@lunora/codegen 1.0.0-alpha.46 → 1.0.0-alpha.47

package/dist/index.d.ts

@@ -7,10 +7,10 @@ import { StudioFeaturesResult } from '@lunora/do';
 import { Schema } from '@lunora/server';
 import { JsonSchema } from '@lunora/values';
 /**
-* AST-observable subset of a column's modifier chain (`.unique()`, `.default()`,
-* …). Function-valued modifiers (`.$defaultFn`/`.$onUpdateFn`) can't be
-* serialized, so only their *presence* is recorded.
-*/
+ * AST-observable subset of a column's modifier chain (`.unique()`, `.default()`,
+ * …). Function-valued modifiers (`.$defaultFn`/`.$onUpdateFn`) can't be
+ * serialized, so only their *presence* is recorded.
+ */
 interface ColumnMetaIR {
   /** `.default(...)` or `.$defaultFn(...)` present — field is optional on insert. */
   hasDefault?: boolean;
@@ -28,13 +28,13 @@ interface ValidatorIR {
   /** Column modifiers (`.unique()`, `.default()`, `.nullable()`, …) when present. */
   column?: ColumnMetaIR;
   /**
-  * `true` when this validator carries a `.check(...)` refinement. The predicate
-  * is a runtime closure the AST→IR step can't represent, so the node keeps its
-  * base `kind` but records the refinement's presence here. The AOT args-validator
-  * compiler declines any node with this flag (compiling it would silently skip
-  * the predicate). `.meta(...)` is pure metadata with no parse effect and does
-  * NOT set this.
-  */
+   * `true` when this validator carries a `.check(...)` refinement. The predicate
+   * is a runtime closure the AST→IR step can't represent, so the node keeps its
+   * base `kind` but records the refinement's presence here. The AOT args-validator
+   * compiler declines any node with this flag (compiling it would silently skip
+   * the predicate). `.meta(...)` is pure metadata with no parse effect and does
+   * NOT set this.
+   */
   hasRefinement?: boolean;
   /** For `v.optional(inner)` / `v.array(inner)`. */
   inner?: ValidatorIR;
@@ -78,19 +78,19 @@ interface VectorIndexIR {
   table: string;
 }
 /**
-* One ordering key on a rank index's `sortBy`: the column and direction.
-* Mirrors the runtime `RankSortKey` (defaults `direction` to `"asc"`).
-*/
+ * One ordering key on a rank index's `sortBy`: the column and direction.
+ * Mirrors the runtime `RankSortKey` (defaults `direction` to `"asc"`).
+ */
 interface RankSortKeyIR {
   direction: "asc" | "desc";
   field: string;
 }
 /**
-* A `.rankIndex(name, { sortBy, partitionBy?, where? })` declaration. The owning
-* table is always the table the index is declared on, so — unlike a vector index
-* — there is no separate `on`/`table` reference to carry: it rides along on its
-* {@link TableIR}. Only the fields needed for type emission are captured.
-*/
+ * A `.rankIndex(name, { sortBy, partitionBy?, where? })` declaration. The owning
+ * table is always the table the index is declared on, so — unlike a vector index
+ * — there is no separate `on`/`table` reference to carry: it rides along on its
+ * {@link TableIR}. Only the fields needed for type emission are captured.
+ */
 interface RankIndexIR {
   name: string;
   /** Columns scoping each ranking; omitted ⇒ one global rank over the table. */
@@ -112,11 +112,11 @@ interface RelationIR {
   table: string;
 }
 /**
-* Statically-discovered `.source(...)` config (plan 077). Only the bits the
-* advisor lints + DO wiring need are captured; `map`/`tenantBy` are functions and
-* cannot be serialized, so their presence is recorded as `hasTenantBy` rather than
-* the function itself.
-*/
+ * Statically-discovered `.source(...)` config (plan 077). Only the bits the
+ * advisor lints + DO wiring need are captured; `map`/`tenantBy` are functions and
+ * cannot be serialized, so their presence is recorded as `hasTenantBy` rather than
+ * the function itself.
+ */
 interface ExternalSourceIR {
   /** The wrangler Hyperdrive binding name. */
   binding: string;
@@ -135,42 +135,42 @@ interface ExternalSourceIR {
   /** The membership query literal, when statically knowable. */
   query?: string;
   /**
-  * `true` when `.source(...)` was present but its argument was **not** a static
-  * object literal (e.g. `.source(buildConfig())`), so none of the fields above
-  * could be read. The source still exists — this flag lets `hasSourcedTables`
-  * (codegen) and the `external_source_*` lints treat it as a source that can't be
-  * verified, instead of mistaking it for no `.source()` at all.
-  */
+   * `true` when `.source(...)` was present but its argument was **not** a static
+   * object literal (e.g. `.source(buildConfig())`), so none of the fields above
+   * could be read. The source still exists — this flag lets `hasSourcedTables`
+   * (codegen) and the `external_source_*` lints treat it as a source that can't be
+   * verified, instead of mistaking it for no `.source()` at all.
+   */
   unanalyzable?: boolean;
 }
 interface TableIR {
   /**
-  * `true` when the table chain carried `.externallyManaged()` — its rows are
-  * written outside Lunora's discoverable insert path (adapter/migration/
-  * middleware), so advisor insert-path lints skip it. Optional: hand-built
-  * IR and the runtime `fromServerSchema` path default it to `false`.
-  */
+   * `true` when the table chain carried `.externallyManaged()` — its rows are
+   * written outside Lunora's discoverable insert path (adapter/migration/
+   * middleware), so advisor insert-path lints skip it. Optional: hand-built
+   * IR and the runtime `fromServerSchema` path default it to `false`.
+   */
   externallyManaged?: boolean;
   /**
-  * Set when the chain carried `.source(...)` — the table is materialized from an
-  * external Hyperdrive-backed database by a system poll loop (plan 077). Carries
-  * the statically-knowable bits the advisor lints read; the functions (`map`,
-  * `tenantBy`) are not serialized, only their presence (`hasTenantBy`).
-  */
+   * Set when the chain carried `.source(...)` — the table is materialized from an
+   * external Hyperdrive-backed database by a system poll loop (plan 077). Carries
+   * the statically-knowable bits the advisor lints read; the functions (`map`,
+   * `tenantBy`) are not serialized, only their presence (`hasTenantBy`).
+   */
   externalSource?: ExternalSourceIR;
   /**
-  * Storage backend for a `.global()` table: `"d1"` (default) or
-  * `"hyperdrive"` (a Postgres/MySQL database via Cloudflare Hyperdrive). Only
-  * meaningful when `shardMode === "global"`; absent for sharded/root tables.
-  */
+   * Storage backend for a `.global()` table: `"d1"` (default) or
+   * `"hyperdrive"` (a Postgres/MySQL database via Cloudflare Hyperdrive). Only
+   * meaningful when `shardMode === "global"`; absent for sharded/root tables.
+   */
   globalBackend?: "d1" | "hyperdrive";
   indexes: ReadonlyArray<IndexIR>;
   /**
-  * `true` when the table chain carried `.public()` — an explicit opt-OUT of
-  * the schema's `.rls("required")` enforcement for this one table. Optional:
-  * hand-built IR and tables that never called `.public()` default it to
-  * `false`.
-  */
+   * `true` when the table chain carried `.public()` — an explicit opt-OUT of
+   * the schema's `.rls("required")` enforcement for this one table. Optional:
+   * hand-built IR and tables that never called `.public()` default it to
+   * `false`.
+   */
   isPublic?: boolean;
   name: string;
   /** Rank indexes declared inline via `.rankIndex(name, …)`. */
@@ -194,18 +194,18 @@ interface TableIR {
 type JurisdictionIR = "eu" | "fedramp" | "us";
 interface SchemaIR {
   /**
-  * Cloudflare data-residency jurisdiction declared via
-  * `defineSchema(...).jurisdiction("…")`. Emitted into the generated worker's
-  * `createWorker({ jurisdiction })` (and `ctx.scheduler` / `ctx.containers`).
-  * Absent ⇒ un-pinned.
-  */
+   * Cloudflare data-residency jurisdiction declared via
+   * `defineSchema(...).jurisdiction("…")`. Emitted into the generated worker's
+   * `createWorker({ jurisdiction })` (and `ctx.scheduler` / `ctx.containers`).
+   * Absent ⇒ un-pinned.
+   */
   jurisdiction?: JurisdictionIR;
   /**
-  * Set when `defineSchema(...).rls("required")` was chained onto the schema —
-  * every table's `ctx.db` write path is denied without an RLS-covering
-  * procedure unless the table itself is `.public()` (see {@link TableIR.isPublic}).
-  * Absent when the schema never called `.rls("required")`.
-  */
+   * Set when `defineSchema(...).rls("required")` was chained onto the schema —
+   * every table's `ctx.db` write path is denied without an RLS-covering
+   * procedure unless the table itself is `.public()` (see {@link TableIR.isPublic}).
+   * Absent when the schema never called `.rls("required")`.
+   */
   rlsMode?: "required";
   tables: ReadonlyArray<TableIR>;
   /** All vector indexes (inline Shape A hoisted + standalone Shape B), flattened. */
@@ -218,33 +218,33 @@ interface FunctionIR {
   filePath: string;
   kind: "action" | "mutation" | "query" | "stream";
   /**
-  * Set on connection-lifecycle hooks (`onConnect`/`onDisconnect`): the socket
-  * side the hook fires on. Such a function is also an internal mutation (so it
-  * lands in `LUNORA_FUNCTIONS` for path dispatch); emit additionally collects
-  * it into the `LUNORA_LIFECYCLE_HOOKS` manifest keyed by this side. Absent on
-  * ordinary functions.
-  */
+   * Set on connection-lifecycle hooks (`onConnect`/`onDisconnect`): the socket
+   * side the hook fires on. Such a function is also an internal mutation (so it
+   * lands in `LUNORA_FUNCTIONS` for path dispatch); emit additionally collects
+   * it into the `LUNORA_LIFECYCLE_HOOKS` manifest keyed by this side. Absent on
+   * ordinary functions.
+   */
   lifecycle?: "connect" | "disconnect";
   /**
-  * Serialized TS source for the handler's return type, with `Promise&lt;T>`
-  * unwrapped so callers see `T` directly. Defaults to `"unknown"` when
-  * ts-morph cannot resolve the type (typically because the consuming
-  * project lacks a tsconfig that can reach `@lunora/server`).
-  */
+   * Serialized TS source for the handler's return type, with `Promise&lt;T>`
+   * unwrapped so callers see `T` directly. Defaults to `"unknown"` when
+   * ts-morph cannot resolve the type (typically because the consuming
+   * project lacks a tsconfig that can reach `@lunora/server`).
+   */
   returnType: string;
   /**
-  * Call surface the function is exposed on. Absent (or `"public"`) means it
-  * lands in the generated `api`; `"internal"` routes it to the separate
-  * `internal` object and is rejected by the DO's external RPC path.
-  */
+   * Call surface the function is exposed on. Absent (or `"public"`) means it
+   * lands in the generated `api`; `"internal"` routes it to the separate
+   * `internal` object and is rejected by the DO's external RPC path.
+   */
   visibility?: "internal" | "public";
 }
 /**
-* A `defineMigration({...})` declaration discovered in the user's lunora
-* sources. The emitted `LUNORA_MIGRATIONS` registry keys on {@link MigrationIR.id}; the
-* import wiring needs {@link MigrationIR.exportName}/{@link MigrationIR.filePath}. {@link MigrationIR.table} is
-* informational (the runtime object carries the authoritative value).
-*/
+ * A `defineMigration({...})` declaration discovered in the user's lunora
+ * sources. The emitted `LUNORA_MIGRATIONS` registry keys on {@link MigrationIR.id}; the
+ * import wiring needs {@link MigrationIR.exportName}/{@link MigrationIR.filePath}. {@link MigrationIR.table} is
+ * informational (the runtime object carries the authoritative value).
+ */
 interface MigrationIR {
   /** Export binding name, used to reference the module member in generated imports. */
   exportName: string;
@@ -256,59 +256,59 @@ interface MigrationIR {
   table: string;
 }
 /**
-* A `defineShape({...})` declaration discovered in `lunora/shapes.ts`
-* (local-first sync engine, Phase 7). The emitted `LUNORA_SHAPES` registry keys
-* on {@link ShapeIR.exportName}; the generated DO's `resolveShape` override
-* dispatches a `shape_subscribe` to the matching registered shape. Discovery is
-* marker-driven (the `__lunoraShape` brand) — no field metadata is lifted here
-* because the runtime object (`columns`/`compileWhere`) carries the authority.
-*/
+ * A `defineShape({...})` declaration discovered in `lunora/shapes.ts`
+ * (local-first sync engine, Phase 7). The emitted `LUNORA_SHAPES` registry keys
+ * on {@link ShapeIR.exportName}; the generated DO's `resolveShape` override
+ * dispatches a `shape_subscribe` to the matching registered shape. Discovery is
+ * marker-driven (the `__lunoraShape` brand) — no field metadata is lifted here
+ * because the runtime object (`columns`/`compileWhere`) carries the authority.
+ */
 interface ShapeIR {
   /** Export binding name — the shape's registry key and import member. */
   exportName: string;
   /** Path relative to `&lt;projectRoot>/lunora/` without extension — always `"shapes"`. */
   filePath: string;
   /**
-  * The `table` string literal from the `defineShape({ table })` call, lifted
-  * only for static advisor lints (the runtime object stays authoritative).
-  * `undefined` when `table` is not a plain string literal — lints skip those.
-  */
+   * The `table` string literal from the `defineShape({ table })` call, lifted
+   * only for static advisor lints (the runtime object stays authoritative).
+   * `undefined` when `table` is not a plain string literal — lints skip those.
+   */
   table?: string;
 }
 /**
-* The single `defineIdentity({...})` claim contract discovered in
-* `lunora/identity.ts`. Discovery is **marker-driven** (the `__lunoraIdentity`
-* brand, exactly like {@link ShapeIR}) — no claim metadata is lifted here
-* because the emitted `_generated/server.ts` recovers the claim *type* from the
-* declaration itself (`InferIdentity` over the contract's `typeof`), and the
-* runtime object (`validate`/`onInvalid`) carries the authority at the boundary.
-* Exactly one per app; absent ⇒ generated output is byte-identical to today.
-*/
+ * The single `defineIdentity({...})` claim contract discovered in
+ * `lunora/identity.ts`. Discovery is **marker-driven** (the `__lunoraIdentity`
+ * brand, exactly like {@link ShapeIR}) — no claim metadata is lifted here
+ * because the emitted `_generated/server.ts` recovers the claim *type* from the
+ * declaration itself (`InferIdentity` over the contract's `typeof`), and the
+ * runtime object (`validate`/`onInvalid`) carries the authority at the boundary.
+ * Exactly one per app; absent ⇒ generated output is byte-identical to today.
+ */
 interface IdentityIR {
   /** Export binding name — the namespace member `_generated/server.ts` reads via `typeof`. */
   exportName: string;
 }
 /**
-* The single `defineEnv({...})` contract discovered in `lunora/env.ts`. Like
-* {@link IdentityIR}, only the export binding is lifted — the emitted
-* `_generated/server.ts` recovers the validated shape from the declaration
-* itself (`ReturnType` over the accessor's `typeof`), and the generated ShardDO
-* applies the same accessor to the worker `env` at ctx-build time to populate
-* `ctx.env`. Exactly one per app; absent ⇒ generated output is byte-identical.
-*/
+ * The single `defineEnv({...})` contract discovered in `lunora/env.ts`. Like
+ * {@link IdentityIR}, only the export binding is lifted — the emitted
+ * `_generated/server.ts` recovers the validated shape from the declaration
+ * itself (`ReturnType` over the accessor's `typeof`), and the generated ShardDO
+ * applies the same accessor to the worker `env` at ctx-build time to populate
+ * `ctx.env`. Exactly one per app; absent ⇒ generated output is byte-identical.
+ */
 interface EnvIR {
   /** Export binding name — the namespace member `_generated/server.ts` reads via `typeof`. */
   exportName: string;
 }
 /**
-* A `defineMutator({...})` declaration discovered in `lunora/mutators.ts`
-* (local-first sync engine, Phase 7). The emitted registry registers the
-* authoritative `server` impl into the DO's `LUNORA_FUNCTIONS` table (so
-* `handleRpc` transaction-wraps it) and records its path in
-* `LUNORA_MUTATOR_PATHS` so the DO's `isCustomMutator` override routes the
-* client-watermark push protocol. The client `client` impl is split into the
-* browser bundle separately — only the path crosses to the server side.
-*/
+ * A `defineMutator({...})` declaration discovered in `lunora/mutators.ts`
+ * (local-first sync engine, Phase 7). The emitted registry registers the
+ * authoritative `server` impl into the DO's `LUNORA_FUNCTIONS` table (so
+ * `handleRpc` transaction-wraps it) and records its path in
+ * `LUNORA_MUTATOR_PATHS` so the DO's `isCustomMutator` override routes the
+ * client-watermark push protocol. The client `client` impl is split into the
+ * browser bundle separately — only the path crosses to the server side.
+ */
 interface MutatorIR {
   /** Export binding name — the mutator's registry key and import member. */
   exportName: string;
@@ -316,15 +316,15 @@ interface MutatorIR {
   filePath: string;
 }
 /**
-* A whole-row `ctx.db.replace(id, document)` write discovered inside a custom
-* mutator's inline `server` impl (`lunora/mutators.ts`) — the input the
-* `mutator_full_row_replace` advisor lint consumes. A `replace` overwrites the
-* entire row, so a concurrent edit to a different column on a synced table is
-* clobbered; `ctx.db.patch(id, { field })` merges at the column level instead.
-* Structurally identical to `AdvisorMutatorWrite` so it passes straight through
-* to the advisor without conversion, exactly as `InsertWriteIR` does for
-* `AdvisorInsertWrite`.
-*/
+ * A whole-row `ctx.db.replace(id, document)` write discovered inside a custom
+ * mutator's inline `server` impl (`lunora/mutators.ts`) — the input the
+ * `mutator_full_row_replace` advisor lint consumes. A `replace` overwrites the
+ * entire row, so a concurrent edit to a different column on a synced table is
+ * clobbered; `ctx.db.patch(id, { field })` merges at the column level instead.
+ * Structurally identical to `AdvisorMutatorWrite` so it passes straight through
+ * to the advisor without conversion, exactly as `InsertWriteIR` does for
+ * `AdvisorInsertWrite`.
+ */
 interface MutatorWriteIR {
   /** The mutator export whose `server` impl performs the replace, e.g. `renameChannel`. */
   exportName: string;
@@ -334,12 +334,12 @@ interface MutatorWriteIR {
   line: number;
 }
 /**
-* A single cron job lifted from a `cronJobs()` builder in `lunora/crons.ts`.
-* Mirrors `@lunora/scheduler`'s `CronJob`: {@link CronJobIR.cron} is the compiled
-* standard cron expression, {@link CronJobIR.functionPath} is the target
-* `__lunoraRef` (`namespace:fn`), and {@link CronJobIR.args} is the static
-* argument object passed at registration.
-*/
+ * A single cron job lifted from a `cronJobs()` builder in `lunora/crons.ts`.
+ * Mirrors `@lunora/scheduler`'s `CronJob`: {@link CronJobIR.cron} is the compiled
+ * standard cron expression, {@link CronJobIR.functionPath} is the target
+ * `__lunoraRef` (`namespace:fn`), and {@link CronJobIR.args} is the static
+ * argument object passed at registration.
+ */
 interface CronJobIR {
   /** Static args object (source-text JSON), defaults to `{}`. */
   args: Record<string, unknown>;
@@ -350,25 +350,25 @@ interface CronJobIR {
   /** Unique, human-readable job name. */
   name: string;
   /**
-  * Set when the job targets a durable workflow (a `lunora/workflows.ts`
-  * export) instead of a function: the workflow's `WORKFLOW_*` binding name
-  * plus its export name. On each fire the worker starts a new workflow
-  * INSTANCE (the {@link CronJobIR.args} become its `params`) rather than
-  * dispatching a one-shot function.
-  */
+   * Set when the job targets a durable workflow (a `lunora/workflows.ts`
+   * export) instead of a function: the workflow's `WORKFLOW_*` binding name
+   * plus its export name. On each fire the worker starts a new workflow
+   * INSTANCE (the {@link CronJobIR.args} become its `params`) rather than
+   * dispatching a one-shot function.
+   */
   workflow?: {
     binding: string;
     exportName: string;
   };
 }
 /**
-* A container lifted from a `defineContainer()` export in
-* `lunora/containers.ts`. Carries everything the emitters and the config layer
-* need to wire wrangler (`containers[]` + the Durable Object binding +
-* migration class) and the generated `_generated/containers.ts` DO class.
-* Names are derived via `@lunora/container`'s shared helpers so codegen and
-* the config layer can never disagree.
-*/
+ * A container lifted from a `defineContainer()` export in
+ * `lunora/containers.ts`. Carries everything the emitters and the config layer
+ * need to wire wrangler (`containers[]` + the Durable Object binding +
+ * migration class) and the generated `_generated/containers.ts` DO class.
+ * Names are derived via `@lunora/container`'s shared helpers so codegen and
+ * the config layer can never disagree.
+ */
 interface ContainerIR {
   /** Durable Object binding name, e.g. `CONTAINER_TRANSCODER`. */
   bindingName: string;
@@ -377,18 +377,18 @@ interface ContainerIR {
   /** Generated DO class name, e.g. `TranscoderContainer`. */
   className: string;
   /**
-  * Whether the container may open outbound internet connections, when the
-  * value was a static literal. `undefined` means the field was omitted (the
-  * platform default is `true`) or wasn't a literal. Lifted for the advisor.
-  */
+   * Whether the container may open outbound internet connections, when the
+   * value was a static literal. `undefined` means the field was omitted (the
+   * platform default is `true`) or wasn't a literal. Lifted for the advisor.
+   */
   enableInternet?: boolean;
   /** The `lunora/containers.ts` export name, e.g. `transcoder`. */
   exportName: string;
   /**
-  * Normalized image source: a local Dockerfile (`dockerfile`), a pre-built
-  * registry reference (`registry`), or a Railpack source directory (`build`)
-  * that the deploy step builds and pushes before wrangler runs.
-  */
+   * Normalized image source: a local Dockerfile (`dockerfile`), a pre-built
+   * registry reference (`registry`), or a Railpack source directory (`build`)
+   * that the deploy step builds and pushes before wrangler runs.
+   */
   image: {
     buildContext: string;
     dockerfilePath: string;
@@ -416,20 +416,20 @@ interface ContainerIR {
     stepPercentage?: number;
   };
   /**
-  * The static `sleepAfter` value, when it was a literal. `undefined` means
-  * omitted (platform default `"10m"`) or non-literal. Lifted for the advisor.
-  */
+   * The static `sleepAfter` value, when it was a literal. `undefined` means
+   * omitted (platform default `"10m"`) or non-literal. Lifted for the advisor.
+   */
   sleepAfter?: number | string;
 }
 /**
-* A workflow lifted from a `defineWorkflow()` export in `lunora/workflows.ts`.
-* Carries what the emitters and the config layer need to wire the wrangler
-* `workflows[]` entry and the generated `_generated/workflows.ts`
-* `WorkflowEntrypoint` class. Unlike containers, workflows are NOT Durable
-* Objects — wrangler gets only a `workflows[]` entry, never a `durable_objects`
-* binding or a migration class. Names are derived via `@lunora/workflow`'s
-* shared helpers so codegen and the config layer can never disagree.
-*/
+ * A workflow lifted from a `defineWorkflow()` export in `lunora/workflows.ts`.
+ * Carries what the emitters and the config layer need to wire the wrangler
+ * `workflows[]` entry and the generated `_generated/workflows.ts`
+ * `WorkflowEntrypoint` class. Unlike containers, workflows are NOT Durable
+ * Objects — wrangler gets only a `workflows[]` entry, never a `durable_objects`
+ * binding or a migration class. Names are derived via `@lunora/workflow`'s
+ * shared helpers so codegen and the config layer can never disagree.
+ */
 interface WorkflowIR {
   /** The Cloudflare `Workflow` binding name, e.g. `WORKFLOW_ORDER_PIPELINE`. */
   bindingName: string;
@@ -438,32 +438,32 @@ interface WorkflowIR {
   /** The `lunora/workflows.ts` export name, e.g. `orderPipeline`. */
   exportName: string;
   /**
-  * The stable wrangler `workflows[].name`. Defaults to the kebab-cased export
-  * name (`orderPipeline` → `order-pipeline`); a static `name:` literal in the
-  * definition overrides it.
-  */
+   * The stable wrangler `workflows[].name`. Defaults to the kebab-cased export
+   * name (`orderPipeline` → `order-pipeline`); a static `name:` literal in the
+   * definition overrides it.
+   */
   name: string;
   /**
-  * Durable step labels lifted from the handler body — the first string-literal
-  * argument of every `ctx.step.do` / `.sleep` / `.sleepUntil` / `.waitForEvent`
-  * call. Feeds the duplicate-step-name lint, which flags a name used twice
-  * (Cloudflare memoizes by name, so the second call silently returns the
-  * first's cached result). Calls with a non-literal name are omitted (not
-  * statically comparable).
-  */
+   * Durable step labels lifted from the handler body — the first string-literal
+   * argument of every `ctx.step.do` / `.sleep` / `.sleepUntil` / `.waitForEvent`
+   * call. Feeds the duplicate-step-name lint, which flags a name used twice
+   * (Cloudflare memoizes by name, so the second call silently returns the
+   * first's cached result). Calls with a non-literal name are omitted (not
+   * statically comparable).
+   */
   steps: ReadonlyArray<WorkflowStepIR>;
 }
 /**
-* An agent lifted from a `defineAgent()` export in `lunora/agents.ts`. A
-* `defineAgent` compiles its durable tool-loop onto a Cloudflare Workflow, so —
-* like {@link WorkflowIR} — an agent is NOT a Durable Object: wrangler gets only
-* a `workflows[]` entry, never a `durable_objects` binding or a migration class.
-* Carries what the emitters and the config layer need to wire the generated
-* agent `WorkflowEntrypoint` class (e.g. `SupportAgentWorkflow`), the typed
-* per-agent `ctx.agents` producer, and the reconciled wrangler `workflows[]`
-* entry. Names are derived via `@lunora/agent`'s shared helpers so codegen and
-* the config layer can never disagree.
-*/
+ * An agent lifted from a `defineAgent()` export in `lunora/agents.ts`. A
+ * `defineAgent` compiles its durable tool-loop onto a Cloudflare Workflow, so —
+ * like {@link WorkflowIR} — an agent is NOT a Durable Object: wrangler gets only
+ * a `workflows[]` entry, never a `durable_objects` binding or a migration class.
+ * Carries what the emitters and the config layer need to wire the generated
+ * agent `WorkflowEntrypoint` class (e.g. `SupportAgentWorkflow`), the typed
+ * per-agent `ctx.agents` producer, and the reconciled wrangler `workflows[]`
+ * entry. Names are derived via `@lunora/agent`'s shared helpers so codegen and
+ * the config layer can never disagree.
+ */
 interface AgentIR {
   /** The Cloudflare `Workflow` binding name, e.g. `AGENT_SUPPORT`. */
   bindingName: string;
@@ -472,39 +472,39 @@ interface AgentIR {
   /** The `lunora/agents.ts` export name, e.g. `support`. */
   exportName: string;
   /**
-  * The stable wrangler `workflows[].name`. Defaults to the kebab-cased export
-  * name (`support` → `agent-support`); a static `name:` literal in the
-  * definition overrides it.
-  */
+   * The stable wrangler `workflows[].name`. Defaults to the kebab-cased export
+   * name (`support` → `agent-support`); a static `name:` literal in the
+   * definition overrides it.
+   */
   name: string;
   /**
-  * Whether the definition declares an `onEmail` mapper on
-  * `defineAgent({ onEmail: … })`. When `true` the emitter wires this agent
-  * onto the worker's top-level `email()` handler (via `@lunora/agent/inbound`)
-  * so inbound mail starts a durable run. Detected by AST PRESENCE — the
-  * closure is never evaluated — and written to IR only when present, so
-  * email-free agents (and agent-free projects) stay byte-identical.
-  */
+   * Whether the definition declares an `onEmail` mapper on
+   * `defineAgent({ onEmail: … })`. When `true` the emitter wires this agent
+   * onto the worker's top-level `email()` handler (via `@lunora/agent/inbound`)
+   * so inbound mail starts a durable run. Detected by AST PRESENCE — the
+   * closure is never evaluated — and written to IR only when present, so
+   * email-free agents (and agent-free projects) stay byte-identical.
+   */
   onEmail?: boolean;
   /**
-  * Whether the definition opted into public run-starts via
-  * `defineAgent({ publicRun: true })` — emitted into the `ctx.agents` wiring
-  * spec so the public `agents:agentRun` mutation can gate on it fail-closed.
-  * Absent (falsy) means server-side starts only; the field is written to IR
-  * only when the literal is `true`, so agent-free and non-opted-in output is
-  * byte-identical.
-  */
+   * Whether the definition opted into public run-starts via
+   * `defineAgent({ publicRun: true })` — emitted into the `ctx.agents` wiring
+   * spec so the public `agents:agentRun` mutation can gate on it fail-closed.
+   * Absent (falsy) means server-side starts only; the field is written to IR
+   * only when the literal is `true`, so agent-free and non-opted-in output is
+   * byte-identical.
+   */
   publicRun?: boolean;
   /**
-  * Whether the definition opted into a real-time voice session via a `voice`
-  * block on `defineAgent({ voice: … })`. Unlike the durable loop (a Workflow),
-  * the voice path IS a Durable Object — so when this is `true` the emitter
-  * generates the `voiceClassName` `VoiceSessionDO` subclass and the
-  * `api.agents.{name}Voice` client reference, and the config layer reconciles
-  * a `durable_objects` binding (`voiceBindingName`) + `new_sqlite_classes`
-  * migration. Written to IR only when the literal is present, so voice-free
-  * agents (and agent-free projects) stay byte-identical.
-  */
+   * Whether the definition opted into a real-time voice session via a `voice`
+   * block on `defineAgent({ voice: … })`. Unlike the durable loop (a Workflow),
+   * the voice path IS a Durable Object — so when this is `true` the emitter
+   * generates the `voiceClassName` `VoiceSessionDO` subclass and the
+   * `api.agents.{name}Voice` client reference, and the config layer reconciles
+   * a `durable_objects` binding (`voiceBindingName`) + `new_sqlite_classes`
+   * migration. Written to IR only when the literal is present, so voice-free
+   * agents (and agent-free projects) stay byte-identical.
+   */
   voice?: boolean;
   /** The voice DO's Cloudflare `DurableObjectNamespace` binding name, e.g. `VOICE_SUPPORT`. Present only when `voice`. */
   voiceBindingName?: string;
@@ -521,14 +521,14 @@ interface WorkflowStepIR {
   name: string;
 }
 /**
-* A queue lifted from a `defineQueue()` export in `lunora/queues.ts`. Carries
-* what the emitters and the config layer need to wire the typed `ctx.queues`
-* producer, the generated worker `queue()` dispatch, and the wrangler
-* `queues.producers[]` / `queues.consumers[]` entries. Like workflows, a queue
-* is NOT a Durable Object — wrangler gets only `queues.*` entries. Names are
-* derived via `@lunora/queue`'s shared helpers so codegen and the config layer
-* can never disagree.
-*/
+ * A queue lifted from a `defineQueue()` export in `lunora/queues.ts`. Carries
+ * what the emitters and the config layer need to wire the typed `ctx.queues`
+ * producer, the generated worker `queue()` dispatch, and the wrangler
+ * `queues.producers[]` / `queues.consumers[]` entries. Like workflows, a queue
+ * is NOT a Durable Object — wrangler gets only `queues.*` entries. Names are
+ * derived via `@lunora/queue`'s shared helpers so codegen and the config layer
+ * can never disagree.
+ */
 interface QueueIR {
   /** The Cloudflare `Queue` producer binding name, e.g. `QUEUE_EMAIL`. */
   bindingName: string;
@@ -537,10 +537,10 @@ interface QueueIR {
   /** How the queue is consumed: `"push"` (a worker `queue()` handler) or `"pull"` (external HTTP). */
   mode: "pull" | "push";
   /**
-  * The stable wrangler queue name (`queues.producers[].queue`). Defaults to
-  * the kebab-cased export name (`emailQueue` → `email-queue`); a static
-  * `name:` literal in the definition overrides it.
-  */
+   * The stable wrangler queue name (`queues.producers[].queue`). Defaults to
+   * the kebab-cased export name (`emailQueue` → `email-queue`); a static
+   * `name:` literal in the definition overrides it.
+   */
   name: string;
   /** Push-consumer batch/retry tuning, mirrored onto the wrangler `queues.consumers[]` entry. */
   tuning: {
@@ -552,38 +552,38 @@ interface QueueIR {
   };
 }
 /**
-* The feature-flag provider declared by the default export of `lunora/flags.ts`
-* (`defineFlags({ provider, … })`). Discovery is **metadata-only** — codegen
-* imports the real module at runtime for the provider value; this IR exists so
-* the config layer can reconcile/validate the wrangler `flagship` binding when
-* the app uses Flagship in binding mode. A `custom` provider (any other
-* OpenFeature factory) carries no binding to reconcile.
-*/
+ * The feature-flag provider declared by the default export of `lunora/flags.ts`
+ * (`defineFlags({ provider, … })`). Discovery is **metadata-only** — codegen
+ * imports the real module at runtime for the provider value; this IR exists so
+ * the config layer can reconcile/validate the wrangler `flagship` binding when
+ * the app uses Flagship in binding mode. A `custom` provider (any other
+ * OpenFeature factory) carries no binding to reconcile.
+ */
 interface FlagsIR {
   /**
-  * The wrangler `flagship[].binding` name — set **only** for a flagship
-  * `provider` in binding mode (`flagshipProvider({ binding: "FLAGS" })`). The
-  * config layer hints/validates a matching `flagship` binding from this.
-  */
+   * The wrangler `flagship[].binding` name — set **only** for a flagship
+   * `provider` in binding mode (`flagshipProvider({ binding: "FLAGS" })`). The
+   * config layer hints/validates a matching `flagship` binding from this.
+   */
   bindingName?: string;
   /**
-  * Flagship operating mode — `"binding"` (wrangler binding, needs a
-  * `flagship` entry) or `"http"` (no binding); `undefined` for a `custom`
-  * provider or when the mode can't be read statically.
-  */
+   * Flagship operating mode — `"binding"` (wrangler binding, needs a
+   * `flagship` entry) or `"http"` (no binding); `undefined` for a `custom`
+   * provider or when the mode can't be read statically.
+   */
   mode?: "binding" | "http";
   /** `"flagship"` when the provider is `flagshipProvider(...)`, else `"custom"` (any other OpenFeature provider factory). */
   provider: "custom" | "flagship";
 }
 /**
-* A `ctx.workflows.get("name")…` call discovered in a function body — the
-* use-site analog of {@link WorkflowIR} (which is the declaration side). Feeds
-* the `workflow_unused` lint (a declared workflow with zero call sites) and the
-* `workflow_unknown_target` lint (a `.get("x")` whose `x` isn't declared — a
-* typo catcher). {@link WorkflowCallIR.workflow} is `""` when the `get(...)`
-* argument is not a string literal (a dynamic name — which suppresses the
-* unused-workflow heuristic rather than producing a false positive).
-*/
+ * A `ctx.workflows.get("name")…` call discovered in a function body — the
+ * use-site analog of {@link WorkflowIR} (which is the declaration side). Feeds
+ * the `workflow_unused` lint (a declared workflow with zero call sites) and the
+ * `workflow_unknown_target` lint (a `.get("x")` whose `x` isn't declared — a
+ * typo catcher). {@link WorkflowCallIR.workflow} is `""` when the `get(...)`
+ * argument is not a string literal (a dynamic name — which suppresses the
+ * unused-workflow heuristic rather than producing a false positive).
+ */
 interface WorkflowCallIR {
   /** Export binding name of the function performing the call, e.g. `create`. */
   exportName: string;
@@ -595,11 +595,11 @@ interface WorkflowCallIR {
   workflow: string;
 }
 /**
-* A `ctx.db.query("table")…` read discovered in a function body, reduced to what
-* the `filter_without_index` advisor lint needs: which table, whether the chain
-* narrows with an index, and whether it filters. `table` is `""` when the
-* `query(...)` argument is not a string literal (a dynamic table — not lintable).
-*/
+ * A `ctx.db.query("table")…` read discovered in a function body, reduced to what
+ * the `filter_without_index` advisor lint needs: which table, whether the chain
+ * narrows with an index, and whether it filters. `table` is `""` when the
+ * `query(...)` argument is not a string literal (a dynamic table — not lintable).
+ */
 interface QueryReadIR {
   /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
   file: string;
@@ -613,12 +613,12 @@ interface QueryReadIR {
   table: string;
 }
 /**
-* A `ctx.authApi.&lt;method>(...)` call discovered in a function body, attributed
-* to the exported function (and its file = api namespace) that performs it.
-* Structurally identical to `AdvisorAuthApiCall` so it passes straight through
-* to the advisor lint without conversion, exactly as `InsertWriteIR` does for
-* `AdvisorInsertWrite`.
-*/
+ * A `ctx.authApi.&lt;method>(...)` call discovered in a function body, attributed
+ * to the exported function (and its file = api namespace) that performs it.
+ * Structurally identical to `AdvisorAuthApiCall` so it passes straight through
+ * to the advisor lint without conversion, exactly as `InsertWriteIR` does for
+ * `AdvisorInsertWrite`.
+ */
 interface AuthApiCallIR {
   /** Export binding name of the function performing the call, e.g. "createOrg". */
   exportName: string;
@@ -632,12 +632,12 @@ interface AuthApiCallIR {
   method: string;
 }
 /**
-* A `ctx.db.insert("table", …)` write discovered in a function body, attributed
-* to the exported function (and its file = api namespace) that performs it — the
-* write-side analog of {@link QueryReadIR}. Lets tooling wire a table's write
-* action by behavior (which function inserts into it) rather than by naming.
-* {@link InsertWriteIR.table} is `""` when the argument is not a string literal.
-*/
+ * A `ctx.db.insert("table", …)` write discovered in a function body, attributed
+ * to the exported function (and its file = api namespace) that performs it — the
+ * write-side analog of {@link QueryReadIR}. Lets tooling wire a table's write
+ * action by behavior (which function inserts into it) rather than by naming.
+ * {@link InsertWriteIR.table} is `""` when the argument is not a string literal.
+ */
 interface InsertWriteIR {
   /** Export binding name of the function performing the insert, e.g. "send". */
   exportName: string;
@@ -649,14 +649,14 @@ interface InsertWriteIR {
   table: string;
 }
 /**
-* A non-deterministic API call (`Date.now`, `Math.random`, `crypto.randomUUID`,
-* `crypto.getRandomValues`, `fetch`) discovered lexically inside a `query(...)`
-* or `mutation(...)` handler body — the `nondeterministic_query_mutation` lint
-* input. Structurally identical to `AdvisorNondeterministicCall` so values pass
-* straight through to the advisor without conversion, exactly as `AuthApiCallIR`
-* does for `AdvisorAuthApiCall`. `action(...)` handlers are never recorded —
-* actions are the determinism escape hatch.
-*/
+ * A non-deterministic API call (`Date.now`, `Math.random`, `crypto.randomUUID`,
+ * `crypto.getRandomValues`, `fetch`) discovered lexically inside a `query(...)`
+ * or `mutation(...)` handler body — the `nondeterministic_query_mutation` lint
+ * input. Structurally identical to `AdvisorNondeterministicCall` so values pass
+ * straight through to the advisor without conversion, exactly as `AuthApiCallIR`
+ * does for `AdvisorAuthApiCall`. `action(...)` handlers are never recorded —
+ * actions are the determinism escape hatch.
+ */
 interface NondeterministicCallIR {
   /** The non-deterministic API invoked, e.g. `Date.now` / `Math.random` / `crypto.randomUUID` / `fetch`. */
   callee: string;
@@ -670,13 +670,13 @@ interface NondeterministicCallIR {
   line: number;
 }
 /**
-* One `ctx.r2sql` access lexically inside a `query`/`mutation` handler — the
-* `r2sql_outside_action` advisor lint input. Structurally identical to the
-* advisor's `AdvisorR2sqlCall` (same field set) so values pass straight through
-* `lintSchema` without conversion, exactly as `NondeterministicCallIR` does.
-* Only `query`/`mutation` handlers are recorded; `action(...)` is the intended
-* home for `ctx.r2sql` and is skipped.
-*/
+ * One `ctx.r2sql` access lexically inside a `query`/`mutation` handler — the
+ * `r2sql_outside_action` advisor lint input. Structurally identical to the
+ * advisor's `AdvisorR2sqlCall` (same field set) so values pass straight through
+ * `lintSchema` without conversion, exactly as `NondeterministicCallIR` does.
+ * Only `query`/`mutation` handlers are recorded; `action(...)` is the intended
+ * home for `ctx.r2sql` and is skipped.
+ */
 interface R2sqlCallIR {
   /** The accessed `ctx.r2sql` surface, e.g. `ctx.r2sql.query` / `ctx.r2sql.from`. */
   callee: string;
@@ -690,21 +690,21 @@ interface R2sqlCallIR {
   line: number;
 }
 /**
-* Per-procedure RLS usage snapshot, produced by `discoverRlsProcedures` for the
-* `rls_uncovered_table` advisor lint. Structurally identical to
-* `AdvisorRlsProcedure` (they share the same field set) so values pass straight
-* through to the advisor without conversion, exactly as `AuthApiCallIR` does for
-* `AdvisorAuthApiCall`.
-*/
+ * Per-procedure RLS usage snapshot, produced by `discoverRlsProcedures` for the
+ * `rls_uncovered_table` advisor lint. Structurally identical to
+ * `AdvisorRlsProcedure` (they share the same field set) so values pass straight
+ * through to the advisor without conversion, exactly as `AuthApiCallIR` does for
+ * `AdvisorAuthApiCall`.
+ */
 interface RlsProcedureIR {
   /** Export binding name of the procedure (e.g. `listDocuments`). */
   exportName: string;
   /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
   file: string;
   /**
-  * Table names extracted from the `rls(policies)` array literal. Empty when the
-  * policies argument is not a statically-readable array literal.
-  */
+   * Table names extracted from the `rls(policies)` array literal. Empty when the
+   * policies argument is not a statically-readable array literal.
+   */
   rlsTables: string[];
   /** Tables read by the procedure via `ctx.db.query/findMany/findFirst/…`. */
   tablesRead: string[];
@@ -716,22 +716,22 @@ interface RlsProcedureIR {
   visibility: "internal" | "public";
 }
 /**
-* One procedure reduced to the facts the `mask_uncovered_pii_column` lint needs:
-* whether its builder chain includes `.use(mask(...))`, which `(table, column)`
-* pairs that mask declares, and which tables the procedure reads/writes. The
-* column-level analogue of {@link RlsProcedureIR}. Structurally identical to
-* `AdvisorMaskProcedure` so values pass straight through without conversion.
-*/
+ * One procedure reduced to the facts the `mask_uncovered_pii_column` lint needs:
+ * whether its builder chain includes `.use(mask(...))`, which `(table, column)`
+ * pairs that mask declares, and which tables the procedure reads/writes. The
+ * column-level analogue of {@link RlsProcedureIR}. Structurally identical to
+ * `AdvisorMaskProcedure` so values pass straight through without conversion.
+ */
 interface MaskProcedureIR {
   /** Export binding name of the procedure (e.g. `listUsers`). */
   exportName: string;
   /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
   file: string;
   /**
-  * `(table, column)` pairs this procedure's `mask(policies)` object literal
-  * declares. Empty when the policies argument is not a statically-readable
-  * object literal (conservative: `usesMask` is still `true`).
-  */
+   * `(table, column)` pairs this procedure's `mask(policies)` object literal
+   * declares. Empty when the policies argument is not a statically-readable
+   * object literal (conservative: `usesMask` is still `true`).
+   */
   maskColumns: {
     column: string;
     table: string;
@@ -746,14 +746,14 @@ interface MaskProcedureIR {
   visibility: "internal" | "public";
 }
 /**
-* One masked column surfaced to the studio's data-browser mask preview: a
-* `(table, column)` pair plus the declared {@link MaskProcedureIR} strategy so
-* the preview can pick redact-vs-hash-vs-custom rendering. Aggregated across the
-* project's `.use(mask(...))` chains by `discoverMaskMetadata`; the descriptive
-* twin of {@link RlsPolicyIR}. `"custom"` covers any non-string strategy (a
-* `(value, ctx) => …` function) — its logic is an opaque closure, never read by
-* the UI; the preview renders a fixed sentinel for it.
-*/
+ * One masked column surfaced to the studio's data-browser mask preview: a
+ * `(table, column)` pair plus the declared {@link MaskProcedureIR} strategy so
+ * the preview can pick redact-vs-hash-vs-custom rendering. Aggregated across the
+ * project's `.use(mask(...))` chains by `discoverMaskMetadata`; the descriptive
+ * twin of {@link RlsPolicyIR}. `"custom"` covers any non-string strategy (a
+ * `(value, ctx) => …` function) — its logic is an opaque closure, never read by
+ * the UI; the preview renders a fixed sentinel for it.
+ */
 interface MaskColumnMetadataIR {
   /** Column the mask policy redacts. */
   column: string;
@@ -763,26 +763,26 @@ interface MaskColumnMetadataIR {
   table: string;
 }
 /**
-* Schema-wide masking metadata the codegen emits into the generated ShardDO so
-* the studio's data-browser mask toggle can preview what a non-privileged caller
-* would see. Aggregated across every `.use(mask(...))` chain in the project —
-* purely descriptive (table + column + strategy), never the masking closure. The
-* column-level analogue of {@link RlsMetadataIR}.
-*/
+ * Schema-wide masking metadata the codegen emits into the generated ShardDO so
+ * the studio's data-browser mask toggle can preview what a non-privileged caller
+ * would see. Aggregated across every `.use(mask(...))` chain in the project —
+ * purely descriptive (table + column + strategy), never the masking closure. The
+ * column-level analogue of {@link RlsMetadataIR}.
+ */
 interface MaskMetadataIR {
   /** Every statically-discovered masked column, deduped by `(table, column)` (first declaration wins). */
   columns: MaskColumnMetadataIR[];
 }
 /**
-* One masked column whose `mask(policies)` strategy is a statically-known
-* literal (`"hash"` or `"redact"`) — the `mask_weak_hash_strategy_on_pii` lint
-* input. Unlike {@link MaskColumnMetadataIR} (app-wide, deduped by `(table,
-* column)`, studio-preview evidence), this is per declaration site (file + line
-* + enclosing export), undeduped, so the lint can point at the exact
-* `mask(...)` call that applies a weak strategy. A `MaskFn` (custom, non-literal)
-* strategy carries no lint-relevant signal and is never recorded here.
-* Structurally identical to `AdvisorMaskStrategy`.
-*/
+ * One masked column whose `mask(policies)` strategy is a statically-known
+ * literal (`"hash"` or `"redact"`) — the `mask_weak_hash_strategy_on_pii` lint
+ * input. Unlike {@link MaskColumnMetadataIR} (app-wide, deduped by `(table,
+ * column)`, studio-preview evidence), this is per declaration site (file + line
+ * + enclosing export), undeduped, so the lint can point at the exact
+ * `mask(...)` call that applies a weak strategy. A `MaskFn` (custom, non-literal)
+ * strategy carries no lint-relevant signal and is never recorded here.
+ * Structurally identical to `AdvisorMaskStrategy`.
+ */
 interface MaskStrategyIR {
   /** Masked column name. */
   column: string;
@@ -798,13 +798,13 @@ interface MaskStrategyIR {
   table: string;
 }
 /**
-* One statically-readable policy entry from an `rls([...])` array literal,
-* surfaced to the studio's read-only RLS inspector via the generated
-* `rlsPolicies()` hook. Captures the policy's `table` + `on` operation and the
-* procedure it guards — never the `when` predicate, which is an opaque JS
-* closure (its logic stays in code, not the UI). Produced by
-* `discoverRlsProcedures` alongside the lint IR.
-*/
+ * One statically-readable policy entry from an `rls([...])` array literal,
+ * surfaced to the studio's read-only RLS inspector via the generated
+ * `rlsPolicies()` hook. Captures the policy's `table` + `on` operation and the
+ * procedure it guards — never the `when` predicate, which is an opaque JS
+ * closure (its logic stays in code, not the UI). Produced by
+ * `discoverRlsProcedures` alongside the lint IR.
+ */
 interface RlsPolicyIR {
   /** Source file (relative to `lunora/`, without extension) the policy is declared in. */
   file: string;
@@ -816,12 +816,12 @@ interface RlsPolicyIR {
   table: string;
 }
 /**
-* One statically-readable role entry from an `rls(policies, { roles: [...] })`
-* call, surfaced to the studio's RLS inspector. Captures the role's `name`,
-* optional `description`, and the names of the permissions it grants (string
-* literals or `definePermission("name")` calls). Produced by
-* `discoverRlsProcedures`.
-*/
+ * One statically-readable role entry from an `rls(policies, { roles: [...] })`
+ * call, surfaced to the studio's RLS inspector. Captures the role's `name`,
+ * optional `description`, and the names of the permissions it grants (string
+ * literals or `definePermission("name")` calls). Produced by
+ * `discoverRlsProcedures`.
+ */
 interface RlsRoleIR {
   /** Optional human-readable description from `defineRole(name, { description })`. */
   description?: string;
@@ -831,11 +831,11 @@ interface RlsRoleIR {
   permissions: string[];
 }
 /**
-* Schema-wide RLS metadata the codegen emits into the generated ShardDO so the
-* studio's read-only inspector can list, per table, which policies guard it and
-* what roles are defined. Aggregated across every `.use(rls(...))` chain in the
-* project — purely descriptive, never the predicate logic.
-*/
+ * Schema-wide RLS metadata the codegen emits into the generated ShardDO so the
+ * studio's read-only inspector can list, per table, which policies guard it and
+ * what roles are defined. Aggregated across every `.use(rls(...))` chain in the
+ * project — purely descriptive, never the predicate logic.
+ */
 interface RlsMetadataIR {
   /** Every statically-discovered policy `(table, on, procedure)` entry. */
   policies: RlsPolicyIR[];
@@ -854,32 +854,32 @@ interface StorageRuleIR {
   procedure: string;
 }
 /**
-* Schema-wide storage-access-rule metadata emitted into the generated ShardDO so
-* the studio's read-only inspector can list, per bucket, which operations are
-* gated and under what key prefix. Aggregated across every
-* `.use(storageRules(...))` chain — descriptive only, never the predicate logic.
-*/
+ * Schema-wide storage-access-rule metadata emitted into the generated ShardDO so
+ * the studio's read-only inspector can list, per bucket, which operations are
+ * gated and under what key prefix. Aggregated across every
+ * `.use(storageRules(...))` chain — descriptive only, never the predicate logic.
+ */
 interface StorageRulesMetadataIR {
   rules: StorageRuleIR[];
 }
 /**
-* A typed REST route declared with the `httpRoute.&lt;verb>("/path")…` builder in
-* `@lunora/server` and mounted on `httpRouter()`. Captured statically from the
-* builder chain so the OpenAPI emitter can render a real `paths` entry: the verb
-* + path become the operation's method + URL, and the accumulated validator maps
-* become its query parameters, path parameters, and request body.
-*/
+ * A typed REST route declared with the `httpRoute.&lt;verb>("/path")…` builder in
+ * `@lunora/server` and mounted on `httpRouter()`. Captured statically from the
+ * builder chain so the OpenAPI emitter can render a real `paths` entry: the verb
+ * + path become the operation's method + URL, and the accumulated validator maps
+ * become its query parameters, path parameters, and request body.
+ */
 interface HttpRouteIR {
   /** `v.*` validators decoding the JSON request body (`.body({...})`), keyed by field. */
   body: Record<string, ValidatorIR>;
   /**
-  * Rendered TS type of one SSE chunk — the `R` the `.stream(handler)`
-  * handler yields — inferred from the handler via the type checker. Present
-  * only when {@link HttpRouteIR.stream} is `true`; `"unknown"` when the
-  * checker can't resolve enough context. Feeds the emitted
-  * `HttpStreamRef&lt;Chunk, …>` so the chunk type flows to the client.
-  * @experimental Part of the HTTP-SSE stream surface (the `httpStreams.*` emission).
-  */
+   * Rendered TS type of one SSE chunk — the `R` the `.stream(handler)`
+   * handler yields — inferred from the handler via the type checker. Present
+   * only when {@link HttpRouteIR.stream} is `true`; `"unknown"` when the
+   * checker can't resolve enough context. Feeds the emitted
+   * `HttpStreamRef&lt;Chunk, …>` so the chunk type flows to the client.
+   * @experimental Part of the HTTP-SSE stream surface (the `httpStreams.*` emission).
+   */
   chunkType?: string;
   /** Export binding name of the route handler (used only for diagnostics / dedupe). */
   exportName: string;
@@ -899,17 +899,17 @@ interface HttpRouteIR {
   stream: boolean;
 }
 /**
-* Per-procedure protective-middleware snapshot, produced by
-* `discoverProcedureMiddleware` for the security lints
-* (`public_mutation_without_ratelimit`, `user_creating_mutation_without_captcha`).
-* Records which `.use(...)` guards a procedure's builder chain carries plus the
-* behavioural facts that decide whether a guard is *expected* (does it write a
-* user/session table, does it send mail). `protectPublic({ rateLimit, captcha })`
-* is unwrapped: the bundle's object-literal keys set `usesRateLimit`/`usesCaptcha`
-* exactly as the individual `.use(rateLimit(...))` / `.use(verifyTurnstile(...))`
-* steps would. Structurally identical to `AdvisorProcedureProtection` so values
-* pass straight through to the advisor without conversion.
-*/
+ * Per-procedure protective-middleware snapshot, produced by
+ * `discoverProcedureMiddleware` for the security lints
+ * (`public_mutation_without_ratelimit`, `user_creating_mutation_without_captcha`).
+ * Records which `.use(...)` guards a procedure's builder chain carries plus the
+ * behavioural facts that decide whether a guard is *expected* (does it write a
+ * user/session table, does it send mail). `protectPublic({ rateLimit, captcha })`
+ * is unwrapped: the bundle's object-literal keys set `usesRateLimit`/`usesCaptcha`
+ * exactly as the individual `.use(rateLimit(...))` / `.use(verifyTurnstile(...))`
+ * steps would. Structurally identical to `AdvisorProcedureProtection` so values
+ * pass straight through to the advisor without conversion.
+ */
 interface ProcedureMiddlewareIR {
   /** `true` when the handler (or a helper inside it) references `ctx.mail` / `ctx.email`. */
   callsMail: boolean;
@@ -939,13 +939,13 @@ interface ProcedureMiddlewareIR {
   writesUserTable: boolean;
 }
 /**
-* Per-procedure argument-validator snapshot, produced by the
-* argument-validator discoverer for the input-hardening lints
-* (`public_arg_uses_any`, `unbounded_string_arg`). Only public procedures are
-* recorded — internal functions take server-trusted input. Structurally identical
-* to `AdvisorArgumentValidator` so it passes straight through to the advisor
-* without conversion.
-*/
+ * Per-procedure argument-validator snapshot, produced by the
+ * argument-validator discoverer for the input-hardening lints
+ * (`public_arg_uses_any`, `unbounded_string_arg`). Only public procedures are
+ * recorded — internal functions take server-trusted input. Structurally identical
+ * to `AdvisorArgumentValidator` so it passes straight through to the advisor
+ * without conversion.
+ */
 interface ArgumentValidatorIR {
   /** Arg names declared as `v.any()` (unvalidated, untyped input). */
   anyArgs: string[];
@@ -959,12 +959,12 @@ interface ArgumentValidatorIR {
   unboundedStringArgs: string[];
 }
 /**
-* One factory/constructor call in `lunora/` whose config object literal a
-* security lint inspects for a present-or-absent key — the shared input for the
-* config-call security lints (payment authorize, inbound-mail verify, rate-limit
-* store, browser private-targets). Structurally identical to `AdvisorConfigCall`
-* so it passes straight through to the advisor without conversion.
-*/
+ * One factory/constructor call in `lunora/` whose config object literal a
+ * security lint inspects for a present-or-absent key — the shared input for the
+ * config-call security lints (payment authorize, inbound-mail verify, rate-limit
+ * store, browser private-targets). Structurally identical to `AdvisorConfigCall`
+ * so it passes straight through to the advisor without conversion.
+ */
 interface ConfigCallIR {
   /** `true` when the config argument was a static object literal the feeder could read. */
   analyzable: boolean;
@@ -980,11 +980,11 @@ interface ConfigCallIR {
   trueKeys: string[];
 }
 /**
-* One secret-shaped string literal discovered in `lunora/` source — the
-* `hardcoded_secret` lint input. Complements the pre-commit `vis secrets` scan by
-* surfacing the same class of finding in-IDE via the studio Advisors table.
-* Structurally identical to `AdvisorSecretLiteral`.
-*/
+ * One secret-shaped string literal discovered in `lunora/` source — the
+ * `hardcoded_secret` lint input. Complements the pre-commit `vis secrets` scan by
+ * surfacing the same class of finding in-IDE via the studio Advisors table.
+ * Structurally identical to `AdvisorSecretLiteral`.
+ */
 interface SecretLiteralIR {
   /** Source file relative to `&lt;projectRoot>/lunora/`, without extension. */
   file: string;
@@ -996,14 +996,14 @@ interface SecretLiteralIR {
   preview: string;
 }
 /**
-* One `ctx.sql.query(text, …)` / `ctx.sql.unsafe(text, …)` call whose `text`
-* argument is built in place rather than passed as a fixed statement — the
-* `sql_injection_risk` lint input. The Hyperdrive driver binds ONLY the `params`
-* array; the `text` string is spliced verbatim into the SQL, so a `text` assembled
-* from a string concatenation or a substitution template literal is an injection
-* vector. A fixed string literal / no-substitution template is safe. Structurally
-* identical to `AdvisorSqlInterpolation`.
-*/
+ * One `ctx.sql.query(text, …)` / `ctx.sql.unsafe(text, …)` call whose `text`
+ * argument is built in place rather than passed as a fixed statement — the
+ * `sql_injection_risk` lint input. The Hyperdrive driver binds ONLY the `params`
+ * array; the `text` string is spliced verbatim into the SQL, so a `text` assembled
+ * from a string concatenation or a substitution template literal is an injection
+ * vector. A fixed string literal / no-substitution template is safe. Structurally
+ * identical to `AdvisorSqlInterpolation`.
+ */
 interface SqlInterpolationIR {
   /** Export binding name of the procedure performing the `ctx.sql` call. */
   exportName: string;
@@ -1013,14 +1013,14 @@ interface SqlInterpolationIR {
   line: number;
 }
 /**
-* One `ctx.fetch(url, …)` call inside an action whose URL argument is derived
-* from the handler's `args` — the `action_fetch_ssrf` lint input. `ctx.fetch` is
-* the action-only outbound-request escape hatch with no host allowlist, so a URL
-* assembled from request input is a server-side request forgery vector (cloud
-* metadata endpoints, internal services). Only arg-derived URLs reach here; a
-* fixed literal or a URL built from config/`ctx.*` is not recorded. Structurally
-* identical to `AdvisorArgumentDerivedFetch`.
-*/
+ * One `ctx.fetch(url, …)` call inside an action whose URL argument is derived
+ * from the handler's `args` — the `action_fetch_ssrf` lint input. `ctx.fetch` is
+ * the action-only outbound-request escape hatch with no host allowlist, so a URL
+ * assembled from request input is a server-side request forgery vector (cloud
+ * metadata endpoints, internal services). Only arg-derived URLs reach here; a
+ * fixed literal or a URL built from config/`ctx.*` is not recorded. Structurally
+ * identical to `AdvisorArgumentDerivedFetch`.
+ */
 interface ArgumentDerivedFetchIR {
   /** Export binding name of the action performing the `ctx.fetch` call. */
   exportName: string;
@@ -1030,15 +1030,15 @@ interface ArgumentDerivedFetchIR {
   line: number;
 }
 /**
-* One `ctx.kv.&lt;method>(key, …)` call whose namespace key is derived from the
-* handler's `args` with no server-side scoping — the `kv_unscoped_user_key_idor`
-* lint input. Workers KV is a single flat namespace, so a key taken straight from
-* request input lets any caller read, overwrite, or delete another user's entry
-* (IDOR). Only arg-derived, unscoped keys reach here; a fixed literal, or a key
-* prefixed with a server-trusted identity (`${ctx.auth.userId}:…` — references
-* `ctx`, so treated as scoped), is not recorded. `list` is excluded (it takes a
-* prefix, not a per-entry key). Structurally identical to `AdvisorKvKeyAccess`.
-*/
+ * One `ctx.kv.&lt;method>(key, …)` call whose namespace key is derived from the
+ * handler's `args` with no server-side scoping — the `kv_unscoped_user_key_idor`
+ * lint input. Workers KV is a single flat namespace, so a key taken straight from
+ * request input lets any caller read, overwrite, or delete another user's entry
+ * (IDOR). Only arg-derived, unscoped keys reach here; a fixed literal, or a key
+ * prefixed with a server-trusted identity (`${ctx.auth.userId}:…` — references
+ * `ctx`, so treated as scoped), is not recorded. `list` is excluded (it takes a
+ * prefix, not a per-entry key). Structurally identical to `AdvisorKvKeyAccess`.
+ */
 interface KvKeyAccessIR {
   /** Export binding name of the procedure performing the `ctx.kv` access. */
   exportName: string;
@@ -1050,16 +1050,16 @@ interface KvKeyAccessIR {
   method: string;
 }
 /**
-* One `ctx.db` write (`insert` / `replace` / `patch` / `insertManyUnsafe`) that sets
-* an ownership / identity column — `userId`, `ownerId`, `tenantId`, and the like —
-* from the handler's `args` instead of the server-trusted identity. The
-* `owner_field_from_args_not_auth` lint input: the ownership column decides who a
-* row belongs to, so a value taken from request input lets any caller write rows
-* owned by another user or tenant (the act-as-any-user / cross-tenant IDOR vector).
-* A column stamped from `ctx.*`, or set to a fixed literal, is not recorded; only an
-* arg-derived identity write reaches here. Structurally identical to
-* `AdvisorOwnerFieldWrite`.
-*/
+ * One `ctx.db` write (`insert` / `replace` / `patch` / `insertManyUnsafe`) that sets
+ * an ownership / identity column — `userId`, `ownerId`, `tenantId`, and the like —
+ * from the handler's `args` instead of the server-trusted identity. The
+ * `owner_field_from_args_not_auth` lint input: the ownership column decides who a
+ * row belongs to, so a value taken from request input lets any caller write rows
+ * owned by another user or tenant (the act-as-any-user / cross-tenant IDOR vector).
+ * A column stamped from `ctx.*`, or set to a fixed literal, is not recorded; only an
+ * arg-derived identity write reaches here. Structurally identical to
+ * `AdvisorOwnerFieldWrite`.
+ */
 interface OwnerFieldWriteIR {
   /** Export binding name of the procedure performing the write. */
   exportName: string;
@@ -1073,15 +1073,15 @@ interface OwnerFieldWriteIR {
   method: string;
 }
 /**
-* One `ctx.storage.&lt;bucket>.&lt;method>(key, …)` call whose R2 object key is derived
-* from the handler's `args` with no server-side scoping — the
-* `storage_key_from_user_args` lint input. The bucket read/write/URL/delete methods
-* key by their first argument, so an object key taken straight from request input is
-* object-level IDOR (read/overwrite/delete anyone's object). A key referencing a
-* server-trusted `ctx.*` value (e.g. `${ctx.auth.userId}/…`) is treated as scoped
-* and is not recorded; only an arg-derived, `ctx`-free key reaches here.
-* Structurally identical to `AdvisorStorageKeyAccess`.
-*/
+ * One `ctx.storage.&lt;bucket>.&lt;method>(key, …)` call whose R2 object key is derived
+ * from the handler's `args` with no server-side scoping — the
+ * `storage_key_from_user_args` lint input. The bucket read/write/URL/delete methods
+ * key by their first argument, so an object key taken straight from request input is
+ * object-level IDOR (read/overwrite/delete anyone's object). A key referencing a
+ * server-trusted `ctx.*` value (e.g. `${ctx.auth.userId}/…`) is treated as scoped
+ * and is not recorded; only an arg-derived, `ctx`-free key reaches here.
+ * Structurally identical to `AdvisorStorageKeyAccess`.
+ */
 interface StorageKeyAccessIR {
   /** Export binding name of the procedure performing the storage call. */
   exportName: string;
@@ -1093,16 +1093,16 @@ interface StorageKeyAccessIR {
   method: string;
 }
 /**
-* One `ctx.containers.&lt;exportName>.get(name, …)` call whose instance key is derived
-* from the handler's `args` with no server-side scoping — the
-* `container_instance_key_from_user_input` lint input. Each container definition's
-* `.get(name)` accessor routes to one instance per `name`, so a key taken straight from
-* request input lets any caller reach another tenant's container (a cross-tenant IDOR). A
-* fixed literal key, or one derived from a server-trusted identity (`${ctx.auth.userId}` —
-* references `ctx`, so treated as scoped), is not recorded; only an arg-derived, unscoped
-* key reaches here. `.any()`/`.pool()` take no key and are not sinks. Structurally
-* identical to `AdvisorContainerKeyAccess`.
-*/
+ * One `ctx.containers.&lt;exportName>.get(name, …)` call whose instance key is derived
+ * from the handler's `args` with no server-side scoping — the
+ * `container_instance_key_from_user_input` lint input. Each container definition's
+ * `.get(name)` accessor routes to one instance per `name`, so a key taken straight from
+ * request input lets any caller reach another tenant's container (a cross-tenant IDOR). A
+ * fixed literal key, or one derived from a server-trusted identity (`${ctx.auth.userId}` —
+ * references `ctx`, so treated as scoped), is not recorded; only an arg-derived, unscoped
+ * key reaches here. `.any()`/`.pool()` take no key and are not sinks. Structurally
+ * identical to `AdvisorContainerKeyAccess`.
+ */
 interface ContainerKeyAccessIR {
   /** Export binding name of the procedure performing the `ctx.containers` access. */
   exportName: string;
@@ -1114,15 +1114,15 @@ interface ContainerKeyAccessIR {
   method: string;
 }
 /**
-* One `ctx.ai.run(model, …)` call whose model-id argument is derived from the handler's
-* `args` with no server-side scoping — the `ai_raw_run_escape_hatch` lint input.
-* `ctx.ai.run` is the raw Workers AI binding passthrough, bypassing the typed
-* `ctx.ai.model(...)` + AI-SDK layer (`generateText`/`streamText`/…) that caps output and
-* enforces a schema, so an arg-derived model id lets any caller select an arbitrary model.
-* A fixed literal model, or one scoped by a server-trusted `ctx.*` value, is not recorded;
-* only an arg-derived, unscoped model id reaches here (an arg-derived `inputs` argument is
-* normal usage and is never inspected). Structurally identical to `AdvisorAiRawRun`.
-*/
+ * One `ctx.ai.run(model, …)` call whose model-id argument is derived from the handler's
+ * `args` with no server-side scoping — the `ai_raw_run_escape_hatch` lint input.
+ * `ctx.ai.run` is the raw Workers AI binding passthrough, bypassing the typed
+ * `ctx.ai.model(...)` + AI-SDK layer (`generateText`/`streamText`/…) that caps output and
+ * enforces a schema, so an arg-derived model id lets any caller select an arbitrary model.
+ * A fixed literal model, or one scoped by a server-trusted `ctx.*` value, is not recorded;
+ * only an arg-derived, unscoped model id reaches here (an arg-derived `inputs` argument is
+ * normal usage and is never inspected). Structurally identical to `AdvisorAiRawRun`.
+ */
 interface AiRawRunIR {
   /** Export binding name of the procedure performing the `ctx.ai.run` call. */
   exportName: string;
@@ -1132,15 +1132,15 @@ interface AiRawRunIR {
   line: number;
 }
 /**
-* One `ctx.vectors.&lt;method>(indexName, input)` call whose `input.namespace` is derived
-* from the handler's `args` with no server-side scoping — the
-* `vectors_namespace_from_user_input` lint input. A Vectorize namespace partitions one
-* index into isolated sub-collections, so a namespace taken straight from request input
-* lets any caller read or poison another tenant's vectors. A fixed literal namespace, or
-* one prefixed with a server-trusted identity (`${ctx.auth.orgId}` — references `ctx`, so
-* treated as scoped), is not recorded; only an arg-derived, unscoped namespace reaches
-* here. Structurally identical to `AdvisorVectorNamespaceAccess`.
-*/
+ * One `ctx.vectors.&lt;method>(indexName, input)` call whose `input.namespace` is derived
+ * from the handler's `args` with no server-side scoping — the
+ * `vectors_namespace_from_user_input` lint input. A Vectorize namespace partitions one
+ * index into isolated sub-collections, so a namespace taken straight from request input
+ * lets any caller read or poison another tenant's vectors. A fixed literal namespace, or
+ * one prefixed with a server-trusted identity (`${ctx.auth.orgId}` — references `ctx`, so
+ * treated as scoped), is not recorded; only an arg-derived, unscoped namespace reaches
+ * here. Structurally identical to `AdvisorVectorNamespaceAccess`.
+ */
 interface VectorNamespaceAccessIR {
   /** Export binding name of the procedure performing the `ctx.vectors` access. */
   exportName: string;
@@ -1152,15 +1152,15 @@ interface VectorNamespaceAccessIR {
   method: string;
 }
 /**
-* One `ctx.mail`/`ctx.email` `send`/`queue` call whose recipient field (`to`/`cc`/`bcc`)
-* is derived from the handler's `args` with no server-side scoping — the
-* `mail_recipient_from_request_input` lint input. A recipient taken straight from request
-* input turns the deployment into an open relay / spam amplifier (any caller can direct
-* mail to an arbitrary address). A fixed literal recipient, or one scoped by a
-* server-trusted `ctx.*` value (e.g. `ctx.auth.user.email`), is not recorded; only an
-* arg-derived, unscoped recipient reaches here. Structurally identical to
-* `AdvisorMailRecipientAccess`.
-*/
+ * One `ctx.mail`/`ctx.email` `send`/`queue` call whose recipient field (`to`/`cc`/`bcc`)
+ * is derived from the handler's `args` with no server-side scoping — the
+ * `mail_recipient_from_request_input` lint input. A recipient taken straight from request
+ * input turns the deployment into an open relay / spam amplifier (any caller can direct
+ * mail to an arbitrary address). A fixed literal recipient, or one scoped by a
+ * server-trusted `ctx.*` value (e.g. `ctx.auth.user.email`), is not recorded; only an
+ * arg-derived, unscoped recipient reaches here. Structurally identical to
+ * `AdvisorMailRecipientAccess`.
+ */
 interface MailRecipientAccessIR {
   /** Export binding name of the procedure performing the `ctx.mail`/`ctx.email` call. */
   exportName: string;
@@ -1172,13 +1172,13 @@ interface MailRecipientAccessIR {
   method: string;
 }
 /**
-* One `ctx.browser.&lt;method>(url, …)` call whose navigation URL (`arguments[0]`)
-* is derived from the handler's `args` with no server-side scoping — the
-* `browser_user_url_without_allowlist` lint input. The lint additionally
-* cross-references `createBrowser` config-call evidence to suppress findings
-* when the browser is hardened with an `allowedHosts` allowlist or
-* `resolveDns`. Structurally identical to `AdvisorBrowserUrlAccess`.
-*/
+ * One `ctx.browser.&lt;method>(url, …)` call whose navigation URL (`arguments[0]`)
+ * is derived from the handler's `args` with no server-side scoping — the
+ * `browser_user_url_without_allowlist` lint input. The lint additionally
+ * cross-references `createBrowser` config-call evidence to suppress findings
+ * when the browser is hardened with an `allowedHosts` allowlist or
+ * `resolveDns`. Structurally identical to `AdvisorBrowserUrlAccess`.
+ */
 interface BrowserUrlAccessIR {
   /** Export binding name of the procedure performing the `ctx.browser` call. */
   exportName: string;
@@ -1190,14 +1190,14 @@ interface BrowserUrlAccessIR {
   method: string;
 }
 /**
-* One runtime container-override call: a `&lt;handle>.start({ enableInternet: true, … })`
-* launch override, or a `&lt;handle>.egress.&lt;method>(...)` runtime firewall mutation
-* (`allow` / `deny` / `setAllowed`) — the `container_start_enable_internet_override`
-* and `container_runtime_egress_relaxation` lint input. Both shapes re-open network
-* access the static `defineContainer` declaration (and its `container_public_internet`
-* lint) assumes is locked down. Matched structurally by call shape, independent of the
-* receiver's resolved type. Structurally identical to `AdvisorContainerOverride`.
-*/
+ * One runtime container-override call: a `&lt;handle>.start({ enableInternet: true, … })`
+ * launch override, or a `&lt;handle>.egress.&lt;method>(...)` runtime firewall mutation
+ * (`allow` / `deny` / `setAllowed`) — the `container_start_enable_internet_override`
+ * and `container_runtime_egress_relaxation` lint input. Both shapes re-open network
+ * access the static `defineContainer` declaration (and its `container_public_internet`
+ * lint) assumes is locked down. Matched structurally by call shape, independent of the
+ * receiver's resolved type. Structurally identical to `AdvisorContainerOverride`.
+ */
 interface ContainerOverrideIR {
   /** e.g. the egress method name, or `"enableInternet: true"`. */
   detail: string;
@@ -1211,18 +1211,18 @@ interface ContainerOverrideIR {
   line: number;
 }
 /**
-* One `buildImageDeliveryUrl({ key, … })` call (`@lunora/bindings/images`) whose
-* `key` — the CDN transform's source image, an absolute URL or an
-* origin-relative key — is derived from the handler's `args` with no
-* server-side scoping — the `images_url_source_from_user_input` lint input.
-* `ctx.images.transform`/`info` take image *bytes*, never a URL, so they are not
-* sinks; only the `key` of `buildImageDeliveryUrl` accepts a URL-or-key source
-* and is inspected. An arg-derived `key` lets any caller point the CDN's
-* `/cdn-cgi/image/` transform at an attacker-chosen origin (SSRF / open proxy)
-* or at an arbitrary key under the account's own store. A fixed literal, or a
-* key scoped by a server-trusted `ctx.*` value, is not recorded. Structurally
-* identical to `AdvisorImageDeliveryUrlAccess`.
-*/
+ * One `buildImageDeliveryUrl({ key, … })` call (`@lunora/bindings/images`) whose
+ * `key` — the CDN transform's source image, an absolute URL or an
+ * origin-relative key — is derived from the handler's `args` with no
+ * server-side scoping — the `images_url_source_from_user_input` lint input.
+ * `ctx.images.transform`/`info` take image *bytes*, never a URL, so they are not
+ * sinks; only the `key` of `buildImageDeliveryUrl` accepts a URL-or-key source
+ * and is inspected. An arg-derived `key` lets any caller point the CDN's
+ * `/cdn-cgi/image/` transform at an attacker-chosen origin (SSRF / open proxy)
+ * or at an arbitrary key under the account's own store. A fixed literal, or a
+ * key scoped by a server-trusted `ctx.*` value, is not recorded. Structurally
+ * identical to `AdvisorImageDeliveryUrlAccess`.
+ */
 interface ImageDeliveryUrlAccessIR {
   /** Export binding name of the procedure performing the `buildImageDeliveryUrl` call. */
   exportName: string;
@@ -1232,17 +1232,17 @@ interface ImageDeliveryUrlAccessIR {
   line: number;
 }
 /**
-* One `createAuth({...})` call's configuration snapshot — the shared input for
-* the five `auth_*` security lints (trusted-origins wildcard, CSRF check
-* disabled, secure cookies disabled, email verification disabled, session
-* freshAge zero). Matched by callee NAME (an `import`-agnostic, fail-closed
-* convention the other feeders share), so a re-export or alias still resolves.
-* When the config argument isn't a statically-analyzable object literal (a
-* top-level spread, or not an object literal at all), `analyzable` is `false`
-* and every boolean fact defaults to its SAFE (not-flagged) value — an opaque
-* config can't be relied on either way. Structurally identical to
-* `AdvisorAuthConfig`.
-*/
+ * One `createAuth({...})` call's configuration snapshot — the shared input for
+ * the five `auth_*` security lints (trusted-origins wildcard, CSRF check
+ * disabled, secure cookies disabled, email verification disabled, session
+ * freshAge zero). Matched by callee NAME (an `import`-agnostic, fail-closed
+ * convention the other feeders share), so a re-export or alias still resolves.
+ * When the config argument isn't a statically-analyzable object literal (a
+ * top-level spread, or not an object literal at all), `analyzable` is `false`
+ * and every boolean fact defaults to its SAFE (not-flagged) value — an opaque
+ * config can't be relied on either way. Structurally identical to
+ * `AdvisorAuthConfig`.
+ */
 interface AuthConfigIR {
   /** `true` when the call's config argument was a static object literal the feeder could read. */
   analyzable: boolean;
@@ -1266,17 +1266,17 @@ interface AuthConfigIR {
   trustedOriginsWildcard: boolean;
 }
 /**
-* One `rateLimit`/`dbRateLimit` middleware call (`@lunora/ratelimit`) whose
-* `key` selector — the per-caller rate-limit sub-key, `(ctx) => string |
-* undefined` — is derived from the handler's `args` with no server-side
-* scoping (no reference to the trusted `ctx` binding anywhere in the selector)
-* — the `ratelimit_key_spoofable_or_global` lint input. A key an attacker
-* controls lets them rotate it per request and bypass the limit entirely,
-* defeating its purpose. A selector scoped by `ctx` (e.g. `ctx.auth.userId`,
-* `ctx.ip`), or one with no `args` reference at all (a fixed/global bucket —
-* the "no key" case this lint deliberately does not flag, to keep it low-FP),
-* is not recorded. Structurally identical to `AdvisorRatelimitKeySelector`.
-*/
+ * One `rateLimit`/`dbRateLimit` middleware call (`@lunora/ratelimit`) whose
+ * `key` selector — the per-caller rate-limit sub-key, `(ctx) => string |
+ * undefined` — is derived from the handler's `args` with no server-side
+ * scoping (no reference to the trusted `ctx` binding anywhere in the selector)
+ * — the `ratelimit_key_spoofable_or_global` lint input. A key an attacker
+ * controls lets them rotate it per request and bypass the limit entirely,
+ * defeating its purpose. A selector scoped by `ctx` (e.g. `ctx.auth.userId`,
+ * `ctx.ip`), or one with no `args` reference at all (a fixed/global bucket —
+ * the "no key" case this lint deliberately does not flag, to keep it low-FP),
+ * is not recorded. Structurally identical to `AdvisorRatelimitKeySelector`.
+ */
 interface RatelimitKeySelectorIR {
   /** The `rateLimit`/`dbRateLimit` callee invoked. */
   callee: string;
@@ -1290,16 +1290,16 @@ interface RatelimitKeySelectorIR {
   line: number;
 }
 /**
-* One payload-derived privileged dispatch — a `ctx.run`/`context.run` back into a
-* Lunora function from inside a `defineQueue` push handler or a `defineWorkflow`
-* handler, whose args reference the handler's untrusted payload (`context.params`
-* for a workflow, a `for (… of batch.messages)` body for a queue) — the
-* `privileged_dispatch_unvalidated_payload` lint input. Both handler kinds run
-* under the **system identity** (RLS disabled), so forwarding attacker-influenced
-* payload into the dispatch bypasses the target's row policy. The resolved
-* `targetFile`/`targetExport` let the lint join RLS-procedure evidence and fire
-* only for RLS-gated targets. Structurally identical to `AdvisorPrivilegedDispatch`.
-*/
+ * One payload-derived privileged dispatch — a `ctx.run`/`context.run` back into a
+ * Lunora function from inside a `defineQueue` push handler or a `defineWorkflow`
+ * handler, whose args reference the handler's untrusted payload (`context.params`
+ * for a workflow, a `for (… of batch.messages)` body for a queue) — the
+ * `privileged_dispatch_unvalidated_payload` lint input. Both handler kinds run
+ * under the **system identity** (RLS disabled), so forwarding attacker-influenced
+ * payload into the dispatch bypasses the target's row policy. The resolved
+ * `targetFile`/`targetExport` let the lint join RLS-procedure evidence and fire
+ * only for RLS-gated targets. Structurally identical to `AdvisorPrivilegedDispatch`.
+ */
 interface PrivilegedDispatchIR {
   /** `"queue"` for a `defineQueue` handler, `"workflow"` for a `defineWorkflow` handler. */
   dispatchKind: "queue" | "workflow";
@@ -1315,11 +1315,11 @@ interface PrivilegedDispatchIR {
   targetFile: string;
 }
 /**
-* One discovered `httpRoute.&lt;verb>("/admin/…")` route on an admin/privileged-looking
-* path, with whether its builder chain references an auth/admin guard — the
-* `admin_route_without_guard` lint input. Structurally identical to
-* `AdvisorAdminRoute`.
-*/
+ * One discovered `httpRoute.&lt;verb>("/admin/…")` route on an admin/privileged-looking
+ * path, with whether its builder chain references an auth/admin guard — the
+ * `admin_route_without_guard` lint input. Structurally identical to
+ * `AdvisorAdminRoute`.
+ */
 interface AdminRouteIR {
   /** Export binding name of the route handler. */
   exportName: string;
@@ -1333,17 +1333,17 @@ interface AdminRouteIR {
   usesGuard: boolean;
 }
 /**
-* One tracked `ctx.storage.&lt;bucket>.&lt;method>(...)` upload/signing call — the
-* shared input for the storage config-hygiene security lints
-* (`storage_upload_without_content_type_allowlist`, `storage_upload_without_max_size`,
-* `storage_generate_upload_url_no_content_type_pin`, `storage_presigned_url_for_private_content`).
-* `upload`/`store` carry the `UploadOptions` guards (`allowedContentTypes` /
-* `maxSize`); `generateUploadUrl` carries the signed-PUT `contentType` pin;
-* `getPresignedUrl`/`getSignedUrl` carry a statically-known `expiresInSeconds`
-* literal. `presentKeys` is empty (and `expiresInSeconds` unset) when the
-* options argument was absent, a non-literal, or a spread — see `analyzable`.
-* Structurally identical to `AdvisorStorageUpload`.
-*/
+ * One tracked `ctx.storage.&lt;bucket>.&lt;method>(...)` upload/signing call — the
+ * shared input for the storage config-hygiene security lints
+ * (`storage_upload_without_content_type_allowlist`, `storage_upload_without_max_size`,
+ * `storage_generate_upload_url_no_content_type_pin`, `storage_presigned_url_for_private_content`).
+ * `upload`/`store` carry the `UploadOptions` guards (`allowedContentTypes` /
+ * `maxSize`); `generateUploadUrl` carries the signed-PUT `contentType` pin;
+ * `getPresignedUrl`/`getSignedUrl` carry a statically-known `expiresInSeconds`
+ * literal. `presentKeys` is empty (and `expiresInSeconds` unset) when the
+ * options argument was absent, a non-literal, or a spread — see `analyzable`.
+ * Structurally identical to `AdvisorStorageUpload`.
+ */
 interface StorageUploadIR {
   /** `true` when the call's options-object argument (or its deliberate absence) was statically resolvable. */
   analyzable: boolean;
@@ -1361,16 +1361,16 @@ interface StorageUploadIR {
   presentKeys: string[];
 }
 /**
-* One discovered `httpAction`/`httpRoute` handler in `lunora/` that performs a
-* side effect (`ctx.runMutation` / `ctx.runAction` / a `ctx.db.{insert,patch,
-* replace,delete,insertManyUnsafe}` write) from the HTTP edge, with whether it
-* reads `ctx.auth` — the `http_action_missing_auth_guard` lint input. A handler
-* that mutates state or dispatches an action without ever consulting the request
-* identity is an unauthenticated write bypassing identity/RLS. Only handlers with
-* a statically-resolvable inline body and `ctx` binding are recorded (fail-safe
-* under-report); read-only handlers are never recorded. Structurally identical to
-* `AdvisorHttpActionGuard`.
-*/
+ * One discovered `httpAction`/`httpRoute` handler in `lunora/` that performs a
+ * side effect (`ctx.runMutation` / `ctx.runAction` / a `ctx.db.{insert,patch,
+ * replace,delete,insertManyUnsafe}` write) from the HTTP edge, with whether it
+ * reads `ctx.auth` — the `http_action_missing_auth_guard` lint input. A handler
+ * that mutates state or dispatches an action without ever consulting the request
+ * identity is an unauthenticated write bypassing identity/RLS. Only handlers with
+ * a statically-resolvable inline body and `ctx` binding are recorded (fail-safe
+ * under-report); read-only handlers are never recorded. Structurally identical to
+ * `AdvisorHttpActionGuard`.
+ */
 interface HttpActionGuardIR {
   /** Export binding name of the handler (or `"&lt;module>"` when mounted inline / not a named binding). */
   exportName: string;
@@ -1388,19 +1388,19 @@ interface HttpActionGuardIR {
   sideEffect: string;
 }
 /**
-* One response-header write, inside an `httpAction` handler, whose value is derived
-* from raw request input (`request.headers`, `request.url`/query, `await
-* request.json()`) with no CR/LF sanitizer — the
-* `http_action_response_header_injection` lint input. A `Request`-derived string
-* placed verbatim into a response header lets a caller smuggle `\r\n` and inject
-* extra headers or split the response (header injection / response splitting). Only
-* sites whose value is request-tainted AND unguarded are recorded: a value routed
-* through a CR/LF guard (`isSafeHeaderValue`), a URL/URI encoder
-* (`encodeURIComponent`/`encodeURI`), a numeric coercion (`Number`/`parseInt`/
-* `parseFloat`), or `btoa` is treated as safe and never recorded (`String(...)` /
-* `.toString()` are NOT sanitizers — they don't strip CR/LF). Structurally
-* identical to `AdvisorHttpHeaderWrite`.
-*/
+ * One response-header write, inside an `httpAction` handler, whose value is derived
+ * from raw request input (`request.headers`, `request.url`/query, `await
+ * request.json()`) with no CR/LF sanitizer — the
+ * `http_action_response_header_injection` lint input. A `Request`-derived string
+ * placed verbatim into a response header lets a caller smuggle `\r\n` and inject
+ * extra headers or split the response (header injection / response splitting). Only
+ * sites whose value is request-tainted AND unguarded are recorded: a value routed
+ * through a CR/LF guard (`isSafeHeaderValue`), a URL/URI encoder
+ * (`encodeURIComponent`/`encodeURI`), a numeric coercion (`Number`/`parseInt`/
+ * `parseFloat`), or `btoa` is treated as safe and never recorded (`String(...)` /
+ * `.toString()` are NOT sanitizers — they don't strip CR/LF). Structurally
+ * identical to `AdvisorHttpHeaderWrite`.
+ */
 interface HttpHeaderWriteIR {
   /** Export binding name of the enclosing handler, or `"&lt;module>"` when mounted inline. */
   exportName: string;
@@ -1414,16 +1414,16 @@ interface HttpHeaderWriteIR {
   via: "headers-append" | "headers-ctor" | "headers-set" | "response-init";
 }
 /**
-* One rate-limit / Turnstile middleware call in `lunora/` — the
-* `ratelimit_middleware_fail_open` lint input. `rateLimit`/`dbRateLimit`
-* (`@lunora/ratelimit`) and `verifyTurnstileMiddleware` (`@lunora/auth`) each
-* accept a `failOpen` escape hatch that admits every request when the
-* limiter/siteverify is unavailable; `failOpen` is `true` only when the options
-* literal set it to the boolean literal `true` (anything else is fail-closed).
-* The lint escalates a fail-open guard to a finding when the guarded procedure
-* (`exportName`/`limitName`) looks auth/payment-sensitive. Structurally
-* identical to `AdvisorFailOpenGuard`.
-*/
+ * One rate-limit / Turnstile middleware call in `lunora/` — the
+ * `ratelimit_middleware_fail_open` lint input. `rateLimit`/`dbRateLimit`
+ * (`@lunora/ratelimit`) and `verifyTurnstileMiddleware` (`@lunora/auth`) each
+ * accept a `failOpen` escape hatch that admits every request when the
+ * limiter/siteverify is unavailable; `failOpen` is `true` only when the options
+ * literal set it to the boolean literal `true` (anything else is fail-closed).
+ * The lint escalates a fail-open guard to a finding when the guarded procedure
+ * (`exportName`/`limitName`) looks auth/payment-sensitive. Structurally
+ * identical to `AdvisorFailOpenGuard`.
+ */
 interface FailOpenGuardIR {
   /** The middleware factory at the call site: `rateLimit` / `dbRateLimit` / `verifyTurnstileMiddleware`. */
   callee: string;
@@ -1439,14 +1439,14 @@ interface FailOpenGuardIR {
   line: number;
 }
 /**
-* One `ctx.flags.boolean("key", &lt;boolean-literal>)` read in `lunora/` — the
-* `flag_gates_security_with_unsafe_default` lint input. OpenFeature returns the
-* `defaultValue` when the provider errors, so a fail-open default on a
-* security-shaped key silently opens access during an outage. Only reads with a
-* statically-known string key and boolean-literal default are recorded; the lint
-* owns the security-shape + polarity judgment. Structurally identical to
-* `AdvisorFlagSecurityDefault`.
-*/
+ * One `ctx.flags.boolean("key", &lt;boolean-literal>)` read in `lunora/` — the
+ * `flag_gates_security_with_unsafe_default` lint input. OpenFeature returns the
+ * `defaultValue` when the provider errors, so a fail-open default on a
+ * security-shaped key silently opens access during an outage. Only reads with a
+ * statically-known string key and boolean-literal default are recorded; the lint
+ * owns the security-shape + polarity judgment. Structurally identical to
+ * `AdvisorFlagSecurityDefault`.
+ */
 interface FlagSecurityDefaultIR {
   /** The boolean-literal default returned on a provider outage (fail-open value). */
   defaultValue: boolean;
@@ -1460,13 +1460,13 @@ interface FlagSecurityDefaultIR {
   line: number;
 }
 /**
-* One `generateText` / `streamText` call in `lunora/` whose `tools` reach a
-* privileged side effect (a DB write, function dispatch, or outbound
-* fetch/mail/queue send). `userInputDerived` records whether the model input
-* (`prompt`/`messages`/`system`) flows from the handler's `args`; the
-* `ai_tool_side_effect_prompt_injection` lint fires only when it does.
-* Structurally identical to `AdvisorAiToolSideEffect`.
-*/
+ * One `generateText` / `streamText` call in `lunora/` whose `tools` reach a
+ * privileged side effect (a DB write, function dispatch, or outbound
+ * fetch/mail/queue send). `userInputDerived` records whether the model input
+ * (`prompt`/`messages`/`system`) flows from the handler's `args`; the
+ * `ai_tool_side_effect_prompt_injection` lint fires only when it does.
+ * Structurally identical to `AdvisorAiToolSideEffect`.
+ */
 interface AiToolSideEffectIR {
   /** Export binding name of the procedure performing the call. */
   exportName: string;
@@ -1482,13 +1482,13 @@ interface AiToolSideEffectIR {
   userInputDerived: boolean;
 }
 /**
-* One `&lt;receiver>.identity.&lt;key>` claim read in `lunora/`, where `&lt;receiver>` is
-* an RLS/mask policy `auth` (or `ctx.auth`/`context.auth`). `declared` records
-* whether `&lt;key>` is in the app's `defineIdentity({ ... })` contract (or the
-* always-present `userId`); the `identity_undeclared_claim_trusted` lint fires on
-* the undeclared reads. Emitted only when a resolvable identity contract exists.
-* Structurally identical to `AdvisorIdentityClaimRead`.
-*/
+ * One `&lt;receiver>.identity.&lt;key>` claim read in `lunora/`, where `&lt;receiver>` is
+ * an RLS/mask policy `auth` (or `ctx.auth`/`context.auth`). `declared` records
+ * whether `&lt;key>` is in the app's `defineIdentity({ ... })` contract (or the
+ * always-present `userId`); the `identity_undeclared_claim_trusted` lint fires on
+ * the undeclared reads. Emitted only when a resolvable identity contract exists.
+ * Structurally identical to `AdvisorIdentityClaimRead`.
+ */
 interface IdentityClaimReadIR {
   /** `true` when `key` is a declared claim (in the `defineIdentity` contract, or the always-present `userId`). */
   declared: boolean;
@@ -1502,13 +1502,13 @@ interface IdentityClaimReadIR {
   line: number;
 }
 /**
-* One payment webhook-adapter construction in `lunora/` (`createStripeAdapter` /
-* `createPolarAdapter` / `createAutumnAdapter` / `createDodoPaymentsAdapter`).
-* `toleranceSeconds` carries the statically-known `webhookToleranceSeconds`
-* replay window when it is a plain numeric literal; the payment-webhook
-* wide-tolerance lint fires when it exceeds a conservative ceiling. Structurally
-* identical to `AdvisorPaymentWebhook`.
-*/
+ * One payment webhook-adapter construction in `lunora/` (`createStripeAdapter` /
+ * `createPolarAdapter` / `createAutumnAdapter` / `createDodoPaymentsAdapter`).
+ * `toleranceSeconds` carries the statically-known `webhookToleranceSeconds`
+ * replay window when it is a plain numeric literal; the payment-webhook
+ * wide-tolerance lint fires when it exceeds a conservative ceiling. Structurally
+ * identical to `AdvisorPaymentWebhook`.
+ */
 interface PaymentWebhookIR {
   /** The adapter factory invoked. */
   callee: "createAutumnAdapter" | "createDodoPaymentsAdapter" | "createPolarAdapter" | "createStripeAdapter";
@@ -1522,13 +1522,13 @@ interface PaymentWebhookIR {
   toleranceSeconds?: number;
 }
 /**
-* One `ctx.db.&lt;table>.findMany({ includeDeleted })` list read whose
-* `includeDeleted` is either a hardcoded `true` or derived from the handler's
-* `args` — the `soft_delete_include_deleted_from_args` lint input. The lint joins
-* `table` against the schema's soft-delete tables and `visibility` against
-* `.public()` before flagging. Structurally identical to `AdvisorSoftDeleteRead`
-* so values pass straight through without conversion.
-*/
+ * One `ctx.db.&lt;table>.findMany({ includeDeleted })` list read whose
+ * `includeDeleted` is either a hardcoded `true` or derived from the handler's
+ * `args` — the `soft_delete_include_deleted_from_args` lint input. The lint joins
+ * `table` against the schema's soft-delete tables and `visibility` against
+ * `.public()` before flagging. Structurally identical to `AdvisorSoftDeleteRead`
+ * so values pass straight through without conversion.
+ */
 interface SoftDeleteReadIR {
   /** Export binding name of the procedure performing the read. */
   exportName: string;
@@ -1546,14 +1546,14 @@ interface SoftDeleteReadIR {
   visibility: "internal" | "public";
 }
 /**
-* One `ctx.db.&lt;table>.findMany({ with: { &lt;rel> } })` relation-hydrating list read
-* — the `masked_relation_leak_via_with` lint input. Column masking does not
-* descend into `with`-hydrated relations, so a masked table surfaced only through
-* a `with` on an unprotected parent read is returned in the clear. The lint
-* resolves each relation accessor to its target table and joins it against the
-* discovered mask evidence before flagging. Structurally identical to
-* `AdvisorRelationLoad` so values pass straight through without conversion.
-*/
+ * One `ctx.db.&lt;table>.findMany({ with: { &lt;rel> } })` relation-hydrating list read
+ * — the `masked_relation_leak_via_with` lint input. Column masking does not
+ * descend into `with`-hydrated relations, so a masked table surfaced only through
+ * a `with` on an unprotected parent read is returned in the clear. The lint
+ * resolves each relation accessor to its target table and joins it against the
+ * discovered mask evidence before flagging. Structurally identical to
+ * `AdvisorRelationLoad` so values pass straight through without conversion.
+ */
 interface RelationLoadIR {
   /** Export binding name of the procedure performing the read. */
   exportName: string;
@@ -1569,16 +1569,16 @@ interface RelationLoadIR {
   visibility: "internal" | "public";
 }
 /**
-* One `query` handler whose `return` hands back the raw rows of a table — the
-* result of a `ctx.db.&lt;table>.findMany()` / `.findFirst()` / `.get()` read, or a
-* `ctx.db.query("&lt;table>")…collect()` fluent chain — returned directly (or through
-* one local `const` hop) with no hand-built projection. The
-* `output_projection_missing_on_public_read` lint keeps only `visibility ===
-* "public"` rows with no `.output(...)` / `.use(mask(...))` on the chain, then
-* joins `table` against the schema and flags one whose columns are PII-named.
-* Structurally identical to `AdvisorRawRowReturn` so values pass straight through
-* without conversion.
-*/
+ * One `query` handler whose `return` hands back the raw rows of a table — the
+ * result of a `ctx.db.&lt;table>.findMany()` / `.findFirst()` / `.get()` read, or a
+ * `ctx.db.query("&lt;table>")…collect()` fluent chain — returned directly (or through
+ * one local `const` hop) with no hand-built projection. The
+ * `output_projection_missing_on_public_read` lint keeps only `visibility ===
+ * "public"` rows with no `.output(...)` / `.use(mask(...))` on the chain, then
+ * joins `table` against the schema and flags one whose columns are PII-named.
+ * Structurally identical to `AdvisorRawRowReturn` so values pass straight through
+ * without conversion.
+ */
 interface RawRowReturnIR {
   /** Export binding name of the query returning the raw rows. */
   exportName: string;
@@ -1596,16 +1596,16 @@ interface RawRowReturnIR {
   visibility: "internal" | "public";
 }
 /**
-* One `query`/`mutation` handler that gates a `ctx.db.get`/`patch`/`delete` on a
-* null-checked `ctx.db.normalizeId(table, id)` result — the
-* `normalize_id_used_as_authorization` lint input. `normalizeId` validates an id's
-* structural shape only (it never reads the database), so a non-null result proves
-* the id is well-formed, never that the caller owns the row; gating access on it is
-* an IDOR. The lint owns the negative proof — it keeps only `visibility === "public"`
-* rows with no `.use(rls(...))` and no ownership/identity mention (`mentionsOwnership`),
-* then joins `table` against the schema's RLS mode before flagging. Structurally
-* identical to `AdvisorNormalizeIdAuthorization` so values pass straight through.
-*/
+ * One `query`/`mutation` handler that gates a `ctx.db.get`/`patch`/`delete` on a
+ * null-checked `ctx.db.normalizeId(table, id)` result — the
+ * `normalize_id_used_as_authorization` lint input. `normalizeId` validates an id's
+ * structural shape only (it never reads the database), so a non-null result proves
+ * the id is well-formed, never that the caller owns the row; gating access on it is
+ * an IDOR. The lint owns the negative proof — it keeps only `visibility === "public"`
+ * rows with no `.use(rls(...))` and no ownership/identity mention (`mentionsOwnership`),
+ * then joins `table` against the schema's RLS mode before flagging. Structurally
+ * identical to `AdvisorNormalizeIdAuthorization` so values pass straight through.
+ */
 interface NormalizeIdAuthorizationIR {
   /** Export binding name of the procedure performing the normalize-then-access. */
   exportName: string;
@@ -1625,14 +1625,14 @@ interface NormalizeIdAuthorizationIR {
   visibility: "internal" | "public";
 }
 /**
-* One committed `wrangler.jsonc` `vars` entry whose value is a plaintext secret —
-* the `plaintext_secret_in_wrangler_vars` lint input. `vars` are baked into the
-* deployed Worker in cleartext and checked into source control, so a real API key
-* / token / private key there ships the secret to every reader of the repo and the
-* bundle; it belongs in a Secrets Store binding or `wrangler secret put`. Produced
-* by `@lunora/config` (which reads `wrangler.jsonc`), not a ts-morph feeder —
-* codegen only passes it through. Structurally identical to `AdvisorWranglerVariable`.
-*/
+ * One committed `wrangler.jsonc` `vars` entry whose value is a plaintext secret —
+ * the `plaintext_secret_in_wrangler_vars` lint input. `vars` are baked into the
+ * deployed Worker in cleartext and checked into source control, so a real API key
+ * / token / private key there ships the secret to every reader of the repo and the
+ * bundle; it belongs in a Secrets Store binding or `wrangler secret put`. Produced
+ * by `@lunora/config` (which reads `wrangler.jsonc`), not a ts-morph feeder —
+ * codegen only passes it through. Structurally identical to `AdvisorWranglerVariable`.
+ */
 interface WranglerVariableIR {
   /** The `wrangler.jsonc` file the var was read from, relative to the project root. */
   file: string;
@@ -1652,30 +1652,30 @@ interface ProjectIR {
   schema: SchemaIR;
 }
 /**
-* Run the static lints against a discovered {@link SchemaIR} and the reads/writes/calls
-* found in function bodies: query reads feed `filter_without_index`, insert writes
-* feed `table_without_insert`, authApi calls feed `auth_api_call_without_headers`,
-* rls procedure snapshots feed `rls_uncovered_table`, mask procedure
-* snapshots feed `mask_uncovered_pii_column`, and per-column mask strategies
-* feed `mask_weak_hash_strategy_on_pii`; declared containers
-* feed the `container_*` lints; declared workflows (with their durable step labels)
-* + `ctx.workflows.get(...)` call sites feed the `workflow_unused` /
-* `workflow_unknown_target` / duplicate-step-name lints; non-deterministic
-* calls inside query/mutation handlers feed the `nondeterministic_query_mutation` lint
-* (all default empty for callers that don't analyze functions/containers/workflows).
-* The IR types are structurally identical to the advisor's evidence types so they
-* pass straight through without conversion. Returns the findings; surfacing them
-* (console, error overlay, studio Advisors table) is the caller's choice.
-*/
-/**
-* Named inputs for {@link lintSchema}. Every feeder is a discrete key rather than
-* a positional argument: the feeder list grows every few releases and many IR
-* types are structurally similar (`{file, exportName, line}`-shaped evidence),
-* so a positional call was a silent-transposition hazard — swapping two adjacent
-* arguments could typecheck yet feed the wrong evidence to the wrong lint and
-* corrupt a security advisory. `schema` is the only required field; every other
-* feeder defaults to "not analyzed" when omitted.
-*/
+ * Run the static lints against a discovered {@link SchemaIR} and the reads/writes/calls
+ * found in function bodies: query reads feed `filter_without_index`, insert writes
+ * feed `table_without_insert`, authApi calls feed `auth_api_call_without_headers`,
+ * rls procedure snapshots feed `rls_uncovered_table`, mask procedure
+ * snapshots feed `mask_uncovered_pii_column`, and per-column mask strategies
+ * feed `mask_weak_hash_strategy_on_pii`; declared containers
+ * feed the `container_*` lints; declared workflows (with their durable step labels)
+ * + `ctx.workflows.get(...)` call sites feed the `workflow_unused` /
+ * `workflow_unknown_target` / duplicate-step-name lints; non-deterministic
+ * calls inside query/mutation handlers feed the `nondeterministic_query_mutation` lint
+ * (all default empty for callers that don't analyze functions/containers/workflows).
+ * The IR types are structurally identical to the advisor's evidence types so they
+ * pass straight through without conversion. Returns the findings; surfacing them
+ * (console, error overlay, studio Advisors table) is the caller's choice.
+ */
+/**
+ * Named inputs for {@link lintSchema}. Every feeder is a discrete key rather than
+ * a positional argument: the feeder list grows every few releases and many IR
+ * types are structurally similar (`{file, exportName, line}`-shaped evidence),
+ * so a positional call was a silent-transposition hazard — swapping two adjacent
+ * arguments could typecheck yet feed the wrong evidence to the wrong lint and
+ * corrupt a security advisory. `schema` is the only required field; every other
+ * feeder defaults to "not analyzed" when omitted.
+ */
 interface LintSchemaOptions {
   adminRoutes?: ReadonlyArray<AdminRouteIR>;
   aiRawRuns?: ReadonlyArray<AiRawRunIR>;
@@ -1728,19 +1728,19 @@ interface LintSchemaOptions {
 }
 declare const lintSchema: (options: LintSchemaOptions) => Finding[];
 /**
-* Render advisor findings as a single multi-line string for console surfacing:
-* a one-line summary header followed by one `[LEVEL] name: detail` line per
-* finding. Returns `""` when there are no findings.
-*/
+ * Render advisor findings as a single multi-line string for console surfacing:
+ * a one-line summary header followed by one `[LEVEL] name: detail` line per
+ * finding. Returns `""` when there are no findings.
+ */
 declare const formatAdvisories: (findings: ReadonlyArray<Finding>) => string;
 /**
-* An error thrown by codegen discovery when the user's schema or function
-* source has a structural problem that can be pinpointed to a specific source
-* location. A `LunoraError` subclass (`code: "CODEGEN_DIAGNOSTIC"`); the `file`,
-* `line`, and `column` properties (also passed through as the base `loc`) mirror
-* what Vite's error-overlay `loc` field expects so the browser can display the
-* exact spot.
-*/
+ * An error thrown by codegen discovery when the user's schema or function
+ * source has a structural problem that can be pinpointed to a specific source
+ * location. A `LunoraError` subclass (`code: "CODEGEN_DIAGNOSTIC"`); the `file`,
+ * `line`, and `column` properties (also passed through as the base `loc`) mirror
+ * what Vite's error-overlay `loc` field expects so the browser can display the
+ * exact spot.
+ */
 declare class CodegenDiagnosticError extends LunoraError {
   readonly column: number;
   readonly file: string;
@@ -1748,199 +1748,181 @@ declare class CodegenDiagnosticError extends LunoraError {
   constructor(message: string, file: string, line: number, column: number);
 }
 /**
-* Build a {@link CodegenDiagnosticError} whose message includes the source
-* location and whose `file`/`line`/`column` properties are set from the
-* ts-morph `Node`'s position in its source file.
-*
-* Message format: `@lunora/codegen: &lt;detail> (&lt;file>:&lt;line>:&lt;column>)`
-*
-* `meta` is merged onto the returned error for callers that also carry the
-* project-wide `LunoraError` envelope (`code`/`name`/`status`) — it never
-* touches `file`/`line`/`column`, and the error stays an instance of
-* {@link CodegenDiagnosticError} so the Vite overlay's `instanceof` location
-* lookup is unaffected.
-*/
+ * Build a {@link CodegenDiagnosticError} whose message includes the source
+ * location and whose `file`/`line`/`column` properties are set from the
+ * ts-morph `Node`'s position in its source file.
+ *
+ * Message format: `@lunora/codegen: &lt;detail> (&lt;file>:&lt;line>:&lt;column>)`
+ *
+ * `meta` is merged onto the returned error for callers that also carry the
+ * project-wide `LunoraError` envelope (`code`/`name`/`status`) — it never
+ * touches `file`/`line`/`column`, and the error stays an instance of
+ * {@link CodegenDiagnosticError} so the Vite overlay's `instanceof` location
+ * lookup is unaffected.
+ */
 declare const diagnosticAt: (node: Node, detail: string, meta?: Record<string, unknown>) => CodegenDiagnosticError;
 /** The only file agents may be declared in — mirrors `lunora/workflows.ts`. */
 declare const AGENTS_FILENAME = "agents.ts";
 /**
-* Discover every agent the project declares: exported `defineAgent()` calls in
-* `lunora/agents.ts`. Returns `[]` when the file doesn't exist. Only four things
-* are read statically — the optional `name` override (wrangler `workflows[].name`),
-* the optional `publicRun` opt-in (the `agents:agentRun` capability gate), the
-* presence of a `voice` block (which turns on the voice-session Durable Object),
-* and the presence of an `onEmail` mapper (which wires the worker `email()`
-* handler); the rest of the agent config (model / tools / memory / voice models /
-* the `onEmail` closure body) is runtime-only, so codegen never evaluates it.
-*/
+ * Discover every agent the project declares: exported `defineAgent()` calls in
+ * `lunora/agents.ts`. Returns `[]` when the file doesn't exist. Only four things
+ * are read statically — the optional `name` override (wrangler `workflows[].name`),
+ * the optional `publicRun` opt-in (the `agents:agentRun` capability gate), the
+ * presence of a `voice` block (which turns on the voice-session Durable Object),
+ * and the presence of an `onEmail` mapper (which wires the worker `email()`
+ * handler); the rest of the agent config (model / tools / memory / voice models /
+ * the `onEmail` closure body) is runtime-only, so codegen never evaluates it.
+ */
 declare const discoverAgents: (project: Project, lunoraDirectory: string) => AgentIR[];
 /**
-* Discover `ctx.authApi.&lt;method>(...)` (and bare `authApi.&lt;method>(...)`) calls
-* under the lunora source directory and attribute each to the exported function
-* (and file) performing it. Calls outside an exported declaration are dropped.
-*/
+ * Discover `ctx.authApi.&lt;method>(...)` (and bare `authApi.&lt;method>(...)`) calls
+ * under the lunora source directory and attribute each to the exported function
+ * (and file) performing it. Calls outside an exported declaration are dropped.
+ */
 declare const discoverAuthApiCalls: (project: Project, lunoraDirectory: string) => AuthApiCallIR[];
 /** The only file containers may be declared in — mirrors `lunora/crons.ts`. */
 declare const CONTAINERS_FILENAME = "containers.ts";
 /**
-* Discover every container the project declares: exported `defineContainer()`
-* calls in `lunora/containers.ts`. Returns `[]` when the file doesn't exist.
-* Wrangler-relevant fields (`image`, `instanceType`, `maxInstances`, `name`)
-* must be static literals; runtime-only fields (`env`, `sleepAfter`, …) may be
-* any expression since the generated class imports the definition object.
-*/
+ * Discover every container the project declares: exported `defineContainer()`
+ * calls in `lunora/containers.ts`. Returns `[]` when the file doesn't exist.
+ * Wrangler-relevant fields (`image`, `instanceType`, `maxInstances`, `name`)
+ * must be static literals; runtime-only fields (`env`, `sleepAfter`, …) may be
+ * any expression since the generated class imports the definition object.
+ */
 declare const discoverContainers: (project: Project, lunoraDirectory: string) => ContainerIR[];
 /**
-* Scan every `.ts` file under `lunoraDir` for `cronJobs()` builder registrations
-* (`crons.interval(...)`, `crons.daily(...)`, `crons.cron(...)`, …) and lift them
-* into {@link CronJobIR}. Schedules are compiled to standard cron expressions;
-* function references are resolved to their `namespace:fn` dispatch path, while a
-* `workflows.NAME` / `agents.NAME` reference (or a bare identifier naming a
-* declared workflow) resolves to a durable workflow start. Names must be unique
-* across the project.
-*/
+ * Scan every `.ts` file under `lunoraDir` for `cronJobs()` builder registrations
+ * (`crons.interval(...)`, `crons.daily(...)`, `crons.cron(...)`, …) and lift them
+ * into {@link CronJobIR}. Schedules are compiled to standard cron expressions;
+ * function references are resolved to their `namespace:fn` dispatch path, while a
+ * `workflows.NAME` / `agents.NAME` reference (or a bare identifier naming a
+ * declared workflow) resolves to a durable workflow start. Names must be unique
+ * across the project.
+ */
 declare const discoverCrons: (project: Project, lunoraDirectory: string, workflows?: ReadonlyArray<WorkflowIR>, agents?: ReadonlyArray<AgentIR>) => CronJobIR[];
 /** The only file a feature-flag provider may be declared in — mirrors `lunora/queues.ts`. */
 declare const FLAGS_FILENAME = "flags.ts";
-/** One statically-discovered flag read: the key plus the value type its `ctx.flags.&lt;type>` call implies. */
-
-/**
-* Discover the feature-flag provider a project declares in `lunora/flags.ts`.
-* Returns `undefined` when the file doesn't exist (the app has no flags). The
-* read is metadata-only and lenient: codegen wires `ctx.flags` purely from the
-* file's *existence* (`run-codegen.ts`) and imports the real module for the
-* provider value — this IR exists solely so the config layer can reconcile the
-* wrangler `flagship` binding for the Flagship binding-mode provider. Anything
-* it can't read statically degrades to a `custom` provider (no binding), never
-* a thrown error.
-*/
+/**
+ * Discover the feature-flag provider a project declares in `lunora/flags.ts`.
+ * Returns `undefined` when the file doesn't exist (the app has no flags). The
+ * read is metadata-only and lenient: codegen wires `ctx.flags` purely from the
+ * file's *existence* (`run-codegen.ts`) and imports the real module for the
+ * provider value — this IR exists solely so the config layer can reconcile the
+ * wrangler `flagship` binding for the Flagship binding-mode provider. Anything
+ * it can't read statically degrades to a `custom` provider (no binding), never
+ * a thrown error.
+ */
 declare const discoverFlags: (project: Project, lunoraDirectory: string) => FlagsIR | undefined;
 /**
-* Scan all .ts files under `lunoraDir` (skipping `_generated/` and `schema.ts`)
-* for top-level `export const x = query/mutation/action({...})` registrations.
-*/
+ * Scan all .ts files under `lunoraDir` (skipping `_generated/` and `schema.ts`)
+ * for top-level `export const x = query/mutation/action({...})` registrations.
+ */
 declare const discoverFunctions: (project: Project, lunoraDirectory: string) => FunctionIR[];
 /**
-* Scan all `.ts` files under `lunoraDir` (skipping `_generated/` and `schema.ts`)
-* for `export const x = httpRoute.&lt;verb>(...)…handler(...)` typed REST routes.
-* These are the headline OpenAPI target: each becomes a real `paths` entry.
-*/
+ * Scan all `.ts` files under `lunoraDir` (skipping `_generated/` and `schema.ts`)
+ * for `export const x = httpRoute.&lt;verb>(...)…handler(...)` typed REST routes.
+ * These are the headline OpenAPI target: each becomes a real `paths` entry.
+ */
 declare const discoverHttpRoutes: (project: Project, lunoraDirectory: string) => HttpRouteIR[];
 /**
-* Discover `ctx.db.insert("table", …)` writes under the lunora source directory
-* and attribute each to the exported function (and file) performing it. Calls
-* with a non-literal table argument, or outside an exported declaration, are
-* dropped (`table === ""` / no enclosing export).
-*/
+ * Discover `ctx.db.insert("table", …)` writes under the lunora source directory
+ * and attribute each to the exported function (and file) performing it. Calls
+ * with a non-literal table argument, or outside an exported declaration, are
+ * dropped (`table === ""` / no enclosing export).
+ */
 declare const discoverInserts: (project: Project, lunoraDirectory: string) => InsertWriteIR[];
 /**
-* Discover masking usage for every exported Lunora procedure under the lunora
-* source directory — the column-level twin of `discoverRlsProcedures`. For each
-* procedure, records whether its builder chain includes `.use(mask(...))`, which
-* `(table, column)` pairs that mask declares, and which tables it reads/writes
-* through `ctx.db`. Feeds the `mask_uncovered_pii_column` advisor lint.
-*/
+ * Discover masking usage for every exported Lunora procedure under the lunora
+ * source directory — the column-level twin of `discoverRlsProcedures`. For each
+ * procedure, records whether its builder chain includes `.use(mask(...))`, which
+ * `(table, column)` pairs that mask declares, and which tables it reads/writes
+ * through `ctx.db`. Feeds the `mask_uncovered_pii_column` advisor lint.
+ */
 declare const discoverMaskProcedures: (project: Project, lunoraDirectory: string) => MaskProcedureIR[];
 /**
-* Aggregate the schema-wide masking metadata the studio's data-browser mask
-* toggle reads: every statically-discovered `(table, column, strategy)` masked
-* column across the project's `.use(mask(...))` chains. Walks the same builder
-* chains as {@link discoverMaskProcedures} but carries the strategy the preview
-* needs to choose redact-vs-hash-vs-custom rendering. Deduped by `(table,
-* column)` with the first declaration winning, so a column masked by several
-* procedures lists once — the same evidence the advisor lint uses.
-*/
-/**
-* Scan all `.ts` files under `lunoraDir` for top-level
-* `export const x = defineMigration({...})` declarations and lift them into
-* {@link MigrationIR}. `id` must be a static string literal (it's the registry
-* key); `table` is best-effort and left `""` when not a literal.
-*/
+ * Scan all `.ts` files under `lunoraDir` for top-level
+ * `export const x = defineMigration({...})` declarations and lift them into
+ * {@link MigrationIR}. `id` must be a static string literal (it's the registry
+ * key); `table` is best-effort and left `""` when not a literal.
+ */
 declare const discoverMigrations: (project: Project, lunoraDirectory: string) => MigrationIR[];
 /** The only file custom mutators may be declared in — mirrors `lunora/queues.ts`. */
 declare const MUTATORS_FILENAME = "mutators.ts";
 /**
-* Decide whether a call's callee is `defineMutator` — either the bare imported
-* identifier (`defineMutator(...)`) or a namespace member access
-* (`server.defineMutator(...)`). Both are valid ES module syntax, so discovery
-* must see mutators declared either way.
-*/
-
-/**
-* Discover every custom mutator the project declares: exported
-* `defineMutator()` calls in `lunora/mutators.ts`. Returns `[]` when the file
-* doesn't exist. Only the export binding is lifted — the runtime object carries
-* the authoritative `server` impl + `handler`, so codegen never evaluates the
-* body. The client `client` impl is split into the browser bundle separately.
-*/
+ * Discover every custom mutator the project declares: exported
+ * `defineMutator()` calls in `lunora/mutators.ts`. Returns `[]` when the file
+ * doesn't exist. Only the export binding is lifted — the runtime object carries
+ * the authoritative `server` impl + `handler`, so codegen never evaluates the
+ * body. The client `client` impl is split into the browser bundle separately.
+ */
 declare const discoverMutators: (project: Project, lunoraDirectory: string) => MutatorIR[];
 /**
-* Discover non-deterministic API calls (`Date.now`, `new Date()`, `Date()`,
-* `Math.random`, `crypto.randomUUID`, `crypto.getRandomValues` — including
-* `globalThis`/`self`/`window`-prefixed receivers — and `fetch`) lexically inside
-* the handler body of every exported `query(...)` / `mutation(...)` registration
-* under the lunora source directory — the `nondeterministic_query_mutation` lint
-* input. `action(...)` (and `stream(...)`) registrations are intentionally
-* skipped: actions run exactly once and may use ambient APIs freely.
-*
-* Traversal is scoped to the handler node (not the whole declaration), mirroring
-* how the auth-api / insert feeders attribute calls — so a call in a sibling
-* helper outside the handler, or in a nested `action(...)` passed elsewhere, is
-* not attributed to the query/mutation. One {@link NondeterministicCallIR} is
-* produced per call site.
-*/
+ * Discover non-deterministic API calls (`Date.now`, `new Date()`, `Date()`,
+ * `Math.random`, `crypto.randomUUID`, `crypto.getRandomValues` — including
+ * `globalThis`/`self`/`window`-prefixed receivers — and `fetch`) lexically inside
+ * the handler body of every exported `query(...)` / `mutation(...)` registration
+ * under the lunora source directory — the `nondeterministic_query_mutation` lint
+ * input. `action(...)` (and `stream(...)`) registrations are intentionally
+ * skipped: actions run exactly once and may use ambient APIs freely.
+ *
+ * Traversal is scoped to the handler node (not the whole declaration), mirroring
+ * how the auth-api / insert feeders attribute calls — so a call in a sibling
+ * helper outside the handler, or in a nested `action(...)` passed elsewhere, is
+ * not attributed to the query/mutation. One {@link NondeterministicCallIR} is
+ * produced per call site.
+ */
 declare const discoverNondeterministicCalls: (project: Project, lunoraDirectory: string) => NondeterministicCallIR[];
 /**
-* Discover `ctx.db.query("table")…` reads under the lunora source directory and
-* reduce each to a {@link QueryReadIR}. Only reads that call `.filter()` are
-* returned — an unfiltered read is never a `filter_without_index` candidate, so
-* dropping the rest keeps the lint input small.
-*/
+ * Discover `ctx.db.query("table")…` reads under the lunora source directory and
+ * reduce each to a {@link QueryReadIR}. Only reads that call `.filter()` are
+ * returned — an unfiltered read is never a `filter_without_index` candidate, so
+ * dropping the rest keeps the lint input small.
+ */
 declare const discoverQueries: (project: Project, lunoraDirectory: string) => QueryReadIR[];
 /** The only file queues may be declared in — mirrors `lunora/workflows.ts`. */
 declare const QUEUES_FILENAME = "queues.ts";
 /**
-* Discover every queue the project declares: exported `defineQueue()` calls in
-* `lunora/queues.ts`. Returns `[]` when the file doesn't exist. Only the
-* wrangler-relevant literals (`name`/`mode`/batch tuning) are read; the handler
-* body is runtime-only, so codegen never evaluates it.
-*/
+ * Discover every queue the project declares: exported `defineQueue()` calls in
+ * `lunora/queues.ts`. Returns `[]` when the file doesn't exist. Only the
+ * wrangler-relevant literals (`name`/`mode`/batch tuning) are read; the handler
+ * body is runtime-only, so codegen never evaluates it.
+ */
 declare const discoverQueues: (project: Project, lunoraDirectory: string) => QueueIR[];
 /**
-* Discover `ctx.r2sql` accesses lexically inside the handler body of every
-* exported `query(...)` / `mutation(...)` registration under the lunora source
-* directory — the `r2sql_outside_action` lint input. `action(...)` (and
-* `stream(...)`) registrations are intentionally skipped: R2 SQL is the
-* external, non-reactive surface that belongs in actions.
-*
-* Traversal is scoped to the handler node (not the whole declaration), mirroring
-* `discoverNondeterministicCalls` — so a `ctx.r2sql` touch in a sibling helper
-* outside the handler is not attributed to the query/mutation. One
-* {@link R2sqlCallIR} is produced per access site.
-*/
+ * Discover `ctx.r2sql` accesses lexically inside the handler body of every
+ * exported `query(...)` / `mutation(...)` registration under the lunora source
+ * directory — the `r2sql_outside_action` lint input. `action(...)` (and
+ * `stream(...)`) registrations are intentionally skipped: R2 SQL is the
+ * external, non-reactive surface that belongs in actions.
+ *
+ * Traversal is scoped to the handler node (not the whole declaration), mirroring
+ * `discoverNondeterministicCalls` — so a `ctx.r2sql` touch in a sibling helper
+ * outside the handler is not attributed to the query/mutation. One
+ * {@link R2sqlCallIR} is produced per access site.
+ */
 declare const discoverR2sqlCalls: (project: Project, lunoraDirectory: string) => R2sqlCallIR[];
 declare const discoverRlsProcedures: (project: Project, lunoraDirectory: string) => RlsProcedureIR[];
 /**
-* Aggregate the schema-wide RLS metadata the studio's read-only inspector reads:
-* every statically-discovered `(table, on, procedure)` policy entry plus every
-* role declared via `rls(policies, { roles })`. Walks the same builder chains as
-* {@link discoverRlsProcedures} but extracts the richer `{ on }` operation +
-* role/permission shape rather than the lint's table-name set.
-*
-* Only the **builder** form (`c.use(rls(...)).query(...)`) can declare policies,
-* so bare-factory procedures contribute nothing. The `when` predicate is never
-* read — it's an opaque JS closure whose logic belongs in code, not the UI.
-* Roles are deduped by name (first declaration wins) so a role registered on
-* several procedures lists once.
-*/
+ * Aggregate the schema-wide RLS metadata the studio's read-only inspector reads:
+ * every statically-discovered `(table, on, procedure)` policy entry plus every
+ * role declared via `rls(policies, { roles })`. Walks the same builder chains as
+ * {@link discoverRlsProcedures} but extracts the richer `{ on }` operation +
+ * role/permission shape rather than the lint's table-name set.
+ *
+ * Only the **builder** form (`c.use(rls(...)).query(...)`) can declare policies,
+ * so bare-factory procedures contribute nothing. The `when` predicate is never
+ * read — it's an opaque JS closure whose logic belongs in code, not the UI.
+ * Roles are deduped by name (first declaration wins) so a role registered on
+ * several procedures lists once.
+ */
 declare const discoverRlsMetadata: (project: Project, lunoraDirectory: string) => RlsMetadataIR;
 /**
-* Which sandbox tools a project imports from `@lunora/agent` (main entry or the
-* `/sandbox` subpath), detected by NAMED value import. Drives two things:
-* registering the `sandbox:invoke` dispatcher (either tool) and provisioning the
-* `BROWSER` wrangler binding (`browserTool` — the browser op runs on
-* `ctx.browser` inside the dispatcher).
-*/
+ * Which sandbox tools a project imports from `@lunora/agent` (main entry or the
+ * `/sandbox` subpath), detected by NAMED value import. Drives two things:
+ * registering the `sandbox:invoke` dispatcher (either tool) and provisioning the
+ * `BROWSER` wrangler binding (`browserTool` — the browser op runs on
+ * `ctx.browser` inside the dispatcher).
+ */
 interface SandboxUsage {
   /** `import { browserTool } from "@lunora/agent"` (or `/sandbox`) appears in `lunora/`. */
   usesSandboxBrowser: boolean;
@@ -1949,47 +1931,47 @@ interface SandboxUsage {
 }
 declare const discoverSandboxUsage: (project: Project, lunoraDirectory: string) => SandboxUsage;
 /**
-* Load `&lt;projectRoot>/lunora/schema.ts`, find `defineSchema({...})`, and
-* return a structural IR. Throws if the file or call cannot be found.
-*/
+ * Load `&lt;projectRoot>/lunora/schema.ts`, find `defineSchema({...})`, and
+ * return a structural IR. Throws if the file or call cannot be found.
+ */
 declare const discoverSchema: (project: Project, schemaPath: string, projectRoot?: string) => SchemaIR;
 /** The only file shapes may be declared in — mirrors `lunora/queues.ts`. */
 declare const SHAPES_FILENAME = "shapes.ts";
 /**
-* Discover every replication shape the project declares: exported
-* `defineShape()` calls in `lunora/shapes.ts`. Returns `[]` when the file
-* doesn't exist. Only the export binding is lifted — the runtime object carries
-* the authoritative `table`/`columns`/`compileWhere`, so codegen never
-* evaluates the predicate.
-*/
+ * Discover every replication shape the project declares: exported
+ * `defineShape()` calls in `lunora/shapes.ts`. Returns `[]` when the file
+ * doesn't exist. Only the export binding is lifted — the runtime object carries
+ * the authoritative `table`/`columns`/`compileWhere`, so codegen never
+ * evaluates the predicate.
+ */
 declare const discoverShapes: (project: Project, lunoraDirectory: string) => ShapeIR[];
 /**
-* Aggregate the schema-wide storage-rule metadata the studio's inspector reads:
-* every statically-discovered `(bucket, on, prefix, procedure)` entry across all
-* `.use(storageRules(...))` chains. Only the builder form can declare rules, so
-* bare-factory procedures contribute nothing.
-*/
+ * Aggregate the schema-wide storage-rule metadata the studio's inspector reads:
+ * every statically-discovered `(bucket, on, prefix, procedure)` entry across all
+ * `.use(storageRules(...))` chains. Only the builder form can declare rules, so
+ * bare-factory procedures contribute nothing.
+ */
 declare const discoverStorageRulesMetadata: (project: Project, lunoraDirectory: string) => StorageRulesMetadataIR;
 /** The only file workflows may be declared in — mirrors `lunora/containers.ts`. */
 declare const WORKFLOWS_FILENAME = "workflows.ts";
 /**
-* Discover every workflow the project declares: exported `defineWorkflow()`
-* calls in `lunora/workflows.ts`. Returns `[]` when the file doesn't exist. The
-* only wrangler-relevant literal is the optional `name` override; the workflow
-* body is runtime-only, so codegen never evaluates it.
-*/
+ * Discover every workflow the project declares: exported `defineWorkflow()`
+ * calls in `lunora/workflows.ts`. Returns `[]` when the file doesn't exist. The
+ * only wrangler-relevant literal is the optional `name` override; the workflow
+ * body is runtime-only, so codegen never evaluates it.
+ */
 declare const discoverWorkflows: (project: Project, lunoraDirectory: string) => WorkflowIR[];
 declare const GENERATED_HEADER = "// GENERATED by @lunora/codegen — do not edit.\n// Run `lunora codegen` to regenerate.\n\n";
 /** Emit `_generated/dataModel.ts` — `Doc&lt;"name">` + `Id&lt;"name">` for every table. */
 declare const emitDataModel: (schema: SchemaIR, useUmbrella?: boolean) => string;
 /**
-* Emit `_generated/api.ts` — the typed `api.*` registry (public functions), the
-* `internal.*` registry, and (when the project declares them) the typed
-* `workflows.*` / `agents.*` scheduler-target reference objects. `api`/`internal` are the same `anyApi` proxy
-* at runtime (the `__lunoraRef` is identical); visibility is enforced
-* server-side at dispatch, not in the reference. Splitting the *types* keeps
-* internal functions off the client-facing `api` surface.
-*/
+ * Emit `_generated/api.ts` — the typed `api.*` registry (public functions), the
+ * `internal.*` registry, and (when the project declares them) the typed
+ * `workflows.*` / `agents.*` scheduler-target reference objects. `api`/`internal` are the same `anyApi` proxy
+ * at runtime (the `__lunoraRef` is identical); visibility is enforced
+ * server-side at dispatch, not in the reference. Splitting the *types* keeps
+ * internal functions off the client-facing `api` surface.
+ */
 interface EmitApiOptions {
   agents?: ReadonlyArray<AgentIR>;
   functions: ReadonlyArray<FunctionIR>;
@@ -2000,47 +1982,37 @@ interface EmitApiOptions {
 }
 declare const emitApi: (options: EmitApiOptions) => string;
 /**
-* Emit `_generated/seed.ts` — a project-bound `createSeedClient` with this
-* schema's `InsertModel` and runtime schema pre-applied, so a test or script
-* calls `createSeedClient({ seed: 1 }).users(5)` with full column types and no
-* manual wiring. The runtime schema is the default export of `lunora/schema.ts`
-* (the same import the generated ShardDO uses).
-*
-* Returns `""` when `@lunora/seed` is not a declared dependency, so projects
-* that don't use it keep a clean `_generated/` and never import the package.
-*/
-/**
-* Emit `_generated/collections.ts` — one TanStack DB collection factory per
-* `defineShape` in `lunora/shapes.ts` (the local-first partial-replication
-* surface). Each factory builds a live collection that syncs its shape's rowset
-* through the client's poke protocol (`subscribeShape`), so an app feeds the
-* result straight to `useLiveQuery`.
-*
-* Returns `""` (so `writeIfPresent` skips the file) unless the project both
-* declares shapes AND installs `@lunora/db` — the add-on that ships
-* `lunoraCollectionOptions`. `@lunora/db` stays a scoped install even under the
-* `lunorash` umbrella (an opt-in add-on, like `@lunora/auth`), so its import is
-* always `@lunora/db/collections`; only the in-umbrella `@lunora/client` import
-* is remapped to `lunorash/client`.
-*/
+ * Emit `_generated/collections.ts` — one TanStack DB collection factory per
+ * `defineShape` in `lunora/shapes.ts` (the local-first partial-replication
+ * surface). Each factory builds a live collection that syncs its shape's rowset
+ * through the client's poke protocol (`subscribeShape`), so an app feeds the
+ * result straight to `useLiveQuery`.
+ *
+ * Returns `""` (so `writeIfPresent` skips the file) unless the project both
+ * declares shapes AND installs `@lunora/db` — the add-on that ships
+ * `lunoraCollectionOptions`. `@lunora/db` stays a scoped install even under the
+ * `lunorash` umbrella (an opt-in add-on, like `@lunora/auth`), so its import is
+ * always `@lunora/db/collections`; only the in-umbrella `@lunora/client` import
+ * is remapped to `lunorash/client`.
+ */
 declare const emitCollections: (shapes: ReadonlyArray<ShapeIR>, hasDatabase: boolean, useUmbrella?: boolean) => string;
 interface EmitServerOptions {
   /** Agents declared via `defineAgent` exports — wires the typed `ctx.agents` producers onto Mutation/Action contexts. */
   agents?: ReadonlyArray<AgentIR>;
   containers?: ReadonlyArray<ContainerIR>;
   /**
-  * The single `defineEnv(...)` contract declared in `lunora/env.ts`. When
-  * present, `ctx.env` is typed as the validated `InferEnv` shape (recovered
-  * via `ReturnType` over the accessor's `typeof`). `undefined` leaves `ctx.env`
-  * the base optional binding record — byte-identical to today.
-  */
+   * The single `defineEnv(...)` contract declared in `lunora/env.ts`. When
+   * present, `ctx.env` is typed as the validated `InferEnv` shape (recovered
+   * via `ReturnType` over the accessor's `typeof`). `undefined` leaves `ctx.env`
+   * the base optional binding record — byte-identical to today.
+   */
   env?: EnvIR;
   /**
-  * A `lunora/` source reads `ctx.access` — wires the verified Cloudflare Access
-  * facade (`@lunora/cloudflare-access/context`) onto every ctx. Distinct from
-  * `emitApp`'s `hasAccess` (which gates the worker's `.access()` resolveIdentity
-  * method); this one gates the per-request `ctx.access` read surface.
-  */
+   * A `lunora/` source reads `ctx.access` — wires the verified Cloudflare Access
+   * facade (`@lunora/cloudflare-access/context`) onto every ctx. Distinct from
+   * `emitApp`'s `hasAccess` (which gates the worker's `.access()` resolveIdentity
+   * method); this one gates the per-request `ctx.access` read surface.
+   */
   hasAccessFacade?: boolean;
   hasAi?: boolean;
   /** A `lunora/` source uses `@lunora/bindings/analytics` / `ctx.analytics` — wires the write helper onto every ctx. */
@@ -2063,13 +2035,13 @@ interface EmitServerOptions {
   /** A `lunora/` source uses `@lunora/x402/pay` / `ctx.x402` — wires the agent-wallet pay rail onto ActionCtx only. */
   hasX402?: boolean;
   /**
-  * The single `defineIdentity(...)` claim contract declared in
-  * `lunora/identity.ts` (Plan 080). When present, `ctx.auth.getIdentity()`,
-  * the RLS policy `ctx.auth.identity`, and the shard-authorization hooks
-  * narrow to the declared shape (recovered via `InferIdentity` over the
-  * contract's `typeof`). `undefined` keeps the identity an untyped bag —
-  * byte-identical to today.
-  */
+   * The single `defineIdentity(...)` claim contract declared in
+   * `lunora/identity.ts` (Plan 080). When present, `ctx.auth.getIdentity()`,
+   * the RLS policy `ctx.auth.identity`, and the shard-authorization hooks
+   * narrow to the declared shape (recovered via `InferIdentity` over the
+   * contract's `typeof`). `undefined` keeps the identity an untyped bag —
+   * byte-identical to today.
+   */
   identity?: IdentityIR;
   /** Queues declared via `defineQueue` exports — wires the typed `ctx.queues` producers onto Mutation/Action contexts. */
   queues?: ReadonlyArray<QueueIR>;
@@ -2079,29 +2051,7 @@ interface EmitServerOptions {
   useUmbrella?: boolean;
   workflows?: ReadonlyArray<WorkflowIR>;
 }
-declare const emitServer: ({
-  agents,
-  containers,
-  env,
-  hasAccessFacade,
-  hasAi,
-  hasAnalytics,
-  hasBrowser,
-  hasFlags,
-  hasHyperdrive,
-  hasImages,
-  hasKv,
-  hasPayments,
-  hasPipelines,
-  hasR2sql,
-  hasX402,
-  identity,
-  queues,
-  schema,
-  storageRuleBuckets,
-  useUmbrella,
-  workflows
-}?: EmitServerOptions) => string;
+declare const emitServer: ({ agents, containers, env, hasAccessFacade, hasAi, hasAnalytics, hasBrowser, hasFlags, hasHyperdrive, hasImages, hasKv, hasPayments, hasPipelines, hasR2sql, hasX402, identity, queues, schema, storageRuleBuckets, useUmbrella, workflows }?: EmitServerOptions) => string;
 interface EmitFunctionsOptions {
   agents?: ReadonlyArray<AgentIR>;
   functions: ReadonlyArray<FunctionIR>;
@@ -2114,50 +2064,33 @@ interface EmitFunctionsOptions {
 }
 declare const emitFunctions: (options: EmitFunctionsOptions) => string;
 /**
-* Storage-column map per table for the file browser: `{ table: [field, …] }` for
-* every field declared `v.storage(...)` (unwrapping `v.optional(...)`). The
-* generated shard hands this to the base `storageColumns` hook so the admin
-* `storageReferences` read can join R2 objects back to the rows that own them
-* (and flag orphans — objects no row references). Only scalar storage columns
-* are emitted; an array-of-storage field can't be matched by an equality scan,
-* so it is skipped here.
-*/
-/**
-* Emit `_generated/containers.ts` — one container-enabled Durable Object class
-* per `defineContainer` export, each a thin subclass of `LunoraContainer`
-* (`@lunora/container/do`) constructed with the user's definition object. The
-* worker entry must re-export these classes: wrangler requires every
-* `containers[].class_name` to be exported by the deployed worker. Returns ""
-* when the project declares no containers (the file is not written then).
-*/
+ * Emit `_generated/containers.ts` — one container-enabled Durable Object class
+ * per `defineContainer` export, each a thin subclass of `LunoraContainer`
+ * (`@lunora/container/do`) constructed with the user's definition object. The
+ * worker entry must re-export these classes: wrangler requires every
+ * `containers[].class_name` to be exported by the deployed worker. Returns ""
+ * when the project declares no containers (the file is not written then).
+ */
 declare const emitContainers: (containers: ReadonlyArray<ContainerIR>, jurisdiction?: JurisdictionIR) => string;
 /**
-* Emit `_generated/workflows.ts` — one `WorkflowEntrypoint` class per
-* `defineWorkflow` export, each a thin subclass of `LunoraWorkflow`
-* (`@lunora/workflow/do`) constructed with the user's definition object. The
-* worker entry must re-export these classes: wrangler requires every
-* `workflows[].class_name` to be exported by the deployed worker. Returns ""
-* when the project declares no workflows (the file is not written then).
-*/
+ * Emit `_generated/workflows.ts` — one `WorkflowEntrypoint` class per
+ * `defineWorkflow` export, each a thin subclass of `LunoraWorkflow`
+ * (`@lunora/workflow/do`) constructed with the user's definition object. The
+ * worker entry must re-export these classes: wrangler requires every
+ * `workflows[].class_name` to be exported by the deployed worker. Returns ""
+ * when the project declares no workflows (the file is not written then).
+ */
 declare const emitWorkflows: (workflows: ReadonlyArray<WorkflowIR>) => string;
 /**
-* Emit `_generated/agents.ts` — one `WorkflowEntrypoint` class per `defineAgent`
-* export, each a thin subclass of `LunoraWorkflow` (`@lunora/workflow/do`)
-* constructed with the compiled agent tool-loop (`compileAgentWorkflow`). Like
-* `_generated/workflows.ts`, the worker entry must re-export these classes:
-* wrangler requires every `workflows[].class_name` to be exported by the
-* deployed worker. Returns "" when the project declares no agents (the file is
-* not written then).
-*/
+ * Emit `_generated/agents.ts` — one `WorkflowEntrypoint` class per `defineAgent`
+ * export, each a thin subclass of `LunoraWorkflow` (`@lunora/workflow/do`)
+ * constructed with the compiled agent tool-loop (`compileAgentWorkflow`). Like
+ * `_generated/workflows.ts`, the worker entry must re-export these classes:
+ * wrangler requires every `workflows[].class_name` to be exported by the
+ * deployed worker. Returns "" when the project declares no agents (the file is
+ * not written then).
+ */
 declare const emitAgents: (agents: ReadonlyArray<AgentIR>) => string;
-/**
-* Emit `_generated/queues.ts` — the push-consumer registry the worker `queue()`
-* handler dispatches through. Maps each push queue's stable wrangler name (which
-* `batch.queue` carries) to its `defineQueue` definition + export name. Pull
-* queues are consumed by an external worker, so they carry no handler and are
-* omitted here. Returns "" (and the file is not written) when no push queues are
-* declared — a pull-only or queue-free app keeps a clean `_generated/`.
-*/
 interface EmitShardOptions {
   advisories?: ReadonlyArray<Finding>;
   /** Agents declared via `defineAgent` exports in `lunora/agents.ts` — wires the typed `ctx.agents` producers. */
@@ -2207,100 +2140,72 @@ interface EmitShardOptions {
   useUmbrella?: boolean;
   workflows?: ReadonlyArray<WorkflowIR>;
 }
-declare const emitShard: ({
-  advisories,
-  agents,
-  containers,
-  env,
-  flagKeys,
-  hasAccessFacade,
-  hasAi,
-  hasAnalytics,
-  hasBrowser,
-  hasFlags,
-  hasHyperdrive,
-  hasImages,
-  hasKv,
-  hasPayments,
-  hasPipelines,
-  hasR2sql,
-  hasX402,
-  maskMetadata,
-  mutators,
-  queues,
-  rlsMetadata,
-  schema,
-  shapes,
-  storageRules,
-  studioFeatures,
-  useUmbrella,
-  workflows
-}: EmitShardOptions) => string;
-/**
-* Emit drizzle `sqliteTable` definitions for the project schema, split into
-* `global` (D1-backed) and `shard` (DO-SQLite-backed) buckets. Tables marked
-* `.global()` go in the global file; everything else (default root + `.shardBy()`)
-* goes in the shard file.
-*
-* `searchIndexes` are intentionally not emitted — drizzle has no `sqliteTable`
-* abstraction for FTS5 virtual tables. FTS plumbing is handled by the runtime
-* outside of drizzle.
-*/
+declare const emitShard: ({ advisories, agents, containers, env, flagKeys, hasAccessFacade, hasAi, hasAnalytics, hasBrowser, hasFlags, hasHyperdrive, hasImages, hasKv, hasPayments, hasPipelines, hasR2sql, hasX402, maskMetadata, mutators, queues, rlsMetadata, schema, shapes, storageRules, studioFeatures, useUmbrella, workflows }: EmitShardOptions) => string;
+/**
+ * Emit drizzle `sqliteTable` definitions for the project schema, split into
+ * `global` (D1-backed) and `shard` (DO-SQLite-backed) buckets. Tables marked
+ * `.global()` go in the global file; everything else (default root + `.shardBy()`)
+ * goes in the shard file.
+ *
+ * `searchIndexes` are intentionally not emitted — drizzle has no `sqliteTable`
+ * abstraction for FTS5 virtual tables. FTS plumbing is handled by the runtime
+ * outside of drizzle.
+ */
 declare const emitDrizzleSchema: (schema: SchemaIR, useUmbrella?: boolean) => {
   global: string;
   shard: string;
 };
 /**
-* Emit `_generated/crons.ts` from the discovered cron jobs.
-*
-* `LUNORA_CRON_TRIGGERS` is the deduplicated schedule array — what lands in
-* wrangler's `triggers.crons` (the vite plugin reconciles it into
-* `wrangler.jsonc`, and {@link emitWranglerCronTriggers} renders the same list
-* for the CLI / docs).
-*
-* `LUNORA_CRONS` is the dispatcher map keyed by cron expression, each value a
-* list of `{ name, functionPath, args }`. Cloudflare's `scheduled()` handler
-* receives only the cron string, so multiple jobs sharing one expression must
-* all fire — hence a list per key rather than a single entry.
-*
-* Jobs arrive pre-sorted by name (deterministic output); the trigger array
-* preserves first-seen order of distinct expressions.
-*
-* Cloudflare caps a Worker at **3 Cron Triggers** (i.e. 3 distinct cron
-* expressions). Because the dispatcher fires every job sharing an expression,
-* many jobs can ride a single trigger — only the count of *distinct* schedules
-* matters. `lunora codegen` warns when that count exceeds the limit; for
-* finer-grained scheduling use Durable Object alarms (`@lunora/scheduler`),
-* which have no such cap.
-*/
+ * Emit `_generated/crons.ts` from the discovered cron jobs.
+ *
+ * `LUNORA_CRON_TRIGGERS` is the deduplicated schedule array — what lands in
+ * wrangler's `triggers.crons` (the vite plugin reconciles it into
+ * `wrangler.jsonc`, and {@link emitWranglerCronTriggers} renders the same list
+ * for the CLI / docs).
+ *
+ * `LUNORA_CRONS` is the dispatcher map keyed by cron expression, each value a
+ * list of `{ name, functionPath, args }`. Cloudflare's `scheduled()` handler
+ * receives only the cron string, so multiple jobs sharing one expression must
+ * all fire — hence a list per key rather than a single entry.
+ *
+ * Jobs arrive pre-sorted by name (deterministic output); the trigger array
+ * preserves first-seen order of distinct expressions.
+ *
+ * Cloudflare caps a Worker at **3 Cron Triggers** (i.e. 3 distinct cron
+ * expressions). Because the dispatcher fires every job sharing an expression,
+ * many jobs can ride a single trigger — only the count of *distinct* schedules
+ * matters. `lunora codegen` warns when that count exceeds the limit; for
+ * finer-grained scheduling use Durable Object alarms (`@lunora/scheduler`),
+ * which have no such cap.
+ */
 declare const emitCrons: (crons: ReadonlyArray<CronJobIR>) => string;
 /**
-* Render `_generated/vectors.ts` — the static registry of every vector index
-* declared in `schema.ts` (inline `.vectorize()` columns + standalone
-* `defineVectorIndex()` definitions).
-*
-* Cloudflare Vectorize exposes no way to enumerate an account's indexes at
-* runtime — a binding can `describe()` itself but the worker can't ask "which
-* indexes exist". So this generated array is the source of truth the studio's
-* vector browser lists, and the worker's admin route pairs each entry with its
-* live `describe()` stats. Entries are sorted by name for deterministic output.
-*/
+ * Render `_generated/vectors.ts` — the static registry of every vector index
+ * declared in `schema.ts` (inline `.vectorize()` columns + standalone
+ * `defineVectorIndex()` definitions).
+ *
+ * Cloudflare Vectorize exposes no way to enumerate an account's indexes at
+ * runtime — a binding can `describe()` itself but the worker can't ask "which
+ * indexes exist". So this generated array is the source of truth the studio's
+ * vector browser lists, and the worker's admin route pairs each entry with its
+ * live `describe()` stats. Entries are sorted by name for deterministic output.
+ */
 declare const emitVectors: (vectorIndexes: ReadonlyArray<VectorIndexIR>) => string;
 /**
-* Render the deduplicated cron schedules as a JSON fragment suitable for
-* splicing into `wrangler.jsonc`'s `triggers.crons`. The vite plugin uses this
-* (plus the parsed wrangler config) to reconcile generated triggers without the
-* user hand-editing the file.
-*/
+ * Render the deduplicated cron schedules as a JSON fragment suitable for
+ * splicing into `wrangler.jsonc`'s `triggers.crons`. The vite plugin uses this
+ * (plus the parsed wrangler config) to reconcile generated triggers without the
+ * user hand-editing the file.
+ */
 declare const emitWranglerCronTriggers: (crons: ReadonlyArray<CronJobIR>) => string[];
 /** Which capability methods the generated `defineApp` builder exposes — one flag per package-backed feature the app actually uses. */
 interface EmitAppOptions {
   /**
-  * Inbound-email agents (`defineAgent({ onEmail })`) → wire the worker's
-  * top-level `email()` handler to `dispatchAgentEmail(...)` (from
-  * `@lunora/agent/inbound`), so received mail starts a durable run. Empty/absent
-  * ⇒ no wiring, byte-identical output for email-free (and agent-free) projects.
-  */
+   * Inbound-email agents (`defineAgent({ onEmail })`) → wire the worker's
+   * top-level `email()` handler to `dispatchAgentEmail(...)` (from
+   * `@lunora/agent/inbound`), so received mail starts a durable run. Empty/absent
+   * ⇒ no wiring, byte-identical output for email-free (and agent-free) projects.
+   */
   emailAgents?: ReadonlyArray<{
     bindingName: string;
     exportName: string;
@@ -2350,12 +2255,12 @@ interface EmitAppOptions {
   /** Project depends on the unscoped `lunorash` umbrella → import the runtime via `lunorash/runtime` instead of `@lunora/runtime`. */
   useUmbrella: boolean;
   /**
-  * Voice-enabled agents (`defineAgent({ voice: … })`) → wire
-  * `options.voiceAgents`, mapping each agent's export name to its `VOICE_*`
-  * Durable Object namespace binding so the runtime exposes
-  * `/_lunora/voice/&lt;exportName>`. Empty/absent ⇒ no wiring, byte-identical
-  * output for voice-free (and agent-free) projects.
-  */
+   * Voice-enabled agents (`defineAgent({ voice: … })`) → wire
+   * `options.voiceAgents`, mapping each agent's export name to its `VOICE_*`
+   * Durable Object namespace binding so the runtime exposes
+   * `/_lunora/voice/&lt;exportName>`. Empty/absent ⇒ no wiring, byte-identical
+   * output for voice-free (and agent-free) projects.
+   */
   voiceAgents?: ReadonlyArray<{
     bindingName: string;
     exportName: string;
@@ -2366,20 +2271,20 @@ interface EmitAppOptions {
   wantsOpenRpc: boolean;
 }
 /**
-* Emit `_generated/app.ts` — a fluent, feature-specialized worker-composition
-* builder. Only the methods for capabilities THIS app uses are emitted, so the
-* builder's type surface (IntelliSense) lists exactly what can be configured.
-*
-* Each capability declaration is fanned into BOTH runtime surfaces: the DO-side
-* `createShardDO(...)` factory that backs `ctx.*`, and the worker-side
-* `createWorker(...)` options that back the studio/admin endpoints — so storage
-* / scheduler / global are declared once instead of twice. The builder is pure
-* sugar over the public `createWorker` / `createShardDO`; both stay usable.
-*
-* Lives in generated code (not `@lunora/runtime`, which is dependency-free) so
-* it can import the add-on packages the app installed (`@lunora/auth`,
-* `@lunora/storage`, …) directly.
-*/
+ * Emit `_generated/app.ts` — a fluent, feature-specialized worker-composition
+ * builder. Only the methods for capabilities THIS app uses are emitted, so the
+ * builder's type surface (IntelliSense) lists exactly what can be configured.
+ *
+ * Each capability declaration is fanned into BOTH runtime surfaces: the DO-side
+ * `createShardDO(...)` factory that backs `ctx.*`, and the worker-side
+ * `createWorker(...)` options that back the studio/admin endpoints — so storage
+ * / scheduler / global are declared once instead of twice. The builder is pure
+ * sugar over the public `createWorker` / `createShardDO`; both stay usable.
+ *
+ * Lives in generated code (not `@lunora/runtime`, which is dependency-free) so
+ * it can import the add-on packages the app installed (`@lunora/auth`,
+ * `@lunora/storage`, …) directly.
+ */
 declare const emitApp: (options: EmitAppOptions) => string;
 /** Inputs the OpenAPI emitter needs from a codegen run. */
 interface OpenApiEmitInput {
@@ -2389,40 +2294,40 @@ interface OpenApiEmitInput {
   version?: string;
 }
 /**
-* Emit an OpenAPI 3.1.0 document covering both Lunora function surfaces.
-*
-* `httpRouter()` typed REST routes become real `paths` keyed by their method +
-* URL, with query/path parameters and JSON request bodies derived from their
-* `v.*` validators, and a response schema from `.output()` when declared.
-*
-* RPC `query`/`mutation`/`action` functions become one operation each on
-* `POST /_lunora/rpc` (disambiguated by a `#functionPath` path fragment), with a
-* requestBody pinning `functionPath` + typed `args`. `internal`/`stream`
-* functions are excluded (unreachable / not invocable on the external RPC path).
-*
-* Operations are grouped into `tags` by file namespace, and every operation
-* references a reusable `LunoraError` error-response component enumerating the
-* standard error codes. Borrows oRPC's per-procedure-operation + tag-grouping +
-* internal-filtering structure; the JSON Schema dialect matches `@lunora/values`
-* (Draft 2020-12). Returns the document as a plain object (the single source of
-* truth `emitOpenApi` stringifies and `emitOpenApiModule` inlines, so the
-* `.json` and `.ts` artifacts can never drift).
-*/
+ * Emit an OpenAPI 3.1.0 document covering both Lunora function surfaces.
+ *
+ * `httpRouter()` typed REST routes become real `paths` keyed by their method +
+ * URL, with query/path parameters and JSON request bodies derived from their
+ * `v.*` validators, and a response schema from `.output()` when declared.
+ *
+ * RPC `query`/`mutation`/`action` functions become one operation each on
+ * `POST /_lunora/rpc` (disambiguated by a `#functionPath` path fragment), with a
+ * requestBody pinning `functionPath` + typed `args`. `internal`/`stream`
+ * functions are excluded (unreachable / not invocable on the external RPC path).
+ *
+ * Operations are grouped into `tags` by file namespace, and every operation
+ * references a reusable `LunoraError` error-response component enumerating the
+ * standard error codes. Borrows oRPC's per-procedure-operation + tag-grouping +
+ * internal-filtering structure; the JSON Schema dialect matches `@lunora/values`
+ * (Draft 2020-12). Returns the document as a plain object (the single source of
+ * truth `emitOpenApi` stringifies and `emitOpenApiModule` inlines, so the
+ * `.json` and `.ts` artifacts can never drift).
+ */
 declare const buildOpenApiDocument: (input: OpenApiEmitInput) => Record<string, unknown>;
 /**
-* Emit the OpenAPI 3.1 document as a pretty-printed JSON string
-* (`_generated/openapi.json`) — the portable artifact for external tooling.
-*/
+ * Emit the OpenAPI 3.1 document as a pretty-printed JSON string
+ * (`_generated/openapi.json`) — the portable artifact for external tooling.
+ */
 declare const emitOpenApi: (input: OpenApiEmitInput) => string;
 /**
-* Emit the OpenAPI document as an importable TS module
-* (`_generated/openapi.ts`) the worker entry imports and passes to
-* `createWorker({ openApiSpec })`. The document object literal is inlined
-* verbatim (same `JSON.stringify` form the `.json` uses), so the `.ts` and
-* `.json` are byte-identical content and regenerate together — closing the gap
-* where a Worker cannot read the JSON file at runtime. `document_` is the object
-* returned by {@link buildOpenApiDocument} (reused, never recomputed).
-*/
+ * Emit the OpenAPI document as an importable TS module
+ * (`_generated/openapi.ts`) the worker entry imports and passes to
+ * `createWorker({ openApiSpec })`. The document object literal is inlined
+ * verbatim (same `JSON.stringify` form the `.json` uses), so the `.ts` and
+ * `.json` are byte-identical content and regenerate together — closing the gap
+ * where a Worker cannot read the JSON file at runtime. `document_` is the object
+ * returned by {@link buildOpenApiDocument} (reused, never recomputed).
+ */
 declare const emitOpenApiModule: (document_: Record<string, unknown>) => string;
 /** The OpenRPC dialect version this emitter targets. */
 declare const OPENRPC_VERSION = "1.3.2";
@@ -2433,37 +2338,37 @@ interface OpenRpcEmitInput {
   version?: string;
 }
 /**
-* Emit an OpenRPC 1.x document describing Lunora's JSON-RPC surface.
-*
-* Only the RPC `query`/`mutation`/`action` functions become `methods` — one per
-* function, `name` = `file:fn`. `internal` (off the external RPC path) and
-* `stream` (not invocable over the RPC envelope) are excluded, the same filter
-* the OpenAPI emitter applies. Each method's single `args` param is typed from
-* the function's `v.*` validators (`argsObjectSchema`); `result` is the
-* `.output()` schema when declared, else a best-effort inferred schema. The
-* standard `LunoraError` codes ride along under each method's `errors`.
-*
-* `httpRouter()` typed REST routes are deliberately omitted — OpenRPC is
-* RPC-only and cannot represent REST paths; the OpenAPI document is the spec
-* that covers the REST surface. Methods are sorted by name for stable output.
-* Returns the document as a plain object (the single source of truth
-* `emitOpenRpc` stringifies and `emitOpenRpcModule` inlines, so the `.json` and
-* `.ts` artifacts can never drift).
-*/
+ * Emit an OpenRPC 1.x document describing Lunora's JSON-RPC surface.
+ *
+ * Only the RPC `query`/`mutation`/`action` functions become `methods` — one per
+ * function, `name` = `file:fn`. `internal` (off the external RPC path) and
+ * `stream` (not invocable over the RPC envelope) are excluded, the same filter
+ * the OpenAPI emitter applies. Each method's single `args` param is typed from
+ * the function's `v.*` validators (`argsObjectSchema`); `result` is the
+ * `.output()` schema when declared, else a best-effort inferred schema. The
+ * standard `LunoraError` codes ride along under each method's `errors`.
+ *
+ * `httpRouter()` typed REST routes are deliberately omitted — OpenRPC is
+ * RPC-only and cannot represent REST paths; the OpenAPI document is the spec
+ * that covers the REST surface. Methods are sorted by name for stable output.
+ * Returns the document as a plain object (the single source of truth
+ * `emitOpenRpc` stringifies and `emitOpenRpcModule` inlines, so the `.json` and
+ * `.ts` artifacts can never drift).
+ */
 declare const buildOpenRpcDocument: (input: OpenRpcEmitInput) => Record<string, unknown>;
 /**
-* Emit the OpenRPC 1.x document as a pretty-printed JSON string
-* (`_generated/openrpc.json`) — the portable artifact for external tooling.
-*/
+ * Emit the OpenRPC 1.x document as a pretty-printed JSON string
+ * (`_generated/openrpc.json`) — the portable artifact for external tooling.
+ */
 declare const emitOpenRpc: (input: OpenRpcEmitInput) => string;
 /**
-* Emit the OpenRPC document as an importable TS module
-* (`_generated/openrpc.ts`) the worker entry imports and passes to
-* `createWorker({ openRpcSpec })`. The document object literal is inlined
-* verbatim (same `JSON.stringify` form the `.json` uses), so the `.ts` and
-* `.json` are byte-identical content and regenerate together. `document_` is
-* the object returned by {@link buildOpenRpcDocument} (reused, never recomputed).
-*/
+ * Emit the OpenRPC document as an importable TS module
+ * (`_generated/openrpc.ts`) the worker entry imports and passes to
+ * `createWorker({ openRpcSpec })`. The document object literal is inlined
+ * verbatim (same `JSON.stringify` form the `.json` uses), so the `.ts` and
+ * `.json` are byte-identical content and regenerate together. `document_` is
+ * the object returned by {@link buildOpenRpcDocument} (reused, never recomputed).
+ */
 declare const emitOpenRpcModule: (document_: Record<string, unknown>) => string;
 /** Current snapshot format version. Bumped if the structural shape below changes. */
 declare const SCHEMA_SNAPSHOT_VERSION: 1;
@@ -2494,26 +2399,26 @@ interface TableSnapshot {
   /** Relation accessor name → {@link RelationSnapshot}. */
   relations: Record<string, RelationSnapshot>;
   /**
-  * `"root"` (default single-DO), `"global"` (D1-replicated), or
-  * `"shardBy:&lt;field>"` (partitioned). Encoded as a string so the snapshot
-  * stays a plain JSON-stable value.
-  */
+   * `"root"` (default single-DO), `"global"` (D1-replicated), or
+   * `"shardBy:&lt;field>"` (partitioned). Encoded as a string so the snapshot
+   * stays a plain JSON-stable value.
+   */
   shardMode: string;
 }
 /** The committed baseline — a deterministic structural view of the whole schema. */
 interface SchemaSnapshot {
   /**
-  * Cloudflare DO data-residency jurisdiction declared via `.jurisdiction("…")`,
-  * or absent. Tracked because changing it strands all existing Durable Object
-  * data (a DO name maps to a different ID per jurisdiction). Optional, so old
-  * baselines written before this field parse cleanly (absent ⇒ undefined).
-  *
-  * Typed as a plain `string` (not the authoring union) on purpose: this is
-  * STORED data that a newer Lunora may have written with a jurisdiction this
-  * version doesn't yet know. Preserving the raw value keeps the breaking
-  * `changedJurisdiction` diff correct under a downgrade — coercing an unknown
-  * value to `undefined` would fail OPEN and hide the most destructive change.
-  */
+   * Cloudflare DO data-residency jurisdiction declared via `.jurisdiction("…")`,
+   * or absent. Tracked because changing it strands all existing Durable Object
+   * data (a DO name maps to a different ID per jurisdiction). Optional, so old
+   * baselines written before this field parse cleanly (absent ⇒ undefined).
+   *
+   * Typed as a plain `string` (not the authoring union) on purpose: this is
+   * STORED data that a newer Lunora may have written with a jurisdiction this
+   * version doesn't yet know. Preserving the raw value keeps the breaking
+   * `changedJurisdiction` diff correct under a downgrade — coercing an unknown
+   * value to `undefined` would fail OPEN and hide the most destructive change.
+   */
   jurisdiction?: string;
   /** Sorted list of every declared `defineMigration` id at capture time. */
   migrationIds: ReadonlyArray<string>;
@@ -2536,36 +2441,36 @@ interface SchemaDrift {
   changes: ReadonlyArray<DriftChange>;
 }
 /**
-* Build a {@link SchemaSnapshot} from a parsed {@link SchemaIR} and the set of
-* declared migration ids. Tables and migration ids are sorted so the emitted
-* JSON is byte-stable across runs (no spurious diffs / churn).
-*/
+ * Build a {@link SchemaSnapshot} from a parsed {@link SchemaIR} and the set of
+ * declared migration ids. Tables and migration ids are sorted so the emitted
+ * JSON is byte-stable across runs (no spurious diffs / churn).
+ */
 declare const buildSchemaSnapshot: (schema: SchemaIR, migrationIds: ReadonlyArray<string>) => SchemaSnapshot;
 /** Serialize a snapshot to the exact bytes written to `lunora/.lunora-schema.json` (trailing newline). */
 declare const serializeSchemaSnapshot: (snapshot: SchemaSnapshot) => string;
 /**
-* Thrown by {@link parseSchemaSnapshot} when the baseline file exists but is
-* malformed (bad JSON / wrong version / invalid table shape). Lets the CLI gate
-* treat a corrupt baseline as a hard error rather than silently degrading to a
-* "first capture" that would mask drift and then overwrite the bad file.
-*/
+ * Thrown by {@link parseSchemaSnapshot} when the baseline file exists but is
+ * malformed (bad JSON / wrong version / invalid table shape). Lets the CLI gate
+ * treat a corrupt baseline as a hard error rather than silently degrading to a
+ * "first capture" that would mask drift and then overwrite the bad file.
+ */
 declare class SchemaSnapshotParseError extends LunoraError {
   constructor(message: string);
 }
 /**
-* Parse a committed snapshot file. Returns `undefined` ONLY when the content is
-* absent/empty; throws {@link SchemaSnapshotParseError} when content is present
-* but malformed (bad JSON, wrong version, or structurally-invalid tables) so the
-* caller can distinguish "no baseline yet" (a legitimate first capture) from "a
-* corrupt baseline" (which must not be silently treated as a first capture).
-*/
+ * Parse a committed snapshot file. Returns `undefined` ONLY when the content is
+ * absent/empty; throws {@link SchemaSnapshotParseError} when content is present
+ * but malformed (bad JSON, wrong version, or structurally-invalid tables) so the
+ * caller can distinguish "no baseline yet" (a legitimate first capture) from "a
+ * corrupt baseline" (which must not be silently treated as a first capture).
+ */
 declare const parseSchemaSnapshot: (content: string | undefined) => SchemaSnapshot | undefined;
 /**
-* Diff the current snapshot against a committed baseline and classify every
-* structural change. Pure — no I/O. When `baseline` is `undefined` (no committed
-* snapshot yet) there is no drift to report: every table is treated as a fresh
-* additive `addedTable`, so a first deploy is never blocked.
-*/
+ * Diff the current snapshot against a committed baseline and classify every
+ * structural change. Pure — no I/O. When `baseline` is `undefined` (no committed
+ * snapshot yet) there is no drift to report: every table is treated as a fresh
+ * additive `addedTable`, so a first deploy is never blocked.
+ */
 declare const diffSchemaSnapshots: (baseline: SchemaSnapshot | undefined, current: SchemaSnapshot) => SchemaDrift;
 /** The decision the pre-deploy gate returns. */
 interface SchemaDriftDecision {
@@ -2576,157 +2481,158 @@ interface SchemaDriftDecision {
   /** Migration ids declared now but absent from the baseline — proof a migration was added. */
   newMigrationIds: ReadonlyArray<string>;
   /**
-  * A multi-line, actionable explanation. Always present; empty string when
-  * there is no drift at all. Mirrors the D1-placeholder guard's message style.
-  */
+   * A multi-line, actionable explanation. Always present; empty string when
+   * there is no drift at all. Mirrors the D1-placeholder guard's message style.
+   */
   reason: string;
 }
 /**
-* Decide whether breaking schema drift should block a deploy.
-*
-* Blocks only when the baseline exists (a first-ever capture is never blocking),
-* there is at least one `breaking` change, no NEW migration id was added since
-* the baseline, and the `allowDrift` override is not set. Safe-only drift (or
-* breaking drift accompanied by a new migration id) passes.
-*/
+ * Decide whether breaking schema drift should block a deploy.
+ *
+ * Blocks only when the baseline exists (a first-ever capture is never blocking),
+ * there is at least one `breaking` change, no NEW migration id was added since
+ * the baseline, and the `allowDrift` override is not set. Safe-only drift (or
+ * breaking drift accompanied by a new migration id) passes.
+ */
 declare const evaluateSchemaDrift: (options: {
   allowDrift?: boolean;
   baseline: SchemaSnapshot | undefined;
   current: SchemaSnapshot;
 }) => SchemaDriftDecision;
 /**
-* Committed, tracked baseline file holding the blessed structural schema
-* snapshot the pre-deploy drift gate diffs against. Lives in `lunora/` (NOT the
-* gitignored `_generated/`) so it is committed alongside `schema.ts`. Leading
-* dot keeps it tucked away next to the schema it describes.
-*/
+ * Committed, tracked baseline file holding the blessed structural schema
+ * snapshot the pre-deploy drift gate diffs against. Lives in `lunora/` (NOT the
+ * gitignored `_generated/`) so it is committed alongside `schema.ts`. Leading
+ * dot keeps it tucked away next to the schema it describes.
+ */
 declare const SCHEMA_SNAPSHOT_FILENAME = ".lunora-schema.json";
 /**
-* Construct the ts-morph `Project` codegen discovers over. Prefers the user's
-* `tsconfig.json` (when one is found walking up from `lunoraDirectory`) so
-* cross-file type resolution and path aliases work; falls back to an isolated
-* project otherwise. This is the exact construction {@link runCodegen} uses
-* when no `project` is injected — exported so a long-lived caller (the Vite
-* dev-loop) can build one once and reuse it across runs via
-* {@link refreshCodegenProject} instead of re-parsing the user's whole TS
-* program on every save.
-*/
+ * Construct the ts-morph `Project` codegen discovers over. Prefers the user's
+ * `tsconfig.json` (when one is found walking up from `lunoraDirectory`) so
+ * cross-file type resolution and path aliases work; falls back to an isolated
+ * project otherwise. This is the exact construction {@link runCodegen} uses
+ * when no `project` is injected — exported so a long-lived caller (the Vite
+ * dev-loop) can build one once and reuse it across runs via
+ * {@link refreshCodegenProject} instead of re-parsing the user's whole TS
+ * program on every save.
+ */
 declare const createCodegenProject: (lunoraDirectory: string) => Project;
 /**
-* Synchronise a reused {@link createCodegenProject} Project with the current
-* on-disk state of `lunoraDirectory`, so the next {@link runCodegen} sees the
-* same files a freshly-constructed Project would — without re-parsing the whole
-* TS program. Adds any on-disk source file the Project doesn't yet have, and
-* `refreshFromFileSystemSync()`es the ones it does (picking up edits); then
-* removes Project source files under `lunoraDirectory` that no longer exist on
-* disk (the classic stale-deleted-file cache bug).
-*
-* Files outside `lunoraDirectory` (e.g. those pulled in by the user's tsconfig)
-* are left untouched — they back type resolution and rarely change in the
-* dev-loop; a tsconfig change invalidates the whole cached Project upstream.
-*/
+ * Synchronise a reused {@link createCodegenProject} Project with the current
+ * on-disk state of `lunoraDirectory`, so the next {@link runCodegen} sees the
+ * same files a freshly-constructed Project would — without re-parsing the whole
+ * TS program. Adds any on-disk source file the Project doesn't yet have, and
+ * `refreshFromFileSystemSync()`es the ones it does (picking up edits); then
+ * removes Project source files under `lunoraDirectory` that no longer exist on
+ * disk (the classic stale-deleted-file cache bug).
+ *
+ * Files outside `lunoraDirectory` (e.g. those pulled in by the user's tsconfig)
+ * are left untouched — they back type resolution and rarely change in the
+ * dev-loop; a tsconfig change invalidates the whole cached Project upstream.
+ */
 declare const refreshCodegenProject: (project: Project, lunoraDirectory: string) => void;
 /**
-* Top-level codegen entry. Parses `&lt;projectRoot>/lunora/schema.ts` and every
-* function file under `&lt;projectRoot>/lunora/`, then writes
-* `_generated/{api,server,dataModel}.ts` next to them.
-*
-* When `LUNORA_CODEGEN_TIMING` is set (truthy), a single diagnostic summary
-* line is written to stderr with the total wall time and the discovery-vs-emit
-* split — opt-in instrumentation that is otherwise zero-cost and side-effect-free
-* on the returned {@link CodegenResult}.
-*/
+ * Top-level codegen entry. Parses `&lt;projectRoot>/lunora/schema.ts` and every
+ * function file under `&lt;projectRoot>/lunora/`, then writes
+ * `_generated/{api,server,dataModel}.ts` next to them.
+ *
+ * When `LUNORA_CODEGEN_TIMING` is set (truthy), a single diagnostic summary
+ * line is written to stderr with the total wall time and the discovery-vs-emit
+ * split — opt-in instrumentation that is otherwise zero-cost and side-effect-free
+ * on the returned {@link CodegenResult}.
+ */
 declare const runCodegen: (options: CodegenOptions) => CodegenResult;
 interface CodegenOptions {
   /**
-  * Which machine-readable API spec(s) to emit into `_generated/`.
-  *
-  * `"openapi"` (the default) writes only `openapi.json` (OpenAPI 3.1; covers
-  * both the RPC functions and `httpRouter()` REST routes). `"openrpc"` writes
-  * only `openrpc.json` (OpenRPC 1.x; the RPC functions only — OpenRPC cannot
-  * represent REST routes). `"both"` writes both files; `"none"` writes neither.
-  *
-  * Regardless of the choice, `CodegenResult.generated.openApi` and `.openRpc`
-  * always carry the rendered string (computation is cheap and pure); only the
-  * on-disk write is gated by this option.
-  */
+   * Which machine-readable API spec(s) to emit into `_generated/`.
+   *
+   * `"openapi"` (the default) writes only `openapi.json` (OpenAPI 3.1; covers
+   * both the RPC functions and `httpRouter()` REST routes). `"openrpc"` writes
+   * only `openrpc.json` (OpenRPC 1.x; the RPC functions only — OpenRPC cannot
+   * represent REST routes). `"both"` writes both files; `"none"` writes neither.
+   *
+   * Regardless of the choice, `CodegenResult.generated.openApi` and `.openRpc`
+   * always carry the rendered string (computation is cheap and pure); only the
+   * on-disk write is gated by this option.
+   */
   apiSpec?: "both" | "none" | "openapi" | "openrpc";
   /**
-  * When true, run discovery + emit (so any schema/function parse error
-  * surfaces) but skip writing files to `_generated/`. The returned
-  * `outputDirectory` is still the path that *would* have been written.
-  */
+   * When true, run discovery + emit (so any schema/function parse error
+   * surfaces) but skip writing files to `_generated/`. The returned
+   * `outputDirectory` is still the path that *would* have been written.
+   */
   dryRun?: boolean;
   /**
-  * Run the static schema advisor (unindexed FKs, …) during codegen.
-  * Defaults to `true`. When `false`, `CodegenResult.advisories` is empty.
-  * Computed regardless of `dryRun`; codegen never prints them — see
-  * {@link CodegenResult.advisories}.
-  */
+   * Run the static schema advisor (unindexed FKs, …) during codegen.
+   * Defaults to `true`. When `false`, `CodegenResult.advisories` is empty.
+   * Computed regardless of `dryRun`; codegen never prints them — see
+   * {@link CodegenResult.advisories}.
+   */
   lint?: boolean;
   /** Override the lunora subdirectory name. Defaults to `"lunora"`. */
   lunoraDirectory?: string;
   /**
-  * Reuse a previously-constructed ts-morph {@link Project} instead of building
-  * a fresh one each run. The caller owns refreshing its source files from disk
-  * (see {@link refreshCodegenProject}) — codegen does not re-read changed files
-  * off an injected Project. Built via {@link createCodegenProject} when absent.
-  * Used by the Vite dev-loop to avoid re-parsing the whole TS program on every
-  * save; omit it (CLI one-shot path) to get the default fresh-Project behaviour.
-  */
+   * Reuse a previously-constructed ts-morph {@link Project} instead of building
+   * a fresh one each run. The caller owns refreshing its source files from disk
+   * (see {@link refreshCodegenProject}) — codegen does not re-read changed files
+   * off an injected Project. Built via {@link createCodegenProject} when absent.
+   * Used by the Vite dev-loop to avoid re-parsing the whole TS program on every
+   * save; omit it (CLI one-shot path) to get the default fresh-Project behaviour.
+   */
   project?: Project;
   /** Project root containing the `lunora/` directory. */
   projectRoot: string;
   /**
-  * Re-bless the committed schema-drift baseline (`lunora/.lunora-schema.json`)
-  * with the current structural snapshot. The baseline is ALWAYS written on
-  * first capture (when the file is absent); set this to overwrite an existing
-  * one — e.g. after the developer has added the data migration that justifies
-  * a breaking change. Ignored when `dryRun` is true.
-  */
+   * Re-bless the committed schema-drift baseline (`lunora/.lunora-schema.json`)
+   * with the current structural snapshot. The baseline is ALWAYS written on
+   * first capture (when the file is absent); set this to overwrite an existing
+   * one — e.g. after the developer has added the data migration that justifies
+   * a breaking change. Ignored when `dryRun` is true.
+   */
   updateSchemaBaseline?: boolean;
   /**
-  * Committed `wrangler.jsonc` `vars` entries that hold plaintext secrets — the
-  * `plaintext_secret_in_wrangler_vars` lint input. Produced by `@lunora/config`
-  * (which reads `wrangler.jsonc`) and threaded through by the CLI / Vite plugin;
-  * codegen only forwards it to the advisor. Absent when no wrangler config is
-  * present or the caller doesn't scan it.
-  */
+   * Committed `wrangler.jsonc` `vars` entries that hold plaintext secrets — the
+   * `plaintext_secret_in_wrangler_vars` lint input. Produced by `@lunora/config`
+   * (which reads `wrangler.jsonc`) and threaded through by the CLI / Vite plugin;
+   * codegen only forwards it to the advisor. Absent when no wrangler config is
+   * present or the caller doesn't scan it.
+   */
   wranglerVariables?: ReadonlyArray<WranglerVariableIR>;
 }
 interface CodegenResult {
   /**
-  * Static schema advisor findings (e.g. unindexed foreign keys) produced
-  * this run. Empty when `lint` is `false` or the schema is clean. Codegen
-  * does not print these itself — each caller presents them through its own
-  * channel (the CLI logger, the vite overlay, the studio Advisors table).
-  * `formatAdvisories` is exported for a plain multi-line rendering.
-  */
+   * Static schema advisor findings (e.g. unindexed foreign keys) produced
+   * this run. Empty when `lint` is `false` or the schema is clean. Codegen
+   * does not print these itself — each caller presents them through its own
+   * channel (the CLI logger, the vite overlay, the studio Advisors table).
+   * `formatAdvisories` is exported for a plain multi-line rendering.
+   */
   advisories: ReadonlyArray<Finding>;
   /**
-  * Agents discovered from `defineAgent` exports in `lunora/agents.ts` — the
-  * list the config layer reconciles into wrangler's `workflows[]` array (an
-  * agent compiles onto a Cloudflare Workflow). Agents are NOT Durable Objects,
-  * so this adds no binding or migration. Empty when the project declares none.
-  */
+   * Agents discovered from `defineAgent` exports in `lunora/agents.ts` — the
+   * list the config layer reconciles into wrangler's `workflows[]` array (an
+   * agent compiles onto a Cloudflare Workflow). Agents are NOT Durable Objects,
+   * so this adds no binding or migration. Empty when the project declares none.
+   */
   agents: ReadonlyArray<AgentIR>;
   /**
-  * Containers discovered from `defineContainer` exports in
-  * `lunora/containers.ts` — the list the config layer reconciles into
-  * wrangler's `containers[]`, `CONTAINER_*` Durable Object bindings, and
-  * migration classes. Empty when the project declares no containers.
-  */
+   * Containers discovered from `defineContainer` exports in
+   * `lunora/containers.ts` — the list the config layer reconciles into
+   * wrangler's `containers[]`, `CONTAINER_*` Durable Object bindings, and
+   * migration classes. Empty when the project declares no containers.
+   */
   containers: ReadonlyArray<ContainerIR>;
   /**
-  * Deduplicated cron schedules discovered from `cronJobs()` definitions —
-  * the array the vite plugin reconciles into `wrangler.jsonc`'s
-  * `triggers.crons`. Empty when the project declares no crons.
-  */
+   * Deduplicated cron schedules discovered from `cronJobs()` definitions —
+   * the array the vite plugin reconciles into `wrangler.jsonc`'s
+   * `triggers.crons`. Empty when the project declares no crons.
+   */
   cronTriggers: ReadonlyArray<string>;
   generated: {
     /** WorkflowEntrypoint classes for declared agents (`_generated/agents.ts`); `""` (and not written) when no agents are declared. */
     agents: string;
-    api: string; /** Fluent worker-composition builder (`_generated/app.ts`) — `defineApp()`. Always written. */
+    api: string;
+    /** Fluent worker-composition builder (`_generated/app.ts`) — `defineApp()`. Always written. */
     app: string;
     /** Partial-replication collection factories (`_generated/collections.ts`); `""` (and not written) unless the project declares shapes and installs `@lunora/db`. */
     collections: string;
@@ -2736,85 +2642,85 @@ interface CodegenResult {
     dataModel: string;
     drizzleGlobal: string;
     drizzleShard: string;
-    functions: string; /** OpenAPI 3.1.0 document (`_generated/openapi.json`), pretty-printed JSON. */
+    functions: string;
+    /** OpenAPI 3.1.0 document (`_generated/openapi.json`), pretty-printed JSON. */
     openApi: string;
     /**
-    * OpenAPI document as an importable TS module (`_generated/openapi.ts`) —
-    * `export const openApiSpec`, the worker imports it for
-    * `createWorker({ openApiSpec })`. Same document as `openApi`. Written
-    * alongside `openapi.json` whenever `apiSpec` includes `openapi`.
-    */
+     * OpenAPI document as an importable TS module (`_generated/openapi.ts`) —
+     * `export const openApiSpec`, the worker imports it for
+     * `createWorker({ openApiSpec })`. Same document as `openApi`. Written
+     * alongside `openapi.json` whenever `apiSpec` includes `openapi`.
+     */
     openApiModule: string;
     /** OpenRPC 1.x document (`_generated/openrpc.json`), pretty-printed JSON. Always computed; written only when `apiSpec` includes `openrpc`. */
     openRpc: string;
     /**
-    * OpenRPC document as an importable TS module (`_generated/openrpc.ts`) —
-    * `export const openRpcSpec`, for `createWorker({ openRpcSpec })`. Same
-    * document as `openRpc`. Written alongside `openrpc.json` whenever
-    * `apiSpec` includes `openrpc`.
-    */
+     * OpenRPC document as an importable TS module (`_generated/openrpc.ts`) —
+     * `export const openRpcSpec`, for `createWorker({ openRpcSpec })`. Same
+     * document as `openRpc`. Written alongside `openrpc.json` whenever
+     * `apiSpec` includes `openrpc`.
+     */
     openRpcModule: string;
     /** Push-consumer queue registry (`_generated/queues.ts`); `""` (and not written) when no push queues are declared. */
     queues: string;
     /** Project-bound seed client (`_generated/seed.ts`); `""` (and not written) when `@lunora/seed` is not a declared dependency. */
     seed: string;
     server: string;
-    shard: string; /** Static vector-index registry (`_generated/vectors.ts`) — `LUNORA_VECTOR_INDEXES`. Empty array body when the schema declares none. */
+    shard: string;
+    /** Static vector-index registry (`_generated/vectors.ts`) — `LUNORA_VECTOR_INDEXES`. Empty array body when the schema declares none. */
     vectors: string;
     /** WorkflowEntrypoint classes (`_generated/workflows.ts`); `""` (and not written) when no workflows are declared. */
     workflows: string;
   };
   outputDirectory: string;
   /**
-  * Queues discovered from `defineQueue` exports in `lunora/queues.ts` — the
-  * list the config layer reconciles into wrangler's `queues.producers[]` /
-  * `queues.consumers[]`. Queues are NOT Durable Objects, so this adds no
-  * binding or migration. Empty when the project declares no queues.
-  */
+   * Queues discovered from `defineQueue` exports in `lunora/queues.ts` — the
+   * list the config layer reconciles into wrangler's `queues.producers[]` /
+   * `queues.consumers[]`. Queues are NOT Durable Objects, so this adds no
+   * binding or migration. Empty when the project declares no queues.
+   */
   queues: ReadonlyArray<QueueIR>;
   /**
-  * The CURRENT structural schema snapshot computed this run (tables + field
-  * kinds/optionality + indexes/relations/shard mode + declared migration ids).
-  * The pre-deploy drift gate diffs this against the committed baseline read
-  * from {@link CodegenResult.schemaSnapshotPath}. Always present, even on a
-  * `dryRun`.
-  */
+   * The CURRENT structural schema snapshot computed this run (tables + field
+   * kinds/optionality + indexes/relations/shard mode + declared migration ids).
+   * The pre-deploy drift gate diffs this against the committed baseline read
+   * from {@link CodegenResult.schemaSnapshotPath}. Always present, even on a
+   * `dryRun`.
+   */
   schemaSnapshot: SchemaSnapshot;
   /** Absolute path of the committed baseline file (`lunora/.lunora-schema.json`). */
   schemaSnapshotPath: string;
   /**
-  * Workflows discovered from `defineWorkflow` exports in
-  * `lunora/workflows.ts` — the list the config layer reconciles into
-  * wrangler's `workflows[]` array. Workflows are NOT Durable Objects, so this
-  * adds no binding or migration. Empty when the project declares no workflows.
-  */
+   * Workflows discovered from `defineWorkflow` exports in
+   * `lunora/workflows.ts` — the list the config layer reconciles into
+   * wrangler's `workflows[]` array. Workflows are NOT Durable Objects, so this
+   * adds no binding or migration. Empty when the project declares no workflows.
+   */
   workflows: ReadonlyArray<WorkflowIR>;
 }
 /**
-* Convert a {@link SchemaIR} into a synthetic runtime {@link Schema} carrying just
-* the `tables[name].shape` surface `@lunora/seed` introspects. System columns
-* (`_id`, `_creationTime`) are absent from the IR shape, exactly as the seed
-* engine expects (it assigns `_id` itself).
-*/
+ * Convert a {@link SchemaIR} into a synthetic runtime {@link Schema} carrying just
+ * the `tables[name].shape` surface `@lunora/seed` introspects. System columns
+ * (`_id`, `_creationTime`) are absent from the IR shape, exactly as the seed
+ * engine expects (it assigns `_id` itself).
+ */
 declare const schemaFromIr: (ir: SchemaIR) => Schema;
 /**
-* Convert a codegen {@link ValidatorIR} into a JSON Schema node. A thin wrapper
-* over the shared {@link jsonSchemaFromNode} core (from `@lunora/values`) with the
-* IR-backed {@link irReader}, so the kind→schema mapping is the *same* algorithm
-* `@lunora/values`' `toJsonSchema` runs — codegen never instantiates the runtime
-* `v.*` objects, it only holds the reflected IR. Shared by the OpenAPI and
-* OpenRPC emitters so both surfaces speak one JSON Schema dialect.
-*/
+ * Convert a codegen {@link ValidatorIR} into a JSON Schema node. A thin wrapper
+ * over the shared {@link jsonSchemaFromNode} core (from `@lunora/values`) with the
+ * IR-backed {@link irReader}, so the kind→schema mapping is the *same* algorithm
+ * `@lunora/values`' `toJsonSchema` runs — codegen never instantiates the runtime
+ * `v.*` objects, it only holds the reflected IR. Shared by the OpenAPI and
+ * OpenRPC emitters so both surfaces speak one JSON Schema dialect.
+ */
 declare const validatorIrToJsonSchema: (validator: ValidatorIR) => JsonSchema;
-/** Build `{ type: "object", properties, required }` from an IR shape (mirrors `@lunora/values`' object mapping). */
-
-/**
-* The machine-readable `LunoraError` codes Lunora emits on the RPC + REST
-* surfaces, enumerated from `@lunora/server`'s `CODE_STATUS` map plus the
-* runtime/DO dispatch codes (`FUNCTION_NOT_FOUND`, `PAYLOAD_TOO_LARGE`,
-* `METHOD_NOT_ALLOWED`, the `*_NOT_CONFIGURED` admin gates, …). The list documents
-* the contract; clients switch on `error.code`. Kept sorted for stable output.
-*/
+/**
+ * The machine-readable `LunoraError` codes Lunora emits on the RPC + REST
+ * surfaces, enumerated from `@lunora/server`'s `CODE_STATUS` map plus the
+ * runtime/DO dispatch codes (`FUNCTION_NOT_FOUND`, `PAYLOAD_TOO_LARGE`,
+ * `METHOD_NOT_ALLOWED`, the `*_NOT_CONFIGURED` admin gates, …). The list documents
+ * the contract; clients switch on `error.code`. Kept sorted for stable output.
+ */
 declare const LUNORA_ERROR_CODES: ReadonlyArray<string>;
 /** The matching secret rule's `kind` for a string value, or `undefined` when none matches. */
 declare const secretKindOf: (value: string) => string | undefined;