@lunora/config 1.0.0-alpha.35 → 1.0.0-alpha.351

package/dist/packem_shared/infer-bindings.d-CFxssIAC.d.ts

@@ -0,0 +1,480 @@
+import { SchemaIR, AgentIR, ContainerIR, QueueIR, ServiceBindingIR, WorkflowIR } from '@lunora/codegen';
+/**
+ * `DeployDriver` — the provider-neutral seam between a Lunora command and the
+ * host CLI that carries it out (plan 114, §5.3).
+ *
+ * The seam is the **toolchain surface**: which command a host runs to deploy,
+ * serve, tail, or set a secret. A driver only *describes* that command
+ * ({@link ToolchainCommand}); it never spawns. The CLI keeps ownership of
+ * running it — package-manager resolution (`pnpm exec` / `npx --` / `bun x`)
+ * and the injected spawner its tests substitute — so the driver stays free of
+ * process concerns and remains trivially testable as a pure function.
+ *
+ * Each request type below is deliberately neutral: `preview`, `environment`,
+ * `temporary` are concepts, not wrangler flags. A second host maps the same
+ * request onto its own CLI without the caller changing.
+ *
+ * Three drivers are registered: Cloudflare (`cloudflare/cloudflare-driver.ts`)
+ * and celld (`celld/celld-driver.ts`), which ship toolchains, and Node
+ * (`node/node-driver.ts`), which has none — it is a codegen target, and
+ * `lunora deploy` / `lunora dev` refuse it at selection.
+ *
+ * **What this seam deliberately does NOT carry: configuration inference.** It
+ * used to, through an `infer`/`provision` pair over a provider-neutral
+ * `ResourceGraph`. Nothing ever called either one — every consumer reads
+ * `.toolchain` or just validates the target — and the arm rotted in place: the
+ * Node driver was *only* `infer` + `provision`, so its report of what that
+ * target cannot serve (containers, undispatched crons) could not reach an
+ * operator however wrong the app was. The reason it never got wired is worth
+ * keeping: writing real host configuration needs the host's own encodings —
+ * binding names, DO class wiring, migration tags — which a neutral graph
+ * necessarily discards, so `provision` re-derived them anyway and the graph was
+ * decorative. A second target that needs to share inference should grow the
+ * seam back with a caller attached, and with an encoding escape hatch.
+ */
+/**
+ * A host CLI invocation, described but not run.
+ *
+ * `tool` is the binary name only (`"wrangler"`); the caller resolves how to
+ * execute it through the project's package manager (see `toolchainExecArgs`).
+ * Keeping that split means a driver never has to know whether the project uses
+ * pnpm, npm, yarn, or bun.
+ */
+interface ToolchainCommand {
+  /** Arguments for {@link ToolchainCommand.tool}. */
+  args: ReadonlyArray<string>;
+  /**
+   * The tool is a standalone binary installed on `PATH`, not a project
+   * dependency: run it directly. Going through the package manager would be
+   * wrong for it — `npx --` / `bun x` fetch an npm package of the same name
+   * when none is installed locally, which for a non-npm binary is somebody
+   * else's code.
+   */
+  onPath?: boolean;
+  /** The host CLI binary, e.g. `"wrangler"`. */
+  tool: string;
+}
+/** Neutral options for a deploy. */
+interface DeployRequest {
+  /** Host config file to deploy, when the flow uses a projected one (see {@link DeployDriver.projectConfig}). */
+  configPath?: string;
+  /** Validate and bundle without publishing — nothing ships. */
+  dryRun?: boolean;
+  /** Deploy this entry file instead of the host config's default (framework composition). */
+  entry?: string;
+  /** Named deployment environment, when the host supports them. */
+  environment?: string;
+  /** Write the built bundle (and any build metadata) to this directory. */
+  outDir?: string;
+  /** Upload a preview/versioned artifact instead of taking production traffic. */
+  preview?: boolean;
+  /** Deploy to a short-lived, unauthenticated account where the host offers one. */
+  temporary?: boolean;
+}
+/** Neutral options for a local dev server. */
+interface DevRequest {
+  /** Host config file to run against, when the flow uses a generated one. */
+  configPath?: string;
+  /** Named environment. */
+  environment?: string;
+  /** Extra host-specific flags the caller has already resolved. */
+  extraArgs?: ReadonlyArray<string>;
+}
+/** Neutral options for tailing live logs. */
+interface TailRequest {
+  /** Named environment. */
+  environment?: string;
+  /** Output format the host tail supports (`"json"`, `"pretty"`, …). */
+  format?: string;
+  /** Free-text filter. */
+  search?: string;
+  /** Status filter (`"error"`, `"ok"`, …). */
+  status?: string;
+  /** Tail a short-lived account's deployment. */
+  temporary?: boolean;
+  /** Tail a specific deployed worker/service by name, when the host addresses them individually. */
+  worker?: string;
+}
+/** Neutral options for reading or writing deployment secrets. */
+interface SecretRequest {
+  /** Named environment. */
+  environment?: string;
+  /** The secret's name — required for `put`, unused for `list`. */
+  key?: string;
+  /** Operate against a short-lived account. */
+  temporary?: boolean;
+}
+/**
+ * The host's command-line surface. Optional as a whole: a host with no vendor
+ * CLI (the Node target; a hypothetical API-driven one) declares none, and
+ * `isRunnableTarget` refuses it for the commands that would have to shell out.
+ *
+ * `deploy` and `dev` are what make a target runnable. The secret and tail
+ * commands are optional on their own, because a runnable host can simply not
+ * have them — celld keeps configuration in plain `vars` and has no log tail —
+ * and the commands that need one say so rather than guessing a substitute.
+ */
+interface DriverToolchain {
+  /** The command that deploys the app. */
+  deploy: (request: DeployRequest) => ToolchainCommand;
+  /** The command that runs a local dev server. */
+  dev: (request: DevRequest) => ToolchainCommand;
+  /**
+   * Where `lunora dev` runs the worker. `"workerd"`: `wrangler dev`, or the
+   * Vite plugin's `@cloudflare/vite-plugin`, whichever flavor the project
+   * picks. `"own"`: the host's dev server ({@link DriverToolchain.dev}) on
+   * the projected config, always the standalone flavor — neither Vite nor a
+   * framework sidecar can serve the worker on that runtime.
+   */
+  readonly devServer: "own" | "workerd";
+  /**
+   * Whether `lunora deploy` builds and pushes container images itself
+   * (railpack, into the host's registry) before `deploy`. `false` when the
+   * host CLI builds each image from its Dockerfile during the deploy.
+   */
+  readonly prebuildsContainerImages: boolean;
+  /** The command that writes many secrets in one call, as a JSON object of name to value on stdin. Optional: hosts without it get one `secretPut` per key. */
+  secretBulk?: (request: SecretRequest) => ToolchainCommand;
+  /** The command that lists remote secret names, when the host has a secret store. */
+  secretList?: (request: SecretRequest) => ToolchainCommand;
+  /** The command that writes one secret, when the host has a secret store. Its value is passed on stdin, never argv. */
+  secretPut?: (request: SecretRequest) => ToolchainCommand;
+  /** The command that tails live logs, when the host has one. */
+  tail?: (request: TailRequest) => ToolchainCommand;
+}
+/** What a {@link DeployDriver.projectConfig} projection is for — a dev server may need a different source than a deploy. */
+type ProjectionPurpose = "deploy" | "dev";
+/**
+ * The result of {@link DeployDriver.projectConfig}: a plan, not yet on disk.
+ * The caller validates the request it is for (the toolchain's argv builder
+ * refuses unsupported options), then calls `write` — so a refused command
+ * changes nothing.
+ */
+interface ProjectedConfig {
+  /** Where the projection goes, to pass as the request's `configPath`. */
+  configPath: string;
+  /** Every key removed, as a dotted path (`observability`, `containers[0].rollout_step_percentage`). */
+  dropped: ReadonlyArray<string>;
+  /** Write the projection (and any build-artifact cleanup it planned). */
+  write: () => void;
+}
+/** A deploy target's implementation: an identity the registry resolves, and the host CLI surface (if any) behind it. */
+interface DeployDriver {
+  /** The target id this driver serves (`"cloudflare"`, …) — matches codegen's `target`. */
+  readonly id: string;
+  /** Human-readable target name, for logs. */
+  readonly name: string;
+  /**
+   * Rewrite the project's wrangler config into the form this host's CLI
+   * accepts, and return the file to hand `deploy`/`dev` as `configPath`.
+   * Absent when the host reads the project's config as-is (Cloudflare).
+   *
+   * Needed because Lunora's reconcilers and templates write Cloudflare-only
+   * keys (`observability`, `limits`, …) that a Workers-compatible host with a
+   * strict config reader refuses outright. `dropped` names what was removed,
+   * so the caller can say so instead of silently deploying less than the
+   * config describes.
+   */
+  readonly projectConfig?: (projectRoot: string, purpose: ProjectionPurpose) => ProjectedConfig;
+  /**
+   * The host's command-line surface, or `undefined` for a host that has none.
+   * Pure: these build argv, they never spawn.
+   */
+  readonly toolchain?: DriverToolchain;
+}
+/**
+ * An invocation-scoped memo for project discovery. A CLI command creates one,
+ * threads it through every `discover*` / `inferLunoraBindings` call it makes,
+ * and clears it after anything rewrites the sources discovery reads (codegen).
+ * Deliberately not module-level: tests and long-lived processes never see a
+ * stale result.
+ */
+interface DiscoveryCache {
+  /** Drop every memoised result. */
+  clear: () => void;
+  /** Return the result memoised under `key`, computing it on first use. */
+  memo: <T>(key: string, compute: () => T) => T;
+}
+declare const createDiscoveryCache: () => DiscoveryCache;
+/** One filterable Vectorize metadata property a schema declares. */
+interface VectorMetadataDeclaration {
+  /** The vector index the property belongs to. */
+  index: string;
+  /**
+   * The validator kind behind the column, with `v.optional(...)` and a
+   * nullable union unwrapped (metadata columns are usually optional), or
+   * `undefined` when the column isn't in the owning table's shape. Callers map it to the Vectorize
+   * metadata type; a kind that can't be filtered on is reported, not indexed.
+   */
+  kind: string | undefined;
+  /** Column mirrored into vector metadata. */
+  property: string;
+}
+interface SchemaInfo {
+  /**
+   * Whether the schema declares a **D1-backed** `.global()` table — the only
+   * flavour that needs the `DB` binding and the app's `.global({ d1 })` chain.
+   * A `.global({ backend: "hyperdrive" })` table needs neither, and counting it
+   * here demanded a D1 database of a project that has none.
+   */
+  hasD1GlobalTable: boolean;
+  /** Whether the schema declares a `.global({ backend: "hyperdrive" })` table — needs the app's `.hyperdriveGlobal(...)` chain instead. Required, not optional: the only producer always knows the answer, and `?` made every consumer read a two-valued fact as three-valued. */
+  hasHyperdriveGlobalTable: boolean;
+  /**
+   * Data-residency jurisdiction declared via `defineSchema(...).jurisdiction("…")`.
+   * It pins the app's Durable Objects only; KV namespaces and R2 buckets carry
+   * their own jurisdiction, set when they are created.
+   */
+  jurisdiction?: SchemaIR["jurisdiction"];
+  /** Names of vector indexes declared via `.vectorize()` / `defineVectorIndex()`. */
+  vectorIndexNames?: ReadonlyArray<string>;
+  /**
+   * Metadata properties declared filterable on a vector index. Cloudflare
+   * needs an explicit metadata index per property before a `filter` can match
+   * anything, so deploy provisions these and doctor reports them.
+   */
+  vectorMetadata?: ReadonlyArray<VectorMetadataDeclaration>;
+}
+interface DiscoverSchemaInfoResult {
+  /** Parse error message, when the schema exists but could not be analyzed. */
+  error?: string;
+  /** Schema facts, or `undefined` when no `schema.ts` exists or parsing failed. */
+  info: SchemaInfo | undefined;
+}
+/** Discover the schema facts, memoised on `cache` when one is given. */
+declare const discoverSchemaInfo: (projectRoot: string, schemaDirectory: string, cache?: DiscoveryCache) => DiscoverSchemaInfoResult;
+interface DurableObjectSpec {
+  binding: string;
+  className: string;
+}
+/**
+ * Canonical Durable Object class → binding name. wrangler requires the worker
+ * to export a class of this exact name, so detection keys on the class name.
+ */
+declare const DURABLE_OBJECT_BINDINGS: {
+  readonly LunoraDO: "SHARD";
+  readonly SchedulerDO: "SCHEDULER";
+  readonly SessionDO: "SESSION";
+  readonly ShardDO: "SHARD";
+  readonly ShardRegistryDO: "SHARD_REGISTRY";
+};
+type DurableObjectClass = keyof typeof DURABLE_OBJECT_BINDINGS;
+/**
+ * The `_generated/` modules that hold a generated Durable Object / Workflow
+ * class — one per class kind a project can declare. wrangler validates every
+ * `class_name` against the worker's exports, so this is the set a worker entry
+ * re-exports (and the set the composed class-A entry star-re-exports for the
+ * kinds the project has).
+ *
+ * Owned here because four places need it and they must not drift:
+ * `@lunora/vite` emits one star re-export per entry, the wrangler validator
+ * DECIDES the composed entry's exports from it, `reconcile-bindings` types its
+ * export-gap `module` field on it, and this module's own `detectClassExports`
+ * probes the same names.
+ *
+ * `scheduler` carries no `define*` declarations of its own — codegen writes it
+ * off `hasScheduler` purely so the composed class-A entry has a `SchedulerDO`
+ * to forward. Its presence is therefore the ONLY signal the plugin and the
+ * validator need, and it is the same signal that decides whether the builder
+ * has a `.scheduler()` method at all. `@lunora/vite` depends on `@lunora/config`, so config
+ * owning it is the direction the dependency graph allows.
+ */
+declare const GENERATED_CLASS_MODULES: readonly ["agents", "containers", "scheduler", "shardRegistry", "workflows"];
+/** One {@link GENERATED_CLASS_MODULES} entry. */
+type GeneratedClassModule = (typeof GENERATED_CLASS_MODULES)[number];
+/**
+ * The framework Durable Object each class module forwards, for the modules that
+ * carry one: codegen writes them off the same signal that gives the builder the
+ * matching method, so the module's existence means the composed entry exports
+ * the class.
+ */
+declare const GENERATED_MODULE_DURABLE_OBJECTS: Partial<Record<GeneratedClassModule, DurableObjectClass>>;
+/** The `_generated/` module codegen writes when `lunora.config` opts in to the merge. */
+declare const MERGED_DURABLE_OBJECTS_MODULE: "durableObjects";
+/**
+ * Whether the project merges its Durable Objects: codegen wrote the merge
+ * module. The one test the composed entry, binding inference and the export
+ * validator all ask — the same "module existence is the signal" rule the
+ * scheduler and registry modules follow.
+ */
+declare const isMergedProject: (generatedDirectory: string) => boolean;
+/** Whether `module` holds a class the merged class hosts — imported into it, never re-exported. */
+declare const isMergedRoleModule: (module: string) => boolean;
+/**
+ * The class-B composed entry. `lunora deploy` passes this file to wrangler as
+ * the positional script whenever it exists, overriding `wrangler.main` — so it
+ * is what actually gets bundled and what wrangler checks its DO/Workflow
+ * bindings against. `main` in a class-B project names the framework adapter's
+ * build output (`.svelte-kit/cloudflare/_worker.js`, `dist/_worker.js`), which
+ * exists after `vite build` and exports only the SSR fetch handler. Lexing that
+ * instead read every declared class as unexported: nothing provisioned, plus a
+ * "add `export * from …`" warning the user cannot silence.
+ *
+ * Exported, not documented-as-duplicated: the CLI's `resolveComposedWorkerEntry`
+ * imports this constant, so the deploy's positional entry and the file this
+ * module lexes for exported classes cannot drift apart.
+ */
+declare const COMPOSED_WORKER_ENTRY = "src/worker.ts";
+/**
+ * A `defineContainer` declaration plus whether its generated DO class is
+ * exported by the worker entry. Only exported containers are safe to
+ * provision — wrangler rejects a `containers[].class_name` (and its Durable
+ * Object binding) that the worker doesn't export.
+ */
+type InferredContainer = ContainerIR & {
+  exported: boolean;
+};
+/**
+ * A `defineWorkflow` declaration plus whether its generated
+ * `WorkflowEntrypoint` class is exported by the worker entry. Only exported
+ * workflows are safe to provision — wrangler rejects an `exports.<Class>`
+ * workflow the worker doesn't export. Workflows are NOT Durable Objects, so this never
+ * implies a `durable_objects` binding or migration.
+ */
+interface InferredWorkflow extends WorkflowIR {
+  exported: boolean;
+}
+/**
+ * A `defineAgent` declaration plus whether its generated agent
+ * `WorkflowEntrypoint` class (e.g. `SupportAgentWorkflow`) is exported by the
+ * worker entry. An agent compiles onto a Cloudflare Workflow, so — exactly like
+ * {@link InferredWorkflow} — only exported agents are safe to provision
+ * (wrangler rejects an `exports.<Class>` workflow the worker doesn't export), and
+ * an agent is NOT a Durable Object (no `durable_objects` binding or migration).
+ */
+interface InferredAgent extends AgentIR {
+  exported: boolean;
+}
+/**
+ * A queue declared in `lunora/queues.ts`. Unlike workflows, a queue needs no
+ * worker-entry class export (its `queue()` handler rides `createWorker`), so
+ * there is no `exported` flag — every declared queue is reconcilable into the
+ * wrangler `queues.producers[]` / `queues.consumers[]`.
+ */
+type InferredQueue = QueueIR;
+interface InferredBindings {
+  /** Agents declared in `lunora/agents.ts` (exported or not — see {@link InferredAgent.exported}); reconciled into wrangler `exports`. */
+  agents: InferredAgent[];
+  /** Containers declared in `lunora/containers.ts` (exported or not — see {@link InferredContainer.exported}). */
+  containers: InferredContainer[];
+  /** Durable Objects the worker entry exports → safe to bind. */
+  durableObjects: DurableObjectSpec[];
+  /**
+   * The wrangler `flagship[].binding` name implied by `lunora/flags.ts` when it
+   * uses the Flagship provider in binding mode — `undefined` for HTTP-mode
+   * Flagship, a custom OpenFeature provider, or no flags. The binding needs an
+   * un-mintable `app_id`, so it is reconciled as a hint, not auto-written.
+   */
+  flagshipBinding?: string;
+  /**
+   * The schema's `.jurisdiction("…")`, when it declares one. Read by the binding
+   * hints whose resource takes its residency at creation (Artifacts), so the
+   * hint can name the jurisdiction to create it in.
+   */
+  jurisdiction?: SchemaInfo["jurisdiction"];
+  /** Schema declares a `.global()` table → needs the `DB` D1 binding. */
+  needsD1: boolean;
+  /** Queues declared in `lunora/queues.ts` → reconciled into `queues.producers[]` / `queues.consumers[]`. */
+  queues: InferredQueue[];
+  /**
+   * Sibling Workers declared in `lunora.config` `services` → reconciled into
+   * `services[]` (plan 457). `undefined` when the declaration is unreadable, so
+   * reconcile leaves every entry alone rather than removing the owned ones.
+   */
+  services: ServiceBindingIR[] | undefined;
+  /** Human-readable provenance for each inferred binding / hint, for logging. */
+  signals: string[];
+  /** `@lunora/ai` is imported, `ctx.ai` read, or `env.AI` used → needs the `ai` Workers AI binding. */
+  usesAi: boolean;
+  /** `@lunora/bindings/ai-search` is value-imported or `ctx.aiSearch` read → self-describing `ai_search_namespaces` binding (`AI_SEARCH` on namespace `default`; auto-writeable). */
+  usesAiSearch: boolean;
+  /** `@lunora/bindings/analytics` is imported or `ctx.analytics` read → self-describing `analytics_engine_datasets` binding (auto-writeable). */
+  usesAnalytics: boolean;
+  /** `@lunora/bindings/analytics-sql` is value-imported or `ctx.analyticsSql` read → self-describing `analytics` binding (`{ binding: ANALYTICS_SQL }`; auto-writeable, wrangler >= 4.145.0). */
+  usesAnalyticsSql: boolean;
+  /**
+   * `ctx.artifacts` is read or `@lunora/bindings/artifacts` value-imported.
+   * Hint-only: the first repo `create()` against a missing namespace creates it
+   * UNRESTRICTED, and a namespace's jurisdiction can never change after that,
+   * so Lunora never writes the binding for you.
+   */
+  usesArtifacts: boolean;
+  /** `@lunora/auth` is imported (sessions may be D1- or `SessionDO`-backed). */
+  usesAuth: boolean;
+  /** `@lunora/browser` is imported or `ctx.browser` read → self-describing `browser` binding (auto-writeable). */
+  usesBrowser: boolean;
+  /** `@lunora/auth/cimd/workers` is imported → needs the `global_fetch_strictly_public` compatibility flag (no binding; `lunora doctor` checks it). */
+  usesCimdWorkers: boolean;
+  /** `lunora/flags.ts` declares a feature-flag provider (any OpenFeature provider — Flagship or custom). */
+  usesFlags: boolean;
+  /** `@lunora/hyperdrive` is imported or `ctx.sql` read (binding needs an un-mintable remote `id`; hint-only). */
+  usesHyperdrive: boolean;
+  /** `@lunora/bindings/images` is imported or `ctx.images` read → self-describing `images` binding (auto-writeable). */
+  usesImages: boolean;
+  /** `@lunora/bindings/kv` is imported or `ctx.kv` read (namespace binding name + id are user-defined; hint-only). */
+  usesKv: boolean;
+  /** `@lunora/mail` is imported (Resend API key must be set in `.dev.vars`; no binding). No `ctx.mail` helper exists, so only the import counts. */
+  usesMail: boolean;
+  /** `@lunora/notify` is imported or `ctx.notify` read (no binding; channel secrets ride `usesNotifyFcm` / `usesNotifyWebPush`). */
+  usesNotify: boolean;
+  /** `lunora/notify.ts` configures the `fcm` channel → the `FCM_*` secrets in `.dev.vars`. */
+  usesNotifyFcm: boolean;
+  /** `lunora/notify.ts` configures the `webPush` channel → the `VAPID_*` secrets in `.dev.vars`. */
+  usesNotifyWebPush: boolean;
+  /** `@lunora/payment/autumn` is imported → the Autumn secrets in `.dev.vars` (no binding). */
+  usesPaymentAutumn: boolean;
+  /** `@lunora/payment/creem` is imported → the Creem secrets in `.dev.vars` (no binding). */
+  usesPaymentCreem: boolean;
+  /** `@lunora/payment/dodopayments` is imported → the Dodo Payments secrets in `.dev.vars` (no binding). */
+  usesPaymentDodopayments: boolean;
+  /** `@lunora/payment/polar` is imported → the Polar secrets in `.dev.vars` (no binding). */
+  usesPaymentPolar: boolean;
+  /** `@lunora/payment` is imported or `ctx.payments` read (provider secrets must be set in `.dev.vars`; no binding). */
+  usesPayments: boolean;
+  /** `@lunora/payment/stripe` is imported → the Stripe secrets in `.dev.vars` (no binding). */
+  usesPaymentStripe: boolean;
+  /** `@lunora/bindings/pipelines` is value-imported or `ctx.pipelines` read (binding needs an un-mintable remote pipeline name; hint-only). */
+  usesPipelines: boolean;
+  /** `@lunora/bindings/r2sql` is value-imported or `ctx.r2sql` read (needs the `R2_SQL_*` secrets in `.dev.vars`; no binding). */
+  usesR2sql: boolean;
+  /** `@lunora/scheduler` is imported or `ctx.scheduler` read. */
+  usesScheduler: boolean;
+  /** `@lunora/storage` is imported or `ctx.storage` read under `lunora/` (R2 bucket binding name is user-defined). */
+  usesStorage: boolean;
+  /** `jsCodeTool` is imported from `@lunora/agent` in `lunora/` → self-describing `worker_loaders` binding (`LOADER`). */
+  usesWorkerLoader: boolean;
+  /** `@lunora/x402/pay` is imported or `ctx.x402` read — the agent-wallet pay rail signs from a Secrets Store binding paired with a spend policy (ActionCtx-only; hint-only). */
+  usesX402: boolean;
+  /** `@lunora/x402/charge` is imported — the charge rail settles USDC to a recipient address (a public `[vars]` entry, user-named; hint-only). */
+  usesX402Charge: boolean;
+  /** Workflows declared in `lunora/workflows.ts` (exported or not — see {@link InferredWorkflow.exported}). */
+  workflows: InferredWorkflow[];
+}
+interface InferOptions {
+  /** Memoises the source scans, so one CLI invocation parses the project once. */
+  cache?: DiscoveryCache;
+  projectRoot: string;
+  /** Directories (relative to root) to scan. Defaults to `lunora` + `src`. */
+  scanDirs?: ReadonlyArray<string>;
+  /** Lunora source directory holding `schema.ts`. Defaults to `lunora`. */
+  schemaDir?: string;
+}
+/**
+ * Scan a Lunora project and report which Cloudflare bindings its code implies.
+ * Read-only: performs no writes. Binding provisioning is driven by the worker
+ * entry's Durable Object exports plus the schema's D1 need; capability imports
+ * surface as hints.
+ */
+declare const inferLunoraBindings: (options: InferOptions) => Promise<InferredBindings>;
+/**
+ * The secret sources a project uses — the {@link PACKAGE_SECRETS_REGISTRY} keys
+ * whose secrets it needs, derived from its already-resolved {@link InferredBindings}.
+ *
+ * This is the canonical bridge between binding inference and the
+ * `.dev.vars.example` scaffolding in `scaffold-dev-variables.ts`. The result is
+ * {@link FLAG_PACKAGES}' sources whose flag is `true` in `bindings` — in
+ * flag-name order — followed by the configured `@lunora/notify` channels
+ * ({@link NOTIFY_CHANNEL_SECRETS}), keeping only sources that carry secrets.
+ */
+declare const secretSourcesFromBindings: (bindings: InferredBindings) => string[];
+export { COMPOSED_WORKER_ENTRY as C, DeployDriver as D, GeneratedClassModule as G, InferredBindings as I, MERGED_DURABLE_OBJECTS_MODULE as M, ProjectionPurpose as P, SchemaInfo as S, ToolchainCommand as T, DiscoveryCache as a, DURABLE_OBJECT_BINDINGS as b, DeployRequest as c, DevRequest as d, DiscoverSchemaInfoResult as e, DriverToolchain as f, GENERATED_CLASS_MODULES as g, GENERATED_MODULE_DURABLE_OBJECTS as h, InferOptions as i, InferredAgent as j, InferredContainer as k, InferredWorkflow as l, ProjectedConfig as m, SecretRequest as n, TailRequest as o, createDiscoveryCache as p, discoverSchemaInfo as q, inferLunoraBindings as r, isMergedProject as s, isMergedRoleModule as t, secretSourcesFromBindings as u };

package/dist/packem_shared/inferLunoraBindings-Gp_7yyIo.mjs

@@ -0,0 +1 @@
+import"./discoverAgentInfo-pqFMJBtJ.mjs";import{i as c,s as d}from"./infer-bindings-C1NFOdMi.mjs";import"./discoverContainerInfo-DzXr7Vm3.mjs";import"./DEV_VARS_EXAMPLE_FILE-CqLorAxT.mjs";import"./discover-info-DC2MrAIM.mjs";import"./package-secrets-registry-BeheNwsP.mjs";import"./discoverSchemaInfo-BBRlXZop.mjs";import"./COMPOSED_WORKER_ENTRY-Ciiba5g_.mjs";import"./discoverWorkflowInfo-zW7Tt0Tn.mjs";export{c as inferLunoraBindings,d as secretSourcesFromBindings};

package/dist/packem_shared/interpretRemote-CcmGeGZ_.mjs

@@ -0,0 +1 @@
+import{readProjectConfigLiterals as o,readProjectTarget as n}from"@lunora/codegen";import{DEFAULT_DEPLOY_TARGET as c,resolveDeployDriver as a}from"./DEFAULT_DEPLOY_TARGET-rR7buNQw.mjs";const s=e=>{if(typeof e=="boolean")return e;if(e!==null&&typeof e=="object")return!0},g=e=>s(o(e).remote),i=e=>n(e),T=(e,r)=>r??i(e)??c,j=(e,r)=>{const t=T(e,r);return a(t),t};export{s as interpretRemote,g as readProjectRemotePreference,i as readProjectTarget,T as resolveProjectTarget,j as resolveTargetOrThrow};

package/dist/packem_shared/lunora-manifest-DuH_Cmyu.mjs

@@ -0,0 +1,6 @@
+import{readFileSync as b,writeFileSync as v}from"node:fs";import{applyEdits as $,modify as S,parseTree as N,findNodeAtLocation as g}from"jsonc-parser";import{join as h}from"node:path";const A=/^([\t ]+)"/mu,F=n=>{const o=A.exec(n)?.[1]??"    ";return{eol:n.includes(`\r
+`)?`\r
+`:`
+`,insertSpaces:!o.startsWith("	"),tabSize:o.length}},I=n=>{const o=h(n,"package.json");try{const t=b(o,"utf8"),{lunora:r}=JSON.parse(t),e=typeof r=="object"&&r!==null&&!Array.isArray(r);return{lunora:e?r:void 0,lunoraIsForeign:r!==void 0&&!e,path:o,text:t}}catch{return}},p=n=>JSON.stringify(n,(o,t)=>typeof t=="object"&&t!==null&&!Array.isArray(t)?Object.fromEntries(Object.entries(t).toSorted(([r],[e])=>r.localeCompare(e))):t),j=(n,o,t)=>{const r=F(n),e=r.insertSpaces===!1?"	":" ".repeat(r.tabSize??4),i=r.eol??`
+`,c=e.repeat(o.length),f=JSON.stringify(t,void 0,e).split(`
+`).join(i+c),l=N(n),a=l===void 0?void 0:g(l,[...o]);if(a!==void 0)return n.slice(0,a.offset)+f+n.slice(a.offset+a.length);let s=l;l!==void 0&&o.length>1&&(s=g(l,o.slice(0,-1)));const y=JSON.stringify(o.at(-1));if(s===void 0&&o.length>1)return j(n,o.slice(0,-1),{[o.at(-1)]:t});if(s?.type!=="object")return $(n,S(n,[...o],t,{formattingOptions:r}));const d=s.children?.at(-1);if(d===void 0){const O=`${i}${c}${y}: ${f}${i}${e.repeat(o.length-1)}`;return`${n.slice(0,s.offset+1)}${O}${n.slice(s.offset+s.length-1)}`}const u=d.offset+d.length;return`${n.slice(0,u)},${i}${c}${y}: ${f}${n.slice(u)}`},K=(n,o,t)=>{const r=Object.keys(n.lunora??{}).every(c=>c===o);if(n.lunoraIsForeign||p(n.lunora?.[o])===p(t))return;const e=t===void 0&&r?["lunora"]:["lunora",o],i=t===void 0?$(n.text,S(n.text,e,void 0,{})):j(n.text,e,t);i!==n.text&&v(n.path,i,"utf8")};export{K as a,p as c,F as f,I as r};

package/dist/packem_shared/materializeServiceDevConfigs-DLUHefD-.mjs

@@ -0,0 +1 @@
+import{isAbsolute as f,dirname as p,resolve as m}from"node:path";import{applyModify as l}from"./applyModify-DKP2l6S9.mjs";import{hasCloudflareCredentials as h}from"./hasCloudflareCredentials-byvHpEiD.mjs";import{withheldWorkersAi as u,writeDevConfig as v}from"./describeWithheldWorkersAi-IIxe3TuI.mjs";import{readWranglerJsonc as w}from"./WRANGLER_FILES-UNW-xY5u.mjs";const g=(t,r)=>{const{parsed:e,text:n}=w(t),o=e?.build,c=u(e?.ai,r.hasCredentials??(()=>h({projectRoot:r.projectRoot}))),d=typeof o?.command=="string"&&o.command!==""&&!(typeof o.cwd=="string"&&f(o.cwd));if(!d&&c===void 0)return{configPath:t};const s=p(t);let i=n;c!==void 0&&(i=l(i,["ai"],void 0)),d&&(i=l(i,["build","cwd"],m(s,typeof o.cwd=="string"?o.cwd:".")));const a=v(s,"service",i);return{cleanup:a.cleanup,configPath:a.configPath,withheld:c}},j=(t,r)=>{const e=t.map(o=>g(o,r)),n=e.flatMap(o=>o.cleanup===void 0?[]:[o.cleanup]);return{cleanup:()=>{for(const o of n)o()},configPaths:e.map(o=>o.configPath),withheld:e.flatMap(o=>o.withheld===void 0?[]:[o.withheld])}};export{j as materializeServiceDevConfigs};

package/dist/packem_shared/mergeWranglerEnvironment-DXiB-HcS.mjs

@@ -0,0 +1 @@
+const c=["ai_search","ai_search_namespaces","analytics","artifacts","containers","d1_databases","durable_objects","k2","kv_namespaces","queues","r2_buckets","secrets","secrets_store_secrets","services","tail_consumers","vars","vectorize","workflows"],i=["assets","compatibility_date","compatibility_flags","exports","logpush","main","migrations","observability","placement"],m=(s,n)=>{if(n===void 0)return{merged:s,unverifiedKeys:[]};const t=s.env?.[n];if(t===void 0){const e=Object.keys(s.env??{}).toSorted((v,f)=>v.localeCompare(f)),l=e.length>0?` (declared: ${e.join(", ")}).`:" (no environments are declared).";return{error:`--env "${n}" names no environment declared in wrangler.jsonc's "env" block${l}`,merged:s,unverifiedKeys:[]}}const o={...s},r=Object.keys(t).filter(e=>e!=="env");for(const e of r)i.includes(e)&&(o[e]=t[e]);for(const e of c)o[e]=t[e];const a=new Set([...c,...i]),d=r.filter(e=>!a.has(e)).map(String);return{merged:o,unverifiedKeys:d}};export{c as NON_INHERITABLE_KEYS,m as mergeWranglerEnvironment};

package/dist/packem_shared/package-secrets-registry-BeheNwsP.mjs

@@ -0,0 +1 @@
+const t=e=>e.endsWith("S")?e.slice(0,-1):e,r=e=>e.replaceAll(/([a-z\d])([A-Z])/gu,"$1_$2").toUpperCase().split(/[_-]+/u).filter(s=>s.length>0),n=new Set(["CREDENTIAL","DSN","PASSPHRASE","PASSWD","PASSWORD","SECRET","TOKEN"]),c=["ACCESS_KEY","API_KEY","ENCRYPTION_KEY","PRIVATE_KEY","SIGNING_KEY"],p=new RegExp(`(?:${[...n,...c.map(e=>e.replaceAll("_",""))].join("|")})S?$`,"iu"),i=e=>r(e).some(s=>s==="PUBLIC"||s==="PUBLISHABLE"),d=e=>{if(i(e))return!1;const s=r(e);if(s.some(o=>n.has(t(o))))return!0;const a=t(s.join("_"));return c.some(o=>a===o||a.endsWith(`_${o}`))||p.test(e)},h=[{description:"Bearer token the local Lunora Studio uses to call the worker's admin endpoints (data browser, schema edits) in dev. Generate with: openssl rand -hex 32",docsUrl:"https://lunora.sh/docs/packages/studio",key:"LUNORA_ADMIN_TOKEN",placeholderValue:"replace-with-openssl-rand-hex-32"}],u=["BETTER_AUTH_SECRET","STORAGE_SIGNING_SECRET"],l={"@lunora/auth":[{description:"32-byte random secret used to sign sessions and tokens. Generate with: openssl rand -hex 32",docsUrl:"https://lunora.sh/docs/packages/auth#secrets",key:"AUTH_SECRET",placeholderValue:"replace-with-openssl-rand-hex-32"},{description:"Public base URL of your worker (used by better-auth for redirects and cookie domain). For local dev this is typically http://localhost:8787",docsUrl:"https://lunora.sh/docs/packages/auth#secrets",key:"AUTH_URL",placeholderValue:"http://localhost:8787"}],"@lunora/bindings/r2sql":[{description:"Cloudflare API token with R2 SQL read access, for `ctx.r2sql`. Create at https://dash.cloudflare.com/profile/api-tokens with the R2 SQL permission.",docsUrl:"https://lunora.sh/docs/packages/bindings#r2-sql",key:"R2_SQL_TOKEN",placeholderValue:"<your-r2-sql-api-token>"},{description:"Cloudflare account id the R2 SQL queries run against. Falls back to CLOUDFLARE_ACCOUNT_ID when unset.",docsUrl:"https://lunora.sh/docs/packages/bindings#r2-sql",key:"R2_SQL_ACCOUNT_ID",placeholderValue:"<your-cloudflare-account-id>"},{description:"Name of the R2 bucket holding the Iceberg tables `ctx.r2sql` queries.",docsUrl:"https://lunora.sh/docs/packages/bindings#r2-sql",key:"R2_SQL_BUCKET",placeholderValue:"<your-r2-sql-bucket>"}],"@lunora/mail":[{description:"Resend API key for sending transactional email via @lunora/mail. Obtain at https://resend.com/api-keys",docsUrl:"https://lunora.sh/docs/packages/mail#secrets",key:"RESEND_API_KEY",placeholderValue:"<your-resend-api-key>"}],"@lunora/notify:fcm":[{description:"Firebase project id for FCM (HTTP v1) push. Found in the Firebase console project settings.",docsUrl:"https://lunora.sh/docs/packages/notify#fcm",key:"FCM_PROJECT_ID",placeholderValue:"<your-firebase-project-id>"},{description:"OAuth2 access token for FCM (HTTP v1). Convenient for dev but expires — in production supply a getAccessToken() in defineNotify instead. Obtain via the Google Cloud SDK / a service account.",docsUrl:"https://lunora.sh/docs/packages/notify#fcm",key:"FCM_ACCESS_TOKEN",placeholderValue:"<your-fcm-access-token>"}],"@lunora/notify:webPush":[{description:"Public VAPID key (base64url) for Web Push. Generate a keypair once with: npx web-push generate-vapid-keys — the public key is also shipped to the browser to subscribe.",docsUrl:"https://lunora.sh/docs/packages/notify#web-push",key:"VAPID_PUBLIC_KEY",placeholderValue:"<your-vapid-public-key>"},{description:"Private VAPID key (base64url) for Web Push — the application-server signing key. Generate with: npx web-push generate-vapid-keys",docsUrl:"https://lunora.sh/docs/packages/notify#web-push",key:"VAPID_PRIVATE_KEY",placeholderValue:"<your-vapid-private-key>"},{description:"VAPID `sub` contact — a mailto: or https: URL identifying the application server (e.g. mailto:you@example.com).",docsUrl:"https://lunora.sh/docs/packages/notify#web-push",key:"VAPID_SUBJECT",placeholderValue:"mailto:you@example.com"}],"@lunora/payment/autumn":[{description:"Autumn secret key (am_sk_…) for the Autumn payment adapter. Obtain at https://app.useautumn.com/dev",docsUrl:"https://lunora.sh/docs/packages/payment#autumn",key:"AUTUMN_SECRET_KEY",placeholderValue:"<your-autumn-secret-key>"},{description:"Autumn webhook signing secret for verifying Standard Webhooks event payloads. Obtain from your Autumn dashboard webhook settings.",docsUrl:"https://lunora.sh/docs/packages/payment#autumn",key:"AUTUMN_WEBHOOK_SECRET",placeholderValue:"<your-autumn-webhook-secret>"}],"@lunora/payment/creem":[{description:"Creem API key for the Creem payment adapter. Obtain at https://www.creem.io/dashboard/developers",docsUrl:"https://lunora.sh/docs/packages/payment#creem",key:"CREEM_API_KEY",placeholderValue:"<your-creem-api-key>"},{description:"Creem webhook signing secret for verifying the creem-signature header. Obtain from your Creem dashboard webhook settings.",docsUrl:"https://lunora.sh/docs/packages/payment#creem",key:"CREEM_WEBHOOK_SECRET",placeholderValue:"<your-creem-webhook-secret>"}],"@lunora/payment/dodopayments":[{description:"Dodo Payments API key (bearer token) for the Dodo Payments adapter. Obtain at https://app.dodopayments.com/developer/api-keys",docsUrl:"https://lunora.sh/docs/packages/payment#dodo-payments",key:"DODO_PAYMENTS_API_KEY",placeholderValue:"<your-dodo-payments-api-key>"},{description:"Dodo Payments webhook signing secret (whsec_…) for verifying event payloads. Obtain at https://app.dodopayments.com/developer/webhooks",docsUrl:"https://lunora.sh/docs/packages/payment#dodo-payments",key:"DODO_PAYMENTS_WEBHOOK_KEY",placeholderValue:"<your-dodo-payments-webhook-secret>"}],"@lunora/payment/polar":[{description:"Polar access token for the Polar payment adapter. Obtain at https://polar.sh/settings/tokens",docsUrl:"https://lunora.sh/docs/packages/payment#polar",key:"POLAR_ACCESS_TOKEN",placeholderValue:"<your-polar-access-token>"},{description:"Polar webhook secret for verifying event payloads from Polar. Obtain at https://polar.sh/settings/webhooks",docsUrl:"https://lunora.sh/docs/packages/payment#polar",key:"POLAR_WEBHOOK_SECRET",placeholderValue:"<your-polar-webhook-secret>"}],"@lunora/payment/stripe":[{description:"Stripe secret key (sk_test_…). Required when using the Stripe adapter. Obtain at https://dashboard.stripe.com/apikeys",docsUrl:"https://lunora.sh/docs/packages/payment#stripe",key:"STRIPE_SECRET_KEY",placeholderValue:"<your-stripe-secret-key>"},{description:"Stripe webhook signing secret (whsec_…) for verifying event payloads. Obtain at https://dashboard.stripe.com/webhooks",docsUrl:"https://lunora.sh/docs/packages/payment#stripe",key:"STRIPE_WEBHOOK_SECRET",placeholderValue:"<your-stripe-webhook-secret>"}]},y=new Set([...u,...[...h,...Object.values(l).flat()].filter(e=>d(e.key)&&!e.placeholderValue.startsWith("<")).map(e=>e.key)]),k=e=>{const s=[];for(const a of e){const o=l[a];o!==void 0&&s.push(...o)}return s};export{h as C,y as M,l as P,d as a,i,k as s};

package/dist/packem_shared/parseDevVariable-teAAahVD.mjs

@@ -0,0 +1 @@
+import{readFileSync as n}from"node:fs";import{join as s}from"node:path";import{parseDevVariableEntries as i}from"./DEV_VARS_EXAMPLE_FILE-CqLorAxT.mjs";const a=(o,r)=>{const e=i(o).find(t=>t.key===r);return e===void 0||e.value===""?void 0:e.value},d=o=>{let r;try{r=a(n(s(o,".dev.vars"),"utf8"),"LUNORA_ADMIN_TOKEN")}catch{r=void 0}const e=process.env.LUNORA_ADMIN_TOKEN;return typeof e=="string"&&e!==""&&e!==r&&console.warn("[lunora] LUNORA_ADMIN_TOKEN is exported in this shell but differs from .dev.vars — the local worker only verifies the .dev.vars token, so the studio uses that one."),r};export{a as parseDevVariable,d as resolveAdminToken};

package/dist/packem_shared/parseSchema-D1Wbr1qv.mjs

@@ -0,0 +1 @@
+import{Project as m,SyntaxKind as n}from"ts-morph";const f=/^v\s*\.\s*optional\s*\(/u,x=/\.shardBy\(\s*["']([^"']+)["']\s*\)/u,T=/\.global\(\s*(?:\{[^{}]*\}\s*)?\)/u,p=/["']/gu,u=e=>{const t=e.getDescendantsOfKind(n.CallExpression);return e.getKind()===n.CallExpression&&t.push(e.asKindOrThrow(n.CallExpression)),t},A=e=>f.test(e.trim()),h=e=>e?.getKind()!==n.ArrayLiteralExpression?[]:e.asKindOrThrow(n.ArrayLiteralExpression).getElements().filter(t=>t.getKind()===n.StringLiteral).map(t=>t.asKindOrThrow(n.StringLiteral).getLiteralText()),E=e=>{if(e?.getKind()!==n.ObjectLiteralExpression)return!1;const t=e.asKindOrThrow(n.ObjectLiteralExpression).getProperty("unique");return t?.getKind()===n.PropertyAssignment&&t.getInitializer()?.getText()==="true"},K=e=>{const t=e.getExpression();if(t.getKind()!==n.PropertyAccessExpression||t.asKindOrThrow(n.PropertyAccessExpression).getName()!=="index")return;const[r,a,s]=e.getArguments();if(r?.getKind()===n.StringLiteral)return{fields:h(a),name:r.asKindOrThrow(n.StringLiteral).getLiteralText(),unique:E(s)}},O=e=>{const t=e.getInitializer();if(t===void 0)return[];const r=[];for(const a of u(t)){const s=K(a);s!==void 0&&r.push(s)}return r},y=e=>{const t=[],r=e.getInitializer(),s=(r===void 0?void 0:u(r).find(l=>l.getExpression().getText()==="defineTable"))?.getArguments()[0];if(s?.getKind()!==n.ObjectLiteralExpression)return t;for(const l of s.getProperties()){if(l.getKind()!==n.PropertyAssignment)continue;const i=l,o=i.getName().replaceAll(p,""),c=i.getInitializer()?.getText()??"";t.push({name:o,optional:A(c),validator:c})}return t},P=e=>{const r=new m({compilerOptions:{allowJs:!0},useInMemoryFileSystem:!0}).createSourceFile("schema.ts",e,{overwrite:!0}),a=r.getDescendantsOfKind(n.CallExpression).find(i=>i.getExpression().getText()==="defineSchema");if(a===void 0)return{ok:!1,reason:r.getImportDeclarations().some(o=>o.getNamedImports().some(c=>c.getName()==="defineSchema"&&c.getAliasNode()!==void 0))?"aliased-define-schema":"no-define-schema"};const s=a.getArguments()[0];if(s?.getKind()!==n.ObjectLiteralExpression)return{ok:!1,reason:"non-object-argument"};const l=[];for(const i of s.getProperties()){if(i.getKind()!==n.PropertyAssignment)continue;const o=i,c=o.getName().replaceAll(p,""),g=o.getInitializer()?.getText()??"",d=x.exec(g);l.push({columns:y(o),global:T.test(g),indexes:O(o),name:c,...d?.[1]===void 0?{}:{shardBy:d[1]}})}return{ok:!0,tables:l}};export{u as collectCalls,P as parseSchema};

package/dist/packem_shared/policy-scaffold.d-D2H4_G01.d.mts

@@ -0,0 +1,86 @@
+/**
+ * The server-module specifier to scaffold into a project's own source:
+ * `lunorash/server` when the project depends on the umbrella, `@lunora/server`
+ * when it installs the granular packages. Same detection codegen and the Vite
+ * compose plugin use, so a scaffolded file imports what the emitted code does.
+ */
+declare const resolveServerModule: (projectRoot: string) => string;
+/** Scaffold a new policy/role/permission stub file under `lunora/`. */
+interface ScaffoldPolicyEdit {
+  readonly kind: "scaffoldPolicy";
+  /**
+   * Base name for the generated file and its exported policy-set identifier,
+   * e.g. `invoices` → `lunora/invoices.policies.ts` exporting `invoicesPolicies`.
+   */
+  readonly name: string;
+  /** Logical table the scaffolded policy guards (used in the stub body). */
+  readonly table: string;
+}
+/** Append `.use(rls(<policies>))` to an existing procedure's builder chain. */
+interface WireRlsEdit {
+  /** Exported procedure name to wire, e.g. `listInvoices`. */
+  readonly exportName: string;
+  readonly kind: "wireRls";
+  /** Identifier of the policy set passed to `rls(...)`, e.g. `invoicesPolicies`. */
+  readonly policies: string;
+}
+/** Additive scaffolder edits — the only requests the scaffolder applies. */
+type AdditivePolicyEdit = ScaffoldPolicyEdit | WireRlsEdit;
+/**
+ * Destructive scaffolder requests — never applied. Rewriting an existing `when`
+ * body changes evaluation semantics silently, so it is refused (STOP condition
+ * in plan 025); carried as data so the editor can describe the request.
+ */
+interface DestructivePolicyEdit {
+  readonly exportName?: string;
+  readonly kind: "rewritePolicyWhen";
+  readonly table?: string;
+}
+/** Any request the scaffolder can receive. */
+type PolicyEdit = AdditivePolicyEdit | DestructivePolicyEdit;
+/**
+ * Classify a scaffolder request. Additive requests ({@link AdditivePolicyEdit})
+ * apply directly; everything else (rewriting an existing predicate) changes
+ * evaluation semantics and is destructive.
+ */
+declare const classifyPolicyEdit: (edit: PolicyEdit) => "additive" | "destructive";
+/** Failure reasons a scaffolder request can report. */
+type PolicyScaffoldFailureReason = "already-wired" | "destructive" | "invalid-identifier" | "unknown-procedure" | "unsupported-procedure-shape";
+/** Tagged result of generating a stub file. */
+type ScaffoldFileResult = {
+  fileName: string;
+  ok: true;
+  source: string;
+} | {
+  ok: false;
+  reason: PolicyScaffoldFailureReason;
+};
+/** Tagged result of wiring a procedure. */
+type WireResult = {
+  ok: false;
+  reason: PolicyScaffoldFailureReason;
+} | {
+  ok: true;
+  text: string;
+};
+/**
+ * Generate the source of a new policy/role/permission stub file. The `when`
+ * predicate is a `() => false` skeleton with a TODO — the scaffolder never
+ * authors real logic, the developer fills it in. Pure (no I/O); the handler
+ * writes the returned source and refuses to overwrite an existing file.
+ *
+ * `serverModule` is the specifier the PROJECT can resolve the builders from
+ * (see {@link resolveServerModule}) — an umbrella-only install has no
+ * `@lunora/server` on disk, so hard-coding it would scaffold a file that
+ * cannot be bundled.
+ */
+declare const scaffoldPolicyFile: (edit: ScaffoldPolicyEdit, serverModule: string) => ScaffoldFileResult;
+/**
+ * Append `.use(rls(<policies>))` to a procedure's builder chain, preserving the
+ * terminal `.query(handler)` (and its handler body) byte-for-byte. Only the
+ * **builder** form can be wired; the bare-factory form (`query({ handler })`)
+ * has no chain and is reported `unsupported-procedure-shape` so the editor can
+ * tell the developer to convert it rather than silently rewriting their code.
+ */
+declare const wireRlsIntoProcedure: (source: string, edit: WireRlsEdit, serverModule: string) => WireResult;
+export { AdditivePolicyEdit as A, DestructivePolicyEdit as D, PolicyEdit as P, ScaffoldPolicyEdit as S, WireRlsEdit as W, PolicyScaffoldFailureReason as a, ScaffoldFileResult as b, WireResult as c, classifyPolicyEdit as d, resolveServerModule as r, scaffoldPolicyFile as s, wireRlsIntoProcedure as w };