@lunora/config 1.0.0-alpha.13 → 1.0.0-alpha.131

package/dist/packem_shared/{policy-scaffold.d-DCmwn7zQ.d.mts → policy-scaffold.d-fV3db0S_.d.mts}

@@ -2,14 +2,14 @@
 interface ScaffoldPolicyEdit {
   readonly kind: "scaffoldPolicy";
   /**
-  * Base name for the generated file and its exported policy-set identifier,
-  * e.g. `invoices` → `lunora/invoices.policies.ts` exporting `invoicesPolicies`.
-  */
+   * Base name for the generated file and its exported policy-set identifier,
+   * e.g. `invoices` → `lunora/invoices.policies.ts` exporting `invoicesPolicies`.
+   */
   readonly name: string;
   /** Logical table the scaffolded policy guards (used in the stub body). */
   readonly table: string;
 }
-/** Append `.use(rls(<policies>))` to an existing procedure's builder chain. */
+/** Append `.use(rls(<policies>))` to an existing procedure's builder chain. */
 interface WireRlsEdit {
   /** Exported procedure name to wire, e.g. `listInvoices`. */
   readonly exportName: string;
@@ -20,10 +20,10 @@ interface WireRlsEdit {
 /** Additive scaffolder edits — the only requests the scaffolder applies. */
 type AdditivePolicyEdit = ScaffoldPolicyEdit | WireRlsEdit;
 /**
-* Destructive scaffolder requests — never applied. Rewriting an existing `when`
-* body changes evaluation semantics silently, so it is refused (STOP condition
-* in plan 025); carried as data so the editor can describe the request.
-*/
+ * Destructive scaffolder requests — never applied. Rewriting an existing `when`
+ * body changes evaluation semantics silently, so it is refused (STOP condition
+ * in plan 025); carried as data so the editor can describe the request.
+ */
 interface DestructivePolicyEdit {
   readonly exportName?: string;
   readonly kind: "rewritePolicyWhen";
@@ -32,10 +32,10 @@ interface DestructivePolicyEdit {
 /** Any request the scaffolder can receive. */
 type PolicyEdit = AdditivePolicyEdit | DestructivePolicyEdit;
 /**
-* Classify a scaffolder request. Additive requests ({@link AdditivePolicyEdit})
-* apply directly; everything else (rewriting an existing predicate) changes
-* evaluation semantics and is destructive.
-*/
+ * Classify a scaffolder request. Additive requests ({@link AdditivePolicyEdit})
+ * apply directly; everything else (rewriting an existing predicate) changes
+ * evaluation semantics and is destructive.
+ */
 declare const classifyPolicyEdit: (edit: PolicyEdit) => "additive" | "destructive";
 /** Failure reasons a scaffolder request can report. */
 type PolicyScaffoldFailureReason = "already-wired" | "destructive" | "invalid-identifier" | "unknown-procedure" | "unsupported-procedure-shape";
@@ -57,18 +57,18 @@ type WireResult = {
   text: string;
 };
 /**
-* Generate the source of a new policy/role/permission stub file. The `when`
-* predicate is a `() => false` skeleton with a TODO — the scaffolder never
-* authors real logic, the developer fills it in. Pure (no I/O); the handler
-* writes the returned source and refuses to overwrite an existing file.
-*/
+ * Generate the source of a new policy/role/permission stub file. The `when`
+ * predicate is a `() => false` skeleton with a TODO — the scaffolder never
+ * authors real logic, the developer fills it in. Pure (no I/O); the handler
+ * writes the returned source and refuses to overwrite an existing file.
+ */
 declare const scaffoldPolicyFile: (edit: ScaffoldPolicyEdit) => ScaffoldFileResult;
 /**
-* Append `.use(rls(&lt;policies>))` to a procedure's builder chain, preserving the
-* terminal `.query(handler)` (and its handler body) byte-for-byte. Only the
-* **builder** form can be wired; the bare-factory form (`query({ handler })`)
-* has no chain and is reported `unsupported-procedure-shape` so the editor can
-* tell the developer to convert it rather than silently rewriting their code.
-*/
+ * Append `.use(rls(<policies>))` to a procedure's builder chain, preserving the
+ * terminal `.query(handler)` (and its handler body) byte-for-byte. Only the
+ * **builder** form can be wired; the bare-factory form (`query({ handler })`)
+ * has no chain and is reported `unsupported-procedure-shape` so the editor can
+ * tell the developer to convert it rather than silently rewriting their code.
+ */
 declare const wireRlsIntoProcedure: (source: string, edit: WireRlsEdit) => WireResult;
 export { AdditivePolicyEdit as A, DestructivePolicyEdit as D, PolicyEdit as P, ScaffoldPolicyEdit as S, WireRlsEdit as W, PolicyScaffoldFailureReason as a, ScaffoldFileResult as b, WireResult as c, classifyPolicyEdit as d, scaffoldPolicyFile as s, wireRlsIntoProcedure as w };

package/dist/packem_shared/{policy-scaffold.d-DCmwn7zQ.d.ts → policy-scaffold.d-fV3db0S_.d.ts}

@@ -2,14 +2,14 @@
 interface ScaffoldPolicyEdit {
   readonly kind: "scaffoldPolicy";
   /**
-  * Base name for the generated file and its exported policy-set identifier,
-  * e.g. `invoices` → `lunora/invoices.policies.ts` exporting `invoicesPolicies`.
-  */
+   * Base name for the generated file and its exported policy-set identifier,
+   * e.g. `invoices` → `lunora/invoices.policies.ts` exporting `invoicesPolicies`.
+   */
   readonly name: string;
   /** Logical table the scaffolded policy guards (used in the stub body). */
   readonly table: string;
 }
-/** Append `.use(rls(<policies>))` to an existing procedure's builder chain. */
+/** Append `.use(rls(<policies>))` to an existing procedure's builder chain. */
 interface WireRlsEdit {
   /** Exported procedure name to wire, e.g. `listInvoices`. */
   readonly exportName: string;
@@ -20,10 +20,10 @@ interface WireRlsEdit {
 /** Additive scaffolder edits — the only requests the scaffolder applies. */
 type AdditivePolicyEdit = ScaffoldPolicyEdit | WireRlsEdit;
 /**
-* Destructive scaffolder requests — never applied. Rewriting an existing `when`
-* body changes evaluation semantics silently, so it is refused (STOP condition
-* in plan 025); carried as data so the editor can describe the request.
-*/
+ * Destructive scaffolder requests — never applied. Rewriting an existing `when`
+ * body changes evaluation semantics silently, so it is refused (STOP condition
+ * in plan 025); carried as data so the editor can describe the request.
+ */
 interface DestructivePolicyEdit {
   readonly exportName?: string;
   readonly kind: "rewritePolicyWhen";
@@ -32,10 +32,10 @@ interface DestructivePolicyEdit {
 /** Any request the scaffolder can receive. */
 type PolicyEdit = AdditivePolicyEdit | DestructivePolicyEdit;
 /**
-* Classify a scaffolder request. Additive requests ({@link AdditivePolicyEdit})
-* apply directly; everything else (rewriting an existing predicate) changes
-* evaluation semantics and is destructive.
-*/
+ * Classify a scaffolder request. Additive requests ({@link AdditivePolicyEdit})
+ * apply directly; everything else (rewriting an existing predicate) changes
+ * evaluation semantics and is destructive.
+ */
 declare const classifyPolicyEdit: (edit: PolicyEdit) => "additive" | "destructive";
 /** Failure reasons a scaffolder request can report. */
 type PolicyScaffoldFailureReason = "already-wired" | "destructive" | "invalid-identifier" | "unknown-procedure" | "unsupported-procedure-shape";
@@ -57,18 +57,18 @@ type WireResult = {
   text: string;
 };
 /**
-* Generate the source of a new policy/role/permission stub file. The `when`
-* predicate is a `() => false` skeleton with a TODO — the scaffolder never
-* authors real logic, the developer fills it in. Pure (no I/O); the handler
-* writes the returned source and refuses to overwrite an existing file.
-*/
+ * Generate the source of a new policy/role/permission stub file. The `when`
+ * predicate is a `() => false` skeleton with a TODO — the scaffolder never
+ * authors real logic, the developer fills it in. Pure (no I/O); the handler
+ * writes the returned source and refuses to overwrite an existing file.
+ */
 declare const scaffoldPolicyFile: (edit: ScaffoldPolicyEdit) => ScaffoldFileResult;
 /**
-* Append `.use(rls(&lt;policies>))` to a procedure's builder chain, preserving the
-* terminal `.query(handler)` (and its handler body) byte-for-byte. Only the
-* **builder** form can be wired; the bare-factory form (`query({ handler })`)
-* has no chain and is reported `unsupported-procedure-shape` so the editor can
-* tell the developer to convert it rather than silently rewriting their code.
-*/
+ * Append `.use(rls(<policies>))` to a procedure's builder chain, preserving the
+ * terminal `.query(handler)` (and its handler body) byte-for-byte. Only the
+ * **builder** form can be wired; the bare-factory form (`query({ handler })`)
+ * has no chain and is reported `unsupported-procedure-shape` so the editor can
+ * tell the developer to convert it rather than silently rewriting their code.
+ */
 declare const wireRlsIntoProcedure: (source: string, edit: WireRlsEdit) => WireResult;
 export { AdditivePolicyEdit as A, DestructivePolicyEdit as D, PolicyEdit as P, ScaffoldPolicyEdit as S, WireRlsEdit as W, PolicyScaffoldFailureReason as a, ScaffoldFileResult as b, WireResult as c, classifyPolicyEdit as d, scaffoldPolicyFile as s, wireRlsIntoProcedure as w };

package/dist/packem_shared/reconcileWranglerCompatibilityDate-BXNiEQ7p.mjs

@@ -0,0 +1 @@
+import{writeFileSync as d}from"node:fs";import{modify as l,applyEdits as c}from"jsonc-parser";import{r as s}from"./jsonc-edit-BZVpxVA0.mjs";import{isCacheEnabled as f,WORKERS_CACHE_MIN_DATE as r}from"./WORKERS_CACHE_MIN_DATE-B1h_wNDN.mjs";import{findWranglerFile as g,readWranglerJsonc as m}from"./WRANGLER_FILES-Bi_18Pj6.mjs";const b=i=>{const e=g(i);if(!e)return{changed:!1,date:void 0,reason:"wrangler.jsonc not found"};const{parsed:t,text:n}=m(e);if(t===void 0)return{changed:!1,date:void 0,reason:`failed to parse ${e} as JSONC`,wranglerPath:e};const a=t.compatibility_date??"";if(!f(t))return{changed:!1,date:a||void 0,reason:"cache not enabled",wranglerPath:e};if(a>=r)return{changed:!1,date:a,reason:`compatibility_date already >= ${r}`,wranglerPath:e};const o=l(n,["compatibility_date"],r,s);return o.length===0?{changed:!1,date:a||void 0,reason:"no structural edit produced",wranglerPath:e}:(d(e,c(n,o),"utf8"),{changed:!0,date:r,wranglerPath:e})};export{b as reconcileWranglerCompatibilityDate};

package/dist/packem_shared/reconcileWranglerCrons-BmQa_kGL.mjs

@@ -0,0 +1 @@
+import{writeFileSync as g}from"node:fs";import{modify as c,applyEdits as l}from"jsonc-parser";import{findWranglerFile as d,readWranglerJsonc as f}from"./WRANGLER_FILES-Bi_18Pj6.mjs";const h=(t,e)=>t.length===e.length&&t.every((r,n)=>r===e[n]),m=(t,e)=>{const r=d(t);if(!r)return{changed:!1,reason:"wrangler.jsonc not found"};const{parsed:n,text:a}=f(r);if(n===void 0)return{changed:!1,reason:`failed to parse ${r} as JSONC`,wranglerPath:r};const o=Array.isArray(n.triggers?.crons)?n.triggers.crons.filter(i=>typeof i=="string"):[];if(h(o,e))return{changed:!1,reason:"triggers.crons already in sync",wranglerPath:r};const s=c(a,["triggers","crons"],[...e],{formattingOptions:{insertSpaces:!0,tabSize:4}});return s.length===0?{changed:!1,reason:"no structural edit produced",wranglerPath:r}:(g(r,l(a,s),"utf8"),{changed:!0,wranglerPath:r})};export{m as reconcileWranglerCrons};

package/dist/packem_shared/renderStudioHtml-B2AkxcW1.mjs

@@ -0,0 +1,15 @@
+const i=e=>JSON.stringify(e).replaceAll("<",String.raw`\u003c`),_=e=>e.replaceAll("&","&amp;").replaceAll('"',"&quot;").replaceAll("<","&lt;"),l=e=>{const t=[`window.__LUNORA_BASE_PATH__=${i(e.basePath)};`];return e.adminToken!==void 0&&e.adminToken!==""&&t.push(`window.__LUNORA_ADMIN_TOKEN__=${i(e.adminToken)};`),e.dataEditable===!0&&t.push("window.__LUNORA_DATA_EDITABLE__=true;"),e.runAsIdentity===!0&&t.push("window.__LUNORA_RUN_AS_IDENTITY__=true;"),e.schemaEditable===!0&&t.push("window.__LUNORA_SCHEMA_EDITABLE__=true;"),e.rulesInstalled===!1&&t.push("window.__LUNORA_RULES_INSTALLED__=false;"),`<!doctype html>
+<html lang="en">
+    <head>
+        <meta charset="UTF-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+        <title>Lunora Studio</title>
+        <script>${t.join("")}<\/script>
+        <link rel="stylesheet" href="${_(e.styleHref)}" />
+    </head>
+    <body>
+        <div id="root"></div>
+        <script type="module" src="${_(e.scriptSrc)}"><\/script>
+    </body>
+</html>
+`};export{l as default};

package/dist/packem_shared/schema-info.d-DS0bUsWE.d.mts

@@ -0,0 +1,375 @@
+import { AgentIR, ContainerIR, QueueIR, WorkflowIR } from '@lunora/codegen';
+/**
+ * `DeployDriver` — the provider-neutral seam between what an app needs and
+ * how a host provides it (plan 114, §5.3).
+ *
+ * Configuration inference is two jobs welded together today. Deciding that an
+ * app needs a shard namespace, a queue, and an object-storage bucket is
+ * host-neutral: it falls out of the app's schema and imports, and every target
+ * reaches the same conclusion. Writing `durable_objects.bindings[]` into a
+ * `wrangler.jsonc` is not — it is one host's encoding of that conclusion.
+ *
+ * The split here names both halves. {@link ResourceGraph} is the neutral answer
+ * to "what does this app need?"; a {@link DeployDriver} turns that graph into
+ * one host's configuration and owns the host's toolchain surface. A second
+ * target implements the driver rather than forking the inference.
+ *
+ * Only the Cloudflare driver exists today (`cloudflare-driver.ts`), and it is
+ * deliberately thin: it delegates to the same `inferLunoraBindings` /
+ * `reconcileWrangler*` functions the CLI called directly before, so routing a
+ * command through the driver is behavior-preserving by construction.
+ *
+ * The second half is the **toolchain surface**: which command a host runs to
+ * deploy, serve, tail, or set a secret. A driver only *describes* that command
+ * ({@link ToolchainCommand}); it never spawns. The CLI keeps ownership of
+ * running it — package-manager resolution (`pnpm exec` / `npx --` / `bun x`)
+ * and the injected spawner its tests substitute — so the driver stays free of
+ * process concerns and remains trivially testable as a pure function.
+ *
+ * Each request type below is deliberately neutral: `preview`, `environment`,
+ * `temporary` are concepts, not wrangler flags. A second host maps the same
+ * request onto its own CLI without the caller changing.
+ */
+/** A durable, single-writer shard namespace (a Durable Object namespace on Cloudflare). */
+interface ShardNamespaceResource {
+  /** The implementing class name the host binds to. */
+  className: string;
+  /** Whether the worker entry re-exports the class — an unexported class cannot be bound. */
+  exported: boolean;
+  /** The binding name the app reaches it through (e.g. `SHARD`). */
+  name: string;
+}
+/** A named resource the app declares and the host must provision (queue, workflow, container). */
+interface NamedResource {
+  /** Whether the declaration is re-exported from the worker entry, where that applies. */
+  exported?: boolean;
+  /** The declared name. */
+  name: string;
+}
+/**
+ * The provider-neutral statement of what an app needs, derived from its schema
+ * and imports. Every field is a *requirement*, not a host encoding: a driver
+ * decides what `objectStorage: true` means for its target.
+ */
+interface ResourceGraph {
+  /** Container images the app declares. */
+  containers: ReadonlyArray<NamedResource>;
+  /** Cron expressions the app schedules. */
+  crons: ReadonlyArray<string>;
+  /**
+   * The app declares a `.global()` table, so it needs a replicated SQL store
+   * (D1 on Cloudflare; Aurora/RDS elsewhere).
+   */
+  globalDatabase: boolean;
+  /** The app reads or writes a key-value store. */
+  keyValueStore: boolean;
+  /** The app needs object storage (R2 on Cloudflare; S3-compatible elsewhere). */
+  objectStorage: boolean;
+  /** Queues the app declares. */
+  queues: ReadonlyArray<NamedResource>;
+  /** Shard namespaces the app needs. */
+  shardNamespaces: ReadonlyArray<ShardNamespaceResource>;
+  /**
+   * Human-readable provenance for each requirement — why inference concluded
+   * the app needs it. Surfaced in CLI logs; never load-bearing.
+   */
+  signals: ReadonlyArray<string>;
+  /** Workflows the app declares. */
+  workflows: ReadonlyArray<NamedResource>;
+}
+/** The outcome of writing a {@link ResourceGraph} into a host's configuration. */
+interface ProvisionResult {
+  /** Short labels for each resource written, for logging. */
+  added: ReadonlyArray<string>;
+  /** Whether the host's configuration file was rewritten. */
+  changed: boolean;
+  /** Resolved configuration path, when the host has one. */
+  configPath?: string;
+  /** Non-fatal hints for requirements the driver cannot auto-provision. */
+  warnings: ReadonlyArray<string>;
+}
+/**
+ * A host CLI invocation, described but not run.
+ *
+ * `tool` is the binary name only (`"wrangler"`); the caller resolves how to
+ * execute it through the project's package manager. Keeping that split means a
+ * driver never has to know whether the project uses pnpm, npm, yarn, or bun.
+ */
+interface ToolchainCommand {
+  /** Arguments for {@link ToolchainCommand.tool}. */
+  args: ReadonlyArray<string>;
+  /** The host CLI binary, e.g. `"wrangler"`. */
+  tool: string;
+}
+/** Neutral options for a deploy. */
+interface DeployRequest {
+  /** Validate and bundle without publishing — nothing ships. */
+  dryRun?: boolean;
+  /** Deploy this entry file instead of the host config's default (framework composition). */
+  entry?: string;
+  /** Named deployment environment, when the host supports them. */
+  environment?: string;
+  /** Write the built bundle (and any build metadata) to this directory. */
+  outDir?: string;
+  /** Upload a preview/versioned artifact instead of taking production traffic. */
+  preview?: boolean;
+  /** Deploy to a short-lived, unauthenticated account where the host offers one. */
+  temporary?: boolean;
+}
+/** Neutral options for a local dev server. */
+interface DevRequest {
+  /** Host config file to run against, when the flow uses a generated one. */
+  configPath?: string;
+  /** Named environment. */
+  environment?: string;
+  /** Extra host-specific flags the caller has already resolved. */
+  extraArgs?: ReadonlyArray<string>;
+}
+/** Neutral options for tailing live logs. */
+interface TailRequest {
+  /** Named environment. */
+  environment?: string;
+  /** Output format the host tail supports (`"json"`, `"pretty"`, …). */
+  format?: string;
+  /** Free-text filter. */
+  search?: string;
+  /** Status filter (`"error"`, `"ok"`, …). */
+  status?: string;
+  /** Tail a short-lived account's deployment. */
+  temporary?: boolean;
+  /** Tail a specific deployed worker/service by name, when the host addresses them individually. */
+  worker?: string;
+}
+/** Neutral options for reading or writing deployment secrets. */
+interface SecretRequest {
+  /** Named environment. */
+  environment?: string;
+  /** The secret's name — required for `put`, unused for `list`. */
+  key?: string;
+  /** Operate against a short-lived account. */
+  temporary?: boolean;
+}
+/**
+ * The host's command-line surface. Optional as a whole: a host with no CLI (a
+ * hypothetical API-driven target) implements `infer`/`provision` only, and the
+ * caller falls back to its own handling.
+ */
+interface DriverToolchain {
+  /** The command that deploys the app. */
+  deploy: (request: DeployRequest) => ToolchainCommand;
+  /** The command that runs a local dev server. */
+  dev: (request: DevRequest) => ToolchainCommand;
+  /** The command that lists remote secret names. */
+  secretList: (request: SecretRequest) => ToolchainCommand;
+  /** The command that writes one secret. Its value is passed on stdin, never argv. */
+  secretPut: (request: SecretRequest) => ToolchainCommand;
+  /** The command that tails live logs. */
+  tail: (request: TailRequest) => ToolchainCommand;
+}
+/** Options every driver method receives. */
+interface DriverContext {
+  /** Cron expressions codegen discovered, threaded in because they come from the app's code rather than its config. */
+  crons?: ReadonlyArray<string>;
+  /** Project root containing the `lunora/` directory. */
+  projectRoot: string;
+}
+/**
+ * A deploy target's implementation: report what the app needs, and encode it
+ * into that host's configuration.
+ *
+ * **Why `provision` does not take a {@link ResourceGraph}.** The obvious
+ * signature is `provision(graph, context)`, and it is wrong. Writing real host
+ * configuration needs the host's own encodings — binding names, DO class
+ * wiring, migration tags — which the neutral graph deliberately discards. A
+ * driver handed only the graph would have to re-derive them, so passing it
+ * would be decorative. `infer` is therefore the *reporting* surface (a portable
+ * picture of the app's requirements, for logs, diagnostics, and cross-target
+ * comparison) and `provision` is the *doing* surface, which owns its own
+ * inference end-to-end.
+ *
+ * That asymmetry is a genuine finding about this seam, not a shortcut: it says
+ * the neutral graph is not a sufficient intermediate representation for config
+ * emission. If a future target needs one, the graph must grow a host-extension
+ * escape hatch rather than pretend it already carries the detail.
+ */
+interface DeployDriver {
+  /** The target id this driver serves (`"cloudflare"`, …) — matches codegen's `target`. */
+  readonly id: string;
+  /**
+   * Read the app and report what it needs, in provider-neutral terms. Pure
+   * with respect to the project: it never writes configuration.
+   */
+  infer: (context: DriverContext) => Promise<ResourceGraph>;
+  /** Human-readable target name, for logs. */
+  readonly name: string;
+  /**
+   * Write the app's requirements into the host's configuration, adding what is
+   * missing and leaving existing entries alone. Must be idempotent:
+   * provisioning an already-provisioned project reports `changed: false`, and
+   * must fold a failed step into a warning rather than throwing.
+   */
+  provision: (context: DriverContext) => Promise<ProvisionResult>;
+  /**
+   * The host's command-line surface, or `undefined` for a host that has none.
+   * Pure: these build argv, they never spawn.
+   */
+  readonly toolchain?: DriverToolchain;
+}
+interface DurableObjectSpec {
+  binding: string;
+  className: string;
+}
+/**
+ * A `defineContainer` declaration plus whether its generated DO class is
+ * exported by the worker entry. Only exported containers are safe to
+ * provision — wrangler rejects a `containers[].class_name` (and its Durable
+ * Object binding) that the worker doesn't export.
+ */
+interface InferredContainer extends ContainerIR {
+  exported: boolean;
+}
+/**
+ * A `defineWorkflow` declaration plus whether its generated
+ * `WorkflowEntrypoint` class is exported by the worker entry. Only exported
+ * workflows are safe to provision — wrangler rejects a `workflows[].class_name`
+ * the worker doesn't export. Workflows are NOT Durable Objects, so this never
+ * implies a `durable_objects` binding or migration.
+ */
+interface InferredWorkflow extends WorkflowIR {
+  exported: boolean;
+}
+/**
+ * A `defineAgent` declaration plus whether its generated agent
+ * `WorkflowEntrypoint` class (e.g. `SupportAgentWorkflow`) is exported by the
+ * worker entry. An agent compiles onto a Cloudflare Workflow, so — exactly like
+ * {@link InferredWorkflow} — only exported agents are safe to provision
+ * (wrangler rejects a `workflows[].class_name` the worker doesn't export), and
+ * an agent is NOT a Durable Object (no `durable_objects` binding or migration).
+ */
+interface InferredAgent extends AgentIR {
+  exported: boolean;
+}
+/**
+ * A queue declared in `lunora/queues.ts`. Unlike workflows, a queue needs no
+ * worker-entry class export (its `queue()` handler rides `createWorker`), so
+ * there is no `exported` flag — every declared queue is reconcilable into the
+ * wrangler `queues.producers[]` / `queues.consumers[]`.
+ */
+type InferredQueue = QueueIR;
+interface InferredBindings {
+  /** Agents declared in `lunora/agents.ts` (exported or not — see {@link InferredAgent.exported}); reconciled into `workflows[]`. */
+  agents: InferredAgent[];
+  /** Containers declared in `lunora/containers.ts` (exported or not — see {@link InferredContainer.exported}). */
+  containers: InferredContainer[];
+  /** Durable Objects the worker entry exports → safe to bind. */
+  durableObjects: DurableObjectSpec[];
+  /**
+   * The wrangler `flagship[].binding` name implied by `lunora/flags.ts` when it
+   * uses the Flagship provider in binding mode — `undefined` for HTTP-mode
+   * Flagship, a custom OpenFeature provider, or no flags. The binding needs an
+   * un-mintable `app_id`, so it is reconciled as a hint, not auto-written.
+   */
+  flagshipBinding?: string;
+  /** Schema declares a `.global()` table → needs the `DB` D1 binding. */
+  needsD1: boolean;
+  /** Queues declared in `lunora/queues.ts` → reconciled into `queues.producers[]` / `queues.consumers[]`. */
+  queues: InferredQueue[];
+  /** Human-readable provenance for each inferred binding / hint, for logging. */
+  signals: string[];
+  /** `@lunora/ai` is imported or `env.AI` is used → needs the `ai` Workers AI binding. */
+  usesAi: boolean;
+  /** `@lunora/bindings/analytics` is imported → self-describing `analytics_engine_datasets` binding (auto-writeable). */
+  usesAnalytics: boolean;
+  /** `@lunora/auth` is imported (sessions may be D1- or `SessionDO`-backed). */
+  usesAuth: boolean;
+  /** `@lunora/browser` is imported → self-describing `browser` binding (auto-writeable). */
+  usesBrowser: boolean;
+  /** `lunora/flags.ts` declares a feature-flag provider (any OpenFeature provider — Flagship or custom). */
+  usesFlags: boolean;
+  /** `@lunora/hyperdrive` is imported (binding needs an un-mintable remote `id`; hint-only). */
+  usesHyperdrive: boolean;
+  /** `@lunora/bindings/images` is imported → self-describing `images` binding (auto-writeable). */
+  usesImages: boolean;
+  /** `@lunora/bindings/kv` is imported (namespace binding name + id are user-defined; hint-only). */
+  usesKv: boolean;
+  /** `@lunora/mail` is imported (Resend API key must be set in `.dev.vars`; no binding). */
+  usesMail: boolean;
+  /** `@lunora/payment` is imported (provider secrets must be set in `.dev.vars`; no binding). */
+  usesPayment: boolean;
+  /** `ctx.pipelines` is used (binding needs an un-mintable remote pipeline name; hint-only). */
+  usesPipelines: boolean;
+  /** `@lunora/scheduler` is imported. */
+  usesScheduler: boolean;
+  /** `@lunora/storage` is imported (R2 bucket binding name is user-defined). */
+  usesStorage: boolean;
+  /** `@lunora/x402/charge` is imported — the charge rail settles USDC to a recipient address (a public `[vars]` entry, user-named; hint-only). */
+  usesX402Charge: boolean;
+  /** `@lunora/x402/pay` is imported — the agent-wallet pay rail signs from a Secrets Store binding paired with a spend policy (ActionCtx-only; hint-only). */
+  usesX402Pay: boolean;
+  /** Workflows declared in `lunora/workflows.ts` (exported or not — see {@link InferredWorkflow.exported}). */
+  workflows: InferredWorkflow[];
+}
+interface InferOptions {
+  projectRoot: string;
+  /** Directories (relative to root) to scan. Defaults to `lunora` + `src`. */
+  scanDirs?: ReadonlyArray<string>;
+  /** Lunora source directory holding `schema.ts`. Defaults to `lunora`. */
+  schemaDir?: string;
+}
+/**
+ * Scan a Lunora project and report which Cloudflare bindings its code implies.
+ * Read-only: performs no writes. Binding provisioning is driven by the worker
+ * entry's Durable Object exports plus the schema's D1 need; capability imports
+ * surface as hints.
+ */
+declare const inferLunoraBindings: (options: InferOptions) => Promise<InferredBindings>;
+/**
+ * Derive the list of `@lunora/*` package names that are actively used by a
+ * project, based on its already-resolved {@link InferredBindings}.
+ *
+ * This is the canonical bridge between binding inference and the package-aware
+ * `.dev.vars.example` scaffolding in `scaffold-dev-variables.ts`. The result is
+ * a stable, predictable slice of {@link CAPABILITY_SOURCES} source values,
+ * filtered to the flags that are `true` in `bindings` — in CAPABILITY_SOURCES
+ * declaration order.
+ */
+declare const packageNamesFromBindings: (bindings: InferredBindings) => string[];
+/** One filterable Vectorize metadata property a schema declares. */
+interface VectorMetadataDeclaration {
+  /** The vector index the property belongs to. */
+  index: string;
+  /**
+   * The validator kind behind the column, or `undefined` when the column
+   * isn't in the owning table's shape. Callers map it to the Vectorize
+   * metadata type; a kind that can't be filtered on is reported, not indexed.
+   */
+  kind: string | undefined;
+  /** Column mirrored into vector metadata. */
+  property: string;
+}
+interface SchemaInfo {
+  /** Whether the lunora schema declares any `.global()` table. */
+  hasGlobalTable: boolean;
+  /** Names of vector indexes declared via `.vectorize()` / `defineVectorIndex()`. */
+  vectorIndexNames?: ReadonlyArray<string>;
+  /**
+   * Metadata properties declared filterable on a vector index. Cloudflare
+   * needs an explicit metadata index per property before a `filter` can match
+   * anything, so deploy provisions these and doctor reports them.
+   */
+  vectorMetadata?: ReadonlyArray<VectorMetadataDeclaration>;
+}
+interface DiscoverSchemaInfoResult {
+  /** Parse error message, when the schema exists but could not be analyzed. */
+  error?: string;
+  /** Schema facts, or `undefined` when no `schema.ts` exists or parsing failed. */
+  info: SchemaInfo | undefined;
+}
+/**
+ * Discover {@link SchemaInfo} for a project. Returns `{ info: undefined }` when
+ * the project declares no `schema.ts` (not an error), or `{ info: undefined,
+ * error }` when a present schema could not be parsed — callers decide whether a
+ * parse failure is a warning (validator) or simply ignorable (inference).
+ */
+declare const discoverSchemaInfo: (projectRoot: string, schemaDirectory: string) => DiscoverSchemaInfoResult;
+export { DeployDriver as D, InferredBindings as I, NamedResource as N, ProvisionResult as P, ResourceGraph as R, SchemaInfo as S, TailRequest as T, DeployRequest as a, DevRequest as b, DiscoverSchemaInfoResult as c, DriverContext as d, DriverToolchain as e, InferOptions as f, InferredAgent as g, InferredContainer as h, InferredWorkflow as i, SecretRequest as j, ShardNamespaceResource as k, ToolchainCommand as l, discoverSchemaInfo as m, inferLunoraBindings as n, packageNamesFromBindings as p };