContainer` declaration (and its `container_public_internet`
-* lint) assumes is locked down. Matched structurally by call shape, independent of the
-* receiver's resolved type. Structurally identical to `AdvisorContainerOverride`.
-*/
+ * One runtime container-override call: a `&lt;handle>.start({ enableInternet: true, … })`
+ * launch override, or a `&lt;handle>.egress.&lt;method>(...)` runtime firewall mutation
+ * (`allow` / `deny` / `setAllowed`) — the `container_start_enable_internet_override`
+ * and `container_runtime_egress_relaxation` lint input. Both shapes re-open network
+ * access the static `defineContainer` declaration (and its `container_public_internet`
+ * lint) assumes is locked down. Matched structurally by call shape, independent of the
+ * receiver's resolved type. Structurally identical to `AdvisorContainerOverride`.
+ */
 interface ContainerOverrideIR {
   /** e.g. the egress method name, or `"enableInternet: true"`. */
   detail: string;
@@ -1211,18 +1211,18 @@ interface ContainerOverrideIR {
   line: number;
 }
 /**
-* One `buildImageDeliveryUrl({ key, … })` call (`@lunora/bindings/images`) whose
-* `key` — the CDN transform's source image, an absolute URL or an
-* origin-relative key — is derived from the handler's `args` with no
-* server-side scoping — the `images_url_source_from_user_input` lint input.
-* `ctx.images.transform`/`info` take image *bytes*, never a URL, so they are not
-* sinks; only the `key` of `buildImageDeliveryUrl` accepts a URL-or-key source
-* and is inspected. An arg-derived `key` lets any caller point the CDN's
-* `/cdn-cgi/image/` transform at an attacker-chosen origin (SSRF / open proxy)
-* or at an arbitrary key under the account's own store. A fixed literal, or a
-* key scoped by a server-trusted `ctx.*` value, is not recorded. Structurally
-* identical to `AdvisorImageDeliveryUrlAccess`.
-*/
+ * One `buildImageDeliveryUrl({ key, … })` call (`@lunora/bindings/images`) whose
+ * `key` — the CDN transform's source image, an absolute URL or an
+ * origin-relative key — is derived from the handler's `args` with no
+ * server-side scoping — the `images_url_source_from_user_input` lint input.
+ * `ctx.images.transform`/`info` take image *bytes*, never a URL, so they are not
+ * sinks; only the `key` of `buildImageDeliveryUrl` accepts a URL-or-key source
+ * and is inspected. An arg-derived `key` lets any caller point the CDN's
+ * `/cdn-cgi/image/` transform at an attacker-chosen origin (SSRF / open proxy)
+ * or at an arbitrary key under the account's own store. A fixed literal, or a
+ * key scoped by a server-trusted `ctx.*` value, is not recorded. Structurally
+ * identical to `AdvisorImageDeliveryUrlAccess`.
+ */
 interface ImageDeliveryUrlAccessIR {
   /** Export binding name of the procedure performing the `buildImageDeliveryUrl` call. */
   exportName: string;
@@ -1232,17 +1232,17 @@ interface ImageDeliveryUrlAccessIR {
   line: number;
 }
 /**
-* One `createAuth({...})` call's configuration snapshot — the shared input for
-* the five `auth_*` security lints (trusted-origins wildcard, CSRF check
-* disabled, secure cookies disabled, email verification disabled, session
-* freshAge zero). Matched by callee NAME (an `import`-agnostic, fail-closed
-* convention the other feeders share), so a re-export or alias still resolves.
-* When the config argument isn't a statically-analyzable object literal (a
-* top-level spread, or not an object literal at all), `analyzable` is `false`
-* and every boolean fact defaults to its SAFE (not-flagged) value — an opaque
-* config can't be relied on either way. Structurally identical to
-* `AdvisorAuthConfig`.
-*/
+ * One `createAuth({...})` call's configuration snapshot — the shared input for
+ * the five `auth_*` security lints (trusted-origins wildcard, CSRF check
+ * disabled, secure cookies disabled, email verification disabled, session
+ * freshAge zero). Matched by callee NAME (an `import`-agnostic, fail-closed
+ * convention the other feeders share), so a re-export or alias still resolves.
+ * When the config argument isn't a statically-analyzable object literal (a
+ * top-level spread, or not an object literal at all), `analyzable` is `false`
+ * and every boolean fact defaults to its SAFE (not-flagged) value — an opaque
+ * config can't be relied on either way. Structurally identical to
+ * `AdvisorAuthConfig`.
+ */
 interface AuthConfigIR {
   /** `true` when the call's config argument was a static object literal the feeder could read. */
   analyzable: boolean;
@@ -1266,17 +1266,17 @@ interface AuthConfigIR {
   trustedOriginsWildcard: boolean;
 }
 /**
-* One `rateLimit`/`dbRateLimit` middleware call (`@lunora/ratelimit`) whose
-* `key` selector — the per-caller rate-limit sub-key, `(ctx) => string |
-* undefined` — is derived from the handler's `args` with no server-side
-* scoping (no reference to the trusted `ctx` binding anywhere in the selector)
-* — the `ratelimit_key_spoofable_or_global` lint input. A key an attacker
-* controls lets them rotate it per request and bypass the limit entirely,
-* defeating its purpose. A selector scoped by `ctx` (e.g. `ctx.auth.userId`,
-* `ctx.ip`), or one with no `args` reference at all (a fixed/global bucket —
-* the "no key" case this lint deliberately does not flag, to keep it low-FP),
-* is not recorded. Structurally identical to `AdvisorRatelimitKeySelector`.
-*/
+ * One `rateLimit`/`dbRateLimit` middleware call (`@lunora/ratelimit`) whose
+ * `key` selector — the per-caller rate-limit sub-key, `(ctx) => string |
+ * undefined` — is derived from the handler's `args` with no server-side
+ * scoping (no reference to the trusted `ctx` binding anywhere in the selector)
+ * — the `ratelimit_key_spoofable_or_global` lint input. A key an attacker
+ * controls lets them rotate it per request and bypass the limit entirely,
+ * defeating its purpose. A selector scoped by `ctx` (e.g. `ctx.auth.userId`,
+ * `ctx.ip`), or one with no `args` reference at all (a fixed/global bucket —
+ * the "no key" case this lint deliberately does not flag, to keep it low-FP),
+ * is not recorded. Structurally identical to `AdvisorRatelimitKeySelector`.
+ */
 interface RatelimitKeySelectorIR {
   /** The `rateLimit`/`dbRateLimit` callee invoked. */
   callee: string;
@@ -1290,16 +1290,16 @@ interface RatelimitKeySelectorIR {
   line: number;
 }
 /**
-* One payload-derived privileged dispatch — a `ctx.run`/`context.run` back into a
-* Lunora function from inside a `defineQueue` push handler or a `defineWorkflow`
-* handler, whose args reference the handler's untrusted payload (`context.params`
-* for a workflow, a `for (… of batch.messages)` body for a queue) — the
-* `privileged_dispatch_unvalidated_payload` lint input. Both handler kinds run
-* under the **system identity** (RLS disabled), so forwarding attacker-influenced
-* payload into the dispatch bypasses the target's row policy. The resolved
-* `targetFile`/`targetExport` let the lint join RLS-procedure evidence and fire
-* only for RLS-gated targets. Structurally identical to `AdvisorPrivilegedDispatch`.
-*/
+ * One payload-derived privileged dispatch — a `ctx.run`/`context.run` back into a
+ * Lunora function from inside a `defineQueue` push handler or a `defineWorkflow`
+ * handler, whose args reference the handler's untrusted payload (`context.params`
+ * for a workflow, a `for (… of batch.messages)` body for a queue) — the
+ * `privileged_dispatch_unvalidated_payload` lint input. Both handler kinds run
+ * under the **system identity** (RLS disabled), so forwarding attacker-influenced
+ * payload into the dispatch bypasses the target's row policy. The resolved
+ * `targetFile`/`targetExport` let the lint join RLS-procedure evidence and fire
+ * only for RLS-gated targets. Structurally identical to `AdvisorPrivilegedDispatch`.
+ */
 interface PrivilegedDispatchIR {
   /** `"queue"` for a `defineQueue` handler, `"workflow"` for a `defineWorkflow` handler. */
   dispatchKind: "queue" | "workflow";
@@ -1315,11 +1315,11 @@ interface PrivilegedDispatchIR {
   targetFile: string;
 }
 /**
-* One discovered `httpRoute.&lt;verb>("/admin/…")` route on an admin/privileged-looking
-* path, with whether its builder chain references an auth/admin guard — the
-* `admin_route_without_guard` lint input. Structurally identical to
-* `AdvisorAdminRoute`.
-*/
+ * One discovered `httpRoute.&lt;verb>("/admin/…")` route on an admin/privileged-looking
+ * path, with whether its builder chain references an auth/admin guard — the
+ * `admin_route_without_guard` lint input. Structurally identical to
+ * `AdvisorAdminRoute`.
+ */
 interface AdminRouteIR {
   /** Export binding name of the route handler. */
   exportName: string;
@@ -1333,17 +1333,17 @@ interface AdminRouteIR {
   usesGuard: boolean;
 }
 /**
-* One tracked `ctx.storage.&lt;bucket>.&lt;method>(...)` upload/signing call — the
-* shared input for the storage config-hygiene security lints
-* (`storage_upload_without_content_type_allowlist`, `storage_upload_without_max_size`,
-* `storage_generate_upload_url_no_content_type_pin`, `storage_presigned_url_for_private_content`).
-* `upload`/`store` carry the `UploadOptions` guards (`allowedContentTypes` /
-* `maxSize`); `generateUploadUrl` carries the signed-PUT `contentType` pin;
-* `getPresignedUrl`/`getSignedUrl` carry a statically-known `expiresInSeconds`
-* literal. `presentKeys` is empty (and `expiresInSeconds` unset) when the
-* options argument was absent, a non-literal, or a spread — see `analyzable`.
-* Structurally identical to `AdvisorStorageUpload`.
-*/
+ * One tracked `ctx.storage.&lt;bucket>.&lt;method>(...)` upload/signing call — the
+ * shared input for the storage config-hygiene security lints
+ * (`storage_upload_without_content_type_allowlist`, `storage_upload_without_max_size`,
+ * `storage_generate_upload_url_no_content_type_pin`, `storage_presigned_url_for_private_content`).
+ * `upload`/`store` carry the `UploadOptions` guards (`allowedContentTypes` /
+ * `maxSize`); `generateUploadUrl` carries the signed-PUT `contentType` pin;
+ * `getPresignedUrl`/`getSignedUrl` carry a statically-known `expiresInSeconds`
+ * literal. `presentKeys` is empty (and `expiresInSeconds` unset) when the
+ * options argument was absent, a non-literal, or a spread — see `analyzable`.
+ * Structurally identical to `AdvisorStorageUpload`.
+ */
 interface StorageUploadIR {
   /** `true` when the call's options-object argument (or its deliberate absence) was statically resolvable. */
   analyzable: boolean;
@@ -1361,16 +1361,16 @@ interface StorageUploadIR {
   presentKeys: string[];
 }
 /**
-* One discovered `httpAction`/`httpRoute` handler in `lunora/` that performs a
-* side effect (`ctx.runMutation` / `ctx.runAction` / a `ctx.db.{insert,patch,
-* replace,delete,insertManyUnsafe}` write) from the HTTP edge, with whether it
-* reads `ctx.auth` — the `http_action_missing_auth_guard` lint input. A handler
-* that mutates state or dispatches an action without ever consulting the request
-* identity is an unauthenticated write bypassing identity/RLS. Only handlers with
-* a statically-resolvable inline body and `ctx` binding are recorded (fail-safe
-* under-report); read-only handlers are never recorded. Structurally identical to
-* `AdvisorHttpActionGuard`.
-*/
+ * One discovered `httpAction`/`httpRoute` handler in `lunora/` that performs a
+ * side effect (`ctx.runMutation` / `ctx.runAction` / a `ctx.db.{insert,patch,
+ * replace,delete,insertManyUnsafe}` write) from the HTTP edge, with whether it
+ * reads `ctx.auth` — the `http_action_missing_auth_guard` lint input. A handler
+ * that mutates state or dispatches an action without ever consulting the request
+ * identity is an unauthenticated write bypassing identity/RLS. Only handlers with
+ * a statically-resolvable inline body and `ctx` binding are recorded (fail-safe
+ * under-report); read-only handlers are never recorded. Structurally identical to
+ * `AdvisorHttpActionGuard`.
+ */
 interface HttpActionGuardIR {
   /** Export binding name of the handler (or `"&lt;module>"` when mounted inline / not a named binding). */
   exportName: string;
@@ -1388,19 +1388,19 @@ interface HttpActionGuardIR {
   sideEffect: string;
 }
 /**
-* One response-header write, inside an `httpAction` handler, whose value is derived
-* from raw request input (`request.headers`, `request.url`/query, `await
-* request.json()`) with no CR/LF sanitizer — the
-* `http_action_response_header_injection` lint input. A `Request`-derived string
-* placed verbatim into a response header lets a caller smuggle `\r\n` and inject
-* extra headers or split the response (header injection / response splitting). Only
-* sites whose value is request-tainted AND unguarded are recorded: a value routed
-* through a CR/LF guard (`isSafeHeaderValue`), a URL/URI encoder
-* (`encodeURIComponent`/`encodeURI`), a numeric coercion (`Number`/`parseInt`/
-* `parseFloat`), or `btoa` is treated as safe and never recorded (`String(...)` /
-* `.toString()` are NOT sanitizers — they don't strip CR/LF). Structurally
-* identical to `AdvisorHttpHeaderWrite`.
-*/
+ * One response-header write, inside an `httpAction` handler, whose value is derived
+ * from raw request input (`request.headers`, `request.url`/query, `await
+ * request.json()`) with no CR/LF sanitizer — the
+ * `http_action_response_header_injection` lint input. A `Request`-derived string
+ * placed verbatim into a response header lets a caller smuggle `\r\n` and inject
+ * extra headers or split the response (header injection / response splitting). Only
+ * sites whose value is request-tainted AND unguarded are recorded: a value routed
+ * through a CR/LF guard (`isSafeHeaderValue`), a URL/URI encoder
+ * (`encodeURIComponent`/`encodeURI`), a numeric coercion (`Number`/`parseInt`/
+ * `parseFloat`), or `btoa` is treated as safe and never recorded (`String(...)` /
+ * `.toString()` are NOT sanitizers — they don't strip CR/LF). Structurally
+ * identical to `AdvisorHttpHeaderWrite`.
+ */
 interface HttpHeaderWriteIR {
   /** Export binding name of the enclosing handler, or `"&lt;module>"` when mounted inline. */
   exportName: string;
@@ -1414,16 +1414,16 @@ interface HttpHeaderWriteIR {
   via: "headers-append" | "headers-ctor" | "headers-set" | "response-init";
 }
 /**
-* One rate-limit / Turnstile middleware call in `lunora/` — the
-* `ratelimit_middleware_fail_open` lint input. `rateLimit`/`dbRateLimit`
-* (`@lunora/ratelimit`) and `verifyTurnstileMiddleware` (`@lunora/auth`) each
-* accept a `failOpen` escape hatch that admits every request when the
-* limiter/siteverify is unavailable; `failOpen` is `true` only when the options
-* literal set it to the boolean literal `true` (anything else is fail-closed).
-* The lint escalates a fail-open guard to a finding when the guarded procedure
-* (`exportName`/`limitName`) looks auth/payment-sensitive. Structurally
-* identical to `AdvisorFailOpenGuard`.
-*/
+ * One rate-limit / Turnstile middleware call in `lunora/` — the
+ * `ratelimit_middleware_fail_open` lint input. `rateLimit`/`dbRateLimit`
+ * (`@lunora/ratelimit`) and `verifyTurnstileMiddleware` (`@lunora/auth`) each
+ * accept a `failOpen` escape hatch that admits every request when the
+ * limiter/siteverify is unavailable; `failOpen` is `true` only when the options
+ * literal set it to the boolean literal `true` (anything else is fail-closed).
+ * The lint escalates a fail-open guard to a finding when the guarded procedure
+ * (`exportName`/`limitName`) looks auth/payment-sensitive. Structurally
+ * identical to `AdvisorFailOpenGuard`.
+ */
 interface FailOpenGuardIR {
   /** The middleware factory at the call site: `rateLimit` / `dbRateLimit` / `verifyTurnstileMiddleware`. */
   callee: string;
@@ -1439,14 +1439,14 @@ interface FailOpenGuardIR {
   line: number;
 }
 /**
-* One `ctx.flags.boolean("key", &lt;boolean-literal>)` read in `lunora/` — the
-* `flag_gates_security_with_unsafe_default` lint input. OpenFeature returns the
-* `defaultValue` when the provider errors, so a fail-open default on a
-* security-shaped key silently opens access during an outage. Only reads with a
-* statically-known string key and boolean-literal default are recorded; the lint
-* owns the security-shape + polarity judgment. Structurally identical to
-* `AdvisorFlagSecurityDefault`.
-*/
+ * One `ctx.flags.boolean("key", &lt;boolean-literal>)` read in `lunora/` — the
+ * `flag_gates_security_with_unsafe_default` lint input. OpenFeature returns the
+ * `defaultValue` when the provider errors, so a fail-open default on a
+ * security-shaped key silently opens access during an outage. Only reads with a
+ * statically-known string key and boolean-literal default are recorded; the lint
+ * owns the security-shape + polarity judgment. Structurally identical to
+ * `AdvisorFlagSecurityDefault`.
+ */
 interface FlagSecurityDefaultIR {
   /** The boolean-literal default returned on a provider outage (fail-open value). */
   defaultValue: boolean;
@@ -1460,13 +1460,13 @@ interface FlagSecurityDefaultIR {
   line: number;
 }
 /**
-* One `generateText` / `streamText` call in `lunora/` whose `tools` reach a
-* privileged side effect (a DB write, function dispatch, or outbound
-* fetch/mail/queue send). `userInputDerived` records whether the model input
-* (`prompt`/`messages`/`system`) flows from the handler's `args`; the
-* `ai_tool_side_effect_prompt_injection` lint fires only when it does.
-* Structurally identical to `AdvisorAiToolSideEffect`.
-*/
+ * One `generateText` / `streamText` call in `lunora/` whose `tools` reach a
+ * privileged side effect (a DB write, function dispatch, or outbound
+ * fetch/mail/queue send). `userInputDerived` records whether the model input
+ * (`prompt`/`messages`/`system`) flows from the handler's `args`; the
+ * `ai_tool_side_effect_prompt_injection` lint fires only when it does.
+ * Structurally identical to `AdvisorAiToolSideEffect`.
+ */
 interface AiToolSideEffectIR {
   /** Export binding name of the procedure performing the call. */
   exportName: string;
@@ -1482,13 +1482,13 @@ interface AiToolSideEffectIR {
   userInputDerived: boolean;
 }
 /**
-* One `&lt;receiver>.identity.&lt;key>` claim read in `lunora/`, where `&lt;receiver>` is
-* an RLS/mask policy `auth` (or `ctx.auth`/`context.auth`). `declared` records
-* whether `&lt;key>` is in the app's `defineIdentity({ ... })` contract (or the
-* always-present `userId`); the `identity_undeclared_claim_trusted` lint fires on
-* the undeclared reads. Emitted only when a resolvable identity contract exists.
-* Structurally identical to `AdvisorIdentityClaimRead`.
-*/
+ * One `&lt;receiver>.identity.&lt;key>` claim read in `lunora/`, where `&lt;receiver>` is
+ * an RLS/mask policy `auth` (or `ctx.auth`/`context.auth`). `declared` records
+ * whether `&lt;key>` is in the app's `defineIdentity({ ... })` contract (or the
+ * always-present `userId`); the `identity_undeclared_claim_trusted` lint fires on
+ * the undeclared reads. Emitted only when a resolvable identity contract exists.
+ * Structurally identical to `AdvisorIdentityClaimRead`.
+ */
 interface IdentityClaimReadIR {
   /** `true` when `key` is a declared claim (in the `defineIdentity` contract, or the always-present `userId`). */
   declared: boolean;
@@ -1502,13 +1502,13 @@ interface IdentityClaimReadIR {
   line: number;
 }
 /**
-* One payment webhook-adapter construction in `lunora/` (`createStripeAdapter` /
-* `createPolarAdapter` / `createAutumnAdapter` / `createDodoPaymentsAdapter`).
-* `toleranceSeconds` carries the statically-known `webhookToleranceSeconds`
-* replay window when it is a plain numeric literal; the payment-webhook
-* wide-tolerance lint fires when it exceeds a conservative ceiling. Structurally
-* identical to `AdvisorPaymentWebhook`.
-*/
+ * One payment webhook-adapter construction in `lunora/` (`createStripeAdapter` /
+ * `createPolarAdapter` / `createAutumnAdapter` / `createDodoPaymentsAdapter`).
+ * `toleranceSeconds` carries the statically-known `webhookToleranceSeconds`
+ * replay window when it is a plain numeric literal; the payment-webhook
+ * wide-tolerance lint fires when it exceeds a conservative ceiling. Structurally
+ * identical to `AdvisorPaymentWebhook`.
+ */
 interface PaymentWebhookIR {
   /** The adapter factory invoked. */
   callee: "createAutumnAdapter" | "createDodoPaymentsAdapter" | "createPolarAdapter" | "createStripeAdapter";
@@ -1522,13 +1522,13 @@ interface PaymentWebhookIR {
   toleranceSeconds?: number;
 }
 /**
-* One `ctx.db.&lt;table>.findMany({ includeDeleted })` list read whose
-* `includeDeleted` is either a hardcoded `true` or derived from the handler's
-* `args` — the `soft_delete_include_deleted_from_args` lint input. The lint joins
-* `table` against the schema's soft-delete tables and `visibility` against
-* `.public()` before flagging. Structurally identical to `AdvisorSoftDeleteRead`
-* so values pass straight through without conversion.
-*/
+ * One `ctx.db.&lt;table>.findMany({ includeDeleted })` list read whose
+ * `includeDeleted` is either a hardcoded `true` or derived from the handler's
+ * `args` — the `soft_delete_include_deleted_from_args` lint input. The lint joins
+ * `table` against the schema's soft-delete tables and `visibility` against
+ * `.public()` before flagging. Structurally identical to `AdvisorSoftDeleteRead`
+ * so values pass straight through without conversion.
+ */
 interface SoftDeleteReadIR {
   /** Export binding name of the procedure performing the read. */
   exportName: string;
@@ -1546,14 +1546,14 @@ interface SoftDeleteReadIR {
   visibility: "internal" | "public";
 }
 /**
-* One `ctx.db.&lt;table>.findMany({ with: { &lt;rel> } })` relation-hydrating list read
-* — the `masked_relation_leak_via_with` lint input. Column masking does not
-* descend into `with`-hydrated relations, so a masked table surfaced only through
-* a `with` on an unprotected parent read is returned in the clear. The lint
-* resolves each relation accessor to its target table and joins it against the
-* discovered mask evidence before flagging. Structurally identical to
-* `AdvisorRelationLoad` so values pass straight through without conversion.
-*/
+ * One `ctx.db.&lt;table>.findMany({ with: { &lt;rel> } })` relation-hydrating list read
+ * — the `masked_relation_leak_via_with` lint input. Column masking does not
+ * descend into `with`-hydrated relations, so a masked table surfaced only through
+ * a `with` on an unprotected parent read is returned in the clear. The lint
+ * resolves each relation accessor to its target table and joins it against the
+ * discovered mask evidence before flagging. Structurally identical to
+ * `AdvisorRelationLoad` so values pass straight through without conversion.
+ */
 interface RelationLoadIR {
   /** Export binding name of the procedure performing the read. */
   exportName: string;
@@ -1569,16 +1569,16 @@ interface RelationLoadIR {
   visibility: "internal" | "public";
 }
 /**
-* One `query` handler whose `return` hands back the raw rows of a table — the
-* result of a `ctx.db.&lt;table>.findMany()` / `.findFirst()` / `.get()` read, or a
-* `ctx.db.query("&lt;table>")…collect()` fluent chain — returned directly (or through
-* one local `const` hop) with no hand-built projection. The
-* `output_projection_missing_on_public_read` lint keeps only `visibility ===
-* "public"` rows with no `.output(...)` / `.use(mask(...))` on the chain, then
-* joins `table` against the schema and flags one whose columns are PII-named.
-* Structurally identical to `AdvisorRawRowReturn` so values pass straight through
-* without conversion.
-*/
+ * One `query` handler whose `return` hands back the raw rows of a table — the
+ * result of a `ctx.db.&lt;table>.findMany()` / `.findFirst()` / `.get()` read, or a
+ * `ctx.db.query("&lt;table>")…collect()` fluent chain — returned directly (or through
+ * one local `const` hop) with no hand-built projection. The
+ * `output_projection_missing_on_public_read` lint keeps only `visibility ===
+ * "public"` rows with no `.output(...)` / `.use(mask(...))` on the chain, then
+ * joins `table` against the schema and flags one whose columns are PII-named.
+ * Structurally identical to `AdvisorRawRowReturn` so values pass straight through
+ * without conversion.
+ */
 interface RawRowReturnIR {
   /** Export binding name of the query returning the raw rows. */
   exportName: string;
@@ -1596,16 +1596,16 @@ interface RawRowReturnIR {
   visibility: "internal" | "public";
 }
 /**
-* One `query`/`mutation` handler that gates a `ctx.db.get`/`patch`/`delete` on a
-* null-checked `ctx.db.normalizeId(table, id)` result — the
-* `normalize_id_used_as_authorization` lint input. `normalizeId` validates an id's
-* structural shape only (it never reads the database), so a non-null result proves
-* the id is well-formed, never that the caller owns the row; gating access on it is
-* an IDOR. The lint owns the negative proof — it keeps only `visibility === "public"`
-* rows with no `.use(rls(...))` and no ownership/identity mention (`mentionsOwnership`),
-* then joins `table` against the schema's RLS mode before flagging. Structurally
-* identical to `AdvisorNormalizeIdAuthorization` so values pass straight through.
-*/
+ * One `query`/`mutation` handler that gates a `ctx.db.get`/`patch`/`delete` on a
+ * null-checked `ctx.db.normalizeId(table, id)` result — the
+ * `normalize_id_used_as_authorization` lint input. `normalizeId` validates an id's
+ * structural shape only (it never reads the database), so a non-null result proves
+ * the id is well-formed, never that the caller owns the row; gating access on it is
+ * an IDOR. The lint owns the negative proof — it keeps only `visibility === "public"`
+ * rows with no `.use(rls(...))` and no ownership/identity mention (`mentionsOwnership`),
+ * then joins `table` against the schema's RLS mode before flagging. Structurally
+ * identical to `AdvisorNormalizeIdAuthorization` so values pass straight through.
+ */
 interface NormalizeIdAuthorizationIR {
   /** Export binding name of the procedure performing the normalize-then-access. */
   exportName: string;
@@ -1625,14 +1625,14 @@ interface NormalizeIdAuthorizationIR {
   visibility: "internal" | "public";
 }
 /**
-* One committed `wrangler.jsonc` `vars` entry whose value is a plaintext secret —
-* the `plaintext_secret_in_wrangler_vars` lint input. `vars` are baked into the
-* deployed Worker in cleartext and checked into source control, so a real API key
-* / token / private key there ships the secret to every reader of the repo and the
-* bundle; it belongs in a Secrets Store binding or `wrangler secret put`. Produced
-* by `@lunora/config` (which reads `wrangler.jsonc`), not a ts-morph feeder —
-* codegen only passes it through. Structurally identical to `AdvisorWranglerVariable`.
-*/
+ * One committed `wrangler.jsonc` `vars` entry whose value is a plaintext secret —
+ * the `plaintext_secret_in_wrangler_vars` lint input. `vars` are baked into the
+ * deployed Worker in cleartext and checked into source control, so a real API key
+ * / token / private key there ships the secret to every reader of the repo and the
+ * bundle; it belongs in a Secrets Store binding or `wrangler secret put`. Produced
+ * by `@lunora/config` (which reads `wrangler.jsonc`), not a ts-morph feeder —
+ * codegen only passes it through. Structurally identical to `AdvisorWranglerVariable`.
+ */
 interface WranglerVariableIR {
   /** The `wrangler.jsonc` file the var was read from, relative to the project root. */
   file: string;
@@ -1652,30 +1652,30 @@ interface ProjectIR {
   schema: SchemaIR;
 }
 /**
-* Run the static lints against a discovered {@link SchemaIR} and the reads/writes/calls
-* found in function bodies: query reads feed `filter_without_index`, insert writes
-* feed `table_without_insert`, authApi calls feed `auth_api_call_without_headers`,
-* rls procedure snapshots feed `rls_uncovered_table`, mask procedure
-* snapshots feed `mask_uncovered_pii_column`, and per-column mask strategies
-* feed `mask_weak_hash_strategy_on_pii`; declared containers
-* feed the `container_*` lints; declared workflows (with their durable step labels)
-* + `ctx.workflows.get(...)` call sites feed the `workflow_unused` /
-* `workflow_unknown_target` / duplicate-step-name lints; non-deterministic
-* calls inside query/mutation handlers feed the `nondeterministic_query_mutation` lint
-* (all default empty for callers that don't analyze functions/containers/workflows).
-* The IR types are structurally identical to the advisor's evidence types so they
-* pass straight through without conversion. Returns the findings; surfacing them
-* (console, error overlay, studio Advisors table) is the caller's choice.
-*/
-/**
-* Named inputs for {@link lintSchema}. Every feeder is a discrete key rather than
-* a positional argument: the feeder list grows every few releases and many IR
-* types are structurally similar (`{file, exportName, line}`-shaped evidence),
-* so a positional call was a silent-transposition hazard — swapping two adjacent
-* arguments could typecheck yet feed the wrong evidence to the wrong lint and
-* corrupt a security advisory. `schema` is the only required field; every other
-* feeder defaults to "not analyzed" when omitted.
-*/
+ * Run the static lints against a discovered {@link SchemaIR} and the reads/writes/calls
+ * found in function bodies: query reads feed `filter_without_index`, insert writes
+ * feed `table_without_insert`, authApi calls feed `auth_api_call_without_headers`,
+ * rls procedure snapshots feed `rls_uncovered_table`, mask procedure
+ * snapshots feed `mask_uncovered_pii_column`, and per-column mask strategies
+ * feed `mask_weak_hash_strategy_on_pii`; declared containers
+ * feed the `container_*` lints; declared workflows (with their durable step labels)
+ * + `ctx.workflows.get(...)` call sites feed the `workflow_unused` /
+ * `workflow_unknown_target` / duplicate-step-name lints; non-deterministic
+ * calls inside query/mutation handlers feed the `nondeterministic_query_mutation` lint
+ * (all default empty for callers that don't analyze functions/containers/workflows).
+ * The IR types are structurally identical to the advisor's evidence types so they
+ * pass straight through without conversion. Returns the findings; surfacing them
+ * (console, error overlay, studio Advisors table) is the caller's choice.
+ */
+/**
+ * Named inputs for {@link lintSchema}. Every feeder is a discrete key rather than
+ * a positional argument: the feeder list grows every few releases and many IR
+ * types are structurally similar (`{file, exportName, line}`-shaped evidence),
+ * so a positional call was a silent-transposition hazard — swapping two adjacent
+ * arguments could typecheck yet feed the wrong evidence to the wrong lint and
+ * corrupt a security advisory. `schema` is the only required field; every other
+ * feeder defaults to "not analyzed" when omitted.
+ */
 interface LintSchemaOptions {
   adminRoutes?: ReadonlyArray<AdminRouteIR>;
   aiRawRuns?: ReadonlyArray<AiRawRunIR>;
@@ -1728,19 +1728,19 @@ interface LintSchemaOptions {
 }
 declare const lintSchema: (options: LintSchemaOptions) => Finding[];
 /**
-* Render advisor findings as a single multi-line string for console surfacing:
-* a one-line summary header followed by one `[LEVEL] name: detail` line per
-* finding. Returns `""` when there are no findings.
-*/
+ * Render advisor findings as a single multi-line string for console surfacing:
+ * a one-line summary header followed by one `[LEVEL] name: detail` line per
+ * finding. Returns `""` when there are no findings.
+ */
 declare const formatAdvisories: (findings: ReadonlyArray<Finding>) => string;
 /**
-* An error thrown by codegen discovery when the user's schema or function
-* source has a structural problem that can be pinpointed to a specific source
-* location. A `LunoraError` subclass (`code: "CODEGEN_DIAGNOSTIC"`); the `file`,
-* `line`, and `column` properties (also passed through as the base `loc`) mirror
-* what Vite's error-overlay `loc` field expects so the browser can display the
-* exact spot.
-*/
+ * An error thrown by codegen discovery when the user's schema or function
+ * source has a structural problem that can be pinpointed to a specific source
+ * location. A `LunoraError` subclass (`code: "CODEGEN_DIAGNOSTIC"`); the `file`,
+ * `line`, and `column` properties (also passed through as the base `loc`) mirror
+ * what Vite's error-overlay `loc` field expects so the browser can display the
+ * exact spot.
+ */
 declare class CodegenDiagnosticError extends LunoraError {
   readonly column: number;
   readonly file: string;
@@ -1748,234 +1748,230 @@ declare class CodegenDiagnosticError extends LunoraError {
   constructor(message: string, file: string, line: number, column: number);
 }
 /**
-* Build a {@link CodegenDiagnosticError} whose message includes the source
-* location and whose `file`/`line`/`column` properties are set from the
-* ts-morph `Node`'s position in its source file.
-*
-* Message format: `@lunora/codegen: &lt;detail> (&lt;file>:&lt;line>:&lt;column>)`
-*
-* `meta` is merged onto the returned error for callers that also carry the
-* project-wide `LunoraError` envelope (`code`/`name`/`status`) — it never
-* touches `file`/`line`/`column`, and the error stays an instance of
-* {@link CodegenDiagnosticError} so the Vite overlay's `instanceof` location
-* lookup is unaffected.
-*/
+ * Build a {@link CodegenDiagnosticError} whose message includes the source
+ * location and whose `file`/`line`/`column` properties are set from the
+ * ts-morph `Node`'s position in its source file.
+ *
+ * Message format: `@lunora/codegen: &lt;detail> (&lt;file>:&lt;line>:&lt;column>)`
+ *
+ * `meta` is merged onto the returned error for callers that also carry the
+ * project-wide `LunoraError` envelope (`code`/`name`/`status`) — it never
+ * touches `file`/`line`/`column`, and the error stays an instance of
+ * {@link CodegenDiagnosticError} so the Vite overlay's `instanceof` location
+ * lookup is unaffected.
+ */
 declare const diagnosticAt: (node: Node, detail: string, meta?: Record<string, unknown>) => CodegenDiagnosticError;
 /** The only file agents may be declared in — mirrors `lunora/workflows.ts`. */
 declare const AGENTS_FILENAME = "agents.ts";
 /**
-* Discover every agent the project declares: exported `defineAgent()` calls in
-* `lunora/agents.ts`. Returns `[]` when the file doesn't exist. Only four things
-* are read statically — the optional `name` override (wrangler `workflows[].name`),
-* the optional `publicRun` opt-in (the `agents:agentRun` capability gate), the
-* presence of a `voice` block (which turns on the voice-session Durable Object),
-* and the presence of an `onEmail` mapper (which wires the worker `email()`
-* handler); the rest of the agent config (model / tools / memory / voice models /
-* the `onEmail` closure body) is runtime-only, so codegen never evaluates it.
-*/
+ * Discover every agent the project declares: exported `defineAgent()` calls in
+ * `lunora/agents.ts`. Returns `[]` when the file doesn't exist. Only four things
+ * are read statically — the optional `name` override (wrangler `workflows[].name`),
+ * the optional `publicRun` opt-in (the `agents:agentRun` capability gate), the
+ * presence of a `voice` block (which turns on the voice-session Durable Object),
+ * and the presence of an `onEmail` mapper (which wires the worker `email()`
+ * handler); the rest of the agent config (model / tools / memory / voice models /
+ * the `onEmail` closure body) is runtime-only, so codegen never evaluates it.
+ */
 declare const discoverAgents: (project: Project, lunoraDirectory: string) => AgentIR[];
 /**
-* Discover `ctx.authApi.&lt;method>(...)` (and bare `authApi.&lt;method>(...)`) calls
-* under the lunora source directory and attribute each to the exported function
-* (and file) performing it. Calls outside an exported declaration are dropped.
-*/
+ * Discover `ctx.authApi.&lt;method>(...)` (and bare `authApi.&lt;method>(...)`) calls
+ * under the lunora source directory and attribute each to the exported function
+ * (and file) performing it. Calls outside an exported declaration are dropped.
+ */
 declare const discoverAuthApiCalls: (project: Project, lunoraDirectory: string) => AuthApiCallIR[];
 /** The only file containers may be declared in — mirrors `lunora/crons.ts`. */
 declare const CONTAINERS_FILENAME = "containers.ts";
 /**
-* Discover every container the project declares: exported `defineContainer()`
-* calls in `lunora/containers.ts`. Returns `[]` when the file doesn't exist.
-* Wrangler-relevant fields (`image`, `instanceType`, `maxInstances`, `name`)
-* must be static literals; runtime-only fields (`env`, `sleepAfter`, …) may be
-* any expression since the generated class imports the definition object.
-*/
+ * Discover every container the project declares: exported `defineContainer()`
+ * calls in `lunora/containers.ts`. Returns `[]` when the file doesn't exist.
+ * Wrangler-relevant fields (`image`, `instanceType`, `maxInstances`, `name`)
+ * must be static literals; runtime-only fields (`env`, `sleepAfter`, …) may be
+ * any expression since the generated class imports the definition object.
+ */
 declare const discoverContainers: (project: Project, lunoraDirectory: string) => ContainerIR[];
 /**
-* Scan every `.ts` file under `lunoraDir` for `cronJobs()` builder registrations
-* (`crons.interval(...)`, `crons.daily(...)`, `crons.cron(...)`, …) and lift them
-* into {@link CronJobIR}. Schedules are compiled to standard cron expressions;
-* function references are resolved to their `namespace:fn` dispatch path, while a
-* `workflows.NAME` / `agents.NAME` reference (or a bare identifier naming a
-* declared workflow) resolves to a durable workflow start. Names must be unique
-* across the project.
-*/
+ * Scan every `.ts` file under `lunoraDir` for `cronJobs()` builder registrations
+ * (`crons.interval(...)`, `crons.daily(...)`, `crons.cron(...)`, …) and lift them
+ * into {@link CronJobIR}. Schedules are compiled to standard cron expressions;
+ * function references are resolved to their `namespace:fn` dispatch path, while a
+ * `workflows.NAME` / `agents.NAME` reference (or a bare identifier naming a
+ * declared workflow) resolves to a durable workflow start. Names must be unique
+ * across the project.
+ */
 declare const discoverCrons: (project: Project, lunoraDirectory: string, workflows?: ReadonlyArray<WorkflowIR>, agents?: ReadonlyArray<AgentIR>) => CronJobIR[];
 /** The only file a feature-flag provider may be declared in — mirrors `lunora/queues.ts`. */
 declare const FLAGS_FILENAME = "flags.ts";
-/** One statically-discovered flag read: the key plus the value type its `ctx.flags.&lt;type>` call implies. */
-
-/**
-* Discover the feature-flag provider a project declares in `lunora/flags.ts`.
-* Returns `undefined` when the file doesn't exist (the app has no flags). The
-* read is metadata-only and lenient: codegen wires `ctx.flags` purely from the
-* file's *existence* (`run-codegen.ts`) and imports the real module for the
-* provider value — this IR exists solely so the config layer can reconcile the
-* wrangler `flagship` binding for the Flagship binding-mode provider. Anything
-* it can't read statically degrades to a `custom` provider (no binding), never
-* a thrown error.
-*/
+/**
+ * Discover the feature-flag provider a project declares in `lunora/flags.ts`.
+ * Returns `undefined` when the file doesn't exist (the app has no flags). The
+ * read is metadata-only and lenient: codegen wires `ctx.flags` purely from the
+ * file's *existence* (`run-codegen.ts`) and imports the real module for the
+ * provider value — this IR exists solely so the config layer can reconcile the
+ * wrangler `flagship` binding for the Flagship binding-mode provider. Anything
+ * it can't read statically degrades to a `custom` provider (no binding), never
+ * a thrown error.
+ */
 declare const discoverFlags: (project: Project, lunoraDirectory: string) => FlagsIR | undefined;
 /**
-* Scan all .ts files under `lunoraDir` (skipping `_generated/` and `schema.ts`)
-* for top-level `export const x = query/mutation/action({...})` registrations.
-*/
+ * Scan all .ts files under `lunoraDir` (skipping `_generated/` and `schema.ts`)
+ * for top-level `export const x = query/mutation/action({...})` registrations.
+ */
 declare const discoverFunctions: (project: Project, lunoraDirectory: string) => FunctionIR[];
 /**
-* Scan all `.ts` files under `lunoraDir` (skipping `_generated/` and `schema.ts`)
-* for `export const x = httpRoute.&lt;verb>(...)…handler(...)` typed REST routes.
-* These are the headline OpenAPI target: each becomes a real `paths` entry.
-*/
+ * Scan all `.ts` files under `lunoraDir` (skipping `_generated/` and `schema.ts`)
+ * for `export const x = httpRoute.&lt;verb>(...)…handler(...)` typed REST routes.
+ * These are the headline OpenAPI target: each becomes a real `paths` entry.
+ */
 declare const discoverHttpRoutes: (project: Project, lunoraDirectory: string) => HttpRouteIR[];
 /**
-* Discover `ctx.db.insert("table", …)` writes under the lunora source directory
-* and attribute each to the exported function (and file) performing it. Calls
-* with a non-literal table argument, or outside an exported declaration, are
-* dropped (`table === ""` / no enclosing export).
-*/
+ * Discover `ctx.db.insert("table", …)` writes under the lunora source directory
+ * and attribute each to the exported function (and file) performing it. Calls
+ * with a non-literal table argument, or outside an exported declaration, are
+ * dropped (`table === ""` / no enclosing export).
+ */
 declare const discoverInserts: (project: Project, lunoraDirectory: string) => InsertWriteIR[];
 /**
-* Discover masking usage for every exported Lunora procedure under the lunora
-* source directory — the column-level twin of `discoverRlsProcedures`. For each
-* procedure, records whether its builder chain includes `.use(mask(...))`, which
-* `(table, column)` pairs that mask declares, and which tables it reads/writes
-* through `ctx.db`. Feeds the `mask_uncovered_pii_column` advisor lint.
-*/
+ * Discover masking usage for every exported Lunora procedure under the lunora
+ * source directory — the column-level twin of `discoverRlsProcedures`. For each
+ * procedure, records whether its builder chain includes `.use(mask(...))`, which
+ * `(table, column)` pairs that mask declares, and which tables it reads/writes
+ * through `ctx.db`. Feeds the `mask_uncovered_pii_column` advisor lint.
+ */
 declare const discoverMaskProcedures: (project: Project, lunoraDirectory: string) => MaskProcedureIR[];
 /**
-* Aggregate the schema-wide masking metadata the studio's data-browser mask
-* toggle reads: every statically-discovered `(table, column, strategy)` masked
-* column across the project's `.use(mask(...))` chains. Walks the same builder
-* chains as {@link discoverMaskProcedures} but carries the strategy the preview
-* needs to choose redact-vs-hash-vs-custom rendering. Deduped by `(table,
-* column)` with the first declaration winning, so a column masked by several
-* procedures lists once — the same evidence the advisor lint uses.
-*/
-/**
-* Scan all `.ts` files under `lunoraDir` for top-level
-* `export const x = defineMigration({...})` declarations and lift them into
-* {@link MigrationIR}. `id` must be a static string literal (it's the registry
-* key); `table` is best-effort and left `""` when not a literal.
-*/
+ * Scan all `.ts` files under `lunoraDir` for top-level
+ * `export const x = defineMigration({...})` declarations and lift them into
+ * {@link MigrationIR}. `id` must be a static string literal (it's the registry
+ * key); `table` is best-effort and left `""` when not a literal.
+ */
 declare const discoverMigrations: (project: Project, lunoraDirectory: string) => MigrationIR[];
 /** The only file custom mutators may be declared in — mirrors `lunora/queues.ts`. */
 declare const MUTATORS_FILENAME = "mutators.ts";
 /**
-* Decide whether a call's callee is `defineMutator` — either the bare imported
-* identifier (`defineMutator(...)`) or a namespace member access
-* (`server.defineMutator(...)`). Both are valid ES module syntax, so discovery
-* must see mutators declared either way.
-*/
-
-/**
-* Discover every custom mutator the project declares: exported
-* `defineMutator()` calls in `lunora/mutators.ts`. Returns `[]` when the file
-* doesn't exist. Only the export binding is lifted — the runtime object carries
-* the authoritative `server` impl + `handler`, so codegen never evaluates the
-* body. The client `client` impl is split into the browser bundle separately.
-*/
+ * Discover every custom mutator the project declares: exported
+ * `defineMutator()` calls in `lunora/mutators.ts`. Returns `[]` when the file
+ * doesn't exist. Only the export binding is lifted — the runtime object carries
+ * the authoritative `server` impl + `handler`, so codegen never evaluates the
+ * body. The client `client` impl is split into the browser bundle separately.
+ */
 declare const discoverMutators: (project: Project, lunoraDirectory: string) => MutatorIR[];
 /**
-* Discover non-deterministic API calls (`Date.now`, `new Date()`, `Date()`,
-* `Math.random`, `crypto.randomUUID`, `crypto.getRandomValues` — including
-* `globalThis`/`self`/`window`-prefixed receivers — and `fetch`) lexically inside
-* the handler body of every exported `query(...)` / `mutation(...)` registration
-* under the lunora source directory — the `nondeterministic_query_mutation` lint
-* input. `action(...)` (and `stream(...)`) registrations are intentionally
-* skipped: actions run exactly once and may use ambient APIs freely.
-*
-* Traversal is scoped to the handler node (not the whole declaration), mirroring
-* how the auth-api / insert feeders attribute calls — so a call in a sibling
-* helper outside the handler, or in a nested `action(...)` passed elsewhere, is
-* not attributed to the query/mutation. One {@link NondeterministicCallIR} is
-* produced per call site.
-*/
+ * Discover non-deterministic API calls (`Date.now`, `new Date()`, `Date()`,
+ * `Math.random`, `crypto.randomUUID`, `crypto.getRandomValues` — including
+ * `globalThis`/`self`/`window`-prefixed receivers — and `fetch`) lexically inside
+ * the handler body of every exported `query(...)` / `mutation(...)` registration
+ * under the lunora source directory — the `nondeterministic_query_mutation` lint
+ * input. `action(...)` (and `stream(...)`) registrations are intentionally
+ * skipped: actions run exactly once and may use ambient APIs freely.
+ *
+ * Traversal is scoped to the handler node (not the whole declaration), mirroring
+ * how the auth-api / insert feeders attribute calls — so a call in a sibling
+ * helper outside the handler, or in a nested `action(...)` passed elsewhere, is
+ * not attributed to the query/mutation. One {@link NondeterministicCallIR} is
+ * produced per call site.
+ */
 declare const discoverNondeterministicCalls: (project: Project, lunoraDirectory: string) => NondeterministicCallIR[];
 /**
-* Discover `ctx.db.query("table")…` reads under the lunora source directory and
-* reduce each to a {@link QueryReadIR}. Only reads that call `.filter()` are
-* returned — an unfiltered read is never a `filter_without_index` candidate, so
-* dropping the rest keeps the lint input small.
-*/
+ * Discover `ctx.db.query("table")…` reads under the lunora source directory and
+ * reduce each to a {@link QueryReadIR}. Only reads that call `.filter()` are
+ * returned — an unfiltered read is never a `filter_without_index` candidate, so
+ * dropping the rest keeps the lint input small.
+ */
 declare const discoverQueries: (project: Project, lunoraDirectory: string) => QueryReadIR[];
 /** The only file queues may be declared in — mirrors `lunora/workflows.ts`. */
 declare const QUEUES_FILENAME = "queues.ts";
 /**
-* Discover every queue the project declares: exported `defineQueue()` calls in
-* `lunora/queues.ts`. Returns `[]` when the file doesn't exist. Only the
-* wrangler-relevant literals (`name`/`mode`/batch tuning) are read; the handler
-* body is runtime-only, so codegen never evaluates it.
-*/
+ * Discover every queue the project declares: exported `defineQueue()` calls in
+ * `lunora/queues.ts`. Returns `[]` when the file doesn't exist. Only the
+ * wrangler-relevant literals (`name`/`mode`/batch tuning) are read; the handler
+ * body is runtime-only, so codegen never evaluates it.
+ */
 declare const discoverQueues: (project: Project, lunoraDirectory: string) => QueueIR[];
 /**
-* Discover `ctx.r2sql` accesses lexically inside the handler body of every
-* exported `query(...)` / `mutation(...)` registration under the lunora source
-* directory — the `r2sql_outside_action` lint input. `action(...)` (and
-* `stream(...)`) registrations are intentionally skipped: R2 SQL is the
-* external, non-reactive surface that belongs in actions.
-*
-* Traversal is scoped to the handler node (not the whole declaration), mirroring
-* `discoverNondeterministicCalls` — so a `ctx.r2sql` touch in a sibling helper
-* outside the handler is not attributed to the query/mutation. One
-* {@link R2sqlCallIR} is produced per access site.
-*/
+ * Discover `ctx.r2sql` accesses lexically inside the handler body of every
+ * exported `query(...)` / `mutation(...)` registration under the lunora source
+ * directory — the `r2sql_outside_action` lint input. `action(...)` (and
+ * `stream(...)`) registrations are intentionally skipped: R2 SQL is the
+ * external, non-reactive surface that belongs in actions.
+ *
+ * Traversal is scoped to the handler node (not the whole declaration), mirroring
+ * `discoverNondeterministicCalls` — so a `ctx.r2sql` touch in a sibling helper
+ * outside the handler is not attributed to the query/mutation. One
+ * {@link R2sqlCallIR} is produced per access site.
+ */
 declare const discoverR2sqlCalls: (project: Project, lunoraDirectory: string) => R2sqlCallIR[];
 declare const discoverRlsProcedures: (project: Project, lunoraDirectory: string) => RlsProcedureIR[];
 /**
-* Aggregate the schema-wide RLS metadata the studio's read-only inspector reads:
-* every statically-discovered `(table, on, procedure)` policy entry plus every
-* role declared via `rls(policies, { roles })`. Walks the same builder chains as
-* {@link discoverRlsProcedures} but extracts the richer `{ on }` operation +
-* role/permission shape rather than the lint's table-name set.
-*
-* Only the **builder** form (`c.use(rls(...)).query(...)`) can declare policies,
-* so bare-factory procedures contribute nothing. The `when` predicate is never
-* read — it's an opaque JS closure whose logic belongs in code, not the UI.
-* Roles are deduped by name (first declaration wins) so a role registered on
-* several procedures lists once.
-*/
+ * Aggregate the schema-wide RLS metadata the studio's read-only inspector reads:
+ * every statically-discovered `(table, on, procedure)` policy entry plus every
+ * role declared via `rls(policies, { roles })`. Walks the same builder chains as
+ * {@link discoverRlsProcedures} but extracts the richer `{ on }` operation +
+ * role/permission shape rather than the lint's table-name set.
+ *
+ * Only the **builder** form (`c.use(rls(...)).query(...)`) can declare policies,
+ * so bare-factory procedures contribute nothing. The `when` predicate is never
+ * read — it's an opaque JS closure whose logic belongs in code, not the UI.
+ * Roles are deduped by name (first declaration wins) so a role registered on
+ * several procedures lists once.
+ */
 declare const discoverRlsMetadata: (project: Project, lunoraDirectory: string) => RlsMetadataIR;
 /**
-* Load `&lt;projectRoot>/lunora/schema.ts`, find `defineSchema({...})`, and
-* return a structural IR. Throws if the file or call cannot be found.
-*/
+ * Which sandbox tools a project imports from `@lunora/agent` (main entry or the
+ * `/sandbox` subpath), detected by NAMED value import. Drives two things:
+ * registering the `sandbox:invoke` dispatcher (either tool) and provisioning the
+ * `BROWSER` wrangler binding (`browserTool` — the browser op runs on
+ * `ctx.browser` inside the dispatcher).
+ */
+interface SandboxUsage {
+  /** `import { browserTool } from "@lunora/agent"` (or `/sandbox`) appears in `lunora/`. */
+  usesSandboxBrowser: boolean;
+  /** `import { containerTool } from "@lunora/agent"` (or `/sandbox`) appears in `lunora/`. */
+  usesSandboxContainer: boolean;
+}
+declare const discoverSandboxUsage: (project: Project, lunoraDirectory: string) => SandboxUsage;
+/**
+ * Load `&lt;projectRoot>/lunora/schema.ts`, find `defineSchema({...})`, and
+ * return a structural IR. Throws if the file or call cannot be found.
+ */
 declare const discoverSchema: (project: Project, schemaPath: string, projectRoot?: string) => SchemaIR;
 /** The only file shapes may be declared in — mirrors `lunora/queues.ts`. */
 declare const SHAPES_FILENAME = "shapes.ts";
 /**
-* Discover every replication shape the project declares: exported
-* `defineShape()` calls in `lunora/shapes.ts`. Returns `[]` when the file
-* doesn't exist. Only the export binding is lifted — the runtime object carries
-* the authoritative `table`/`columns`/`compileWhere`, so codegen never
-* evaluates the predicate.
-*/
+ * Discover every replication shape the project declares: exported
+ * `defineShape()` calls in `lunora/shapes.ts`. Returns `[]` when the file
+ * doesn't exist. Only the export binding is lifted — the runtime object carries
+ * the authoritative `table`/`columns`/`compileWhere`, so codegen never
+ * evaluates the predicate.
+ */
 declare const discoverShapes: (project: Project, lunoraDirectory: string) => ShapeIR[];
 /**
-* Aggregate the schema-wide storage-rule metadata the studio's inspector reads:
-* every statically-discovered `(bucket, on, prefix, procedure)` entry across all
-* `.use(storageRules(...))` chains. Only the builder form can declare rules, so
-* bare-factory procedures contribute nothing.
-*/
+ * Aggregate the schema-wide storage-rule metadata the studio's inspector reads:
+ * every statically-discovered `(bucket, on, prefix, procedure)` entry across all
+ * `.use(storageRules(...))` chains. Only the builder form can declare rules, so
+ * bare-factory procedures contribute nothing.
+ */
 declare const discoverStorageRulesMetadata: (project: Project, lunoraDirectory: string) => StorageRulesMetadataIR;
 /** The only file workflows may be declared in — mirrors `lunora/containers.ts`. */
 declare const WORKFLOWS_FILENAME = "workflows.ts";
 /**
-* Discover every workflow the project declares: exported `defineWorkflow()`
-* calls in `lunora/workflows.ts`. Returns `[]` when the file doesn't exist. The
-* only wrangler-relevant literal is the optional `name` override; the workflow
-* body is runtime-only, so codegen never evaluates it.
-*/
+ * Discover every workflow the project declares: exported `defineWorkflow()`
+ * calls in `lunora/workflows.ts`. Returns `[]` when the file doesn't exist. The
+ * only wrangler-relevant literal is the optional `name` override; the workflow
+ * body is runtime-only, so codegen never evaluates it.
+ */
 declare const discoverWorkflows: (project: Project, lunoraDirectory: string) => WorkflowIR[];
 declare const GENERATED_HEADER = "// GENERATED by @lunora/codegen — do not edit.\n// Run `lunora codegen` to regenerate.\n\n";
 /** Emit `_generated/dataModel.ts` — `Doc&lt;"name">` + `Id&lt;"name">` for every table. */
 declare const emitDataModel: (schema: SchemaIR, useUmbrella?: boolean) => string;
 /**
-* Emit `_generated/api.ts` — the typed `api.*` registry (public functions), the
-* `internal.*` registry, and (when the project declares them) the typed
-* `workflows.*` / `agents.*` scheduler-target reference objects. `api`/`internal` are the same `anyApi` proxy
-* at runtime (the `__lunoraRef` is identical); visibility is enforced
-* server-side at dispatch, not in the reference. Splitting the *types* keeps
-* internal functions off the client-facing `api` surface.
-*/
+ * Emit `_generated/api.ts` — the typed `api.*` registry (public functions), the
+ * `internal.*` registry, and (when the project declares them) the typed
+ * `workflows.*` / `agents.*` scheduler-target reference objects. `api`/`internal` are the same `anyApi` proxy
+ * at runtime (the `__lunoraRef` is identical); visibility is enforced
+ * server-side at dispatch, not in the reference. Splitting the *types* keeps
+ * internal functions off the client-facing `api` surface.
+ */
 interface EmitApiOptions {
   agents?: ReadonlyArray<AgentIR>;
   functions: ReadonlyArray<FunctionIR>;
@@ -1986,47 +1982,37 @@ interface EmitApiOptions {
 }
 declare const emitApi: (options: EmitApiOptions) => string;
 /**
-* Emit `_generated/seed.ts` — a project-bound `createSeedClient` with this
-* schema's `InsertModel` and runtime schema pre-applied, so a test or script
-* calls `createSeedClient({ seed: 1 }).users(5)` with full column types and no
-* manual wiring. The runtime schema is the default export of `lunora/schema.ts`
-* (the same import the generated ShardDO uses).
-*
-* Returns `""` when `@lunora/seed` is not a declared dependency, so projects
-* that don't use it keep a clean `_generated/` and never import the package.
-*/
-/**
-* Emit `_generated/collections.ts` — one TanStack DB collection factory per
-* `defineShape` in `lunora/shapes.ts` (the local-first partial-replication
-* surface). Each factory builds a live collection that syncs its shape's rowset
-* through the client's poke protocol (`subscribeShape`), so an app feeds the
-* result straight to `useLiveQuery`.
-*
-* Returns `""` (so `writeIfPresent` skips the file) unless the project both
-* declares shapes AND installs `@lunora/db` — the add-on that ships
-* `lunoraCollectionOptions`. `@lunora/db` stays a scoped install even under the
-* `lunorash` umbrella (an opt-in add-on, like `@lunora/auth`), so its import is
-* always `@lunora/db/collections`; only the in-umbrella `@lunora/client` import
-* is remapped to `lunorash/client`.
-*/
+ * Emit `_generated/collections.ts` — one TanStack DB collection factory per
+ * `defineShape` in `lunora/shapes.ts` (the local-first partial-replication
+ * surface). Each factory builds a live collection that syncs its shape's rowset
+ * through the client's poke protocol (`subscribeShape`), so an app feeds the
+ * result straight to `useLiveQuery`.
+ *
+ * Returns `""` (so `writeIfPresent` skips the file) unless the project both
+ * declares shapes AND installs `@lunora/db` — the add-on that ships
+ * `lunoraCollectionOptions`. `@lunora/db` stays a scoped install even under the
+ * `lunorash` umbrella (an opt-in add-on, like `@lunora/auth`), so its import is
+ * always `@lunora/db/collections`; only the in-umbrella `@lunora/client` import
+ * is remapped to `lunorash/client`.
+ */
 declare const emitCollections: (shapes: ReadonlyArray<ShapeIR>, hasDatabase: boolean, useUmbrella?: boolean) => string;
 interface EmitServerOptions {
   /** Agents declared via `defineAgent` exports — wires the typed `ctx.agents` producers onto Mutation/Action contexts. */
   agents?: ReadonlyArray<AgentIR>;
   containers?: ReadonlyArray<ContainerIR>;
   /**
-  * The single `defineEnv(...)` contract declared in `lunora/env.ts`. When
-  * present, `ctx.env` is typed as the validated `InferEnv` shape (recovered
-  * via `ReturnType` over the accessor's `typeof`). `undefined` leaves `ctx.env`
-  * the base optional binding record — byte-identical to today.
-  */
+   * The single `defineEnv(...)` contract declared in `lunora/env.ts`. When
+   * present, `ctx.env` is typed as the validated `InferEnv` shape (recovered
+   * via `ReturnType` over the accessor's `typeof`). `undefined` leaves `ctx.env`
+   * the base optional binding record — byte-identical to today.
+   */
   env?: EnvIR;
   /**
-  * A `lunora/` source reads `ctx.access` — wires the verified Cloudflare Access
-  * facade (`@lunora/cloudflare-access/context`) onto every ctx. Distinct from
-  * `emitApp`'s `hasAccess` (which gates the worker's `.access()` resolveIdentity
-  * method); this one gates the per-request `ctx.access` read surface.
-  */
+   * A `lunora/` source reads `ctx.access` — wires the verified Cloudflare Access
+   * facade (`@lunora/cloudflare-access/context`) onto every ctx. Distinct from
+   * `emitApp`'s `hasAccess` (which gates the worker's `.access()` resolveIdentity
+   * method); this one gates the per-request `ctx.access` read surface.
+   */
   hasAccessFacade?: boolean;
   hasAi?: boolean;
   /** A `lunora/` source uses `@lunora/bindings/analytics` / `ctx.analytics` — wires the write helper onto every ctx. */
@@ -2049,13 +2035,13 @@ interface EmitServerOptions {
   /** A `lunora/` source uses `@lunora/x402/pay` / `ctx.x402` — wires the agent-wallet pay rail onto ActionCtx only. */
   hasX402?: boolean;
   /**
-  * The single `defineIdentity(...)` claim contract declared in
-  * `lunora/identity.ts` (Plan 080). When present, `ctx.auth.getIdentity()`,
-  * the RLS policy `ctx.auth.identity`, and the shard-authorization hooks
-  * narrow to the declared shape (recovered via `InferIdentity` over the
-  * contract's `typeof`). `undefined` keeps the identity an untyped bag —
-  * byte-identical to today.
-  */
+   * The single `defineIdentity(...)` claim contract declared in
+   * `lunora/identity.ts` (Plan 080). When present, `ctx.auth.getIdentity()`,
+   * the RLS policy `ctx.auth.identity`, and the shard-authorization hooks
+   * narrow to the declared shape (recovered via `InferIdentity` over the
+   * contract's `typeof`). `undefined` keeps the identity an untyped bag —
+   * byte-identical to today.
+   */
   identity?: IdentityIR;
   /** Queues declared via `defineQueue` exports — wires the typed `ctx.queues` producers onto Mutation/Action contexts. */
   queues?: ReadonlyArray<QueueIR>;
@@ -2065,29 +2051,7 @@ interface EmitServerOptions {
   useUmbrella?: boolean;
   workflows?: ReadonlyArray<WorkflowIR>;
 }
-declare const emitServer: ({
-  agents,
-  containers,
-  env,
-  hasAccessFacade,
-  hasAi,
-  hasAnalytics,
-  hasBrowser,
-  hasFlags,
-  hasHyperdrive,
-  hasImages,
-  hasKv,
-  hasPayments,
-  hasPipelines,
-  hasR2sql,
-  hasX402,
-  identity,
-  queues,
-  schema,
-  storageRuleBuckets,
-  useUmbrella,
-  workflows
-}?: EmitServerOptions) => string;
+declare const emitServer: ({ agents, containers, env, hasAccessFacade, hasAi, hasAnalytics, hasBrowser, hasFlags, hasHyperdrive, hasImages, hasKv, hasPayments, hasPipelines, hasR2sql, hasX402, identity, queues, schema, storageRuleBuckets, useUmbrella, workflows }?: EmitServerOptions) => string;
 interface EmitFunctionsOptions {
   agents?: ReadonlyArray<AgentIR>;
   functions: ReadonlyArray<FunctionIR>;
@@ -2100,50 +2064,33 @@ interface EmitFunctionsOptions {
 }
 declare const emitFunctions: (options: EmitFunctionsOptions) => string;
 /**
-* Storage-column map per table for the file browser: `{ table: [field, …] }` for
-* every field declared `v.storage(...)` (unwrapping `v.optional(...)`). The
-* generated shard hands this to the base `storageColumns` hook so the admin
-* `storageReferences` read can join R2 objects back to the rows that own them
-* (and flag orphans — objects no row references). Only scalar storage columns
-* are emitted; an array-of-storage field can't be matched by an equality scan,
-* so it is skipped here.
-*/
-/**
-* Emit `_generated/containers.ts` — one container-enabled Durable Object class
-* per `defineContainer` export, each a thin subclass of `LunoraContainer`
-* (`@lunora/container/do`) constructed with the user's definition object. The
-* worker entry must re-export these classes: wrangler requires every
-* `containers[].class_name` to be exported by the deployed worker. Returns ""
-* when the project declares no containers (the file is not written then).
-*/
+ * Emit `_generated/containers.ts` — one container-enabled Durable Object class
+ * per `defineContainer` export, each a thin subclass of `LunoraContainer`
+ * (`@lunora/container/do`) constructed with the user's definition object. The
+ * worker entry must re-export these classes: wrangler requires every
+ * `containers[].class_name` to be exported by the deployed worker. Returns ""
+ * when the project declares no containers (the file is not written then).
+ */
 declare const emitContainers: (containers: ReadonlyArray<ContainerIR>, jurisdiction?: JurisdictionIR) => string;
 /**
-* Emit `_generated/workflows.ts` — one `WorkflowEntrypoint` class per
-* `defineWorkflow` export, each a thin subclass of `LunoraWorkflow`
-* (`@lunora/workflow/do`) constructed with the user's definition object. The
-* worker entry must re-export these classes: wrangler requires every
-* `workflows[].class_name` to be exported by the deployed worker. Returns ""
-* when the project declares no workflows (the file is not written then).
-*/
+ * Emit `_generated/workflows.ts` — one `WorkflowEntrypoint` class per
+ * `defineWorkflow` export, each a thin subclass of `LunoraWorkflow`
+ * (`@lunora/workflow/do`) constructed with the user's definition object. The
+ * worker entry must re-export these classes: wrangler requires every
+ * `workflows[].class_name` to be exported by the deployed worker. Returns ""
+ * when the project declares no workflows (the file is not written then).
+ */
 declare const emitWorkflows: (workflows: ReadonlyArray<WorkflowIR>) => string;
 /**
-* Emit `_generated/agents.ts` — one `WorkflowEntrypoint` class per `defineAgent`
-* export, each a thin subclass of `LunoraWorkflow` (`@lunora/workflow/do`)
-* constructed with the compiled agent tool-loop (`compileAgentWorkflow`). Like
-* `_generated/workflows.ts`, the worker entry must re-export these classes:
-* wrangler requires every `workflows[].class_name` to be exported by the
-* deployed worker. Returns "" when the project declares no agents (the file is
-* not written then).
-*/
+ * Emit `_generated/agents.ts` — one `WorkflowEntrypoint` class per `defineAgent`
+ * export, each a thin subclass of `LunoraWorkflow` (`@lunora/workflow/do`)
+ * constructed with the compiled agent tool-loop (`compileAgentWorkflow`). Like
+ * `_generated/workflows.ts`, the worker entry must re-export these classes:
+ * wrangler requires every `workflows[].class_name` to be exported by the
+ * deployed worker. Returns "" when the project declares no agents (the file is
+ * not written then).
+ */
 declare const emitAgents: (agents: ReadonlyArray<AgentIR>) => string;
-/**
-* Emit `_generated/queues.ts` — the push-consumer registry the worker `queue()`
-* handler dispatches through. Maps each push queue's stable wrangler name (which
-* `batch.queue` carries) to its `defineQueue` definition + export name. Pull
-* queues are consumed by an external worker, so they carry no handler and are
-* omitted here. Returns "" (and the file is not written) when no push queues are
-* declared — a pull-only or queue-free app keeps a clean `_generated/`.
-*/
 interface EmitShardOptions {
   advisories?: ReadonlyArray<Finding>;
   /** Agents declared via `defineAgent` exports in `lunora/agents.ts` — wires the typed `ctx.agents` producers. */
@@ -2193,100 +2140,72 @@ interface EmitShardOptions {
   useUmbrella?: boolean;
   workflows?: ReadonlyArray<WorkflowIR>;
 }
-declare const emitShard: ({
-  advisories,
-  agents,
-  containers,
-  env,
-  flagKeys,
-  hasAccessFacade,
-  hasAi,
-  hasAnalytics,
-  hasBrowser,
-  hasFlags,
-  hasHyperdrive,
-  hasImages,
-  hasKv,
-  hasPayments,
-  hasPipelines,
-  hasR2sql,
-  hasX402,
-  maskMetadata,
-  mutators,
-  queues,
-  rlsMetadata,
-  schema,
-  shapes,
-  storageRules,
-  studioFeatures,
-  useUmbrella,
-  workflows
-}: EmitShardOptions) => string;
-/**
-* Emit drizzle `sqliteTable` definitions for the project schema, split into
-* `global` (D1-backed) and `shard` (DO-SQLite-backed) buckets. Tables marked
-* `.global()` go in the global file; everything else (default root + `.shardBy()`)
-* goes in the shard file.
-*
-* `searchIndexes` are intentionally not emitted — drizzle has no `sqliteTable`
-* abstraction for FTS5 virtual tables. FTS plumbing is handled by the runtime
-* outside of drizzle.
-*/
+declare const emitShard: ({ advisories, agents, containers, env, flagKeys, hasAccessFacade, hasAi, hasAnalytics, hasBrowser, hasFlags, hasHyperdrive, hasImages, hasKv, hasPayments, hasPipelines, hasR2sql, hasX402, maskMetadata, mutators, queues, rlsMetadata, schema, shapes, storageRules, studioFeatures, useUmbrella, workflows }: EmitShardOptions) => string;
+/**
+ * Emit drizzle `sqliteTable` definitions for the project schema, split into
+ * `global` (D1-backed) and `shard` (DO-SQLite-backed) buckets. Tables marked
+ * `.global()` go in the global file; everything else (default root + `.shardBy()`)
+ * goes in the shard file.
+ *
+ * `searchIndexes` are intentionally not emitted — drizzle has no `sqliteTable`
+ * abstraction for FTS5 virtual tables. FTS plumbing is handled by the runtime
+ * outside of drizzle.
+ */
 declare const emitDrizzleSchema: (schema: SchemaIR, useUmbrella?: boolean) => {
   global: string;
   shard: string;
 };
 /**
-* Emit `_generated/crons.ts` from the discovered cron jobs.
-*
-* `LUNORA_CRON_TRIGGERS` is the deduplicated schedule array — what lands in
-* wrangler's `triggers.crons` (the vite plugin reconciles it into
-* `wrangler.jsonc`, and {@link emitWranglerCronTriggers} renders the same list
-* for the CLI / docs).
-*
-* `LUNORA_CRONS` is the dispatcher map keyed by cron expression, each value a
-* list of `{ name, functionPath, args }`. Cloudflare's `scheduled()` handler
-* receives only the cron string, so multiple jobs sharing one expression must
-* all fire — hence a list per key rather than a single entry.
-*
-* Jobs arrive pre-sorted by name (deterministic output); the trigger array
-* preserves first-seen order of distinct expressions.
-*
-* Cloudflare caps a Worker at **3 Cron Triggers** (i.e. 3 distinct cron
-* expressions). Because the dispatcher fires every job sharing an expression,
-* many jobs can ride a single trigger — only the count of *distinct* schedules
-* matters. `lunora codegen` warns when that count exceeds the limit; for
-* finer-grained scheduling use Durable Object alarms (`@lunora/scheduler`),
-* which have no such cap.
-*/
+ * Emit `_generated/crons.ts` from the discovered cron jobs.
+ *
+ * `LUNORA_CRON_TRIGGERS` is the deduplicated schedule array — what lands in
+ * wrangler's `triggers.crons` (the vite plugin reconciles it into
+ * `wrangler.jsonc`, and {@link emitWranglerCronTriggers} renders the same list
+ * for the CLI / docs).
+ *
+ * `LUNORA_CRONS` is the dispatcher map keyed by cron expression, each value a
+ * list of `{ name, functionPath, args }`. Cloudflare's `scheduled()` handler
+ * receives only the cron string, so multiple jobs sharing one expression must
+ * all fire — hence a list per key rather than a single entry.
+ *
+ * Jobs arrive pre-sorted by name (deterministic output); the trigger array
+ * preserves first-seen order of distinct expressions.
+ *
+ * Cloudflare caps a Worker at **3 Cron Triggers** (i.e. 3 distinct cron
+ * expressions). Because the dispatcher fires every job sharing an expression,
+ * many jobs can ride a single trigger — only the count of *distinct* schedules
+ * matters. `lunora codegen` warns when that count exceeds the limit; for
+ * finer-grained scheduling use Durable Object alarms (`@lunora/scheduler`),
+ * which have no such cap.
+ */
 declare const emitCrons: (crons: ReadonlyArray<CronJobIR>) => string;
 /**
-* Render `_generated/vectors.ts` — the static registry of every vector index
-* declared in `schema.ts` (inline `.vectorize()` columns + standalone
-* `defineVectorIndex()` definitions).
-*
-* Cloudflare Vectorize exposes no way to enumerate an account's indexes at
-* runtime — a binding can `describe()` itself but the worker can't ask "which
-* indexes exist". So this generated array is the source of truth the studio's
-* vector browser lists, and the worker's admin route pairs each entry with its
-* live `describe()` stats. Entries are sorted by name for deterministic output.
-*/
+ * Render `_generated/vectors.ts` — the static registry of every vector index
+ * declared in `schema.ts` (inline `.vectorize()` columns + standalone
+ * `defineVectorIndex()` definitions).
+ *
+ * Cloudflare Vectorize exposes no way to enumerate an account's indexes at
+ * runtime — a binding can `describe()` itself but the worker can't ask "which
+ * indexes exist". So this generated array is the source of truth the studio's
+ * vector browser lists, and the worker's admin route pairs each entry with its
+ * live `describe()` stats. Entries are sorted by name for deterministic output.
+ */
 declare const emitVectors: (vectorIndexes: ReadonlyArray<VectorIndexIR>) => string;
 /**
-* Render the deduplicated cron schedules as a JSON fragment suitable for
-* splicing into `wrangler.jsonc`'s `triggers.crons`. The vite plugin uses this
-* (plus the parsed wrangler config) to reconcile generated triggers without the
-* user hand-editing the file.
-*/
+ * Render the deduplicated cron schedules as a JSON fragment suitable for
+ * splicing into `wrangler.jsonc`'s `triggers.crons`. The vite plugin uses this
+ * (plus the parsed wrangler config) to reconcile generated triggers without the
+ * user hand-editing the file.
+ */
 declare const emitWranglerCronTriggers: (crons: ReadonlyArray<CronJobIR>) => string[];
 /** Which capability methods the generated `defineApp` builder exposes — one flag per package-backed feature the app actually uses. */
 interface EmitAppOptions {
   /**
-  * Inbound-email agents (`defineAgent({ onEmail })`) → wire the worker's
-  * top-level `email()` handler to `dispatchAgentEmail(...)` (from
-  * `@lunora/agent/inbound`), so received mail starts a durable run. Empty/absent
-  * ⇒ no wiring, byte-identical output for email-free (and agent-free) projects.
-  */
+   * Inbound-email agents (`defineAgent({ onEmail })`) → wire the worker's
+   * top-level `email()` handler to `dispatchAgentEmail(...)` (from
+   * `@lunora/agent/inbound`), so received mail starts a durable run. Empty/absent
+   * ⇒ no wiring, byte-identical output for email-free (and agent-free) projects.
+   */
   emailAgents?: ReadonlyArray<{
     bindingName: string;
     exportName: string;
@@ -2336,12 +2255,12 @@ interface EmitAppOptions {
   /** Project depends on the unscoped `lunorash` umbrella → import the runtime via `lunorash/runtime` instead of `@lunora/runtime`. */
   useUmbrella: boolean;
   /**
-  * Voice-enabled agents (`defineAgent({ voice: … })`) → wire
-  * `options.voiceAgents`, mapping each agent's export name to its `VOICE_*`
-  * Durable Object namespace binding so the runtime exposes
-  * `/_lunora/voice/&lt;exportName>`. Empty/absent ⇒ no wiring, byte-identical
-  * output for voice-free (and agent-free) projects.
-  */
+   * Voice-enabled agents (`defineAgent({ voice: … })`) → wire
+   * `options.voiceAgents`, mapping each agent's export name to its `VOICE_*`
+   * Durable Object namespace binding so the runtime exposes
+   * `/_lunora/voice/&lt;exportName>`. Empty/absent ⇒ no wiring, byte-identical
+   * output for voice-free (and agent-free) projects.
+   */
   voiceAgents?: ReadonlyArray<{
     bindingName: string;
     exportName: string;
@@ -2352,20 +2271,20 @@ interface EmitAppOptions {
   wantsOpenRpc: boolean;
 }
 /**
-* Emit `_generated/app.ts` — a fluent, feature-specialized worker-composition
-* builder. Only the methods for capabilities THIS app uses are emitted, so the
-* builder's type surface (IntelliSense) lists exactly what can be configured.
-*
-* Each capability declaration is fanned into BOTH runtime surfaces: the DO-side
-* `createShardDO(...)` factory that backs `ctx.*`, and the worker-side
-* `createWorker(...)` options that back the studio/admin endpoints — so storage
-* / scheduler / global are declared once instead of twice. The builder is pure
-* sugar over the public `createWorker` / `createShardDO`; both stay usable.
-*
-* Lives in generated code (not `@lunora/runtime`, which is dependency-free) so
-* it can import the add-on packages the app installed (`@lunora/auth`,
-* `@lunora/storage`, …) directly.
-*/
+ * Emit `_generated/app.ts` — a fluent, feature-specialized worker-composition
+ * builder. Only the methods for capabilities THIS app uses are emitted, so the
+ * builder's type surface (IntelliSense) lists exactly what can be configured.
+ *
+ * Each capability declaration is fanned into BOTH runtime surfaces: the DO-side
+ * `createShardDO(...)` factory that backs `ctx.*`, and the worker-side
+ * `createWorker(...)` options that back the studio/admin endpoints — so storage
+ * / scheduler / global are declared once instead of twice. The builder is pure
+ * sugar over the public `createWorker` / `createShardDO`; both stay usable.
+ *
+ * Lives in generated code (not `@lunora/runtime`, which is dependency-free) so
+ * it can import the add-on packages the app installed (`@lunora/auth`,
+ * `@lunora/storage`, …) directly.
+ */
 declare const emitApp: (options: EmitAppOptions) => string;
 /** Inputs the OpenAPI emitter needs from a codegen run. */
 interface OpenApiEmitInput {
@@ -2375,40 +2294,40 @@ interface OpenApiEmitInput {
   version?: string;
 }
 /**
-* Emit an OpenAPI 3.1.0 document covering both Lunora function surfaces.
-*
-* `httpRouter()` typed REST routes become real `paths` keyed by their method +
-* URL, with query/path parameters and JSON request bodies derived from their
-* `v.*` validators, and a response schema from `.output()` when declared.
-*
-* RPC `query`/`mutation`/`action` functions become one operation each on
-* `POST /_lunora/rpc` (disambiguated by a `#functionPath` path fragment), with a
-* requestBody pinning `functionPath` + typed `args`. `internal`/`stream`
-* functions are excluded (unreachable / not invocable on the external RPC path).
-*
-* Operations are grouped into `tags` by file namespace, and every operation
-* references a reusable `LunoraError` error-response component enumerating the
-* standard error codes. Borrows oRPC's per-procedure-operation + tag-grouping +
-* internal-filtering structure; the JSON Schema dialect matches `@lunora/values`
-* (Draft 2020-12). Returns the document as a plain object (the single source of
-* truth `emitOpenApi` stringifies and `emitOpenApiModule` inlines, so the
-* `.json` and `.ts` artifacts can never drift).
-*/
+ * Emit an OpenAPI 3.1.0 document covering both Lunora function surfaces.
+ *
+ * `httpRouter()` typed REST routes become real `paths` keyed by their method +
+ * URL, with query/path parameters and JSON request bodies derived from their
+ * `v.*` validators, and a response schema from `.output()` when declared.
+ *
+ * RPC `query`/`mutation`/`action` functions become one operation each on
+ * `POST /_lunora/rpc` (disambiguated by a `#functionPath` path fragment), with a
+ * requestBody pinning `functionPath` + typed `args`. `internal`/`stream`
+ * functions are excluded (unreachable / not invocable on the external RPC path).
+ *
+ * Operations are grouped into `tags` by file namespace, and every operation
+ * references a reusable `LunoraError` error-response component enumerating the
+ * standard error codes. Borrows oRPC's per-procedure-operation + tag-grouping +
+ * internal-filtering structure; the JSON Schema dialect matches `@lunora/values`
+ * (Draft 2020-12). Returns the document as a plain object (the single source of
+ * truth `emitOpenApi` stringifies and `emitOpenApiModule` inlines, so the
+ * `.json` and `.ts` artifacts can never drift).
+ */
 declare const buildOpenApiDocument: (input: OpenApiEmitInput) => Record<string, unknown>;
 /**
-* Emit the OpenAPI 3.1 document as a pretty-printed JSON string
-* (`_generated/openapi.json`) — the portable artifact for external tooling.
-*/
+ * Emit the OpenAPI 3.1 document as a pretty-printed JSON string
+ * (`_generated/openapi.json`) — the portable artifact for external tooling.
+ */
 declare const emitOpenApi: (input: OpenApiEmitInput) => string;
 /**
-* Emit the OpenAPI document as an importable TS module
-* (`_generated/openapi.ts`) the worker entry imports and passes to
-* `createWorker({ openApiSpec })`. The document object literal is inlined
-* verbatim (same `JSON.stringify` form the `.json` uses), so the `.ts` and
-* `.json` are byte-identical content and regenerate together — closing the gap
-* where a Worker cannot read the JSON file at runtime. `document_` is the object
-* returned by {@link buildOpenApiDocument} (reused, never recomputed).
-*/
+ * Emit the OpenAPI document as an importable TS module
+ * (`_generated/openapi.ts`) the worker entry imports and passes to
+ * `createWorker({ openApiSpec })`. The document object literal is inlined
+ * verbatim (same `JSON.stringify` form the `.json` uses), so the `.ts` and
+ * `.json` are byte-identical content and regenerate together — closing the gap
+ * where a Worker cannot read the JSON file at runtime. `document_` is the object
+ * returned by {@link buildOpenApiDocument} (reused, never recomputed).
+ */
 declare const emitOpenApiModule: (document_: Record<string, unknown>) => string;
 /** The OpenRPC dialect version this emitter targets. */
 declare const OPENRPC_VERSION = "1.3.2";
@@ -2419,37 +2338,37 @@ interface OpenRpcEmitInput {
   version?: string;
 }
 /**
-* Emit an OpenRPC 1.x document describing Lunora's JSON-RPC surface.
-*
-* Only the RPC `query`/`mutation`/`action` functions become `methods` — one per
-* function, `name` = `file:fn`. `internal` (off the external RPC path) and
-* `stream` (not invocable over the RPC envelope) are excluded, the same filter
-* the OpenAPI emitter applies. Each method's single `args` param is typed from
-* the function's `v.*` validators (`argsObjectSchema`); `result` is the
-* `.output()` schema when declared, else a best-effort inferred schema. The
-* standard `LunoraError` codes ride along under each method's `errors`.
-*
-* `httpRouter()` typed REST routes are deliberately omitted — OpenRPC is
-* RPC-only and cannot represent REST paths; the OpenAPI document is the spec
-* that covers the REST surface. Methods are sorted by name for stable output.
-* Returns the document as a plain object (the single source of truth
-* `emitOpenRpc` stringifies and `emitOpenRpcModule` inlines, so the `.json` and
-* `.ts` artifacts can never drift).
-*/
+ * Emit an OpenRPC 1.x document describing Lunora's JSON-RPC surface.
+ *
+ * Only the RPC `query`/`mutation`/`action` functions become `methods` — one per
+ * function, `name` = `file:fn`. `internal` (off the external RPC path) and
+ * `stream` (not invocable over the RPC envelope) are excluded, the same filter
+ * the OpenAPI emitter applies. Each method's single `args` param is typed from
+ * the function's `v.*` validators (`argsObjectSchema`); `result` is the
+ * `.output()` schema when declared, else a best-effort inferred schema. The
+ * standard `LunoraError` codes ride along under each method's `errors`.
+ *
+ * `httpRouter()` typed REST routes are deliberately omitted — OpenRPC is
+ * RPC-only and cannot represent REST paths; the OpenAPI document is the spec
+ * that covers the REST surface. Methods are sorted by name for stable output.
+ * Returns the document as a plain object (the single source of truth
+ * `emitOpenRpc` stringifies and `emitOpenRpcModule` inlines, so the `.json` and
+ * `.ts` artifacts can never drift).
+ */
 declare const buildOpenRpcDocument: (input: OpenRpcEmitInput) => Record<string, unknown>;
 /**
-* Emit the OpenRPC 1.x document as a pretty-printed JSON string
-* (`_generated/openrpc.json`) — the portable artifact for external tooling.
-*/
+ * Emit the OpenRPC 1.x document as a pretty-printed JSON string
+ * (`_generated/openrpc.json`) — the portable artifact for external tooling.
+ */
 declare const emitOpenRpc: (input: OpenRpcEmitInput) => string;
 /**
-* Emit the OpenRPC document as an importable TS module
-* (`_generated/openrpc.ts`) the worker entry imports and passes to
-* `createWorker({ openRpcSpec })`. The document object literal is inlined
-* verbatim (same `JSON.stringify` form the `.json` uses), so the `.ts` and
-* `.json` are byte-identical content and regenerate together. `document_` is
-* the object returned by {@link buildOpenRpcDocument} (reused, never recomputed).
-*/
+ * Emit the OpenRPC document as an importable TS module
+ * (`_generated/openrpc.ts`) the worker entry imports and passes to
+ * `createWorker({ openRpcSpec })`. The document object literal is inlined
+ * verbatim (same `JSON.stringify` form the `.json` uses), so the `.ts` and
+ * `.json` are byte-identical content and regenerate together. `document_` is
+ * the object returned by {@link buildOpenRpcDocument} (reused, never recomputed).
+ */
 declare const emitOpenRpcModule: (document_: Record<string, unknown>) => string;
 /** Current snapshot format version. Bumped if the structural shape below changes. */
 declare const SCHEMA_SNAPSHOT_VERSION: 1;
@@ -2480,26 +2399,26 @@ interface TableSnapshot {
   /** Relation accessor name → {@link RelationSnapshot}. */
   relations: Record<string, RelationSnapshot>;
   /**
-  * `"root"` (default single-DO), `"global"` (D1-replicated), or
-  * `"shardBy:&lt;field>"` (partitioned). Encoded as a string so the snapshot
-  * stays a plain JSON-stable value.
-  */
+   * `"root"` (default single-DO), `"global"` (D1-replicated), or
+   * `"shardBy:&lt;field>"` (partitioned). Encoded as a string so the snapshot
+   * stays a plain JSON-stable value.
+   */
   shardMode: string;
 }
 /** The committed baseline — a deterministic structural view of the whole schema. */
 interface SchemaSnapshot {
   /**
-  * Cloudflare DO data-residency jurisdiction declared via `.jurisdiction("…")`,
-  * or absent. Tracked because changing it strands all existing Durable Object
-  * data (a DO name maps to a different ID per jurisdiction). Optional, so old
-  * baselines written before this field parse cleanly (absent ⇒ undefined).
-  *
-  * Typed as a plain `string` (not the authoring union) on purpose: this is
-  * STORED data that a newer Lunora may have written with a jurisdiction this
-  * version doesn't yet know. Preserving the raw value keeps the breaking
-  * `changedJurisdiction` diff correct under a downgrade — coercing an unknown
-  * value to `undefined` would fail OPEN and hide the most destructive change.
-  */
+   * Cloudflare DO data-residency jurisdiction declared via `.jurisdiction("…")`,
+   * or absent. Tracked because changing it strands all existing Durable Object
+   * data (a DO name maps to a different ID per jurisdiction). Optional, so old
+   * baselines written before this field parse cleanly (absent ⇒ undefined).
+   *
+   * Typed as a plain `string` (not the authoring union) on purpose: this is
+   * STORED data that a newer Lunora may have written with a jurisdiction this
+   * version doesn't yet know. Preserving the raw value keeps the breaking
+   * `changedJurisdiction` diff correct under a downgrade — coercing an unknown
+   * value to `undefined` would fail OPEN and hide the most destructive change.
+   */
   jurisdiction?: string;
   /** Sorted list of every declared `defineMigration` id at capture time. */
   migrationIds: ReadonlyArray<string>;
@@ -2522,36 +2441,36 @@ interface SchemaDrift {
   changes: ReadonlyArray<DriftChange>;
 }
 /**
-* Build a {@link SchemaSnapshot} from a parsed {@link SchemaIR} and the set of
-* declared migration ids. Tables and migration ids are sorted so the emitted
-* JSON is byte-stable across runs (no spurious diffs / churn).
-*/
+ * Build a {@link SchemaSnapshot} from a parsed {@link SchemaIR} and the set of
+ * declared migration ids. Tables and migration ids are sorted so the emitted
+ * JSON is byte-stable across runs (no spurious diffs / churn).
+ */
 declare const buildSchemaSnapshot: (schema: SchemaIR, migrationIds: ReadonlyArray<string>) => SchemaSnapshot;
 /** Serialize a snapshot to the exact bytes written to `lunora/.lunora-schema.json` (trailing newline). */
 declare const serializeSchemaSnapshot: (snapshot: SchemaSnapshot) => string;
 /**
-* Thrown by {@link parseSchemaSnapshot} when the baseline file exists but is
-* malformed (bad JSON / wrong version / invalid table shape). Lets the CLI gate
-* treat a corrupt baseline as a hard error rather than silently degrading to a
-* "first capture" that would mask drift and then overwrite the bad file.
-*/
+ * Thrown by {@link parseSchemaSnapshot} when the baseline file exists but is
+ * malformed (bad JSON / wrong version / invalid table shape). Lets the CLI gate
+ * treat a corrupt baseline as a hard error rather than silently degrading to a
+ * "first capture" that would mask drift and then overwrite the bad file.
+ */
 declare class SchemaSnapshotParseError extends LunoraError {
   constructor(message: string);
 }
 /**
-* Parse a committed snapshot file. Returns `undefined` ONLY when the content is
-* absent/empty; throws {@link SchemaSnapshotParseError} when content is present
-* but malformed (bad JSON, wrong version, or structurally-invalid tables) so the
-* caller can distinguish "no baseline yet" (a legitimate first capture) from "a
-* corrupt baseline" (which must not be silently treated as a first capture).
-*/
+ * Parse a committed snapshot file. Returns `undefined` ONLY when the content is
+ * absent/empty; throws {@link SchemaSnapshotParseError} when content is present
+ * but malformed (bad JSON, wrong version, or structurally-invalid tables) so the
+ * caller can distinguish "no baseline yet" (a legitimate first capture) from "a
+ * corrupt baseline" (which must not be silently treated as a first capture).
+ */
 declare const parseSchemaSnapshot: (content: string | undefined) => SchemaSnapshot | undefined;
 /**
-* Diff the current snapshot against a committed baseline and classify every
-* structural change. Pure — no I/O. When `baseline` is `undefined` (no committed
-* snapshot yet) there is no drift to report: every table is treated as a fresh
-* additive `addedTable`, so a first deploy is never blocked.
-*/
+ * Diff the current snapshot against a committed baseline and classify every
+ * structural change. Pure — no I/O. When `baseline` is `undefined` (no committed
+ * snapshot yet) there is no drift to report: every table is treated as a fresh
+ * additive `addedTable`, so a first deploy is never blocked.
+ */
 declare const diffSchemaSnapshots: (baseline: SchemaSnapshot | undefined, current: SchemaSnapshot) => SchemaDrift;
 /** The decision the pre-deploy gate returns. */
 interface SchemaDriftDecision {
@@ -2562,157 +2481,158 @@ interface SchemaDriftDecision {
   /** Migration ids declared now but absent from the baseline — proof a migration was added. */
   newMigrationIds: ReadonlyArray<string>;
   /**
-  * A multi-line, actionable explanation. Always present; empty string when
-  * there is no drift at all. Mirrors the D1-placeholder guard's message style.
-  */
+   * A multi-line, actionable explanation. Always present; empty string when
+   * there is no drift at all. Mirrors the D1-placeholder guard's message style.
+   */
   reason: string;
 }
 /**
-* Decide whether breaking schema drift should block a deploy.
-*
-* Blocks only when the baseline exists (a first-ever capture is never blocking),
-* there is at least one `breaking` change, no NEW migration id was added since
-* the baseline, and the `allowDrift` override is not set. Safe-only drift (or
-* breaking drift accompanied by a new migration id) passes.
-*/
+ * Decide whether breaking schema drift should block a deploy.
+ *
+ * Blocks only when the baseline exists (a first-ever capture is never blocking),
+ * there is at least one `breaking` change, no NEW migration id was added since
+ * the baseline, and the `allowDrift` override is not set. Safe-only drift (or
+ * breaking drift accompanied by a new migration id) passes.
+ */
 declare const evaluateSchemaDrift: (options: {
   allowDrift?: boolean;
   baseline: SchemaSnapshot | undefined;
   current: SchemaSnapshot;
 }) => SchemaDriftDecision;
 /**
-* Committed, tracked baseline file holding the blessed structural schema
-* snapshot the pre-deploy drift gate diffs against. Lives in `lunora/` (NOT the
-* gitignored `_generated/`) so it is committed alongside `schema.ts`. Leading
-* dot keeps it tucked away next to the schema it describes.
-*/
+ * Committed, tracked baseline file holding the blessed structural schema
+ * snapshot the pre-deploy drift gate diffs against. Lives in `lunora/` (NOT the
+ * gitignored `_generated/`) so it is committed alongside `schema.ts`. Leading
+ * dot keeps it tucked away next to the schema it describes.
+ */
 declare const SCHEMA_SNAPSHOT_FILENAME = ".lunora-schema.json";
 /**
-* Construct the ts-morph `Project` codegen discovers over. Prefers the user's
-* `tsconfig.json` (when one is found walking up from `lunoraDirectory`) so
-* cross-file type resolution and path aliases work; falls back to an isolated
-* project otherwise. This is the exact construction {@link runCodegen} uses
-* when no `project` is injected — exported so a long-lived caller (the Vite
-* dev-loop) can build one once and reuse it across runs via
-* {@link refreshCodegenProject} instead of re-parsing the user's whole TS
-* program on every save.
-*/
+ * Construct the ts-morph `Project` codegen discovers over. Prefers the user's
+ * `tsconfig.json` (when one is found walking up from `lunoraDirectory`) so
+ * cross-file type resolution and path aliases work; falls back to an isolated
+ * project otherwise. This is the exact construction {@link runCodegen} uses
+ * when no `project` is injected — exported so a long-lived caller (the Vite
+ * dev-loop) can build one once and reuse it across runs via
+ * {@link refreshCodegenProject} instead of re-parsing the user's whole TS
+ * program on every save.
+ */
 declare const createCodegenProject: (lunoraDirectory: string) => Project;
 /**
-* Synchronise a reused {@link createCodegenProject} Project with the current
-* on-disk state of `lunoraDirectory`, so the next {@link runCodegen} sees the
-* same files a freshly-constructed Project would — without re-parsing the whole
-* TS program. Adds any on-disk source file the Project doesn't yet have, and
-* `refreshFromFileSystemSync()`es the ones it does (picking up edits); then
-* removes Project source files under `lunoraDirectory` that no longer exist on
-* disk (the classic stale-deleted-file cache bug).
-*
-* Files outside `lunoraDirectory` (e.g. those pulled in by the user's tsconfig)
-* are left untouched — they back type resolution and rarely change in the
-* dev-loop; a tsconfig change invalidates the whole cached Project upstream.
-*/
+ * Synchronise a reused {@link createCodegenProject} Project with the current
+ * on-disk state of `lunoraDirectory`, so the next {@link runCodegen} sees the
+ * same files a freshly-constructed Project would — without re-parsing the whole
+ * TS program. Adds any on-disk source file the Project doesn't yet have, and
+ * `refreshFromFileSystemSync()`es the ones it does (picking up edits); then
+ * removes Project source files under `lunoraDirectory` that no longer exist on
+ * disk (the classic stale-deleted-file cache bug).
+ *
+ * Files outside `lunoraDirectory` (e.g. those pulled in by the user's tsconfig)
+ * are left untouched — they back type resolution and rarely change in the
+ * dev-loop; a tsconfig change invalidates the whole cached Project upstream.
+ */
 declare const refreshCodegenProject: (project: Project, lunoraDirectory: string) => void;
 /**
-* Top-level codegen entry. Parses `&lt;projectRoot>/lunora/schema.ts` and every
-* function file under `&lt;projectRoot>/lunora/`, then writes
-* `_generated/{api,server,dataModel}.ts` next to them.
-*
-* When `LUNORA_CODEGEN_TIMING` is set (truthy), a single diagnostic summary
-* line is written to stderr with the total wall time and the discovery-vs-emit
-* split — opt-in instrumentation that is otherwise zero-cost and side-effect-free
-* on the returned {@link CodegenResult}.
-*/
+ * Top-level codegen entry. Parses `&lt;projectRoot>/lunora/schema.ts` and every
+ * function file under `&lt;projectRoot>/lunora/`, then writes
+ * `_generated/{api,server,dataModel}.ts` next to them.
+ *
+ * When `LUNORA_CODEGEN_TIMING` is set (truthy), a single diagnostic summary
+ * line is written to stderr with the total wall time and the discovery-vs-emit
+ * split — opt-in instrumentation that is otherwise zero-cost and side-effect-free
+ * on the returned {@link CodegenResult}.
+ */
 declare const runCodegen: (options: CodegenOptions) => CodegenResult;
 interface CodegenOptions {
   /**
-  * Which machine-readable API spec(s) to emit into `_generated/`.
-  *
-  * `"openapi"` (the default) writes only `openapi.json` (OpenAPI 3.1; covers
-  * both the RPC functions and `httpRouter()` REST routes). `"openrpc"` writes
-  * only `openrpc.json` (OpenRPC 1.x; the RPC functions only — OpenRPC cannot
-  * represent REST routes). `"both"` writes both files; `"none"` writes neither.
-  *
-  * Regardless of the choice, `CodegenResult.generated.openApi` and `.openRpc`
-  * always carry the rendered string (computation is cheap and pure); only the
-  * on-disk write is gated by this option.
-  */
+   * Which machine-readable API spec(s) to emit into `_generated/`.
+   *
+   * `"openapi"` (the default) writes only `openapi.json` (OpenAPI 3.1; covers
+   * both the RPC functions and `httpRouter()` REST routes). `"openrpc"` writes
+   * only `openrpc.json` (OpenRPC 1.x; the RPC functions only — OpenRPC cannot
+   * represent REST routes). `"both"` writes both files; `"none"` writes neither.
+   *
+   * Regardless of the choice, `CodegenResult.generated.openApi` and `.openRpc`
+   * always carry the rendered string (computation is cheap and pure); only the
+   * on-disk write is gated by this option.
+   */
   apiSpec?: "both" | "none" | "openapi" | "openrpc";
   /**
-  * When true, run discovery + emit (so any schema/function parse error
-  * surfaces) but skip writing files to `_generated/`. The returned
-  * `outputDirectory` is still the path that *would* have been written.
-  */
+   * When true, run discovery + emit (so any schema/function parse error
+   * surfaces) but skip writing files to `_generated/`. The returned
+   * `outputDirectory` is still the path that *would* have been written.
+   */
   dryRun?: boolean;
   /**
-  * Run the static schema advisor (unindexed FKs, …) during codegen.
-  * Defaults to `true`. When `false`, `CodegenResult.advisories` is empty.
-  * Computed regardless of `dryRun`; codegen never prints them — see
-  * {@link CodegenResult.advisories}.
-  */
+   * Run the static schema advisor (unindexed FKs, …) during codegen.
+   * Defaults to `true`. When `false`, `CodegenResult.advisories` is empty.
+   * Computed regardless of `dryRun`; codegen never prints them — see
+   * {@link CodegenResult.advisories}.
+   */
   lint?: boolean;
   /** Override the lunora subdirectory name. Defaults to `"lunora"`. */
   lunoraDirectory?: string;
   /**
-  * Reuse a previously-constructed ts-morph {@link Project} instead of building
-  * a fresh one each run. The caller owns refreshing its source files from disk
-  * (see {@link refreshCodegenProject}) — codegen does not re-read changed files
-  * off an injected Project. Built via {@link createCodegenProject} when absent.
-  * Used by the Vite dev-loop to avoid re-parsing the whole TS program on every
-  * save; omit it (CLI one-shot path) to get the default fresh-Project behaviour.
-  */
+   * Reuse a previously-constructed ts-morph {@link Project} instead of building
+   * a fresh one each run. The caller owns refreshing its source files from disk
+   * (see {@link refreshCodegenProject}) — codegen does not re-read changed files
+   * off an injected Project. Built via {@link createCodegenProject} when absent.
+   * Used by the Vite dev-loop to avoid re-parsing the whole TS program on every
+   * save; omit it (CLI one-shot path) to get the default fresh-Project behaviour.
+   */
   project?: Project;
   /** Project root containing the `lunora/` directory. */
   projectRoot: string;
   /**
-  * Re-bless the committed schema-drift baseline (`lunora/.lunora-schema.json`)
-  * with the current structural snapshot. The baseline is ALWAYS written on
-  * first capture (when the file is absent); set this to overwrite an existing
-  * one — e.g. after the developer has added the data migration that justifies
-  * a breaking change. Ignored when `dryRun` is true.
-  */
+   * Re-bless the committed schema-drift baseline (`lunora/.lunora-schema.json`)
+   * with the current structural snapshot. The baseline is ALWAYS written on
+   * first capture (when the file is absent); set this to overwrite an existing
+   * one — e.g. after the developer has added the data migration that justifies
+   * a breaking change. Ignored when `dryRun` is true.
+   */
   updateSchemaBaseline?: boolean;
   /**
-  * Committed `wrangler.jsonc` `vars` entries that hold plaintext secrets — the
-  * `plaintext_secret_in_wrangler_vars` lint input. Produced by `@lunora/config`
-  * (which reads `wrangler.jsonc`) and threaded through by the CLI / Vite plugin;
-  * codegen only forwards it to the advisor. Absent when no wrangler config is
-  * present or the caller doesn't scan it.
-  */
+   * Committed `wrangler.jsonc` `vars` entries that hold plaintext secrets — the
+   * `plaintext_secret_in_wrangler_vars` lint input. Produced by `@lunora/config`
+   * (which reads `wrangler.jsonc`) and threaded through by the CLI / Vite plugin;
+   * codegen only forwards it to the advisor. Absent when no wrangler config is
+   * present or the caller doesn't scan it.
+   */
   wranglerVariables?: ReadonlyArray<WranglerVariableIR>;
 }
 interface CodegenResult {
   /**
-  * Static schema advisor findings (e.g. unindexed foreign keys) produced
-  * this run. Empty when `lint` is `false` or the schema is clean. Codegen
-  * does not print these itself — each caller presents them through its own
-  * channel (the CLI logger, the vite overlay, the studio Advisors table).
-  * `formatAdvisories` is exported for a plain multi-line rendering.
-  */
+   * Static schema advisor findings (e.g. unindexed foreign keys) produced
+   * this run. Empty when `lint` is `false` or the schema is clean. Codegen
+   * does not print these itself — each caller presents them through its own
+   * channel (the CLI logger, the vite overlay, the studio Advisors table).
+   * `formatAdvisories` is exported for a plain multi-line rendering.
+   */
   advisories: ReadonlyArray<Finding>;
   /**
-  * Agents discovered from `defineAgent` exports in `lunora/agents.ts` — the
-  * list the config layer reconciles into wrangler's `workflows[]` array (an
-  * agent compiles onto a Cloudflare Workflow). Agents are NOT Durable Objects,
-  * so this adds no binding or migration. Empty when the project declares none.
-  */
+   * Agents discovered from `defineAgent` exports in `lunora/agents.ts` — the
+   * list the config layer reconciles into wrangler's `workflows[]` array (an
+   * agent compiles onto a Cloudflare Workflow). Agents are NOT Durable Objects,
+   * so this adds no binding or migration. Empty when the project declares none.
+   */
   agents: ReadonlyArray<AgentIR>;
   /**
-  * Containers discovered from `defineContainer` exports in
-  * `lunora/containers.ts` — the list the config layer reconciles into
-  * wrangler's `containers[]`, `CONTAINER_*` Durable Object bindings, and
-  * migration classes. Empty when the project declares no containers.
-  */
+   * Containers discovered from `defineContainer` exports in
+   * `lunora/containers.ts` — the list the config layer reconciles into
+   * wrangler's `containers[]`, `CONTAINER_*` Durable Object bindings, and
+   * migration classes. Empty when the project declares no containers.
+   */
   containers: ReadonlyArray<ContainerIR>;
   /**
-  * Deduplicated cron schedules discovered from `cronJobs()` definitions —
-  * the array the vite plugin reconciles into `wrangler.jsonc`'s
-  * `triggers.crons`. Empty when the project declares no crons.
-  */
+   * Deduplicated cron schedules discovered from `cronJobs()` definitions —
+   * the array the vite plugin reconciles into `wrangler.jsonc`'s
+   * `triggers.crons`. Empty when the project declares no crons.
+   */
   cronTriggers: ReadonlyArray<string>;
   generated: {
     /** WorkflowEntrypoint classes for declared agents (`_generated/agents.ts`); `""` (and not written) when no agents are declared. */
     agents: string;
-    api: string; /** Fluent worker-composition builder (`_generated/app.ts`) — `defineApp()`. Always written. */
+    api: string;
+    /** Fluent worker-composition builder (`_generated/app.ts`) — `defineApp()`. Always written. */
     app: string;
     /** Partial-replication collection factories (`_generated/collections.ts`); `""` (and not written) unless the project declares shapes and installs `@lunora/db`. */
     collections: string;
@@ -2722,89 +2642,89 @@ interface CodegenResult {
     dataModel: string;
     drizzleGlobal: string;
     drizzleShard: string;
-    functions: string; /** OpenAPI 3.1.0 document (`_generated/openapi.json`), pretty-printed JSON. */
+    functions: string;
+    /** OpenAPI 3.1.0 document (`_generated/openapi.json`), pretty-printed JSON. */
     openApi: string;
     /**
-    * OpenAPI document as an importable TS module (`_generated/openapi.ts`) —
-    * `export const openApiSpec`, the worker imports it for
-    * `createWorker({ openApiSpec })`. Same document as `openApi`. Written
-    * alongside `openapi.json` whenever `apiSpec` includes `openapi`.
-    */
+     * OpenAPI document as an importable TS module (`_generated/openapi.ts`) —
+     * `export const openApiSpec`, the worker imports it for
+     * `createWorker({ openApiSpec })`. Same document as `openApi`. Written
+     * alongside `openapi.json` whenever `apiSpec` includes `openapi`.
+     */
     openApiModule: string;
     /** OpenRPC 1.x document (`_generated/openrpc.json`), pretty-printed JSON. Always computed; written only when `apiSpec` includes `openrpc`. */
     openRpc: string;
     /**
-    * OpenRPC document as an importable TS module (`_generated/openrpc.ts`) —
-    * `export const openRpcSpec`, for `createWorker({ openRpcSpec })`. Same
-    * document as `openRpc`. Written alongside `openrpc.json` whenever
-    * `apiSpec` includes `openrpc`.
-    */
+     * OpenRPC document as an importable TS module (`_generated/openrpc.ts`) —
+     * `export const openRpcSpec`, for `createWorker({ openRpcSpec })`. Same
+     * document as `openRpc`. Written alongside `openrpc.json` whenever
+     * `apiSpec` includes `openrpc`.
+     */
     openRpcModule: string;
     /** Push-consumer queue registry (`_generated/queues.ts`); `""` (and not written) when no push queues are declared. */
     queues: string;
     /** Project-bound seed client (`_generated/seed.ts`); `""` (and not written) when `@lunora/seed` is not a declared dependency. */
     seed: string;
     server: string;
-    shard: string; /** Static vector-index registry (`_generated/vectors.ts`) — `LUNORA_VECTOR_INDEXES`. Empty array body when the schema declares none. */
+    shard: string;
+    /** Static vector-index registry (`_generated/vectors.ts`) — `LUNORA_VECTOR_INDEXES`. Empty array body when the schema declares none. */
     vectors: string;
     /** WorkflowEntrypoint classes (`_generated/workflows.ts`); `""` (and not written) when no workflows are declared. */
     workflows: string;
   };
   outputDirectory: string;
   /**
-  * Queues discovered from `defineQueue` exports in `lunora/queues.ts` — the
-  * list the config layer reconciles into wrangler's `queues.producers[]` /
-  * `queues.consumers[]`. Queues are NOT Durable Objects, so this adds no
-  * binding or migration. Empty when the project declares no queues.
-  */
+   * Queues discovered from `defineQueue` exports in `lunora/queues.ts` — the
+   * list the config layer reconciles into wrangler's `queues.producers[]` /
+   * `queues.consumers[]`. Queues are NOT Durable Objects, so this adds no
+   * binding or migration. Empty when the project declares no queues.
+   */
   queues: ReadonlyArray<QueueIR>;
   /**
-  * The CURRENT structural schema snapshot computed this run (tables + field
-  * kinds/optionality + indexes/relations/shard mode + declared migration ids).
-  * The pre-deploy drift gate diffs this against the committed baseline read
-  * from {@link CodegenResult.schemaSnapshotPath}. Always present, even on a
-  * `dryRun`.
-  */
+   * The CURRENT structural schema snapshot computed this run (tables + field
+   * kinds/optionality + indexes/relations/shard mode + declared migration ids).
+   * The pre-deploy drift gate diffs this against the committed baseline read
+   * from {@link CodegenResult.schemaSnapshotPath}. Always present, even on a
+   * `dryRun`.
+   */
   schemaSnapshot: SchemaSnapshot;
   /** Absolute path of the committed baseline file (`lunora/.lunora-schema.json`). */
   schemaSnapshotPath: string;
   /**
-  * Workflows discovered from `defineWorkflow` exports in
-  * `lunora/workflows.ts` — the list the config layer reconciles into
-  * wrangler's `workflows[]` array. Workflows are NOT Durable Objects, so this
-  * adds no binding or migration. Empty when the project declares no workflows.
-  */
+   * Workflows discovered from `defineWorkflow` exports in
+   * `lunora/workflows.ts` — the list the config layer reconciles into
+   * wrangler's `workflows[]` array. Workflows are NOT Durable Objects, so this
+   * adds no binding or migration. Empty when the project declares no workflows.
+   */
   workflows: ReadonlyArray<WorkflowIR>;
 }
 /**
-* Convert a {@link SchemaIR} into a synthetic runtime {@link Schema} carrying just
-* the `tables[name].shape` surface `@lunora/seed` introspects. System columns
-* (`_id`, `_creationTime`) are absent from the IR shape, exactly as the seed
-* engine expects (it assigns `_id` itself).
-*/
+ * Convert a {@link SchemaIR} into a synthetic runtime {@link Schema} carrying just
+ * the `tables[name].shape` surface `@lunora/seed` introspects. System columns
+ * (`_id`, `_creationTime`) are absent from the IR shape, exactly as the seed
+ * engine expects (it assigns `_id` itself).
+ */
 declare const schemaFromIr: (ir: SchemaIR) => Schema;
 /**
-* Convert a codegen {@link ValidatorIR} into a JSON Schema node. A thin wrapper
-* over the shared {@link jsonSchemaFromNode} core (from `@lunora/values`) with the
-* IR-backed {@link irReader}, so the kind→schema mapping is the *same* algorithm
-* `@lunora/values`' `toJsonSchema` runs — codegen never instantiates the runtime
-* `v.*` objects, it only holds the reflected IR. Shared by the OpenAPI and
-* OpenRPC emitters so both surfaces speak one JSON Schema dialect.
-*/
+ * Convert a codegen {@link ValidatorIR} into a JSON Schema node. A thin wrapper
+ * over the shared {@link jsonSchemaFromNode} core (from `@lunora/values`) with the
+ * IR-backed {@link irReader}, so the kind→schema mapping is the *same* algorithm
+ * `@lunora/values`' `toJsonSchema` runs — codegen never instantiates the runtime
+ * `v.*` objects, it only holds the reflected IR. Shared by the OpenAPI and
+ * OpenRPC emitters so both surfaces speak one JSON Schema dialect.
+ */
 declare const validatorIrToJsonSchema: (validator: ValidatorIR) => JsonSchema;
-/** Build `{ type: "object", properties, required }` from an IR shape (mirrors `@lunora/values`' object mapping). */
-
-/**
-* The machine-readable `LunoraError` codes Lunora emits on the RPC + REST
-* surfaces, enumerated from `@lunora/server`'s `CODE_STATUS` map plus the
-* runtime/DO dispatch codes (`FUNCTION_NOT_FOUND`, `PAYLOAD_TOO_LARGE`,
-* `METHOD_NOT_ALLOWED`, the `*_NOT_CONFIGURED` admin gates, …). The list documents
-* the contract; clients switch on `error.code`. Kept sorted for stable output.
-*/
+/**
+ * The machine-readable `LunoraError` codes Lunora emits on the RPC + REST
+ * surfaces, enumerated from `@lunora/server`'s `CODE_STATUS` map plus the
+ * runtime/DO dispatch codes (`FUNCTION_NOT_FOUND`, `PAYLOAD_TOO_LARGE`,
+ * `METHOD_NOT_ALLOWED`, the `*_NOT_CONFIGURED` admin gates, …). The list documents
+ * the contract; clients switch on `error.code`. Kept sorted for stable output.
+ */
 declare const LUNORA_ERROR_CODES: ReadonlyArray<string>;
 /** The matching secret rule's `kind` for a string value, or `undefined` when none matches. */
 declare const secretKindOf: (value: string) => string | undefined;
 /** A redacted preview of a secret value — first 4 chars plus its length, never the full value. */
 declare const redact: (value: string) => string;
 declare const VERSION = "0.0.0";
-export { AGENTS_FILENAME, type AgentIR, type AuthApiCallIR, CONTAINERS_FILENAME, CodegenDiagnosticError, type CodegenOptions, type CodegenResult, type ContainerIR, type CronJobIR, type DriftChange, type EmitAppOptions, FLAGS_FILENAME, type FieldSnapshot, type FlagsIR, type FunctionIR, GENERATED_HEADER, type HttpRouteIR, type IndexIR, type IndexSnapshot, type InsertWriteIR, LUNORA_ERROR_CODES, type LintSchemaOptions, MUTATORS_FILENAME, type MaskProcedureIR, type MigrationIR, type MutatorIR, OPENRPC_VERSION, type OpenApiEmitInput, type OpenRpcEmitInput, type ProjectIR, QUEUES_FILENAME, type QueryReadIR, type QueueIR, type R2sqlCallIR, type RelationSnapshot, type RlsMetadataIR, type RlsPolicyIR, type RlsProcedureIR, type RlsRoleIR, SCHEMA_SNAPSHOT_FILENAME, SCHEMA_SNAPSHOT_VERSION, SHAPES_FILENAME, type SchemaDrift, type SchemaDriftDecision, type SchemaIR, type SchemaSnapshot, SchemaSnapshotParseError, type ShapeIR, type StorageRuleIR, type StorageRulesMetadataIR, type TableIR, type TableSnapshot, VERSION, type ValidatorIR, type VectorIndexIR, WORKFLOWS_FILENAME, type WorkflowIR, type WranglerVariableIR, buildOpenApiDocument, buildOpenRpcDocument, buildSchemaSnapshot, createCodegenProject, diagnosticAt, diffSchemaSnapshots, discoverAgents, discoverAuthApiCalls, discoverContainers, discoverCrons, discoverFlags, discoverFunctions, discoverHttpRoutes, discoverInserts, discoverMaskProcedures, discoverMigrations, discoverMutators, discoverNondeterministicCalls, discoverQueries, discoverQueues, discoverR2sqlCalls, discoverRlsMetadata, discoverRlsProcedures, discoverSchema, discoverShapes, discoverStorageRulesMetadata, discoverWorkflows, emitAgents, emitApi, emitApp, emitCollections, emitContainers, emitCrons, emitDataModel, emitDrizzleSchema, emitFunctions, emitOpenApi, emitOpenApiModule, emitOpenRpc, emitOpenRpcModule, emitServer, emitShard, emitVectors, emitWorkflows, emitWranglerCronTriggers, evaluateSchemaDrift, formatAdvisories, lintSchema, parseSchemaSnapshot, redact, refreshCodegenProject, runCodegen, schemaFromIr, secretKindOf, serializeSchemaSnapshot, validatorIrToJsonSchema };
+export { AGENTS_FILENAME, type AgentIR, type AuthApiCallIR, CONTAINERS_FILENAME, CodegenDiagnosticError, type CodegenOptions, type CodegenResult, type ContainerIR, type CronJobIR, type DriftChange, type EmitAppOptions, FLAGS_FILENAME, type FieldSnapshot, type FlagsIR, type FunctionIR, GENERATED_HEADER, type HttpRouteIR, type IndexIR, type IndexSnapshot, type InsertWriteIR, LUNORA_ERROR_CODES, type LintSchemaOptions, MUTATORS_FILENAME, type MaskProcedureIR, type MigrationIR, type MutatorIR, OPENRPC_VERSION, type OpenApiEmitInput, type OpenRpcEmitInput, type ProjectIR, QUEUES_FILENAME, type QueryReadIR, type QueueIR, type R2sqlCallIR, type RelationSnapshot, type RlsMetadataIR, type RlsPolicyIR, type RlsProcedureIR, type RlsRoleIR, SCHEMA_SNAPSHOT_FILENAME, SCHEMA_SNAPSHOT_VERSION, SHAPES_FILENAME, type SandboxUsage, type SchemaDrift, type SchemaDriftDecision, type SchemaIR, type SchemaSnapshot, SchemaSnapshotParseError, type ShapeIR, type StorageRuleIR, type StorageRulesMetadataIR, type TableIR, type TableSnapshot, VERSION, type ValidatorIR, type VectorIndexIR, WORKFLOWS_FILENAME, type WorkflowIR, type WranglerVariableIR, buildOpenApiDocument, buildOpenRpcDocument, buildSchemaSnapshot, createCodegenProject, diagnosticAt, diffSchemaSnapshots, discoverAgents, discoverAuthApiCalls, discoverContainers, discoverCrons, discoverFlags, discoverFunctions, discoverHttpRoutes, discoverInserts, discoverMaskProcedures, discoverMigrations, discoverMutators, discoverNondeterministicCalls, discoverQueries, discoverQueues, discoverR2sqlCalls, discoverRlsMetadata, discoverRlsProcedures, discoverSandboxUsage, discoverSchema, discoverShapes, discoverStorageRulesMetadata, discoverWorkflows, emitAgents, emitApi, emitApp, emitCollections, emitContainers, emitCrons, emitDataModel, emitDrizzleSchema, emitFunctions, emitOpenApi, emitOpenApiModule, emitOpenRpc, emitOpenRpcModule, emitServer, emitShard, emitVectors, emitWorkflows, emitWranglerCronTriggers, evaluateSchemaDrift, formatAdvisories, lintSchema, parseSchemaSnapshot, redact, refreshCodegenProject, runCodegen, schemaFromIr, secretKindOf, serializeSchemaSnapshot, validatorIrToJsonSchema };