@lunora/codegen 1.0.0-alpha.321 → 1.0.0-alpha.323

package/dist/packem_shared/SCHEMA_SNAPSHOT_FILENAME-CU4krosg.mjs

@@ -0,0 +1,11 @@
+import{existsSync as M,mkdirSync as Mt,readFileSync as er,writeFileSync as tr,rmSync as Se,readdirSync as En}from"node:fs";import{dirname as _t,join as v,relative as xn}from"node:path";import{performance as ut}from"node:perf_hooks";import{runAdvisor as sr}from"@lunora/advisor";import{LunoraError as j}from"@lunora/errors";import{serializeSchemaSnapshot as nr}from"./SCHEMA_SNAPSHOT_VERSION-C0oHwiJZ.mjs";import{toAdvisorContext as ir}from"./formatAdvisories-BCVASH7N.mjs";import{Node as r,SyntaxKind as d,ts as rr,VariableDeclarationKind as or}from"ts-morph";import{listLunoraSourceFiles as y,lunoraRelativePath as I,bindingKeyName as oe,collectCallRows as C,findObjectProperty as B,collectSecurityCallRows as ar,propertyInitializer as R,listSecurityScanFiles as je,objectLiteralFromCallbackBody as Sn,limitNameOf as An,optionsObjectLiteral as yn,handlerOf as cr,collectNodeRows as se,chainRootOf as He,outermostValueWrapper as w,isWriteTarget as Ge,isSameNode as A,unwrapExpression as h,isConstDeclaration as ne,memberAccessOf as Kt,returningFunctionOf as At,walkChain as lr,RUN_METHODS as bn,functionReferenceSegments as dr,isTestPath as ur,isFunctionLike as ie,functionKeyOf as Nn}from"./isTestPath-B81lOULB.mjs";import{b as Y,d as q,f as D,g as zt,c as x,a as Pn,w as Bt,k as fr,l as gr,h as pr,m as mr,j as yt,i as hr}from"./attribution-hVBriwzy.mjs";import{a as Ps,r as ft,i as H,b as vr,m as wn,c as Ye,e as $t,E as In,C as Cn,d as Er,f as xr,g as Sr}from"./context-root-BdxINX-T.mjs";import{a as N,i as Ar,c as ee,d as Tn,e as yr,f as br}from"./classify-procedure-call-DVxdUhZt.mjs";import{a as S,r as On,s as Nr,b as Pr}from"./project-config-file-BV7RR-l6.mjs";import{a as wr,b as Qe}from"./module-specifiers-WF8iAydP.mjs";import{r as Xe,s as Ir}from"./parse-validator-IDBKIT7M.mjs";import Cr from"./discoverAuthApiCalls-xs0ONfI-.mjs";import{i as _,r as kn}from"./database-calls-BKozZUEW.mjs";import Tr from"./discoverHyperdriveCalls-DV4IglLE.mjs";import{diagnosticAt as Ne}from"./CodegenDiagnosticError-BUXlG3P-.mjs";import{m as Vt,a as ze,s as Rn,d as Or}from"./index-JnqBWRYO.mjs";import{MUTATORS_FILENAME as kr,isDefineMutatorCallee as Rr,mutatorServerImplOf as Fr,discoverMutators as Dr}from"./MUTATORS_FILENAME-Jkk8Zgkb.mjs";import Lr from"./discoverNondeterministicCalls-DvhyKM-f.mjs";import{discoverNotifyConfig as Mr,discoverNotifyCalls as _r}from"./NOTIFY_FILENAME-bAt7J3cs.mjs";import Kr from"./discoverR2sqlCalls-DVcfMO6-.mjs";import zr from"./discoverRlsProcedures-Du7ITNTQ.mjs";import{s as Ut,n as Br}from"./dispatch-namespace-DwTjD7BU.mjs";import{secretKindOf as $r,redact as Vr,isHeuristicSecretKind as Ur,isSecretishName as Wr}from"./redact-Cy14LEnc.mjs";import{a as Re,d as qr,r as jr}from"./modules-CjOcuQnK.mjs";import{WORKFLOWS_FILENAME as Hr,discoverWorkflows as Gr}from"./WORKFLOWS_FILENAME-CdeS224T.mjs";import{r as Yr}from"./json-data-Chfs2Cz5.mjs";import{G as Qr}from"./shared-DnCokNcE.mjs";import{createCodegenProject as Xr}from"./createCodegenProject-V51_yBw3.mjs";import{findTsconfig as Gv,refreshCodegenProject as Yv}from"./createCodegenProject-V51_yBw3.mjs";import{CAPABILITIES as Jr,usedCapabilities as Zr}from"./CAPABILITY_PROBES-brcmKenl.mjs";import{isD1GlobalTable as Fn,isHyperdriveGlobalTable as Dn}from"./isD1GlobalTable-udvHAAzD.mjs";import{discoverAgents as eo}from"./AGENTS_FILENAME-B6-kjzM3.mjs";import{discoverContainers as to}from"./CONTAINERS_FILENAME-dFRtAyIe.mjs";import so from"./discoverCrons-DBnCama4.mjs";import{contextPropertiesRead as no,discoverFeatureUsage as io}from"./capabilitiesUsedBy-D3pvpeAt.mjs";import Ln from"./readPackageDependencies-RHhGiz0k.mjs";import{PROJECT_CONFIG_FILENAMES as ro,findProjectConfigFile as oo}from"./PROJECT_CONFIG_FILENAMES-DzOu-lSc.mjs";import{discoverQueueDeclarations as ao}from"./QUEUES_FILENAME-CsRy4VTF.mjs";import{discoverSandboxUsage as co}from"./discoverSandboxUsage-w6Q3RvxZ.mjs";import{resolveServiceBindings as lo}from"./readServiceBindings-DvqIThzd.mjs";import uo from"./discoverStorageRulesMetadata-ClzKLdCV.mjs";import{resolveCodegenTarget as bt,gatePlatformFeatures as fo,readTargetDiagnostics as go,vectorizeDimensionDiagnostics as po,liveStreamsDeliveryAuthorizationDiagnostic as mo,studioPlatformFor as ho,platformFeatureAvailable as vo}from"./DEFAULT_TARGET-DXhxbij-.mjs";import{i as Eo}from"./schema-BgM8A3XV.mjs";import{b as Mn,e as xo}from"./shard-ceGu_Fps.mjs";import{e as So,a as Ao}from"./server-DAvi_bv_.mjs";import{emitDataModel as yo}from"./emitDataModel-BskFt9Wv.mjs";import{i as bo,a as No,e as Po,b as wo,d as Io,c as Co}from"./unwrap-handler-return-CeaOifqX.mjs";import To from"./discoverFunctions-CZgLhsMn.mjs";import Oo from"./discoverHttpRoutes-WBAqBcfK.mjs";import ko from"./discoverInserts-BjxXCACZ.mjs";import{e as _n}from"./exported-procedure-chains-BNBUkXui.mjs";import Ro from"./discoverMigrations-C9mLIhGZ.mjs";import Fo from"./discoverQueries-C8E7TeRT.mjs";import Do from"./discoverRlsMetadata-QRsWRQbM.mjs";import Lo from"./discoverSchema-BtsX-CN9.mjs";import{discoverShapes as Mo}from"./SHAPES_FILENAME-DkBUN9dK.mjs";import{i as _o}from"./reserved-words-CW1QFbTd.mjs";import{emitApp as Ko}from"./emitApp-DuJW6LKD.mjs";import{readJsonSync as zo}from"@visulima/fs";import{buildSchemaSnapshot as Bo}from"./SchemaSnapshotParseError-BRJT7c2k.mjs";import{buildOpenApiDocument as $o,emitOpenApiModule as Vo}from"./buildOpenApiDocument-DFv-RYZU.mjs";import{buildOpenRpcDocument as Uo,emitOpenRpcModule as Wo}from"./OPENRPC_VERSION-CCY7xqSL.mjs";import{v as qo,t as jo,u as Ho,s as Go,w as Yo}from"./shard-runtime-BpoCV-aM.mjs";import{emitCollections as Qo,emitSeed as Xo,emitApi as Jo,emitInternalApi as Zo}from"./emitApi-CDgIPAG2.mjs";import{emitCrons as ea,emitScheduler as ta,emitShardRegistry as sa,emitDurableObjects as na,emitVectors as ia,emitWranglerCronTriggers as ra}from"./emitCrons-BQW2lviZ.mjs";import oa from"./emitDrizzleSchema-DitcRZ1a.mjs";import{LAZY_FUNCTION_DIRECTORY as Kn,emitFunctions as aa,emitLazyFunctionModules as ca}from"./emitFunctions-CuZzKaU4.mjs";const zn=new Set(["delete","get","head","options","patch","post","put"]),la=new Set(["handler","stream"]),da=/\/(?:_|admin|internal|superuser|sudo|root|debug)/iu,ws=new Set(["ADMIN_TOKEN","adminToken","assertAdmin","assertAuth","auth","Authorization","getSession","identity","isAdmin","requireAdmin","requireAuth","requireRole","verifyAdmin"]),ua=e=>{if(!r.isCallExpression(e))return;const t=e.getExpression();if(!r.isPropertyAccessExpression(t)||!zn.has(t.getName()))return;const s=t.getExpression();if(!r.isIdentifier(s)||s.getText()!=="httpRoute")return;const n=e.getArguments()[0];if(!(!n||!r.isStringLiteral(n)))return{method:t.getName().toUpperCase(),path:n.getLiteralValue()}},fa=e=>{const t=e.getExpression();if(!r.isPropertyAccessExpression(t))return;let s=t.getExpression();for(;r.isCallExpression(s);){const n=s.getExpression();if(!r.isPropertyAccessExpression(n)||zn.has(n.getName()))break;s=n.getExpression()}return ua(s)},ga=e=>{for(const t of e.getDescendantsOfKind(d.PropertyAccessExpression))if(ws.has(t.getName()))return!0;for(const t of e.getDescendantsOfKind(d.CallExpression)){const s=t.getExpression();if(r.isIdentifier(s)&&ws.has(s.getText()))return!0}return!1},pa=(e,t)=>{const s=e.getInitializer();if(!s||!r.isCallExpression(s))return;const n=s.getExpression();if(!r.isPropertyAccessExpression(n)||!la.has(n.getName()))return;const i=fa(s);if(!i||!da.test(i.path))return;const o=s.getArguments()[0],a=o!==void 0&&(r.isArrowFunction(o)||r.isFunctionExpression(o))&&ga(o);return{exportName:q(e)??e.getName(),file:t,method:i.method,path:i.path,usesGuard:a}},ma=(e,t)=>{const s=[];for(const n of Y(e)){const i=pa(n,t);i&&s.push(i)}return s},ha=(e,t)=>{const s=[];for(const n of y(t)){const i=e.getSourceFile(n)??e.addSourceFileAtPath(n);s.push(...ma(i,I(t,n)))}return s},va=e=>{const t=e.getText(),s=n=>{const i=n.getNameNode();return r.isIdentifier(i)&&i.getText()===t};for(const n of e.getAncestors())if(!(!r.isArrowFunction(n)&&!r.isFunctionExpression(n)&&!r.isFunctionDeclaration(n)))for(const i of n.getParameters()){const o=i.getDescendantsOfKind(d.BindingElement).find(a=>s(a));if(o!==void 0)return o}},Ea=e=>{let t=e;for(;;){const s=t.getParent();if(!r.isObjectBindingPattern(s))return;const n=s.getParent();if(r.isBindingElement(n)){t=n;continue}return r.isParameterDeclaration(n)?oe(t):void 0}},xa=e=>{const t=e.getText();if(!e.getAncestors().some(o=>{const a=r.isFunctionLikeDeclaration(o)||r.isArrowFunction(o)?o.getParameters()[1]:void 0,c=a?.getNameNode();return a!==void 0&&(r.isIdentifier(c)?c.getText()===t:a.getDescendantsOfKind(d.BindingElement).some(l=>l.getName()===t))&&Ps(a)}))return!1;const n=D(e),i=r.isParameterDeclaration(n)?n:n?.getFirstAncestorByKind(d.Parameter);return i!==void 0&&(r.isParameterDeclaration(n)||r.isBindingElement(n))&&Ps(i)},Is=(e,t)=>{const s=e.getParent();if(r.isPropertyAccessExpression(s)&&s.getNameNode()===e||r.isPropertyAssignment(s)&&s.getNameNode()===e)return!1;if(e.getText()===t)return!0;const n=va(e);return n!==void 0&&Ea(n)===t?!0:t==="args"&&xa(e)},Bn=(e,t)=>r.isIdentifier(e)?Is(e,t):e.getDescendantsOfKind(d.Identifier).some(s=>Is(s,t)),Sa=e=>{let t=e;for(;r.isPropertyAccessExpression(t)||r.isElementAccessExpression(t)||r.isNonNullExpression(t);)t=t.getExpression();return r.isIdentifier(t)?t:void 0},Cs=e=>{const t=r.isIdentifier(e)?D(e):void 0;return r.isVariableDeclaration(t)&&r.isIdentifier(t.getNameNode())&&!zt(t)?t.getInitializer():void 0},Nt=e=>Bn(e,"args"),G=e=>{if(!r.isIdentifier(e))return;const t=e.getText(),s=e.getFirstAncestor(a=>r.isArrowFunction(a)||r.isFunctionExpression(a)||r.isFunctionDeclaration(a));if(s===void 0)return;const n=e.getStart();let i,o=-1;for(const a of s.getDescendantsOfKind(d.VariableDeclaration)){if(a.getName()!==t)continue;const c=a.getInitializer(),l=a.getStart();c!==void 0&&l<n&&l>o&&(i=c,o=l)}return i},W=e=>{if(Nt(e))return!0;const t=G(e);return t!==void 0&&Nt(t)},Aa=e=>{if(r.isCallExpression(e)||r.isNewExpression(e))return!1;const t=G(e);return t===void 0||!(r.isCallExpression(t)||r.isNewExpression(t))},ae=e=>{if(ft(e))return!0;const t=Cs(e);if(t!==void 0&&ft(t))return!0;const s=t??e;return(r.isIdentifier(s)?[s]:s.getDescendantsOfKind(d.Identifier)).some(i=>{const o=Cs(i);return o!==void 0&&ft(o)})},Fe=(e,t)=>Bn(e,t),ya=(e,t)=>{if(Fe(e,t))return!0;const s=G(e);if(s!==void 0&&Fe(s,t))return!0;const n=Sa(e);if(n!==void 0){const i=G(n);return i!==void 0&&Fe(i,t)}return!1},ba=e=>!r.isPropertyAccessExpression(e)||e.getName()!=="run"?!1:H(e.getExpression(),["ai"]),Na=(e,t)=>{if(!ba(e.getExpression()))return;const s=e.getArguments()[0];if(!(!s||!W(s)||ae(s)))return{scope:x(e),file:t,line:e.getStartLineNumber()}},Pa=(e,t)=>C(e,t,Na),wa=new Set(["generateText","streamText"]),Ia=new Set(["messages","prompt","system"]),Ca=[{methods:new Set(["delete","insert","insertManyUnsafe","patch","patchIf","replace"]),prefixes:["context.db","ctx.db"]},{methods:new Set(["run","runAction","runMutation"]),prefixes:["context","ctx"]},{methods:new Set(["fetch"]),prefixes:["context","ctx"]},{methods:new Set(["queue","send"]),prefixes:["context.email","context.mail","ctx.email","ctx.mail"]}],Ta=(e,t)=>Ca.some(s=>s.methods.has(t)&&s.prefixes.some(n=>e===n||e.startsWith(`${n}.`))),Oa=e=>{const t=e.getExpression();if(!r.isPropertyAccessExpression(t))return;const s=t.getName(),n=[vr(t.getExpression()),t.getExpression().getText()].find(i=>i!==void 0&&Ta(i,s));return n===void 0?void 0:`${n}.${s}`},ka=e=>{for(const t of e.getDescendantsOfKind(d.CallExpression)){const s=Oa(t);if(s!==void 0)return s}},Ra=e=>{const t=new Set,s=e.getFirstAncestor(o=>r.isArrowFunction(o)||r.isFunctionExpression(o)||r.isFunctionDeclaration(o)),[n]=s?.getParameters()??[],i=n?.getNameNode();if(i===void 0||!r.isObjectBindingPattern(i))return t;for(const o of i.getElements()){const a=oe(o),c=o.getNameNode();if(a==="args"&&r.isObjectBindingPattern(c))for(const l of c.getElements())t.add(l.getName())}return t},Fa=e=>{if(Nt(e))return!0;const t=Ra(e);return t.size===0?!1:e.getDescendantsOfKind(d.Identifier).some(s=>t.has(s.getText()))},Da=e=>{for(const t of e.getProperties()){if(!r.isPropertyAssignment(t)||!Ia.has(S(t)))continue;const s=t.getInitializer();if(s!==void 0&&Fa(s))return!0}return!1},La=(e,t)=>{const s=[];for(const n of e.getDescendantsOfKind(d.CallExpression)){const i=N(n.getExpression());if(i===void 0||!wa.has(i))continue;const[o]=n.getArguments();if(o===void 0||!r.isObjectLiteralExpression(o))continue;let a;for(const c of o.getDescendantsOfKind(d.CallExpression))if(N(c.getExpression())==="tool"&&(a=ka(c),a!==void 0))break;a!==void 0&&s.push({scope:x(n),file:t,line:n.getStartLineNumber(),method:i,sideEffect:a,userInputDerived:Da(o)})}return s},Ma=(e,t)=>{const s=[];for(const n of y(t)){const i=e.getSourceFile(n)??e.addSourceFileAtPath(n);s.push(...La(i,I(t,n)))}return s},_a=e=>H(e,["fetch"]),Ka=(e,t)=>{if(!_a(e.getExpression()))return;const s=e.getArguments()[0];if(!(!s||!W(s)))return{scope:x(e),file:t,line:e.getStartLineNumber()}},za=(e,t)=>C(e,t,Ka),Wt=(e,t=new Set)=>{if(t.has(e))return!0;t.add(e);try{return e.getProperties().some(s=>{if(!r.isSpreadAssignment(s))return!1;const n=Xe(s.getExpression());return n===void 0||Wt(n,t)})}finally{t.delete(e)}},Ba=e=>{const t=e.getArguments()[0];if(!t||!r.isObjectLiteralExpression(t))return{objects:[],opaque:!0};const s=B(t,"args");if(!s)return{objects:[],opaque:!1};if(!r.isPropertyAssignment(s))return{objects:[],opaque:!0};const n=s.getInitializer(),i=n===void 0?void 0:Xe(n);return i===void 0?{objects:[],opaque:!0}:{objects:[i],opaque:Wt(i)}},$a=e=>{const t=[];let s=!1,n=e;for(;r.isCallExpression(n);){const i=n.getExpression();if(!r.isPropertyAccessExpression(i))break;if(i.getName()==="input"){const o=n.getArguments()[0],a=o!==void 0&&r.isExpression(o)?Xe(o):void 0;a===void 0?s=!0:(t.push(a),s||=Wt(a))}n=i.getExpression()}return{objects:t,opaque:s}},qt=(e,t)=>t?$a(t):Ba(e),$n=(e,t)=>{if(t.has(e))return[];t.add(e);try{return e.getProperties().flatMap(s=>{if(r.isSpreadAssignment(s)){const n=Xe(s.getExpression());return n===void 0?[]:$n(n,t)}return r.isPropertyAssignment(s)||r.isShorthandPropertyAssignment(s)?[S(s)]:[]})}finally{t.delete(e)}},Va=e=>e.flatMap(t=>$n(t,new Set)),Ua=new Set(["check","length","max"]),Pt=e=>{let t=e;for(;;){const s=t.getParent();if(!s||!r.isPropertyAccessExpression(s)||s.getExpression()!==t)return!1;const n=s.getParent();if(!n||!r.isCallExpression(n)||n.getExpression()!==s)return!1;if(Ua.has(s.getName()))return!0;t=n}},wt=e=>wr(e)||e==="@lunora/values",Wa=e=>{const t=new Set(["v"]);for(const s of Ar(e,"v",wt))t.add(s);for(const s of e.getImportDeclarations()){const n=s.getNamespaceImport();n&&wt(s.getModuleSpecifierValue())&&t.add(`${n.getText()}.v`)}return t},qa=(e,t)=>{const s=new Map;for(const n of e.getVariableStatements())for(const i of n.getDeclarations()){const o=i.getNameNode(),a=i.getInitializer();if(!(!r.isObjectBindingPattern(o)||!a||!t.has(a.getText())))for(const c of o.getElements())c.getDotDotDotToken()||s.set(c.getName(),c.getPropertyNameNode()?.getText()??c.getName())}return s},ja=e=>(e.getSymbol()?.getDeclarations()??[]).some(t=>!t.getSourceFile().isDeclarationFile()&&!r.isImportSpecifier(t)&&!r.isNamespaceImport(t)&&!r.isImportClause(t)),Ha=e=>(e.getSymbol()?.getDeclarations()??[]).some(t=>r.isNamespaceImport(t)&&wt(t.getFirstAncestorByKindOrThrow(d.ImportDeclaration).getModuleSpecifierValue())),jt=(e,t)=>{if(!r.isCallExpression(e))return;const s=e.getExpression();if(r.isPropertyAccessExpression(s)){const n=s.getExpression();if(!t.namespaces.has(n.getText()))return;if(r.isIdentifier(n))return ja(n)?void 0:s.getName();const i=r.isPropertyAccessExpression(n)?n.getExpression():void 0;return r.isIdentifier(i)&&Ha(i)?s.getName():void 0}if(r.isIdentifier(s))return t.destructured.get(s.getText())},Ga=(e,t)=>{if(!r.isIdentifier(e))return;const s=e.getText(),n=t.getVariableDeclaration(s)?.getInitializer();return n&&(r.isArrowFunction(n)||r.isFunctionExpression(n))?n:t.getFunction(s)},Ya=e=>{let t=e.getParent();for(;t&&!r.isFunctionLikeDeclaration(t);)t=t.getParent();return t},Qa=e=>r.isReturnStatement(e)?e.getExpression():void 0,Xa=e=>r.isArrowFunction(e)&&!r.isBlock(e.getBody())?[e.getBody()]:e.getDescendantsOfKind(d.ReturnStatement).filter(t=>Ya(t)?.compilerNode===e.compilerNode).flatMap(t=>{const s=Qa(t);return s?[s]:[]}),Vn=(e,t)=>{if(jt(e,t)!==void 0)return e;if(r.isCallExpression(e)||r.isPropertyAccessExpression(e))return Vn(e.getExpression(),t)},Ja=(e,t)=>{const s=Ga(e.getExpression(),e.getSourceFile());if(!s)return[];const n=Pt(e),i=new Set(Xa(s).map(o=>Vn(o,t)).filter(o=>o!==void 0));return[s,...s.getDescendants()].flatMap(o=>{const a=jt(o,t);return a===void 0?[]:[{bounded:Pt(o)||n&&i.has(o),factory:a}]})},Za=(e,t)=>[e,...e.getDescendants()].flatMap(s=>{const n=jt(s,t),i=n===void 0?[]:[{bounded:Pt(s),factory:n}];return r.isCallExpression(s)?[...i,...Ja(s,t)]:i}),ec=(e,t)=>{const s=[],n=[];for(const i of e)for(const o of i.getProperties()){if(!r.isPropertyAssignment(o))continue;const a=o.getInitializer();if(!a)continue;const c=Za(a,t),l=S(o);c.some(u=>u.factory==="any")?s.push(l):c.some(u=>u.factory==="string"&&!u.bounded)&&n.push(l)}return{anyArgs:s,unboundedStringArgs:n}},tc=(e,t,s)=>{const n=e.getInitializer();if(!n||!r.isCallExpression(n))return;const i=ee(n);if(i?.visibility!=="public")return;const{objects:o}=qt(n,i.receiver),{anyArgs:a,unboundedStringArgs:c}=ec(o,s);if(!(a.length===0&&c.length===0))return{anyArgs:a,exportName:q(e)??e.getName(),file:t,line:n.getStartLineNumber(),unboundedStringArgs:c}},sc=(e,t)=>{const s=[],n=Wa(e),i={destructured:qa(e,n),namespaces:n};for(const o of Y(e)){const a=tc(o,t,i);a&&s.push(a)}return s},nc=(e,t)=>{const s=[];for(const n of y(t)){const i=e.getSourceFile(n)??e.addSourceFileAtPath(n);s.push(...sc(i,I(t,n)))}return s},gt=e=>e?.getKind()===d.TrueKeyword,ic=e=>e?.getKind()===d.FalseKeyword,rc=e=>e!==void 0&&r.isNumericLiteral(e)&&e.getLiteralValue()===0,oc=new Set(["lunoraAuthAdapter","lunoraD1Adapter"]),ac=e=>!e||!r.isArrayLiteralExpression(e)?!1:e.getElements().some(t=>r.isCallExpression(t)&&N(t.getExpression())==="scim"),cc=e=>e!==void 0&&r.isCallExpression(e)&&oc.has(N(e.getExpression())??""),lc=e=>!e||!r.isArrayLiteralExpression(e)?!1:e.getElements().some(t=>r.isStringLiteral(t)&&t.getLiteralText()==="*"),dc=e=>{const t=R(e,"advanced"),s=R(e,"emailAndPassword"),n=R(e,"session");return{analyzable:!0,disableCsrfCheck:gt(R(t,"disableCSRFCheck")),emailPasswordEnabled:gt(R(s,"enabled")),requireEmailVerification:gt(R(s,"requireEmailVerification")),scimOnNonTransactionalAdapter:ac(R(e,"plugins"))&&cc(R(e,"database")),secureCookiesDisabled:ic(R(t,"useSecureCookies")),sessionFreshAgeZero:rc(R(n,"freshAge")),trustedOriginsWildcard:lc(R(e,"trustedOrigins"))}},uc=()=>({analyzable:!1,disableCsrfCheck:!1,emailPasswordEnabled:!1,requireEmailVerification:!1,scimOnNonTransactionalAdapter:!1,secureCookiesDisabled:!1,sessionFreshAgeZero:!1,trustedOriginsWildcard:!1}),fc=(e,t)=>{if(N(e.getExpression())!=="createAuth")return;const s=e.getArguments()[0],n=s!==void 0&&r.isObjectLiteralExpression(s)&&s.getProperties().some(o=>r.isSpreadAssignment(o)),i=s!==void 0&&r.isObjectLiteralExpression(s)&&!n?dc(s):uc();return{scope:x(e),file:t,line:e.getStartLineNumber(),...i}},gc=(e,t)=>ar(e,t,fc),pc=(e,t)=>{if(!r.isPropertyAccessExpression(e))return;const s=e.getName();if(t.methods.has(s))return wn(e.getExpression(),t.matchReceiver)?s:void 0},mc=(e,t,s)=>{const n=pc(e.getExpression(),s);if(n===void 0)return;const i=e.getArguments()[s.argIndex];if(!(!i||!W(i)||ae(i))&&!(s.requireUnmodifiedReach===!0&&!Aa(i)))return{scope:x(e),file:t,line:e.getStartLineNumber(),method:n}},Je=(e,t,s)=>C(e,t,(n,i)=>mc(n,i,s)),hc=new Set(["content","pdf","scrape","screenshot"]),vc=(e,t)=>Je(e,t,{argIndex:0,matchReceiver:s=>s==="ctx.browser",methods:hc}),Ec=new Set(["createBrowser","createInboundEmailHandler","createPayment"]),xc=new Set(["RateLimiter"]),Sc=new Set(["extend"]),Ts="lunora",Ac=["vite.config.ts","vite.config.mts","vite.config.js","vite.config.mjs"],Un=e=>{const t=[],s=[];let n=!1;for(const i of e.getProperties()){if(r.isSpreadAssignment(i)){n=!0;continue}if(r.isPropertyAssignment(i)){const o=S(i);t.push(o),i.getInitializer()?.getKind()===d.TrueKeyword&&s.push(o);continue}(r.isShorthandPropertyAssignment(i)||r.isMethodDeclaration(i))&&t.push(S(i))}return{analyzable:!n,presentKeys:t,trueKeys:s}},It=e=>e&&r.isObjectLiteralExpression(e)?Un(e):{analyzable:!1,presentKeys:[],trueKeys:[]},yc=e=>{const t=e&&(r.isArrowFunction(e)||r.isFunctionExpression(e))?e:void 0,s=t&&Sn(t.getBody());return s?Un(s):{analyzable:!1,presentKeys:[],trueKeys:[]}},bc=(e,t)=>{const s=[];for(const n of e.getDescendantsOfKind(d.CallExpression)){const i=N(n.getExpression());i!==void 0&&(Ec.has(i)?s.push({callee:i,file:t,line:n.getStartLineNumber(),...It(n.getArguments()[0])}):Sc.has(i)&&s.push({callee:i,file:t,line:n.getStartLineNumber(),...yc(n.getArguments()[0])}))}for(const n of e.getDescendantsOfKind(d.NewExpression)){const i=N(n.getExpression());i===void 0||!xc.has(i)||s.push({callee:i,file:t,line:n.getStartLineNumber(),...It(n.getArguments()[0])})}return s},Nc=(e,t)=>{for(const s of Ac){const n=v(t,s);if(!M(n))continue;const i=e.getSourceFile(n)??e.addSourceFileAtPath(n),o=[];for(const a of i.getDescendantsOfKind(d.CallExpression))N(a.getExpression())===Ts&&o.push({callee:Ts,file:s,line:a.getStartLineNumber(),...It(a.getArguments()[0])});return o}return[]},Pc=(e,t)=>{const s=[];for(const{displayPath:n,filePath:i}of je(t)){const o=e.getSourceFile(i)??e.addSourceFileAtPath(i);s.push(...bc(o,n))}return s.push(...Nc(e,_t(t))),s},Os="ctx.containers.",wc=e=>{if(!e.startsWith(Os))return!1;const t=e.slice(Os.length);return t.length>0&&!t.includes(".")},Ic=(e,t)=>Je(e,t,{argIndex:0,matchReceiver:wc,methods:new Set(["get"])}),Cc=new Set(["allow","deny","setAllowed"]),Tc=e=>{const t=e.getArguments()[0];if(!t||!r.isObjectLiteralExpression(t))return!1;const s=B(t,"enableInternet");return s!==void 0&&r.isPropertyAssignment(s)&&r.isTrueLiteral(s.getInitializerOrThrow())},Oc=(e,t)=>{const s=e.getExpression();if(!(!r.isPropertyAccessExpression(s)||s.getName()!=="start"||!Tc(e)))return{detail:"enableInternet: true",scope:x(e),file:t,kind:"enable_internet",line:e.getStartLineNumber()}},kc=(e,t)=>{const s=e.getExpression();if(!r.isPropertyAccessExpression(s)||!Cc.has(s.getName()))return;const n=s.getExpression();if(!(!r.isPropertyAccessExpression(n)||n.getName()!=="egress"))return{detail:s.getName(),scope:x(e),file:t,kind:"egress_relaxation",line:e.getStartLineNumber()}},Rc=(e,t)=>Oc(e,t)??kc(e,t),Fc=(e,t)=>C(e,t,Rc),Dc=e=>{const t=e.getExpression();if(!r.isPropertyAccessExpression(t)||t.getName()!=="count")return;const s=t.getExpression();if(_(s)){const n=e.getArguments()[0];return n&&r.isStringLiteral(n)?n.getLiteralText():""}return r.isPropertyAccessExpression(s)&&_(s.getExpression())?s.getName():void 0},Lc=e=>{const t=e.getExpression(),s=r.isPropertyAccessExpression(t)?t.getExpression():void 0;return e.getArguments()[s!==void 0&&_(s)?1:0]},Mc=new Set(["baseWhere","relationBaseWhere","restrictsCounts","where"]),_c=e=>{if(e===void 0||!r.isObjectLiteralExpression(e))return;const t=[];for(const n of e.getProperties()){if(!r.isPropertyAssignment(n)&&!r.isShorthandPropertyAssignment(n))return;t.push(n.getName())}return t.length>0&&t.every(n=>Mc.has(n))||t.some(n=>n==="AND"||n==="OR"||n==="NOT")?void 0:t},Kc=(e,t,s)=>{const n=new Map(s.map(i=>[i.name,i.aggregateIndexed===!0]));return C(e,t,(i,o)=>{const a=Dc(i);if(a===void 0)return;const c=_c(Lc(i));return{file:o,indexed:n.get(a)!==!1,...c===void 0?{}:{filterFields:c},line:i.getStartLineNumber(),scope:x(i),table:a}})},zc=new Set(["defineExportSink","r2Sink","webhookExportSink"]),Bc=e=>{const t=e.getExpression();if(!r.isIdentifier(t))return;const s=t.getText();return zc.has(s)?s:void 0},$c=e=>{const t=[],s=[];for(const n of e.getProperties()){if(r.isSpreadAssignment(n))return{analyzable:!1,emptyKeys:[],presentKeys:[]};if(r.isPropertyAssignment(n)){const i=S(n);t.push(i);const o=n.getInitializer();o&&r.isStringLiteral(o)&&o.getLiteralText()===""&&s.push(i);continue}(r.isShorthandPropertyAssignment(n)||r.isMethodDeclaration(n)||r.isGetAccessorDeclaration(n))&&t.push(S(n))}return{analyzable:!0,emptyKeys:s,presentKeys:t}},Vc=(e,t)=>{const s=[];for(const{displayPath:n,filePath:i}of je(t)){const o=e.getSourceFile(i)??e.addSourceFileAtPath(i);for(const a of o.getDescendantsOfKind(d.CallExpression)){const c=Bc(a);if(c===void 0)continue;const l=a.getArguments()[0],u=l&&r.isObjectLiteralExpression(l)?$c(l):{analyzable:!1,emptyKeys:[],presentKeys:[]};s.push({analyzable:u.analyzable,emptyKeys:u.emptyKeys,factory:c,file:n,line:a.getStartLineNumber(),presentKeys:u.presentKeys})}}return s},Uc=new Map([["dbRateLimit",2],["rateLimit",2],["verifyTurnstileMiddleware",0]]),Wc=new Set(["dbRateLimit","rateLimit"]),qc=e=>{const t=yn(e);if(!t)return!1;const s=B(t,"failOpen");return s!==void 0&&r.isPropertyAssignment(s)&&s.getInitializer()?.getKind()===d.TrueKeyword},jc=(e,t)=>{const s=N(e.getExpression());if(s===void 0)return;const n=Uc.get(s);if(n!==void 0)return{callee:s,scope:x(e),failOpen:qc(e.getArguments()[n]),file:t,limitName:Wc.has(s)?An(e):"",line:e.getStartLineNumber()}},Hc=(e,t)=>C(e,t,jc),Gc=e=>{const t=e.getInitializer();if(!t||!r.isCallExpression(t))return;const s=ee(t);if(s?.kind!=="query")return;const n=cr(t,s.receiver);return n?{exportName:q(e)??e.getName(),handler:n}:void 0},ks=e=>{const t=e.getParent();return t&&r.isPropertyAccessExpression(t)&&t.getExpression()===e?t:void 0},Yc=e=>{const t=ks(e);if(!t)return"ctx.flags";if(t.getName()==="details"){const s=ks(t);return s?`ctx.flags.details.${s.getName()}`:"ctx.flags.details"}return`ctx.flags.${t.getName()}`},Qc=(e,t)=>{const s=[];for(const n of Ye(e.handler,"flags"))s.push({callee:Yc(n),exportName:e.exportName,file:t,line:n.getStartLineNumber()});return s},Xc=(e,t)=>{const s=[];for(const n of Y(e)){const i=Gc(n);i&&s.push(...Qc(i,t))}return s},Jc=(e,t)=>{const s=[];for(const n of y(t)){const i=e.getSourceFile(n)??e.addSourceFileAtPath(n);s.push(...Xc(i,I(t,n)))}return s},Zc=e=>!r.isPropertyAccessExpression(e)||e.getName()!=="boolean"?!1:H(e.getExpression(),["flags"]),el=e=>{if(e?.getKind()===d.TrueKeyword)return!0;if(e?.getKind()===d.FalseKeyword)return!1},tl=(e,t)=>{if(!Zc(e.getExpression()))return;const[s,n]=e.getArguments();if(!s||!(r.isStringLiteral(s)||r.isNoSubstitutionTemplateLiteral(s)))return;const i=s.getLiteralValue(),o=el(n);if(!(i.length===0||o===void 0))return{defaultValue:o,scope:x(e),file:t,key:i,line:e.getStartLineNumber()}},sl=(e,t)=>C(e,t,tl),nl=e=>{const t=e.getExpression();return r.isPropertyAccessExpression(t)&&t.getName()==="withGeoIndex"},il=e=>{const t=e.getArguments()[0];return t&&r.isStringLiteral(t)?t.getLiteralText():""},rl=(e,t)=>{const s=[];for(const n of y(t)){const i=e.getSourceFile(n)??e.addSourceFileAtPath(n),o=I(t,n);for(const a of i.getDescendantsOfKind(d.CallExpression))nl(a)&&s.push({file:o,indexName:il(a),line:a.getStartLineNumber()})}return s},Ae=e=>e!==void 0&&(r.isArrowFunction(e)||r.isFunctionExpression(e))?e:void 0,Wn=e=>{const t=e.getArguments()[0],s=Ae(t);if(s!==void 0)return s;if(t===void 0||!r.isObjectLiteralExpression(t))return;const n=B(t,"handler");return n!==void 0&&r.isPropertyAssignment(n)?Ae(n.getInitializer()):void 0},ol=new Set(["delete","get","head","options","patch","post","put"]),al=new Set(["handler","stream"]),cl=new Set(["runAction","runMutation"]),ll=new Set(["delete","insert","insertManyUnsafe","patch","patchIf","replace"]),ye=(e,t)=>e!==void 0&&r.isIdentifier(e)&&e.getText()===t,qn=(e,t)=>{if(!(e===void 0||!r.isObjectBindingPattern(e))){for(const s of e.getElements())if(oe(s)===t){const i=s.getNameNode();return r.isIdentifier(i)?i.getText():void 0}}},Rs=(e,t)=>{const s=e.getParameters()[0]?.getNameNode();if(s!==void 0)return t?r.isIdentifier(s)?s.getText():void 0:qn(s,"ctx")},Fs=(e,t)=>{const s=e.getParameters()[t?1:0]?.getNameNode();return t?s!==void 0&&r.isIdentifier(s)?s.getText():void 0:qn(s,"request")},Ds=(e,t)=>{const s=e.getBody(),n=s.getDescendantsOfKind(d.CallExpression);r.isCallExpression(s)&&n.unshift(s);for(const i of n){const o=i.getExpression();if(!r.isPropertyAccessExpression(o))continue;const a=o.getName(),c=o.getExpression();if(cl.has(a)&&ye(c,t))return a;if(ll.has(a)&&r.isPropertyAccessExpression(c)&&c.getName()==="db"&&ye(c.getExpression(),t))return`db.${a}`}},Ls=(e,t)=>{const s=e.getBody();for(const n of s.getDescendantsOfKind(d.PropertyAccessExpression))if(n.getName()==="auth"&&ye(n.getExpression(),t))return!0;for(const n of s.getDescendantsOfKind(d.VariableDeclaration)){const i=n.getNameNode();if(!(!r.isObjectBindingPattern(i)||!ye(n.getInitializer(),t))){for(const o of i.getElements())if(oe(o)==="auth")return!0}}return!1},dl=/signature|hmac|digest|(?:^|[_-])sig(?:[_-]|$)/i,ul=(e,t)=>{const s=e.getExpression();if(!r.isPropertyAccessExpression(s)||s.getName()!=="get"&&s.getName()!=="has")return!1;const n=s.getExpression();return r.isPropertyAccessExpression(n)&&n.getName()==="headers"&&ye(n.getExpression(),t)},fl=e=>[...r.isStringLiteral(e)?[e.getLiteralText()]:[],...e.getDescendantsOfKind(d.StringLiteral).map(t=>t.getLiteralText())],jn=(e,t)=>{const s=e.getVariableDeclaration(t)?.getInitializer();return s===void 0?[]:fl(s)},gl=(e,t)=>{const s=e.getText();for(let n=e.getParent();n!==void 0;n=n.getParent()){if(!r.isArrowFunction(n)&&!r.isFunctionExpression(n)||!n.getParameters().some(c=>c.getName()===s))continue;const i=n.getParent();if(!r.isCallExpression(i))return[];const o=i.getExpression();if(!r.isPropertyAccessExpression(o))return[];const a=o.getExpression();return r.isIdentifier(a)?jn(t,a.getText()):[]}return[]},pl=e=>{const t=e.getArguments()[0];if(t===void 0)return[];if(r.isStringLiteral(t))return[t.getLiteralText()];if(!r.isIdentifier(t))return[];const s=e.getSourceFile(),n=jn(s,t.getText());return n.length>0?n:gl(t,s)},Ms=(e,t)=>{if(t===void 0)return!1;const s=e.getBody(),n=s.getDescendantsOfKind(d.CallExpression);return r.isCallExpression(s)&&n.unshift(s),n.some(i=>ul(i,t)&&pl(i).some(o=>dl.test(o)))},ml=e=>{const t=e.getExpression();if(!r.isPropertyAccessExpression(t)||!al.has(t.getName()))return;let s=t.getExpression();for(;r.isCallExpression(s);){const n=s.getExpression();if(!r.isPropertyAccessExpression(n))return;const i=n.getName();if(ol.has(i)){const o=n.getExpression();return r.isIdentifier(o)&&o.getText()==="httpRoute"?i.toUpperCase():void 0}s=n.getExpression()}},hl=(e,t)=>{const s=e.getExpression();if(r.isIdentifier(s)&&s.getText()==="httpAction"){const c=Ae(e.getArguments()[0]),l=c&&Rs(c,!0);if(!c||l===void 0||Ms(c,Fs(c,!0)))return;const u=Ds(c,l);return u===void 0?void 0:{scope:x(e),file:t,kind:"httpAction",line:e.getStartLineNumber(),readsAuth:Ls(c,l),sideEffect:u}}const n=ml(e);if(n===void 0)return;const i=Ae(e.getArguments()[0]),o=i&&Rs(i,!1);if(!i||o===void 0||Ms(i,Fs(i,!1)))return;const a=Ds(i,o);return a===void 0?void 0:{scope:x(e),file:t,kind:"httpRoute",line:e.getStartLineNumber(),method:n,readsAuth:Ls(i,o),sideEffect:a}},vl=(e,t)=>C(e,t,hl),El=new Set(["btoa","encodeURI","encodeURIComponent","isSafeHeaderValue","Number","parseFloat","parseInt"]),xl=new Set(["append","set"]),Hn=e=>e!==void 0&&(r.isStringLiteral(e)||r.isNoSubstitutionTemplateLiteral(e))?e.getLiteralText():"",_s=(e,t)=>(r.isCallExpression(e)?[e,...e.getDescendantsOfKind(d.CallExpression)]:e.getDescendantsOfKind(d.CallExpression)).some(n=>El.has(N(n.getExpression())??"")&&Fe(n,t)),Sl=(e,t)=>{if(_s(e,t))return!0;const s=G(e);return s!==void 0&&_s(s,t)},Ct=(e,t)=>ya(e,t)&&!Sl(e,t),Al=e=>{if(r.isPropertyAccessExpression(e)&&e.getName()==="headers")return!0;const t=G(e);return t!==void 0&&r.isNewExpression(t)&&N(t.getExpression())==="Headers"},Be=e=>{if(e===void 0)return;if(r.isObjectLiteralExpression(e))return e;const t=G(e);return t!==void 0&&r.isObjectLiteralExpression(t)?t:void 0},Ht=(e,t,s)=>{for(const n of e.getProperties())if(r.isPropertyAssignment(n)){const i=n.getInitializer();i!==void 0&&Ct(i,s.requestName)&&s.rows.push({scope:s.scope,file:s.relativePath,headerName:Hn(n.getNameNode()),line:i.getStartLineNumber(),via:t})}else if(r.isShorthandPropertyAssignment(n)){const i=n.getNameNode();Ct(i,s.requestName)&&s.rows.push({scope:s.scope,file:s.relativePath,headerName:S(n),line:i.getStartLineNumber(),via:t})}else if(r.isSpreadAssignment(n)){const i=Be(n.getExpression());i!==void 0&&Ht(i,t,s)}},Gn=(e,t)=>{const s=Be(e);if(s===void 0)return;const n=B(s,"headers");if(n===void 0||!r.isPropertyAssignment(n))return;const i=Be(n.getInitializer());i!==void 0&&Ht(i,"response-init",t)},yl=(e,t)=>{const s=N(e.getExpression());if(s==="Response")Gn(e.getArguments()[1],t);else if(s==="Headers"){const n=Be(e.getArguments()[0]);n!==void 0&&Ht(n,"headers-ctor",t)}},bl=(e,t)=>{const s=e.getExpression();if(!r.isPropertyAccessExpression(s))return;const n=s.getName(),i=s.getExpression();if(n==="json"&&r.isIdentifier(i)&&i.getText()==="Response"){Gn(e.getArguments()[1],t);return}if(xl.has(n)&&Al(i)){const o=e.getArguments()[1];o!==void 0&&Ct(o,t.requestName)&&t.rows.push({scope:t.scope,file:t.relativePath,headerName:Hn(e.getArguments()[0]),line:o.getStartLineNumber(),via:n==="set"?"headers-set":"headers-append"})}},Nl=(e,t)=>{for(const s of e.getDescendantsOfKind(d.NewExpression))yl(s,t);for(const s of e.getDescendantsOfKind(d.CallExpression))bl(s,t)},Pl=(e,t)=>{const s=e.getExpression();if(!r.isIdentifier(s)||s.getText()!=="httpAction")return[];const n=Ae(e.getArguments()[0]);if(n===void 0)return[];const i=n.getParameters()[1];if(i===void 0)return[];const o=i.getNameNode();if(!r.isIdentifier(o))return[];const a=[];return Nl(n,{scope:x(e),relativePath:t,requestName:o.getText(),rows:a}),a},wl=(e,t)=>{const s=[];for(const n of e.getDescendantsOfKind(d.CallExpression))s.push(...Pl(n,t));return s},Il=(e,t)=>{const s=[];for(const n of y(t)){const i=e.getSourceFile(n)??e.addSourceFileAtPath(n);s.push(...wl(i,I(t,n)))}return s},Yn="identity.ts",Cl=e=>{const t=e.getSymbol();if(!t)return e.getText()==="defineIdentity";for(const s of t.getDeclarations())if(r.isImportSpecifier(s))return Qe(s.getImportDeclaration().getModuleSpecifierValue())?s.getNameNode().getText()==="defineIdentity":!1;return!1},Tl=e=>{const t=e.getSymbol();if(!t)return!1;for(const s of t.getDeclarations()){if(!r.isNamespaceImport(s))continue;const n=s.getFirstAncestorByKind(d.ImportDeclaration);return n!==void 0&&Qe(n.getModuleSpecifierValue())}return!1},Ol=e=>{if(r.isIdentifier(e))return Cl(e);if(r.isPropertyAccessExpression(e)){const t=e.getExpression();return e.getName()==="defineIdentity"&&r.isIdentifier(t)&&Tl(t)}return!1},kl=e=>{const t=[];for(const s of e.getVariableDeclarations()){const n=s.getInitializer();if(n?.getKind()!==d.CallExpression||!Ol(n.getExpression()))continue;const o=s.getNameNode();if(!r.isIdentifier(o)){if(s.getVariableStatement()?.hasExportKeyword()!==!0)continue;throw Ne(o,"defineIdentity exports must be plain named exports (no destructuring)")}const a=Pn(s,"member");a!==void 0&&t.push({exportName:a})}return t},Rl=(e,t)=>{const s=v(t,Yn);if(!M(s))return;const n=e.getSourceFile(s)??e.addSourceFileAtPath(s),i=kl(n);if(i.length!==0){if(i.length>1)throw Ne(n,`lunora/identity.ts declares ${i.length.toString()} defineIdentity() contracts (${i.map(o=>o.exportName).join(", ")}); exactly one is allowed`);return i[0]}},Fl=new Set(["auth","context.auth"]),Dl="userId",Ll=e=>{const t=new Set;for(const s of e.getProperties()){if(r.isSpreadAssignment(s))return;(r.isPropertyAssignment(s)||r.isShorthandPropertyAssignment(s)||r.isMethodDeclaration(s))&&t.add(S(s))}return t},Ml=(e,t)=>{const s=v(t,Yn);if(!M(s))return;const n=e.getSourceFile(s)??e.addSourceFileAtPath(s);for(const i of n.getDescendantsOfKind(d.CallExpression)){if(N(i.getExpression())!=="defineIdentity")continue;const[o]=i.getArguments();return o&&r.isObjectLiteralExpression(o)?Ll(o):void 0}},Ks=e=>{if(e===void 0||!r.isPropertyAccessExpression(e)||e.getName()!=="identity")return;const t=e.getExpression();return Fl.has(t.getText())||H(t,["auth"])?e:void 0},_l=e=>{if(r.isPropertyAccessExpression(e)&&Ks(e.getExpression())!==void 0)return e.getName();if(r.isElementAccessExpression(e)&&Ks(e.getExpression())!==void 0){const t=e.getArgumentExpression();return t&&r.isStringLiteral(t)?t.getLiteralValue():void 0}},zs=(e,t,s)=>{const n=_l(e);return n===void 0?void 0:{declared:n===Dl||s.has(n),file:t,key:n,line:e.getStartLineNumber(),scope:x(e)}},Kl=(e,t)=>{const s=Ml(e,t);return s===void 0?[]:[...se(e,t,d.PropertyAccessExpression,(n,i)=>zs(n,i,s)),...se(e,t,d.ElementAccessExpression,(n,i)=>zs(n,i,s))]},zl=(e,t)=>{if(N(e.getExpression())!=="buildImageDeliveryUrl")return;const s=e.getArguments()[0];if(!s)return;const n=R(s,"key");if(!(!n||!W(n)||ae(n)))return{scope:x(e),file:t,line:e.getStartLineNumber()}},Bl=(e,t)=>C(e,t,zl),$l=new Set(["delete","get","getRaw","getWithMetadata","put"]),Vl=(e,t,s=[])=>{const n=Je(e,t,{argIndex:0,matchReceiver:i=>i==="ctx.kv"||i.startsWith("ctx.kv."),methods:$l});return Bt(n,s)},Ul=new Set(["queue","send"]),Bs=new Set(["bcc","cc","to"]),Wl=e=>{if(!r.isPropertyAccessExpression(e))return;const t=e.getName();if(!Ul.has(t))return;const s=e.getExpression();return H(s,["mail"])||H(s,["email"])?t:void 0},ql=e=>r.isObjectLiteralExpression(e)?e.getProperties().some(t=>{if(r.isShorthandPropertyAssignment(t)){const n=t.getNameNode();return Bs.has(S(t))&&W(n)&&!ae(n)}if(!r.isPropertyAssignment(t)||!Bs.has(S(t)))return!1;const s=t.getInitializer();return s!==void 0&&W(s)&&!ae(s)}):!1,jl=(e,t)=>{const s=Wl(e.getExpression());if(s===void 0)return;const n=e.getArguments()[0];if(!(!n||!ql(n)))return{scope:x(e),file:t,line:e.getStartLineNumber(),method:s}},Hl=(e,t)=>C(e,t,jl),Gl=(e,t,s)=>{const n=e.getArguments()[0];if(!n||!r.isObjectLiteralExpression(n))return[];const i=[];for(const o of n.getProperties()){const a=ze(o);if(a===void 0||!r.isPropertyAssignment(o))continue;const c=o.getInitializer();if(!(!c||!r.isObjectLiteralExpression(c)))for(const l of c.getProperties()){const u=ze(l);if(u===void 0)continue;const f=Rn(l);f!=="custom"&&i.push({column:u,exportName:t,file:s,line:l.getStartLineNumber(),strategy:f,table:a})}}return i},Yl=(e,t)=>{if(!r.isVariableDeclaration(e))return[];const s=e.getInitializer(),n=s&&r.isCallExpression(s)?ee(s):void 0;return n?.receiver?Vt(n.receiver).flatMap(i=>Gl(i,q(e)??e.getName(),t)):[]},Ql=(e,t)=>{const s=[];for(const n of y(t)){const i=e.getSourceFile(n)??e.addSourceFileAtPath(n),o=I(t,n);for(const a of Y(i))s.push(...Yl(a,o))}return s},Xl=e=>{const t=e.getExpression();if(!r.isPropertyAccessExpression(t)||t.getName()!=="replace")return!1;const s=t.getExpression();return _(s)},Jl=e=>{const t=e.getArguments()[0];if(t===void 0||!r.isObjectLiteralExpression(t))return;const s=B(t,"server");if(s!==void 0)return r.isPropertyAssignment(s)?s.getInitializer():s},Zl=e=>{if(!e.isExported())return;const t=e.getInitializer();if(t?.getKind()!==d.CallExpression)return;const s=t;return Rr(s.getExpression())?s:void 0},ed=e=>{const t=Zl(e),s=t===void 0?void 0:Jl(t);if(s===void 0)return[];const n=e.getNameNode(),i=r.isIdentifier(n)?q(e)??n.getText():"";return s.getDescendantsOfKind(d.CallExpression).filter(o=>Xl(o)).map(o=>({exportName:i,file:"lunora/mutators.ts",line:o.getStartLineNumber()}))},td=e=>e.getVariableDeclarations().flatMap(t=>ed(t)),sd=(e,t)=>{const s=v(t,kr);if(!M(s))return[];const n=e.getSourceFile(s)??e.addSourceFileAtPath(s);return td(n)},nd=new Set(["delete","get","patch"]),id=new Set(["accountId","authorId","companyId","createdBy","createdById","customerId","groupId","memberId","organizationId","orgId","ownerId","projectId","teamId","tenantId","userId","workspaceId"]),rd=new Set(["auth","identity","session","user"]),od=new Set([d.EqualsEqualsEqualsToken,d.EqualsEqualsToken,d.ExclamationEqualsEqualsToken,d.ExclamationEqualsToken]),ad=e=>{const t=e.getExpression();if(!r.isPropertyAccessExpression(t)||t.getName()!=="normalizeId"||!_(t.getExpression()))return;const s=e.getArguments()[0];return s&&r.isStringLiteral(s)?s.getLiteralText():""},cd=e=>{let t=e,s=t.getParent();for(;s!==void 0&&(r.isAsExpression(s)||r.isParenthesizedExpression(s)||r.isNonNullExpression(s));)t=s,s=t.getParent();if(s===void 0||!r.isVariableDeclaration(s))return;const n=s.getNameNode();return r.isIdentifier(n)?n.getText():void 0},ld=(e,t)=>e.getDescendantsOfKind(d.Identifier).some(s=>s.getText()===t),dd=e=>r.isThrowStatement(e)||r.isReturnStatement(e)||e.getDescendantsOfKind(d.ThrowStatement).length>0||e.getDescendantsOfKind(d.ReturnStatement).length>0,ud=(e,t)=>e.getDescendantsOfKind(d.IfStatement).some(s=>ld(s.getExpression(),t)&&dd(s.getThenStatement())),fd=(e,t)=>{for(const s of e.getDescendantsOfKind(d.CallExpression)){const n=s.getExpression();if(!r.isPropertyAccessExpression(n))continue;const i=n.getName();if(!nd.has(i))continue;const o=n.getExpression();if(!(_(o)||r.isPropertyAccessExpression(o)&&_(o.getExpression())))continue;const c=s.getArguments()[0];if(c!==void 0&&r.isIdentifier(c)&&c.getText()===t)return i}},gd=e=>e.getDescendantsOfKind(d.CallExpression).some(t=>t.getArguments().some(s=>$t(He(s))!==void 0)),pd=e=>e.getDescendantsOfKind(d.BinaryExpression).some(t=>od.has(t.getOperatorToken().getKind())?r.isPropertyAccessExpression(t.getLeft())||r.isPropertyAccessExpression(t.getRight()):!1),md=e=>{for(const t of e.getDescendantsOfKind(d.Identifier))if(id.has(t.getText()))return!0;return[...rd].some(t=>Ye(e,t).length>0)?!0:gd(e)||pd(e)},hd=(e,t)=>{if(!r.isVariableDeclaration(e))return[];const s=e.getInitializer();if(s===void 0||!r.isCallExpression(s))return[];const n=ee(s);if(n?.kind!=="query"&&n?.kind!=="mutation")return[];const i=Wn(s);if(i===void 0)return[];const o=n.receiver!==void 0&&Tn(n.receiver,"use","rls"),a=md(i),c=new Set,l=[];for(const u of i.getDescendantsOfKind(d.CallExpression)){const f=ad(u);if(f===void 0)continue;const g=cd(u);if(g===void 0||c.has(g)||!ud(i,g))continue;const p=fd(i,g);p!==void 0&&(c.add(g),l.push({exportName:q(e)??e.getName(),file:t,line:u.getStartLineNumber(),mentionsOwnership:a,sinkMethod:p,table:f,usesRls:o,visibility:n.visibility}))}return l},vd=(e,t)=>{const s=[];for(const n of y(t)){const i=e.getSourceFile(n)??e.addSourceFileAtPath(n),o=I(t,n);for(const a of Y(i))s.push(...hd(a,o))}return s},Qn=(e,t)=>{const s=r.isIdentifier(e)&&t!==void 0?D(e):void 0;return s===void 0||t===void 0?!1:s.compilerNode===t.compilerNode?r.isIdentifier(t.getNameNode()):r.isBindingElement(s)&&s.getFirstAncestorByKind(d.Parameter)?.compilerNode===t.compilerNode},Ed=e=>{const t=w(e),s=t.getParent();return(r.isPropertyAccessExpression(s)||r.isElementAccessExpression(s))&&s.getExpression()===t&&!Ge(s)},xd=e=>{const t=w(e).getParent();return r.isVariableDeclaration(t)&&r.isObjectBindingPattern(t.getNameNode())},Sd=e=>{const s=w(e).getParent();if(r.isSpreadAssignment(s)||r.isSpreadElement(s)){const n=s.getParent();return(r.isObjectLiteralExpression(n)||r.isArrayLiteralExpression(n))&&!Ge(n)}return r.isTemplateSpan(s)&&!r.isTaggedTemplateExpression(s.getParent().getParent())},$e=e=>{const t=D(e);return t===void 0||gr(t.getSourceFile())},Tt=(e,t)=>{const s=w(e),n=s.getParent();if(!r.isCallExpression(n))return!1;const i=n.getArguments().indexOf(s),o=h(n.getExpression());if(i===-1||o===void 0)return!1;if(r.isIdentifier(o))return o.getText()==="structuredClone"&&$e(o);if(Qn(He(o),t))return!(r.isPropertyAccessExpression(o)&&In.has(o.getName()))||r.isExpressionStatement(w(r.isAwaitExpression(n.getParent())?n.getParentOrThrow():n).getParent());if(!r.isPropertyAccessExpression(o))return!1;const a=o.getExpression();if(!r.isIdentifier(a)||!$e(a))return!1;const c=a.getText(),l=o.getName();switch(c){case"console":return!0;case"JSON":return l==="stringify";case"Object":return["entries","freeze","isFrozen","keys","values"].includes(l)||l==="assign"&&i>0;default:return!1}},De={kind:"opaque"},Ad={kind:"unreached"},yd=e=>{const t=e.getSymbol()?.getDeclarations()??[],s=t.filter(o=>r.isFunctionDeclaration(o)&&o.hasBody()),[n]=s;return t.every(o=>r.isFunctionDeclaration(o)&&o.getSourceFile()===e.getSourceFile())&&s.length===1&&r.isFunctionDeclaration(n)?n:void 0},Ot=e=>{const t=h(e);if(r.isArrowFunction(t)||r.isFunctionExpression(t))return t;const s=r.isIdentifier(t)?D(t):void 0;if(s?.getSourceFile()!==e.getSourceFile())return;if(r.isFunctionDeclaration(s)){const i=yd(s);return i===void 0||zt(i)?void 0:i}const n=ne(s)?h(s.getInitializer()):void 0;return r.isArrowFunction(n)||r.isFunctionExpression(n)?n:void 0},Xn=(e,t,s)=>{const n=t.getArguments(),i=n.indexOf(s),o=i===-1||n.slice(0,i+1).some(l=>r.isSpreadElement(l))||e.getDescendantsOfKind(d.Identifier).some(l=>l.getText()==="arguments"),a=e.getParameters(),c=a[i];return o?De:c===void 0?a.some(l=>l.isRestParameter())?De:Ad:c.isRestParameter()?De:{kind:"parameter",parameter:c}},bd=e=>{const t=w(e),s=t.getParent();if(!r.isCallExpression(s)||s.getExpression()===t)return;const n=Ot(s.getExpression());return n===void 0?De:Xn(n,s,t)},Nd=new Set(["__defineGetter__","__defineSetter__","__proto__"]),Pd=e=>r.isForInStatement(e)?e.getExpression():r.isConditionalExpression(e)?e.getCondition():r.isElementAccessExpression(e)?e.getArgumentExpression():void 0,Jn=e=>{const t=w(e),s=t.getParent();if(r.isIfStatement(s)||r.isWhileStatement(s)||r.isDoStatement(s)||r.isSwitchStatement(s)||r.isCaseClause(s)||r.isTypeOfExpression(s)||r.isVoidExpression(s)||r.isComputedPropertyName(s))return!0;if(r.isTemplateSpan(s))return!r.isTaggedTemplateExpression(s.getParent().getParent());const n=Pd(s);if(n!==void 0)return A(n,t);if(r.isPrefixUnaryExpression(s))return s.getOperatorToken()!==d.PlusPlusToken&&s.getOperatorToken()!==d.MinusMinusToken;if(!r.isBinaryExpression(s))return!1;const i=s.getOperatorToken().getKind(),o=i>=d.FirstAssignment&&i<=d.LastAssignment,a=i===d.QuestionQuestionToken||i===d.BarBarToken||i===d.AmpersandAmpersandToken;return!o&&!a},wd=4,Zn=(e,t,s=0)=>{if(fr(e))return!0;if(Ed(e)){const i=w(e).getParent(),o=r.isElementAccessExpression(i)?i.getArgumentExpression():void 0,a=r.isStringLiteral(o)?o.getLiteralValue():void 0,c=r.isPropertyAccessExpression(i)?i.getName():a;return c===void 0||!Nd.has(c)}if(xd(e)||Sd(e)||Jn(e)||Tt(e,t))return!0;const n=bd(e);return n?.kind==="unreached"||n?.kind==="parameter"&&Id(n.parameter,s+1)},$s=new WeakMap,Id=(e,t=0)=>{const s=e.getNameNode();if(!r.isIdentifier(s))return!0;const n=$s.get(e.compilerNode);if(n!==void 0)return n;if(t>wd)return!1;const o=(s.getSymbol()?.getDeclarations().length??0)===1&&e.getParentOrThrow().getDescendantsOfKind(d.Identifier).every(a=>a===s||a.getText()!==s.getText()||D(a)?.compilerNode!==e.compilerNode||Zn(a,void 0,t));return(o||t===0)&&$s.set(e.compilerNode,o),o},Vs=new WeakMap,Cd=(e,t)=>{const s=r.isFunctionExpression(e)?e.getNameNode():void 0;if(!r.isArrowFunction(e)&&e.getFirstDescendantByKind(d.ThisKeyword)!==void 0)return!0;const n=new Set([t.getName(),...s===void 0?[]:[s.getText()]]);return e.getDescendantsOfKind(d.Identifier).some(i=>{if(i===s||!n.has(i.getText()))return!1;const o=D(i)?.compilerNode;return o!==void 0&&(o===t.compilerNode||s!==void 0&&o===e.compilerNode)})},Td=(e,t,s)=>{const{context:n,impl:i}=e,o=Vs.get(i.compilerNode);if(o!==void 0)return o;const a=t.getNameNode(),c=r.isIdentifier(a)?[a]:a.getDescendantsOfKind(d.BindingElement).flatMap(g=>{const p=g.getNameNode();return r.isIdentifier(p)?[p]:[]}),l=new Map(c.map(g=>[g.getText(),g.getParentOrThrow().compilerNode])),u=g=>r.isIdentifier(a)?Zn(g,n):!Ge(g),f=!Cd(i,s)&&c.every(g=>(g.getSymbol()?.getDeclarations().length??0)===1)&&i.getDescendantsOfKind(d.Identifier).every(g=>{const p=g.getText();if(p==="arguments")return!1;const E=l.get(p);return E===void 0||c.includes(g)||D(g)?.compilerNode!==E?!0:u(g)});return Vs.set(i.compilerNode,f),f},Us=new WeakMap,Od=e=>{let t=Us.get(e.compilerNode);return t===void 0&&(t=new Map(e.getVariableDeclarations().flatMap(s=>{const n=Fr(s);return n===void 0?[]:[[n.compilerNode,s]]})),Us.set(e.compilerNode,t)),t},kd=e=>{const t=Od(e.getSourceFile()),s=e.getAncestors().find(l=>t.has(l.compilerNode)),n=s===void 0?void 0:t.get(s.compilerNode);if(s===void 0||n===void 0)return;const[i,o]=s.getParameters(),a=o===void 0||o.isRestParameter()?void 0:o,c={context:i,impl:s,mutatorName:q(n)??n.getName()};return a!==void 0&&Td(c,a,n)?{...c,parameter:a,pristine:!0}:{...c,parameter:a,pristine:!1}},pt="args",he=e=>{const t=Kt(e);if(t!==void 0){const c=h(t.object);return r.isIdentifier(c)&&c.getText()===pt?t.member:void 0}if(!r.isIdentifier(e))return;const s=D(e);if(!r.isBindingElement(s)||s.getDotDotDotToken()!==void 0)return;const n=s.getParent();if(!r.isObjectBindingPattern(n))return;const i=n.getParent(),o=ne(i)?h(i.getInitializer()):void 0;return r.isBindingElement(i)&&oe(i)===pt||r.isIdentifier(o)&&o.getText()===pt?oe(s):void 0},Rd=new Set(["auth","identity","user"]),kt=e=>{const t=i=>{const o=$t(i);return o!==void 0&&o.length>0&&Rd.has(o[0]??"")},s=h(e)??e;if(t(s))return!0;const n=G(s);return n!==void 0&&t(n)},ei=(e,t=2)=>{const s=new Set;for(const n of[e,...e.getDescendants()]){const i=he(n);i!==void 0&&s.add(i);const o=t>0&&r.isIdentifier(n)?G(n):void 0;if(o!==void 0)for(const a of ei(o,t-1))s.add(a)}return s},Le=e=>{const t=h(e)??e;if(!r.isBinaryExpression(t))return[];const s=t.getOperatorToken().getKind(),n=t.getLeft(),i=t.getRight();if(s===d.BarBarToken)return[...Le(n),...Le(i)];if(s===d.AmpersandAmpersandToken){const l=(u,f)=>{const g=he(h(u)??u);return g===void 0?[]:Le(f).filter(p=>p===g)};return[...l(n,i),...l(i,n)]}if(s!==d.ExclamationEqualsEqualsToken&&s!==d.ExclamationEqualsToken)return[];const o=[],a=he(h(n)??n),c=he(h(i)??i);return a!==void 0&&kt(i)&&o.push(a),c!==void 0&&kt(n)&&o.push(c),o},Fd=e=>{const t=h(e)??e;if(!r.isIdentifier(t))return!1;const s=t.getSymbol(),n=s?.getAliasedSymbol()?.getValueDeclaration()??s?.getValueDeclaration();if(!r.isVariableDeclaration(n))return!1;const i=h(n.getInitializer());return r.isCallExpression(i)&&yr(i.getExpression(),"defineIdentityGuard")},Dd=e=>{if(!Fd(e.getExpression()))return[];const t=e.getArguments();return t.flatMap((s,n)=>{const i=he(h(s)??s),o=t.some((a,c)=>c!==n&&kt(a));return i!==void 0&&o?[i]:[]})},Ld=e=>{if(r.isThrowStatement(e))return!0;if(!r.isBlock(e))return!1;const t=e.getStatements().at(-1);return t!==void 0&&r.isThrowStatement(t)},Md=e=>r.isArrowFunction(e)||r.isFunctionExpression(e)||r.isFunctionDeclaration(e)||r.isMethodDeclaration(e),Ws=(e,t)=>{for(let s=e.getParent();s!==void 0;s=s.getParent()){if(s===t||s.compilerNode===t.compilerNode)return!0;if(!(r.isBlock(s)||r.isExpressionStatement(s)||r.isAwaitExpression(s)||r.isParenthesizedExpression(s)||r.isVariableStatement(s)||r.isVariableDeclarationList(s)||r.isVariableDeclaration(s)))return!1}return!1},_d=e=>r.isAwaitExpression(e.getParent())||e.getType().isVoid(),Kd=(e,t)=>{const s=new Set;for(const n of e.getDescendantsOfKind(d.IfStatement))if(n.getEnd()<=t&&Ws(n,e)&&Ld(n.getThenStatement()))for(const i of Le(n.getExpression()))s.add(i);for(const n of e.getDescendantsOfKind(d.CallExpression))if(n.getEnd()<=t&&_d(n)&&Ws(n,e))for(const i of Dd(n))s.add(i);return s},zd=(e,t)=>{const s=ei(t);if(s.size===0)return!1;const n=e.getFirstAncestor(Md);if(n===void 0)return!1;const i=Kd(n,e.getStart());return[...s].every(o=>i.has(o))},Bd=new Set(["at","concat","filter","find","findLast","flat","reverse","slice","sort","toReversed","toSorted"]),$d=new Map([["Array",new Set(["from","of"])],["Object",new Set(["entries","values"])]]),Rt=new Set(["catch","every","filter","finally","find","findIndex","findLast","findLastIndex","flatMap","forEach","map","reduce","reduceRight","some","sort","then"]),ti=e=>e.getNameNode().getDescendantsOfKind(d.BindingElement).filter(t=>r.isIdentifier(t.getNameNode())),Vd=e=>{const t=w(e),s=t.getParent();if(r.isVariableDeclaration(s))return A(s.getInitializer(),t)?s:void 0;const n=r.isForOfStatement(s)&&s.getExpression()===t?s.getInitializer():void 0;return r.isVariableDeclarationList(n)?n.getDeclarations()[0]:void 0},Ud=e=>{const t=Vd(e);return t===void 0?void 0:r.isIdentifier(t.getNameNode())?r.isForOfStatement(t.getParent().getParent())||ne(t)?[t]:void 0:ti(t)},ve=e=>e.isUnion()?e.getUnionTypes().every(t=>ve(t)):e.isIntersection()?e.getIntersectionTypes().some(t=>ve(t)):!e.isAny()&&!e.isUnknown()&&!e.isObject()&&!e.isTypeParameter(),Ve=(e,t,s)=>{const n=r.isCallExpression(e)?h(e.getExpression()):void 0;return r.isPropertyAccessExpression(n)&&t.has(n.getName())&&(s===void 0||n.getExpression()===s)},Me=e=>{const t=h(e);if(!r.isArrowFunction(t)&&!r.isFunctionExpression(t))return;const s=t.getBody();return r.isBlock(s)?s.getDescendantsOfKind(d.ReturnStatement).filter(n=>n.getFirstAncestor(i=>r.isFunctionLikeDeclaration(i))===t).map(n=>n.getExpression()):[s]},Wd=e=>{const t=r.isCallExpression(e)?h(e.getExpression()):void 0,s=r.isPropertyAccessExpression(t)?t.getExpression():void 0;return r.isPropertyAccessExpression(t)&&r.isIdentifier(s)&&$d.get(s.getText())?.has(t.getName())===!0&&$e(s)},qd=e=>{const t=At(e);if(!r.isArrowFunction(t)&&!r.isFunctionExpression(t))return;const s=w(t),n=s.getParent();return r.isCallExpression(n)&&n.getArguments().includes(s)&&Ve(n,Cn)?n:void 0},jd=(e,t)=>{if(!(r.isPropertyAccessExpression(e)||r.isElementAccessExpression(e))||e.getExpression()!==t)return;const s=w(e),n=s.getParent();return!r.isCallExpression(n)||n.getExpression()!==s?e:Ve(n,Bd,t)?n:void 0},Hd=(e,t)=>{if(r.isAwaitExpression(e))return e;if(r.isConditionalExpression(e))return e.getCondition()===t?void 0:e;const s=r.isBinaryExpression(e)?e.getOperatorToken().getKind():void 0;return s===d.QuestionQuestionToken||s===d.BarBarToken||s===d.AmpersandAmpersandToken?e:void 0},Gd=(e,t)=>{if(r.isArrayLiteralExpression(e))return e;const n=r.isSpreadElement(e)||r.isSpreadAssignment(e)||r.isShorthandPropertyAssignment(e)||r.isPropertyAssignment(e)&&A(e.getInitializer(),t)?e.getParent():void 0;return r.isArrayLiteralExpression(n)||r.isObjectLiteralExpression(n)?n:void 0},qs=e=>{const t=w(e),s=t.getParent();if(s===void 0)return;const n=r.isCallExpression(s)&&s.getArguments().includes(t)&&Wd(s);return jd(s,t)??Hd(s,t)??Gd(s,t)??(n?s:qd(t))},Yd=5e4,si=()=>({inProgress:new Set,verdicts:new Map});class Qd{cuts=0;work=0;reset(){this.work=0}cut(){return this.cuts+=1,!0}spend(){return this.work+=1,this.work>Yd&&this.cut()}memoized(t,s,n){const i=n.verdicts.get(t);if(i!==void 0)return i;if(n.inProgress.has(t))return this.cuts+=1,!1;if(this.spend())return!0;const o=this.cuts;n.inProgress.add(t);let a;try{a=s()}finally{n.inProgress.delete(t)}return this.cuts===o&&n.verdicts.set(t,a),a}}const Xd=8,Jd=8;class Zd{budget;scope;taint;verdicts=si();constructor(t,s,n){this.scope=t,this.budget=s,this.taint=n}isCompromised(t){return this.flowHasCompromisingUse(t)&&!ve(t.getType())}flowHasCompromisingUse(t){return this.budget.memoized(t.compilerNode,()=>{const s=this.budget.cuts,n=[],i=new Set,o=(c,l)=>{i.has(c.compilerNode)||(i.add(c.compilerNode),n.push({binding:c,hops:l}))};let a=!1;o(t,0);for(const c of n)if(a=(c.binding===t?void 0:this.verdicts.verdicts.get(c.binding.compilerNode))??this.visitBinding(c,t,o),a)break;if(!a&&this.budget.cuts===s)for(const c of i)this.verdicts.verdicts.set(c,!1);return a},this.verdicts)}visitBinding({binding:t,hops:s},n,i){const o=t.getNameNode();if(!r.isIdentifier(o)){for(const l of r.isParameterDeclaration(t)?ti(t):[])i(l,s);return!1}if(this.budget.spend())return!0;const a=(l,u)=>u&&s>=Xd?this.budget.cut():(i(l,u?s+1:s),!1);return this.taint.referencesTo(t,o.getText()).some(l=>this.valueCompromises(w(l),!0,a,0))&&(t===n||!ve(t.getType()))}valueCompromises(t,s,n,i){let o=t;for(let p=qs(o);p!==void 0;p=qs(o)){if(r.isCallExpression(p)&&this.callbackCompromises(p,n))return!0;o=w(p)}const a=o.getParent(),c=o===t&&s,l=()=>!c&&ve(o.getType());if(Ge(o))return!c&&(!r.isBinaryExpression(a)||this.taint.isTaintedValue(a.getRight(),!1));const u=Ud(o);if(u!==void 0)return u.some(p=>n(p,!0));const f=r.isPropertyAccessExpression(a)&&a.getExpression()===o?a.getParent():void 0;if(r.isCallExpression(f)&&f.getExpression()===a)return this.methodCallCompromises(f,n);const g=this.nestedReturningFunctionOf(o);return g!==void 0?this.resultCompromises(g,n,i)&&!l():this.positionCompromises(o,n)&&!l()}resultCompromises(t,s,n){const i=w(t).getParent();if(n>=Jd)return this.budget.cut();if(r.isCallExpression(i))return i.getExpression()===w(t)?this.valueCompromises(i,!1,s,n+1):!Ve(i,Rt);const o=r.isFunctionDeclaration(t)?t:i,a=r.isFunctionDeclaration(o)||ne(o)?o.getNameNode():void 0;return o===void 0||!r.isIdentifier(a)?!0:this.taint.referencesTo(o,a.getText()).some(c=>{const l=w(c),u=l.getParent();return!r.isCallExpression(u)||u.getExpression()!==l||this.valueCompromises(u,!1,s,n+1)})}methodCallCompromises(t,s){return t.getArguments().filter(i=>Me(i)===void 0).some(i=>this.taint.isTaintedValue(i,!1))||this.callbackCompromises(t,s)}callbackCompromises(t,s){const n=Ve(t,Rt)?t.getArguments()[0]:void 0;if(n===void 0)return!1;const i=Ot(n);return i!==void 0&&this.taint.isInImpl(i)?i.getParameters().some(o=>s(o,!1)):this.taint.isTaintedValue(n,!1)}positionCompromises(t,s){const n=t.getParent();if(r.isCallExpression(n)&&n.getArguments().includes(t))return this.argumentCompromises(n,t,s);const i=r.isSpreadElement(n)?n.getParent():void 0;if(n!==void 0&&r.isCallExpression(i))return!Tt(n,this.scope.context)&&this.isOpaqueCallTainted(i.getExpression(),i.getArguments(),n);if(r.isNewExpression(n))return this.isOpaqueCallTainted(n.getExpression(),n.getArguments(),t);if(r.isTemplateSpan(n)){const o=n.getParent(),a=o.getParent(),c=o.getTemplateSpans().map(l=>l.getExpression());return r.isTaggedTemplateExpression(a)&&this.isOpaqueCallTainted(a.getTag(),c,t)}return!this.isReadPosition(t)}argumentCompromises(t,s,n){if(Tt(s,this.scope.context))return!1;const i=Ot(t.getExpression()),o=i===void 0?void 0:Xn(i,t,s);return o?.kind==="unreached"?!1:o?.kind==="parameter"&&i!==void 0&&this.taint.isInImpl(i)?n(o.parameter,!1):this.isOpaqueCallTainted(t.getExpression(),t.getArguments(),s)}isReadPosition(t){const s=t.getParent();return s===void 0||r.isExpressionStatement(s)||r.isForStatement(s)||r.isElementAccessExpression(s)||Jn(t)||A(At(t),this.scope.impl)}isOpaqueCallTainted(t,s,n){const i=!r.isIdentifier(h(n));return this.taint.isTaintedValue(t,!1)||s.some(o=>(o!==n||i)&&this.taint.isTaintedValue(o,!1))}nestedReturningFunctionOf(t){const s=At(t);return A(s,this.scope.impl)?void 0:s}}const eu=new Set(["at","every","filter","finally","find","findIndex","findLast","findLastIndex","forEach","order","slice","some","sort","withIndex","withSearchIndex"]),tu=e=>{const t=h(e);if(!r.isIdentifier(t))return r.isPropertyAccessExpression(t)||r.isElementAccessExpression(t);const s=D(t),n=r.isVariableDeclaration(s)?h(s.getInitializer()):void 0;return s===void 0||r.isFunctionDeclaration(s)||r.isParameterDeclaration(s)||r.isArrowFunction(n)||r.isFunctionExpression(n)},su=new Set(["all","allSettled","any","race"]),js=e=>r.isParameterDeclaration(e)?e:r.isBindingElement(e)?e.getFirstAncestorByKind(d.Parameter):void 0,mt=8;class nu{budget=new Qd;referencesByDeclaration=new Map;referencesByName=new Map;scope;verdicts=si();walk;variableDepth=0;queryDepth=0;constructor(t){this.scope=t,this.walk=new Zd(t,this.budget,this);for(const s of t.impl.getDescendantsOfKind(d.Identifier)){const n=s.getText();this.referencesByName.set(n,[...this.referencesByName.get(n)??[],s])}}isTaintedValue(t,s){this.queryDepth===0&&this.budget.reset(),this.queryDepth+=1;try{return s&&this.isRootedInContext(t,mt)?!1:(r.isIdentifier(t)?[t]:t.getDescendantsOfKind(d.Identifier)).some(i=>pr(i)&&this.isIdentifierTainted(i))}finally{this.queryDepth-=1}}isInImpl(t){const{impl:s}=this.scope;return t!==s&&s.getPos()<=t.getPos()&&t.getEnd()<=s.getEnd()}referencesTo(t,s){let n=this.referencesByDeclaration.get(s);if(n===void 0){n=new Map;for(const i of this.referencesByName.get(s)??[]){const o=D(i)?.compilerNode;o!==void 0&&n.set(o,[...n.get(o)??[],i])}this.referencesByDeclaration.set(s,n)}return(n.get(t.compilerNode)??[]).filter(i=>i.getParent()!==t)}flowsIntoTainted(t){if([t.getInitializer(),...t.getDescendantsOfKind(d.BindingElement).map(g=>g.getInitializer())].some(g=>g!==void 0&&this.isTaintedValue(g,!1)))return!0;const n=t.getParentOrThrow(),i=r.isFunctionLikeDeclaration(n)?n.getParameters().findIndex(g=>g.compilerNode===t.compilerNode):-1,o=w(n),a=o.getParent();if(i===-1)return!0;if(r.isCallExpression(a)){if(a.getExpression()===o)return this.isCallSiteTainted(a,i,t.isRestParameter());const g=h(a.getExpression());if(!r.isPropertyAccessExpression(g)||!Rt.has(g.getName()))return!0;const p=a.getArguments().filter(E=>E!==o);return this.isTaintedValue(g.getExpression(),!0)||p.some(E=>this.isTaintedValue(E,!1))}const c=r.isVariableDeclaration(a)&&ne(a)?a:void 0,l=r.isFunctionDeclaration(n)?n:c,u=l?.getNameNode();if(l===void 0||!r.isIdentifier(u))return!0;const f=this.referencesTo(l,u.getText());return f.length===0||f.some(g=>{const p=w(g),E=p.getParent();return!r.isCallExpression(E)||E.getExpression()!==p||this.isCallSiteTainted(E,i,t.isRestParameter())})}isCallSiteTainted(t,s,n){const i=t.getArguments(),o=i.findIndex(c=>r.isSpreadElement(c)),a=c=>c===s||n&&c>s||o!==-1&&o<=s&&c>=o;return i.some((c,l)=>a(l)&&this.isTaintedValue(c,!1))}isContextRootedCombinator(t,s){const n=h(t.getExpression()),i=r.isPropertyAccessExpression(n)?n.getExpression():void 0,a=r.isPropertyAccessExpression(n)&&r.isIdentifier(i)&&i.getText()==="Promise"&&$e(i)&&su.has(n.getName())?h(t.getArguments()[0]):void 0;if(r.isArrayLiteralExpression(a)){const f=a.getElements();return f.length>0&&f.every(g=>!r.isSpreadElement(g)&&this.isRootedInContext(g,s))}const c=r.isCallExpression(a)?h(a.getExpression()):void 0,l=r.isCallExpression(a)&&r.isPropertyAccessExpression(c)&&c.getName()==="map"?h(a.getArguments()[0]):void 0,u=l===void 0?void 0:Me(l);return u!==void 0&&u.length>0&&u.every(f=>f!==void 0&&this.isRootedInContext(f,s))}isIdentifierTainted(t){const s=t.getText();if(s==="arguments")return!0;const n=D(t),i=js(n);if(i!==void 0)return this.isSource(i);if(s==="args")return!0;if(n===void 0||!this.isInImpl(n))return!1;if(r.isFunctionDeclaration(n))return this.budget.memoized(n.compilerNode,()=>this.isTaintedValue(n,!1),this.verdicts);if(r.isBindingElement(n)&&this.walk.isCompromised(n))return!0;const o=r.isBindingElement(n)?n.getFirstAncestorByKind(d.VariableDeclaration):n;return r.isVariableDeclaration(o)&&this.isVariableTainted(o)}callChainVerdict(t,s){if(this.isContextRootedCombinator(t,s))return!0;const n=h(t.getExpression()),i=r.isPropertyAccessExpression(n)?n.getName():void 0;return i!==void 0&&In.has(i)?!1:i!==void 0&&Cn.has(i)?this.isCallbackResultServerScoped(t,s)?void 0:!1:t.getArguments().some(a=>Me(a)!==void 0)&&(i===void 0||!eu.has(i))?!1:void 0}isCallbackResultServerScoped(t,s){const n=(i,o=[])=>{const a=He(i),c=r.isIdentifier(a)?js(D(a)):void 0;return c!==void 0&&o.includes(c)?!0:this.isRootedInContext(i,s)||!this.isTaintedValue(i,!1)};return t.getArguments().every(i=>{const o=Me(i);if(o===void 0)return!tu(i)&&n(i);const a=h(i),c=r.isArrowFunction(a)||r.isFunctionExpression(a)?a.getParameters():[];return o.every(l=>l===void 0||n(l,c))})}isRootedInContext(t,s){const n=lr(t,u=>this.callChainVerdict(u,s)),i=n.root;if(n.verdict!==void 0)return n.verdict;if(Qn(i,this.scope.context))return!0;const o=r.isIdentifier(i)?D(i):void 0,a=r.isBindingElement(o)?o.getFirstAncestorByKind(d.VariableDeclaration):o,c=ne(a)&&this.isInImpl(a)?a.getInitializer():void 0,l=r.isBindingElement(o)?o:a;return s>0&&c!==void 0&&(r.isBindingElement(l)||r.isVariableDeclaration(l))&&!this.walk.isCompromised(l)&&this.isRootedInContext(c,s-1)}isSource(t){const{impl:s,parameter:n}=this.scope;return t.compilerNode===n?.compilerNode?!0:t.getParent()!==s&&this.isInImpl(t)&&(this.budget.memoized(t.compilerNode,()=>this.flowsIntoTainted(t),this.verdicts)||this.walk.isCompromised(t))}isVariableTainted(t){return this.budget.memoized(t.compilerNode,()=>{const s=t.getParent().getParent();if(r.isCatchClause(t.getParent())||this.walk.isCompromised(t))return!0;if(r.isForOfStatement(s)||r.isForInStatement(s))return this.isTaintedValue(s.getExpression(),!0);const n=t.getInitializer(),i=zt(t);if(n===void 0||i)return!0;if(this.isRootedInContext(n,mt))return!1;if(this.variableDepth>=mt)return this.budget.cut();this.variableDepth+=1;try{return this.isTaintedValue(n,!1)}finally{this.variableDepth-=1}},this.verdicts)}}const Hs=new WeakMap,iu=e=>{const t=Hs.get(e.impl.compilerNode);if(t!==void 0)return t;const s=new nu(e);return Hs.set(e.impl.compilerNode,s),s},ru=new Set(["accountId","authorId","createdBy","createdById","organizationId","orgId","ownerId","tenantId","updatedBy","userId","workspaceId"]),ou=new Set(["insert","insertManyUnsafe","patch","replace"]),au=e=>{if(!r.isPropertyAccessExpression(e))return;const t=e.getName();return ou.has(t)&&Er(e.getExpression())?t:void 0},cu=(e,t)=>{if(t!=="insertManyUnsafe")return r.isObjectLiteralExpression(e)?[e]:[];if(!r.isArrayLiteralExpression(e))return[];const s=[];for(const n of e.getElements())r.isObjectLiteralExpression(n)&&s.push(n);return s},lu=(e,t)=>{const s=Kt(e);return s?.member===t?h(s.object):void 0},Gs=(e,t)=>r.isIdentifier(e)&&D(e)?.compilerNode===t.compilerNode,ni=(e,t,s,n=1)=>{const i=lu(e,s);if(i!==void 0)return Gs(i,t);const o=r.isIdentifier(e)?D(e):void 0;if(r.isBindingElement(o)){const c=o.getParent(),l=c.getParent();return o.getDotDotDotToken()===void 0&&oe(o)===s&&r.isObjectBindingPattern(c)&&(l.compilerNode===t.compilerNode||ne(l)&&Gs(h(l.getInitializer()),t))}const a=ne(o)?o.getInitializer():void 0;return n>0&&a!==void 0&&ni(a,t,s,n-1)},Ft=e=>{const t=h(e)??e;return r.isConditionalExpression(t)?[...Ft(t.getWhenTrue()),...Ft(t.getWhenFalse())]:[t]},du=(e,t,s)=>{const n=[],i=s===void 0?void 0:iu(s);for(const o of e.getProperties()){let a,c;if(r.isPropertyAssignment(o)?(a=S(o),c=o.getInitializer()):r.isShorthandPropertyAssignment(o)&&(a=S(o),c=o.getNameNode()),a===void 0||c===void 0||!ru.has(a))continue;const l=Ft(c).filter(f=>i===void 0?W(f)&&!xr(f):i.isTaintedValue(f,!0));if(l.length>0){const f=t.ownerField===a&&s?.pristine===!0&&ni(c,s.parameter,a),g=l.every(p=>zd(t.call,p));n.push({field:a,file:t.relativePath,line:t.call.getStartLineNumber(),method:t.method,scope:t.scope,...f&&{ownerScoped:!0},...g&&{guarded:!0}})}}return n},uu=(e,t,s)=>{const n=au(e.getExpression()),i=n===void 0?void 0:e.getArguments()[1];if(n===void 0||i===void 0)return[];const o=cu(i,n);if(o.length===0)return[];const a=x(e),c=kd(e),l={call:e,method:n,ownerField:c===void 0?void 0:s(c.mutatorName),relativePath:t,scope:a};return o.flatMap(u=>du(u,l,c))},fu=(e,t,s=[],n=[])=>{const i=new Map(n.map(c=>[`${c.filePath}:${c.exportName}`,c.owner])),o=C(e,t,(c,l)=>uu(c,l,u=>i.get(`${l}:${u}`))),a=new Map(s.map(c=>[`${c.filePath}:${c.exportName}`,c.adminOnly===!0]));return Bt(o,s).map(c=>mr(c.scope)?.every(f=>a.get(`${c.file}:${f}`)===!0)===!0?{...c,adminOnly:!0}:c)},gu=new Set(["createAutumnAdapter","createDodoPaymentsAdapter","createPolarAdapter","createStripeAdapter"]),pu=e=>e&&r.isNumericLiteral(e)?Number(e.getText()):void 0,mu=e=>{const t=B(e,"webhookToleranceSeconds");return t&&r.isPropertyAssignment(t)?pu(t.getInitializer()):void 0},hu=(e,t)=>{const s=N(e.getExpression());if(s===void 0||!gu.has(s))return;const[n]=e.getArguments(),i=n&&r.isObjectLiteralExpression(n)?mu(n):void 0;return{callee:s,scope:x(e),file:t,line:e.getStartLineNumber(),...i===void 0?{}:{toleranceSeconds:i}}},vu=(e,t)=>C(e,t,hu),Eu=new Map([["defineQueue",0],["defineSubscription",1],["defineWorkflow",0]]),xu=e=>{const t=e.getExpression();return r.isIdentifier(t)?t.getText():void 0},Su=(e,t)=>{const s=e.getArguments()[t];if(!s||!r.isObjectLiteralExpression(s))return;const n=B(s,"handler");if(n===void 0||!r.isPropertyAssignment(n))return;const i=n.getInitializer();if(i&&(r.isArrowFunction(i)||r.isFunctionExpression(i)))return i},ii=(e,t)=>{const s=e.getParameters()[t]?.getNameNode();return s&&r.isIdentifier(s)?s.getText():void 0},ri=(e,t)=>e===t||e.startsWith(`${t}.`),oi=e=>{const t=e.getDescendantsOfKind(d.PropertyAccessExpression);return r.isPropertyAccessExpression(e)&&t.push(e),t},Ys=e=>{const t=e.getParent();return r.isPropertyAccessExpression(t)&&t.getNameNode()===e||r.isPropertyAssignment(t)&&t.getNameNode()===e?!1:!(r.isBindingElement(t)&&t.getNameNode()===e)},ai=e=>{const t=e.getDescendantsOfKind(d.Identifier).filter(s=>Ys(s));return r.isIdentifier(e)&&Ys(e)&&t.push(e),t},Au=e=>{if(!r.isVariableDeclaration(e))return[];const t=e.getNameNode();return r.isIdentifier(t)?[t.getText()]:t.getDescendantsOfKind(d.BindingElement).map(s=>s.getName())},yu=e=>{const t=ii(e,1);if(t===void 0)return[];const s=[`${t}.messages`];for(const n of e.getDescendantsOfKind(d.ForOfStatement)){if(n.getExpression().getText()!==`${t}.messages`)continue;const i=n.getInitializer(),o=r.isVariableDeclarationList(i)?i.getDeclarations()[0]?.getNameNode():void 0;o&&r.isIdentifier(o)&&s.push(`${o.getText()}.body`)}return s},bu=(e,t,s)=>{const n=t==="workflow"?[`${s}.params`]:yu(e),i=new Set,o=a=>oi(a).some(c=>n.some(l=>ri(c.getText(),l)))?!0:ai(a).some(c=>i.has(c.getText()));for(const a of e.getDescendantsOfKind(d.VariableDeclaration)){const c=a.getInitializer();if(c&&o(c))for(const l of Au(a))i.add(l)}return{names:i,prefixes:n}},Nu=(e,t)=>oi(e).some(s=>t.prefixes.some(n=>ri(s.getText(),n)))?!0:ai(e).some(s=>t.names.has(s.getText())),Pu=e=>{const t=dr(e);return t===void 0?void 0:{exportName:String(t.at(-1)),file:t.slice(0,-1).join("/")}},wu=(e,t,s)=>{const n=ii(e,0);if(n===void 0)return[];const i=bu(e,t,n),o=new Set([n,...i.prefixes.filter(c=>c.endsWith(".body")).map(c=>c.slice(0,-5))]),a=[];for(const c of e.getDescendantsOfKind(d.CallExpression)){const l=c.getExpression();if(!r.isPropertyAccessExpression(l)||!bn.has(l.getName())||!o.has(l.getExpression().getText()))continue;const u=c.getArguments()[1];if(!u||!Nu(u,i))continue;const f=Pu(c.getArguments()[0]);f!==void 0&&a.push({dispatchKind:t,file:s,scope:x(c),line:c.getStartLineNumber(),targetExport:f.exportName,targetFile:f.file})}return a},Iu=(e,t)=>{const s=[];for(const n of e.getDescendantsOfKind(d.CallExpression)){const i=xu(n),o=i===void 0?void 0:Eu.get(i);if(o===void 0)continue;const a=Su(n,o);a!==void 0&&s.push(...wu(a,i==="defineWorkflow"?"workflow":"queue",t))}return s},Cu=(e,t)=>{const s=[];for(const n of y(t)){const i=e.getSourceFile(n)??e.addSourceFileAtPath(n);s.push(...Iu(i,I(t,n)))}return s},Qs={dbRateLimit:"usesRateLimit",emailGateMiddleware:"usesEmailGate",mask:"usesMask",rateLimit:"usesRateLimit",rls:"usesRls",verifyTurnstileMiddleware:"usesCaptcha"},Xs=new Set(["account","credential","member","passkey","session","user"]),Tu=e=>e.replaceAll(/[-_]/gu," ").replaceAll(/([a-z0-9])([A-Z])/gu,"$1 $2").split(" ").filter(Boolean).map(t=>t.toLowerCase()),Ou=e=>{const s=Tu(e).at(-1);if(!s)return!1;const n=s.endsWith("s")?s.slice(0,-1):s;return Xs.has(s)||Xs.has(n)},ku=e=>{const t=e.replaceAll(/[^a-z0-9]/giu,"").toLowerCase();return t.endsWith("email")||t.endsWith("emailaddress")},Ru=(e,t)=>{const{objects:s,opaque:n}=qt(e,t);return Va(s).some(i=>ku(i))?!0:n?void 0:!1},Fu=e=>{const t=e.getArguments()[0];return!t||!r.isObjectLiteralExpression(t)?{usesCaptcha:!1,usesRateLimit:!1}:{usesCaptcha:!!B(t,"captcha"),usesRateLimit:!!B(t,"rateLimit")}},Du=e=>{if(r.isCallExpression(e))return e;if(!r.isIdentifier(e))return;const s=e.getSourceFile().getVariableDeclaration(e.getText())?.getInitializer();return s&&r.isCallExpression(s)?s:void 0},_e={usesCaptcha:!1,usesEmailGate:!1,usesMask:!1,usesRateLimit:!1,usesRls:!1},Lu=e=>{const t=Du(e),s=t?N(t.getExpression()):void 0;if(t&&s==="protectPublic"){const n=Fu(t);return{..._e,usesCaptcha:n.usesCaptcha,usesRateLimit:n.usesRateLimit}}return s!==void 0&&s in Qs?{..._e,[Qs[s]]:!0}:_e},Mu=e=>{const t={..._e};let s=e;for(;r.isCallExpression(s);){const n=s.getExpression();if(!r.isPropertyAccessExpression(n))break;const i=n.getName()==="use"?s.getArguments()[0]:void 0;if(i){const o=Lu(i);t.usesCaptcha||=o.usesCaptcha,t.usesEmailGate||=o.usesEmailGate,t.usesMask||=o.usesMask,t.usesRateLimit||=o.usesRateLimit,t.usesRls||=o.usesRls}s=n.getExpression()}return t},_u=new Set(["insert","insertMany","insertManyUnsafe","replace"]),Ku=e=>{const t=e.getExpression();if(!r.isPropertyAccessExpression(t)||!_u.has(t.getName()))return!1;const s=t.getExpression();if(!_(s))return!1;const i=e.getArguments()[0];return!i||!(r.isStringLiteral(i)||r.isNoSubstitutionTemplateLiteral(i))?!1:Ou(i.getLiteralText())},zu=new Set(["create","publish","publishBatch","runAfter","runAt","send","sendBatch"]),Js=new Set(["queues","scheduler","topics","workflows"]),Bu=e=>{const t=e.getExpression();if(!r.isPropertyAccessExpression(t)||!zu.has(t.getName()))return!1;let s=t.getExpression();for(;r.isCallExpression(s)||r.isElementAccessExpression(s)||r.isPropertyAccessExpression(s);){if(r.isPropertyAccessExpression(s)&&Js.has(s.getName())&&Sr(s.getExpression()))return!0;s=s.getExpression()}const n=$t(s);return n?.length===1&&Js.has(n[0]??"")},$u=e=>{const t=e.getExpression();if(!r.isPropertyAccessExpression(t)||t.getName()!=="insertManyUnsafe")return!1;const s=t.getExpression();return _(s)},ci=new Set(["generateObject","generateText","streamObject","streamText"]),Vu=e=>{const t=N(e.getExpression());return t!==void 0&&ci.has(t)},Uu=e=>{const t=N(e.getExpression());if(t===void 0||!ci.has(t))return!1;const s=e.getArguments()[0];return!s||!r.isObjectLiteralExpression(s)||s.getProperties().some(n=>r.isSpreadAssignment(n))?!1:!B(s,"maxOutputTokens")},Wu=new Set(["log","span","trace"]),qu=new Set(["ai"]),ju=new Set(["email","mail"]),Hu=new Set(["ai","browser","fetch","mail","notify","queues","sql","storage","topics","workflows"]),ht=(e,t)=>[...t].some(s=>Ye(e,s).length>0),li=new Set([d.ArrowFunction,d.FunctionDeclaration,d.FunctionExpression,d.GetAccessor,d.MethodDeclaration,d.SetAccessor]),Gu=new Set(["every","filter","flatMap","forEach","map","some"]),Yu=new Set(["all","allSettled","race"]),di=e=>{const t=e.getParent();if(!t||!r.isCallExpression(t)||!t.getArguments().includes(e))return;const s=t.getExpression();if(!r.isPropertyAccessExpression(s))return;const n=s.getName();if(Gu.has(n))return t;const i=s.getExpression();if(r.isIdentifier(i)&&i.getText()==="Promise"&&Yu.has(n))return t},Qu=e=>{let t=e.getParent();for(;t;){if(r.isTryStatement(t)){const s=t.getTryBlock();if(e.getPos()>=s.getPos()&&e.getEnd()<=s.getEnd())return!0}if(li.has(t.getKind())){const s=di(t);if(!s)return!1;t=s;continue}t=t.getParent()}return!1},Xu=e=>{let t=e.getParent();for(;t!==void 0;){if(r.isCallExpression(t)&&t.getExpression().getText()==="Promise.allSettled")return!0;if(li.has(t.getKind())){if(t=di(t),t===void 0)return!1;continue}t=t.getParent()}return!1},Ju=e=>{const t=e.getFirstAncestor(u=>r.isArrowFunction(u)||r.isFunctionExpression(u)),s=t?.getParent();if(!t||!r.isCallExpression(s)||!s.getArguments().includes(t))return!1;const n=s.getExpression();if(!r.isIdentifier(n))return!1;const i=n.getSymbol(),o=i?.getAliasedSymbol()?.getValueDeclaration()??i?.getValueDeclaration(),a=r.isVariableDeclaration(o)?o.getInitializer():o;if(!r.isArrowFunction(a)&&!r.isFunctionExpression(a)&&!r.isFunctionDeclaration(a))return!1;const c=s.getArguments().indexOf(t),l=a.getParameters()[c]?.getName();return l===void 0?!1:a.getDescendantsOfKind(d.TryStatement).some(u=>{const f=u.getTryBlock().getDescendantsOfKind(d.CallExpression).some(p=>{const E=p.getExpression();return r.isIdentifier(E)&&E.getText()===l&&r.isAwaitExpression(p.getParent())}),g=u.getCatchClause();return f&&g!==void 0&&g.getDescendantsOfKind(d.ThrowStatement).length>0})},Zu=e=>{let t=e;for(;;){const s=t.getParent();if(!r.isPropertyAccessExpression(s)||s.getExpression()!==t)return!1;if(s.getName()==="catch")return!0;if(s.getName()!=="then"&&s.getName()!=="finally")return!1;const n=s.getParent();if(!r.isCallExpression(n)||n.getExpression()!==s)return!1;t=n}},ef=e=>{let t=e;for(;;){const s=t.getParent();if(r.isPropertyAccessExpression(s)&&s.getExpression()===t){t=s;continue}return r.isCallExpression(s)&&s.getExpression()===t?s:void 0}},tf=e=>{let t=!1,s=!0;for(const n of[...Hu].flatMap(i=>Ye(e,i))){const i=ef(n);i&&(t=!0,!Qu(i)&&!Zu(i)&&!Ju(i)&&!Xu(i)&&(s=!1))}return{handlesErrors:t&&s,reachesOutbound:t}},sf=e=>e.getDescendantsOfKind(d.ThrowStatement).some(t=>{const s=t.getExpression();if(!r.isNewExpression(s))return!1;const n=s.getExpression();return r.isIdentifier(n)&&n.getText()==="Error"}),Zs="lunora-advisor-exempt",nf=/^[\s*/]+/u,rf=/[\w-]/u,of=e=>{const s=(e.getFirstAncestorByKind(d.VariableStatement)??e).getLeadingCommentRanges().map(n=>n.getText()).join(`
+`);for(const n of s.split(`
+`)){const i=n.replace(nf,"");if(!i.startsWith(Zs))continue;const o=i.slice(Zs.length);if(rf.test(o.charAt(0)))continue;const a=o.indexOf("--");return{exempt:!0,exemptReason:(a===-1?"":o.slice(a+2).split("*")[0]??"").trim()}}return{exempt:!1,exemptReason:""}},af=e=>{const[t]=e.getArguments();if(t){if(r.isObjectLiteralExpression(t)){const s=B(t,"handler");return s?r.isPropertyAssignment(s)?s.getInitializer():r.isShorthandPropertyAssignment(s)?s.getNameNode():r.isMethodDeclaration(s)?s:void 0:void 0}return t}},cf=(e,t)=>{const s=af(t);if(!s)return;if(r.isArrowFunction(s)||r.isFunctionExpression(s)||r.isMethodDeclaration(s))return e;if(!r.isIdentifier(s))return;const n=s.getSourceFile(),i=s.getText(),o=n.getVariableDeclaration(i)?.getInitializer();return o&&(r.isArrowFunction(o)||r.isFunctionExpression(o))?o:n.getFunction(i)},lf=e=>{let t=!1,s=!1,n=!1,i=!1,o=!1;for(const l of e.getDescendantsOfKind(d.CallExpression))if(Ku(l)&&(o=!0),Bu(l)&&(t=!0),$u(l)&&(i=!0),Vu(l)&&(s=!0),Uu(l)&&(n=!0),o&&t&&i&&n)break;const{handlesErrors:a,reachesOutbound:c}=tf(e);return{callsMail:ht(e,ju),emitsEvent:ht(e,Wu),fanOut:t,handlesErrors:a,reachesOutbound:c,runsAiGeneration:s||ht(e,qu),throwsBareError:sf(e),unboundedAiGeneration:n,usesInsertManyUnsafe:i,writesUserTable:o}},df=(e,t)=>{const s=e.getInitializer();if(!s||!r.isCallExpression(s))return;const n=ee(s);if(!n||n.kind!=="query"&&n.kind!=="mutation"&&n.kind!=="action")return;const i=n.receiver?Mu(n.receiver):{usesCaptcha:!1,usesEmailGate:!1,usesMask:!1,usesRateLimit:!1,usesRls:!1},o=cf(e,s);return{...o?lf(o):{},...of(e),...i,analyzableBody:o!==void 0,exportName:q(e)??e.getName(),file:t,hasEmailArg:Ru(s,n.receiver),kind:n.kind,visibility:n.visibility}},uf=(e,t)=>{const s=[];for(const n of Y(e)){const i=df(n,t);i&&s.push(i)}return s},ff=(e,t)=>{const s=[];for(const n of y(t)){const i=e.getSourceFile(n)??e.addSourceFileAtPath(n);s.push(...uf(i,I(t,n)))}return s},gf=new Set(["dbRateLimit","rateLimit"]),pf=e=>r.isArrowFunction(e)?e.getBody():e,mf=e=>{if(!r.isArrowFunction(e))return;const t=e.getParameters()[0]?.getNameNode();return t!==void 0&&r.isIdentifier(t)?t:void 0},ui=e=>{const t=e.getParent();return r.isPropertyAccessExpression(t)&&t.getExpression()===e&&t.getName()==="args"},fi=(e,t)=>{const s=t.getSymbol();return s===void 0?[]:e.getDescendantsOfKind(d.Identifier).filter(n=>{if(n.getSymbol()!==s)return!1;const i=n.getParent();return!(r.isPropertyAccessExpression(i)&&i.getNameNode()===n)})},hf=(e,t)=>W(e)||t!==void 0&&fi(e,t).some(s=>ui(s)),vf=(e,t)=>t===void 0?ae(e):fi(e,t).some(s=>!ui(s)),Ef=(e,t)=>{const s=N(e.getExpression());if(s===void 0||!gf.has(s))return;const n=R(yn(e.getArguments()[2]),"key");if(!n)return;const i=pf(n),o=mf(n);if(!(!hf(i,o)||vf(i,o)))return{callee:s,scope:x(e),file:t,limitName:An(e),line:e.getStartLineNumber()}},xf=(e,t)=>C(e,t,Ef),Sf=new Set(["findFirst","findFirstOrThrow","findMany","findUnique","get"]),Af=e=>{const t=e.getExpression();if(!r.isPropertyAccessExpression(t)||!Sf.has(t.getName()))return;const s=t.getExpression();if(_(s)){const n=e.getArguments()[0];return n&&r.isStringLiteral(n)?n.getLiteralText():""}if(r.isPropertyAccessExpression(s)&&_(s.getExpression()))return s.getName()},yf=e=>{let t=e;for(;r.isCallExpression(t);){const s=t.getExpression();if(!r.isPropertyAccessExpression(s))return;if(s.getName()==="query"&&_(s.getExpression())){const n=t.getArguments()[0];return n&&r.isStringLiteral(n)?n.getLiteralText():""}t=s.getExpression()}},bf=e=>{let t=h(e)??e;for(;r.isAwaitExpression(t);)t=h(t.getExpression())??t.getExpression();return t},gi=(e,t=!1)=>{const s=bf(e);if(r.isIdentifier(s)){if(t)return;const n=G(s);return n===void 0?void 0:gi(n,!0)}if(r.isCallExpression(s))return Af(s)??yf(s)},Nf=e=>{const t=e.getBody();if(!r.isBlock(t))return[t];const s=[];for(const n of e.getDescendantsOfKind(d.ReturnStatement)){const i=n.getFirstAncestor(a=>r.isArrowFunction(a)||r.isFunctionExpression(a)||r.isFunctionDeclaration(a)),o=n.getExpression();i===e&&o!==void 0&&s.push(o)}return s},Pf=(e,t)=>{if(!r.isVariableDeclaration(e))return[];const s=e.getInitializer();if(s===void 0||!r.isCallExpression(s))return[];const n=ee(s);if(n?.kind!=="query")return[];const i=Wn(s);if(i===void 0)return[];const o=n.receiver!==void 0&&br(n.receiver,"output"),a=n.receiver!==void 0&&Tn(n.receiver,"use","mask"),c=new Set,l=[];for(const u of Nf(i)){const f=gi(u);f===void 0||c.has(f)||(c.add(f),l.push({exportName:q(e)??e.getName(),file:t,line:u.getStartLineNumber(),table:f,usesMask:a,usesOutput:o,visibility:n.visibility}))}return l},wf=(e,t)=>{const s=[];for(const n of y(t)){const i=e.getSourceFile(n)??e.addSourceFileAtPath(n),o=I(t,n);for(const a of Y(i))s.push(...Pf(a,o))}return s},If=e=>{if(!e||!r.isObjectLiteralExpression(e))return[];const t=[];for(const s of e.getProperties())(r.isPropertyAssignment(s)||r.isShorthandPropertyAssignment(s)||r.isMethodDeclaration(s)||r.isGetAccessorDeclaration(s))&&t.push(S(s));return t},Cf=(e,t)=>{if(!r.isVariableDeclaration(e))return[];const s=e.getInitializer(),n=s&&r.isCallExpression(s)?ee(s):void 0;if(!n)return[];const i=[];for(const o of e.getDescendantsOfKind(d.CallExpression)){const a=kn(o);if(a===void 0)continue;const c=If(R(a.options,"with"));c.length!==0&&i.push({exportName:q(e)??e.getName(),file:t,line:o.getStartLineNumber(),parentTable:a.table,relations:c,visibility:n.visibility})}return i},Tf=(e,t)=>{const s=[];for(const n of y(t)){const i=e.getSourceFile(n)??e.addSourceFileAtPath(n),o=I(t,n);for(const a of Y(i))s.push(...Cf(a,o))}return s},U=(e,t)=>`${e}:${t}`,en=(e,t,s,n)=>s===void 0?void 0:{endLine:e.getEndLineNumber(),exported:n,file:t,name:s,node:e,startLine:e.getStartLineNumber()},Of=(e,t)=>[...se(e,t,d.FunctionDeclaration,(s,n)=>s.getParent().getKind()===d.SourceFile?en(s,n,s.getName(),s.isExported()):void 0),...se(e,t,d.VariableDeclaration,(s,n)=>{const i=s.getVariableStatement();return i?.getParent().getKind()===d.SourceFile?en(i,n,s.getName(),i.isExported()):void 0})],kf=(e,t,s)=>{const n=e.getExpression();if(!r.isIdentifier(n))return;const i=n.getSymbol(),o=(i?.getAliasedSymbol()??i)?.getDeclarations()[0];if(o===void 0||!(r.isFunctionDeclaration(o)||r.isVariableDeclaration(o)))return;const a=o.getName(),c=I(s,o.getSourceFile().getFilePath());return a===void 0?void 0:t.get(U(c,a))},Rf=e=>`${e.table}|${e.method}|${e.fields?.join(",")??"*"}`,Ff=(e,t)=>{const s=new Map(e.map(n=>[U(n.file,n.name),new Map]));for(const n of t){const i=e.find(o=>o.file===n.file&&o.startLine<=n.line&&n.line<=o.endLine);i!==void 0&&n.table!==""&&s.get(U(i.file,i.name))?.set(Rf(n),{fields:n.fields,method:n.method,table:n.table})}return s},Df=(e,t,s)=>e.node.getDescendantsOfKind(d.CallExpression).map(n=>kf(n,t,s)).filter(n=>n!==void 0),Lf=(e,t,s,n)=>{for(const i of e){const o=i.scope.kind==="module"?void 0:t.get(U(i.file,i.scope.name)),a=i.target===void 0?void 0:s.get(i.target);i.kind==="call"&&o!==void 0&&a!==void 0&&n.get(U(o.file,o.name))?.push(a)}},Mf=(e,t,s)=>{const n=new Map(e.map(a=>[U(a.file,a.name),a])),i=new Map(e.map(a=>[`${Ut(a.file)}:${a.name}`,a])),o=new Map(e.map(a=>[U(a.file,a.name),Df(a,n,t)]));return Lf(s,n,i,o),o},_f=(e,t)=>{let s=!1;for(const[n,i]of t??[])e!==void 0&&!e.has(n)&&(e.set(n,i),s=!0);return s},Kf=(e,t,s)=>{let n=!0;for(;n;){n=!1;for(const i of e)for(const o of s.get(U(i.file,i.name))??[])_f(t.get(U(i.file,i.name)),t.get(U(o.file,o.name)))&&(n=!0)}},zf=(e,t,s,n)=>{const i=Of(e,t),o=Ff(i,s);return Kf(i,o,Mf(i,t,n)),i.filter(a=>a.exported).flatMap(a=>[...o.get(U(a.file,a.name))?.values()??[]].map(c=>({...c,exportName:a.name,file:a.file})))},Ue=e=>{if(r.isStringLiteral(e)||r.isNoSubstitutionTemplateLiteral(e))return e.getLiteralText();if(r.isBinaryExpression(e)&&e.getOperatorToken().getKind()===d.PlusToken){const t=Ue(e.getLeft()),s=Ue(e.getRight());return t!==void 0&&s!==void 0?t+s:void 0}},Bf=e=>{let t=e,s=t.getParent();for(;s!==void 0&&r.isBinaryExpression(s)&&s.getOperatorToken().getKind()===d.PlusToken;)t=s,s=t.getParent();return t!==e&&Ue(t)!==void 0},$f=e=>{const t=e.getParent();if(t!==void 0){if(r.isVariableDeclaration(t)||r.isPropertyAssignment(t)||r.isPropertySignature(t))return S(t);if(r.isBinaryExpression(t)&&t.getOperatorToken().getKind()===d.EqualsToken)return t.getLeft().getText()}},Vf=(e,t,s)=>Ur(e)?!ur(s)&&Wr($f(t)):!0,Uf=(e,t)=>{const s=[],n=[...e.getDescendantsOfKind(d.BinaryExpression),...e.getDescendantsOfKind(d.StringLiteral),...e.getDescendantsOfKind(d.NoSubstitutionTemplateLiteral)],i=new Set;for(const o of n){if(Bf(o))continue;const a=Ue(o);if(a===void 0)continue;const c=$r(a);if(c===void 0||!Vf(c,o,t))continue;const l=o.getStartLineNumber(),u=`${String(l)}:${c}`;i.has(u)||(i.add(u),s.push({file:t,kind:c,line:l,preview:Vr(a)}))}return s},Wf=(e,t)=>{const s=[];for(const n of y(t,{includeSkipped:!0})){const i=e.getSourceFile(n)??e.addSourceFileAtPath(n);s.push(...Uf(i,I(t,n)))}return s},qf=(e,t)=>{if(!r.isVariableDeclaration(e))return[];const s=e.getInitializer(),n=s&&r.isCallExpression(s)?ee(s):void 0;if(!n)return[];const i=[];for(const o of e.getDescendantsOfKind(d.CallExpression)){const a=kn(o);if(a===void 0)continue;const c=R(a.options,"includeDeleted");if(c===void 0)continue;const l=r.isTrueLiteral(c),u=!l&&W(c);!l&&!u||i.push({exportName:q(e)??e.getName(),file:t,fromArgs:u,hardcodedTrue:l,line:o.getStartLineNumber(),table:a.table,visibility:n.visibility})}return i},jf=(e,t)=>{const s=[];for(const n of y(t)){const i=e.getSourceFile(n)??e.addSourceFileAtPath(n),o=I(t,n);for(const a of Y(i))s.push(...qf(a,o))}return s},Hf=new Set(["query","unsafe"]),Gf=e=>!r.isPropertyAccessExpression(e)||!Hf.has(e.getName())?!1:H(e.getExpression(),["sql"]),Yf=e=>r.isBinaryExpression(e)||r.isTemplateExpression(e),Qf=(e,t)=>{if(!Gf(e.getExpression()))return;const s=e.getArguments()[0];if(!(!s||!Yf(s)))return{file:t,line:s.getStartLineNumber(),scope:x(e)}},Xf=(e,t)=>C(e,t,Qf),Jf=[["convex",["convex","@convex-dev/"]],["supabase",["@supabase/"]],["firebase",["firebase","@firebase/","firebase-admin"]]],Zf=e=>{for(const[t,s]of Jf)for(const n of s)if(e===n||e.startsWith(n.endsWith("/")?n:`${n}/`))return t},eg=(e,t)=>{const s=[];for(const n of y(t)){const i=e.getSourceFile(n)??e.addSourceFileAtPath(n);for(const o of i.getImportDeclarations()){const a=o.getModuleSpecifierValue(),c=Zf(a);c!==void 0&&s.push({file:I(t,n),line:o.getStartLineNumber(),moduleSpecifier:a,platform:c})}}return s},tg=new Set(["createMultipartUpload","delete","download","generateUploadUrl","get","getMetadata","getPresignedUrl","getSignedUrl","getUrl","head","put","resumeMultipartUpload","store","upload"]),sg=(e,t,s=[])=>{const n=Je(e,t,{argIndex:0,matchReceiver:i=>i==="ctx.storage"||i.startsWith("ctx.storage."),methods:tg,requireUnmodifiedReach:!0});return Bt(n,s)},ng=new Map([["generateUploadUrl",1],["getPresignedUrl",1],["getSignedUrl",1],["store",2],["upload",2]]),ig=e=>e&&r.isNumericLiteral(e)?Number(e.getText()):void 0,rg=e=>{if(e===void 0)return{analyzable:!0,presentKeys:[]};if(!r.isObjectLiteralExpression(e))return{analyzable:!1,presentKeys:[]};const t=[];let s,n=!1;for(const i of e.getProperties()){if(r.isSpreadAssignment(i)){n=!0;continue}if(r.isPropertyAssignment(i)){const o=S(i);t.push(o),o==="expiresInSeconds"&&(s=ig(i.getInitializer()));continue}(r.isShorthandPropertyAssignment(i)||r.isMethodDeclaration(i))&&t.push(S(i))}return{analyzable:!n,expiresInSeconds:s,presentKeys:t}},og=e=>{if(!r.isPropertyAccessExpression(e))return;const t=e.getName(),s=ng.get(t);return s===void 0?void 0:wn(e.getExpression(),i=>i==="ctx.storage"||i.startsWith("ctx.storage."))?{method:t,optionsIndex:s}:void 0},ag=(e,t)=>{const s=og(e.getExpression());if(s!==void 0)return{scope:x(e),file:t,line:e.getStartLineNumber(),method:s.method,...rg(e.getArguments()[s.optionsIndex])}},cg=(e,t)=>C(e,t,ag),lg=e=>r.isDoStatement(e)||r.isForInStatement(e)||r.isForOfStatement(e)||r.isForStatement(e)||r.isWhileStatement(e),pi=e=>{const t=e.getLabel()?.getText(),s=i=>t!==void 0?r.isLabeledStatement(i)&&i.getLabel().getText()===t:lg(i)||r.isBreakStatement(e)&&r.isSwitchStatement(i);let n=e.getFirstAncestor(i=>ie(i)||s(i));if(!(n===void 0||ie(n))){for(;r.isContinueStatement(e)&&r.isLabeledStatement(n);)n=n.getStatement();return n}},Gt=(e,t)=>A(e.getFirstAncestor(s=>A(s,t)||ie(s)),t),dg=(e,t)=>A(e,t)||e.getFirstAncestor(s=>A(s,t))!==void 0,mi=(e,t)=>{if(r.isReturnStatement(e)||r.isThrowStatement(e))return A(e,t)||Gt(e,t);if(r.isBreakStatement(e)||r.isContinueStatement(e)){const s=pi(e);return s!==void 0&&!dg(s,t)}return!1},hi=e=>[...r.isBreakStatement(e)||r.isContinueStatement(e)||r.isReturnStatement(e)||r.isThrowStatement(e)?[e]:[],...e.getDescendantsOfKind(d.BreakStatement),...e.getDescendantsOfKind(d.ContinueStatement),...e.getDescendantsOfKind(d.ReturnStatement),...e.getDescendantsOfKind(d.ThrowStatement)],ug=e=>hi(e).some(t=>mi(t,e)),fg=e=>{const t=r.isCallExpression(e)?e.getExpression():void 0;return r.isPropertyAccessExpression(t)&&t.getName()==="throwIfAborted"},gg=e=>hi(e).some(t=>mi(t,e)||r.isBreakStatement(t)&&A(pi(t),e))||e.getDescendantsOfKind(d.CallExpression).some(t=>fg(t)&&Gt(t,e)),pg=e=>e.getDescendantsOfKind(d.YieldExpression).some(t=>Gt(t,e)),mg=e=>r.isDoStatement(e)||r.isWhileStatement(e)?e.getExpression():e.getCondition(),hg=e=>r.isDoStatement(e)?"do":r.isWhileStatement(e)?"while":"for",vt=(e,t)=>{const s=mg(e);if(!(s===void 0||r.isTrueLiteral(h(s)))||gg(e)||pg(e))return;const i=x(e);if(!(i.kind==="module"&&e.getFirstAncestor(ie)!==void 0))return{file:t,kind:hg(e),line:e.getStartLineNumber(),scope:i}},vg=(e,t)=>[...se(e,t,d.WhileStatement,vt),...se(e,t,d.ForStatement,vt),...se(e,t,d.DoStatement,vt)].toSorted((s,n)=>s.file.localeCompare(n.file)||s.line-n.line),Eg=new Set(["when","where"]),Et=new Set(["definePolicy","defineShape"]),xg=e=>{if(!r.isCallExpression(e))return;const t=e.getExpression();if(r.isPropertyAccessExpression(t)){const n=t.getName();return Et.has(n)?n:void 0}if(!r.isIdentifier(t))return;for(const n of t.getSymbol()?.getDeclarations()??[])if(r.isImportSpecifier(n)){const i=n.getNameNode().getText();return Et.has(i)?i:void 0}const s=t.getText();return Et.has(s)?s:void 0},Sg=e=>r.isObjectLiteralExpression(e)&&e.getProperties().length===0,vi=e=>{if(e!==void 0){if(r.isReturnStatement(e)&&e.getExpression()===void 0||e.getKind()===d.UndefinedKeyword||e.getText()==="undefined")return"undefined";if(Sg(e))return"empty-object";if(r.isParenthesizedExpression(e))return vi(e.getExpression())}},Yt=e=>e.getAncestors().find(t=>r.isArrowFunction(t)||r.isFunctionExpression(t)||r.isFunctionDeclaration(t)),Ag=e=>e.getDescendantsOfKind(d.ReturnStatement).filter(t=>Yt(t)===e),Ei=e=>e.getDescendantsOfKind(d.ConditionalExpression).filter(t=>Yt(t)===e),yg=e=>{const t=Ag(e);return t.length>1?!0:t.some(s=>s.getFirstAncestorByKind(d.IfStatement)!==void 0)||Ei(e).length>0},bg=e=>e.getDescendantsOfKind(d.IfStatement).filter(t=>Yt(t)===e),Dt=e=>e.getKind()===d.NullKeyword||e.getKind()===d.FalseKeyword||r.isIdentifier(e)&&e.getText()==="undefined"?!0:r.isNumericLiteral(e)?e.getLiteralValue()===0:r.isStringLiteral(e)&&e.getLiteralValue()==="",Ng=(e,t)=>Dt(e)||Dt(t),Pg=new Map([[d.EqualsEqualsEqualsToken,"positive"],[d.EqualsEqualsToken,"positive"],[d.ExclamationEqualsEqualsToken,"negative"],[d.ExclamationEqualsToken,"negative"]]),tn=e=>!Dt(e)&&(r.isLiteralExpression(e)||e.getKind()===d.TrueKeyword),wg=(e,t,s)=>{const n=Pg.get(e);if(n!==void 0)return Ng(t,s)?n==="positive"?"negative":"positive":tn(t)||tn(s)?void 0:n},Ee=e=>{if(r.isParenthesizedExpression(e))return Ee(e.getExpression());if(r.isPrefixUnaryExpression(e)&&e.getOperatorToken()===d.ExclamationToken)return"negative";if(r.isBinaryExpression(e)){const t=e.getOperatorToken().getKind(),s=wg(t,e.getLeft(),e.getRight());if(s!==void 0)return s;if(t===d.AmpersandAmpersandToken||t===d.BarBarToken){const n=Ee(e.getLeft()),i=Ee(e.getRight());return n===i?n:"indeterminate"}}return r.isIdentifier(e)||r.isPropertyAccessExpression(e)||r.isElementAccessExpression(e)||r.isCallExpression(e)?"positive":"indeterminate"},sn=e=>{if(e!==void 0){if(r.isReturnStatement(e))return e;if(r.isBlock(e)){const t=e.getStatements().at(-1);return t!==void 0&&r.isReturnStatement(t)?t:void 0}}},Ig=e=>{if(e.getElseStatement()!==void 0)return;const t=e.getNextSiblingIfKind(d.ReturnStatement);return t!==void 0&&t.getNextSibling()===void 0?t:void 0},Cg=e=>r.isReturnStatement(e)?e.getExpression()??e:e,Tg=e=>{const t=[];for(const s of Ei(e)){const n=Ee(s.getCondition());n==="positive"?t.push(s.getWhenFalse()):n==="negative"&&t.push(s.getWhenTrue())}for(const s of bg(e)){const n=Ee(s.getExpression());if(n==="indeterminate")continue;const i=n==="negative"?sn(s.getThenStatement()):sn(s.getElseStatement())??Ig(s);i!==void 0&&t.push(Cg(i))}return t},Og=e=>{for(const t of e.getAncestors())if(r.isVariableDeclaration(t)){const s=t.getNameNode();if(r.isIdentifier(s))return s.getText()}return"<anonymous>"},kg=(e,t,s)=>{if(!r.isCallExpression(e))return[];const[n]=e.getArguments();if(!n||!r.isObjectLiteralExpression(n))return[];const i=[];for(const o of n.getProperties()){if(!r.isPropertyAssignment(o)||!Eg.has(S(o)))continue;const a=o.getInitializer();if(!(!a||!(r.isArrowFunction(a)||r.isFunctionExpression(a)))&&yg(a))for(const c of Tg(a)){const l=vi(c);l!==void 0&&i.push({exportName:Og(e),file:s,form:l,key:S(o),line:c.getStartLineNumber(),owner:t})}}return i},Rg=(e,t)=>{const s=[];for(const n of e.getDescendantsOfKind(d.CallExpression)){const i=xg(n);i!==void 0&&s.push(...kg(n,i,t))}return s},Fg=(e,t)=>{const s=[];for(const n of y(t)){const i=e.getSourceFile(n)??e.addSourceFileAtPath(n);s.push(...Rg(i,I(t,n)))}return s},Dg=new Set(["query","upsert","upsertMany","upsertNow"]),fe=new Set,Lg=e=>{if(!r.isPropertyAccessExpression(e))return;const t=e.getName();if(Dg.has(t))return H(e.getExpression(),["vectors"])?t:void 0},Qt=e=>{let t=e;for(;r.isParenthesizedExpression(t)||r.isAsExpression(t)||r.isSatisfiesExpression(t)||r.isNonNullExpression(t)||r.isTypeAssertion(t);)t=t.getExpression();return t},xi=e=>{const t=e.getParent();return r.isShorthandPropertyAssignment(t)&&t.getNameNode()===e?t.getValueSymbol():e.getSymbol()},Si=e=>xi(e)?.getDeclarations()[0],Mg=e=>{const t=e.getParent();return r.isBindingElement(t)||(r.isPropertyAccessExpression(t)||r.isPropertyAssignment(t)||r.isVariableDeclaration(t)||r.isParameterDeclaration(t)||r.isMethodDeclaration(t))&&t.getNameNode()===e?!1:!r.isQualifiedName(t)||t.getLeft()===e},Ai=e=>{let t=e;for(;t!==void 0&&(r.isBindingElement(t)||r.isObjectBindingPattern(t)||r.isArrayBindingPattern(t));)t=t.getParent();return t!==void 0&&r.isVariableDeclaration(t)?t:void 0},nn=(e,t,s)=>{const n=xi(e)?.compilerSymbol;if(n!==void 0&&t.has(n))return!0;if(s>0){const i=Ai(Si(e)),o=i!==void 0&&r.isVariableDeclaration(i)?i.getInitializer():void 0;if(o!==void 0)return Xt(o,t,s-1)}return W(e)},Xt=(e,t,s)=>{const n=Qt(e);return ae(n)?!1:r.isIdentifier(n)?nn(n,t,s):W(n)?!0:n.getDescendantsOfKind(d.Identifier).some(i=>Mg(i)&&nn(i,t,s))},yi=e=>{const t=Ai(Si(e));return t!==void 0&&r.isVariableDeclaration(t)?t.getInitializer():void 0},Z=(e,t)=>{const s=Qt(e);if(r.isObjectLiteralExpression(s))return[s];if(r.isConditionalExpression(s))return[...Z(s.getWhenTrue(),t),...Z(s.getWhenFalse(),t)];if(r.isBinaryExpression(s)){const n=s.getOperatorToken().getKind();if(n===d.BarBarToken||n===d.QuestionQuestionToken||n===d.AmpersandAmpersandToken)return[...Z(s.getLeft(),t),...Z(s.getRight(),t)]}if(r.isIdentifier(s)&&t){const n=yi(s);return n===void 0?[]:Z(n,!1)}return[]},_g=(e,t)=>{const s=Z(e,t);if(s.length===0)return{replaces:!0,sources:[e]};const n=s.map(o=>We(o,!1)),i=n.flat();if(i.length!==0)return{replaces:n.every(o=>o.length>0),sources:i}},Kg=e=>(r.isPropertyAssignment(e)||r.isShorthandPropertyAssignment(e))&&e.getName()==="namespace",zg=e=>r.isShorthandPropertyAssignment(e)?e.getNameNode():e.getInitializer()??e.getNameNode(),We=(e,t)=>{let s=[];for(const n of e.getProperties())if(r.isSpreadAssignment(n)){const i=_g(n.getExpression(),t);i!==void 0&&(s=i.replaces?i.sources:[...s,...i.sources])}else Kg(n)&&(s=[zg(n)]);return s},Bg=e=>{if(!e||!(r.isArrowFunction(e)||r.isFunctionExpression(e)))return[];const t=e.getBody();return r.isBlock(t)?t.getDescendantsOfKind(d.ReturnStatement).filter(s=>s.getFirstAncestor(n=>r.isFunctionLikeDeclaration(n))===e).flatMap(s=>s.getExpression()??[]):[t]},$g=e=>{if(!e||!(r.isArrowFunction(e)||r.isFunctionExpression(e)))return fe;const t=e.getParameters()[0]?.getNameNode();if(t===void 0)return fe;const s=r.isIdentifier(t)?[t]:t.getDescendantsOfKind(d.BindingElement).map(n=>n.getNameNode());return new Set(s.flatMap(n=>r.isIdentifier(n)?n.getSymbol()?.compilerSymbol??[]:[]))},Lt=(e,t=!0,s=fe)=>{const n=Qt(e);if(r.isIdentifier(n)){const o=t?yi(n):void 0;return o===void 0?[{node:n,parameters:s}]:Lt(o,!1,s)}if(r.isArrayLiteralExpression(n))return n.getElements().flatMap(o=>r.isSpreadElement(o)?Lt(o.getExpression(),t,s):Z(o,!0).flatMap(a=>We(a,!0).map(c=>({node:c,parameters:s}))));const i=r.isCallExpression(n)?n.getExpression():void 0;if(r.isCallExpression(n)&&r.isPropertyAccessExpression(i)&&i.getName()==="map"){const o=n.getArguments()[0],a=Xt(i.getExpression(),fe,1)?$g(o):fe;return Bg(o).flatMap(c=>Z(c,!0).flatMap(l=>We(l,!0).map(u=>({node:u,parameters:a}))))}return[{node:n,parameters:s}]},Vg=(e,t)=>{const s=Lg(e.getExpression());if(s===void 0)return;const n=e.getArguments()[1];if(!(!n||!(s==="upsertMany"?Lt(n):Z(n,!0).flatMap(o=>We(o,!0).map(a=>({node:a,parameters:fe})))).some(({node:o,parameters:a})=>Xt(o,a,1))))return{scope:x(e),file:t,line:e.getStartLineNumber(),method:s}},Ug=(e,t)=>C(e,t,Vg),Wg=(e,t,s)=>{const{callSites:n,containers:i,crons:o,functions:a,modules:c,mutators:l,queues:u,schema:f,shapes:g,wranglerVariables:p,workflows:E}=s;return ir({adminRoutes:ha(e,t),aiRawRuns:Pa(e,t),aiToolSideEffects:Ma(e,t),argumentDerivedFetches:za(e,t),argumentValidators:nc(e,t),authApiCalls:Cr(e,t),authConfigs:gc(e,t),browserUrlAccesses:vc(e,t),callEdges:n.callEdges,configCalls:Pc(e,t),containerKeyAccesses:Ic(e,t),containerOverrides:Fc(e,t),containers:i,countReads:Kc(e,t,f.tables),cronTargets:o.flatMap(V=>V.functionPath===void 0?[]:[V.functionPath]),exportSinks:Vc(e,t),staleMigrationImports:eg(e,t),failOpenGuards:Hc(e,t),flagReads:Jc(e,t),flagSecurityDefaults:sl(e,t),geoIndexUsages:rl(e,t),httpActionGuards:vl(e,t),httpHeaderWrites:Il(e,t),hyperdriveCalls:Tr(e,t),identityClaimReads:Kl(e,t),imageDeliveryUrlAccesses:Bl(e,t),inserts:n.inserts,kvKeyAccesses:Vl(e,t,a),mailRecipientAccesses:Hl(e,t),maskProcedures:Or(e,t),maskStrategies:Ql(e,t),mutatorWrites:sd(e,t),nondeterministicCalls:Lr(e,t),normalizeIdAuthorizations:vd(e,t),notifyCalls:_r(e,t),notifyConfig:Mr(e,t),mutators:l,ownerFieldWrites:fu(e,t,a,l),unrestrictedWhereBranches:Fg(e,t),paymentWebhooks:vu(e,t),privilegedDispatches:Cu(e,t),procedureProtections:ff(e,t),queries:n.queries,queues:u,r2sqlCalls:Kr(e,t),ratelimitKeySelectors:xf(e,t),rawRowReturns:wf(e,t),relationLoads:Tf(e,t),rlsProcedures:zr(e,t),schema:f,secretLiterals:Wf(e,t),modules:c,shapes:g,softDeleteReads:jf(e,t),sqlInterpolations:Xf(e,t),storageKeyAccesses:sg(e,t,a),storageUploads:cg(e,t),tableWrites:n.tableWrites,rowEffects:zf(e,t,n.tableWrites,n.callEdges),unboundedLoops:vg(e,t),vectorNamespaceAccesses:Ug(e,t),workflowCalls:n.workflowCalls,workflows:E,wranglerVariables:p})},qg=e=>({cacheKey:`advisor_accept_unused:${e.rule}:${e.file}:${e.exportName}`,categories:["SCHEMA"],description:"`advisor.accept` in `lunora.config.*` accepts a finding the advisor does not report as an error.",detail:`No ERROR \`${e.rule}\` in \`${e.file}\` for \`${e.exportName}\` — the acceptance no longer applies.`,facing:"INTERNAL",level:"WARN",metadata:{exportName:e.exportName,file:e.file,rule:e.rule},name:"advisor_accept_unused",remediation:"Remove the entry, or correct the rule, file and export name it names.",title:"An accepted advisor finding matches no error"}),jg=(e,t)=>{const s=new Set;return[...e.map(i=>{if(i.level!=="ERROR")return i;const o=t.find(a=>a.rule===i.name&&a.file===i.metadata.file&&a.exportName===i.metadata.exportName);return o===void 0?i:(s.add(o),{...i,detail:`Accepted: ${o.reason}. ${i.detail}`,level:"INFO",metadata:{...i.metadata,accepted:o.reason}})}),...t.filter(i=>!s.has(i)).map(i=>qg(i))]},Hg=()=>({cacheKey:"advisor_accept_invalid",categories:["SCHEMA"],description:"`advisor.accept` in `lunora.config.*` is read by parsing the file, so every entry must be a literal.",detail:"`advisor.accept` is not an array of literal `{ rule, file, exportName, reason }` objects with non-empty strings, so codegen ignored all of it and every ERROR still fails the gate.",facing:"INTERNAL",level:"WARN",metadata:{},name:"advisor_accept_invalid",remediation:'Write `advisor: { accept: [{ rule: "owner_field_from_args_not_auth", file: "lunora/auth/team.ts", exportName: "addTeamMember", reason: "…" }] }` as literals on the config\'s default export.',title:"`advisor.accept` is not a list codegen can read, so no acceptance applies"}),Gg=e=>e.metadata.accepted!==void 0||e.name==="advisor_accept_unused"||e.name==="advisor_accept_invalid",rn={error:"ERROR",info:"INFO",warn:"WARN"},on={ERROR:2,INFO:0,WARN:1},Yg=e=>({cacheKey:"advisor_min_severity_invalid",categories:["SCHEMA"],description:"`advisor.minSeverity` in `lunora.config.*` sets the lowest advisory level codegen reports and writes into `_generated/shard.ts`. Codegen reads it by parsing the file, so it has to be a string literal.",detail:e,facing:"INTERNAL",level:"WARN",metadata:{},name:"advisor_min_severity_invalid",remediation:'Set `advisor: { minSeverity: "info" | "warn" | "error" }` as a literal on the config\'s default export.',title:"`advisor.minSeverity` is not a level codegen can read, so every advisory was reported"}),Qg=(e,t)=>{const{advisor:s}=On(e);if(s===void 0||s.minSeverity===void 0&&s.unreadable!==!0)return[...t];const{minSeverity:n}=s,i=n!==void 0&&Object.hasOwn(rn,n)?rn[n]:void 0;return i===void 0?[...t,Yg(n===void 0?"`advisor.minSeverity` is not a string literal codegen can read without evaluating the config: a computed value or key, or a spread that could set or override it.":`\`advisor.minSeverity\` is "${n}", which is not one of "info", "warn" or "error".`)]:t.filter(o=>Gg(o)||on[o.level]>=on[i])},Xg=(e,t)=>{const{advisor:s}=On(e),n=jg(t,s?.accept??[]);return Qg(e,s?.acceptUnreadable===!0?[...n,Hg()]:n)},Jg={call:"function",enqueue:"queue",invoke:"service",publish:"topic",schedule:"function"},Zg="crons",ep=Hr.replace(/\.ts$/u,""),ue=(e,t)=>`${Ut(e)}:${t}`,xt=(e,t,s)=>t===""?{reason:`the ${s} is not a string literal`}:{to:`${e}:${t}`},tp=e=>[...e.callEdges.map(t=>{const s=t.target===void 0?{reason:t.reason??"unreadable target"}:{to:`${Jg[t.kind]}:${t.target}`};return{file:t.file,kind:t.kind,line:t.line,scope:t.scope,...s}}),...e.queries.map(t=>({file:t.file,kind:"read",line:t.line,scope:t.scope,...xt("table",t.table,"table name")})),...[...e.inserts,...e.tableWrites].map(t=>({file:t.file,kind:"write",line:t.line,scope:t.scope,...xt("table",t.table,"written table")})),...e.workflowCalls.map(t=>({file:t.file,kind:"start",line:t.line,scope:t.scope,...xt("workflow",t.workflow,"workflow name")}))],sp=e=>e.untracked===!0?"inside a helper only code outside any export calls":"inside a non-exported helper",np=e=>{const{scope:t}=e;switch(t.kind){case"export":return[{...e,exportName:t.name}];case"helper":return t.callers.length===0?[{...e,unattributed:sp(t)}]:t.callers.map(s=>({...e,exportName:s}));default:return[{...e,unattributed:"at module scope"}]}},ip=e=>tp(e).flatMap(t=>np(t)),rp=e=>[...e.queues.flatMap(t=>t.topic===void 0?[]:[{file:t.filePath,from:`topic:${t.topic}`,kind:"subscribe",line:0,to:`queue:${t.exportName}`}]),...e.crons.map(t=>{const s=t.workflow===void 0?void 0:`workflow:${t.workflow.exportName}`,n=t.functionPath===void 0?void 0:`function:${t.functionPath}`,i=s??n;return{file:Zg,from:`cron:${t.name}`,kind:"trigger",line:0,...i===void 0?{reason:"the cron has no target"}:{to:i}}})],op=e=>new Map(e.flatMap(t=>t.tables.map(s=>[s,t.name]))),me=(e,t)=>t===void 0?e:{...e,module:t},ap=e=>{const t=new Map,s=new Map,n=op(e.modules),i=(c,l)=>{s.set(c,[...s.get(c)??[],l])},o=(c,l)=>{t.set(c.id,c),l!==void 0&&i(l,c.id)},a=(c,l)=>{c!==void 0&&i(ue(c.file,c.exportName),l)};for(const c of e.functions){const l=ue(c.filePath,c.exportName),u=[...Br(c.filePath),c.exportName].join(".");o(me({detail:c.kind,id:`function:${l}`,kind:"function",name:u},Re(e.modules,c.filePath)),l)}for(const c of e.httpRoutes){const l=ue(c.filePath,c.exportName);o(me({id:`http:${l}`,kind:"http",name:`${c.method} ${c.path}`},Re(e.modules,c.filePath)),l)}for(const c of e.schema.tables)o(me({id:`table:${c.name}`,kind:"table",name:c.name},n.get(c.name)));for(const c of e.queues){const l=c.topic===void 0?{}:{detail:"subscription"};o(me({...l,id:`queue:${c.exportName}`,kind:"queue",name:c.exportName},Re(e.modules,c.filePath)),ue(c.filePath,c.exportName)),a(c.handlerSite,`queue:${c.exportName}`)}for(const c of e.topics)o(me({id:`topic:${c.exportName}`,kind:"topic",name:c.exportName},Re(e.modules,c.filePath)));for(const c of e.workflows)o({id:`workflow:${c.exportName}`,kind:"workflow",name:c.exportName},ue(ep,c.exportName)),a(c.handlerSite,`workflow:${c.exportName}`);for(const c of e.crons)o({detail:c.cron,id:`cron:${c.name}`,kind:"cron",name:c.name});for(const c of e.services){const l=c.rpcEntrypoint===void 0?"fetch":"rpc";o({detail:c.entrypoint===void 0?l:`${l} · ${c.entrypoint}`,id:`service:${c.name}`,kind:"service",name:c.worker})}return{nodes:t,sites:s}},cp=e=>e==="default"?"the default export is not a registered function":`"${e}" is not a registered function`,lp=(e,t)=>"from"in e?[e.from]:"unattributed"in e?{reason:e.unattributed}:t.get(ue(e.file,e.exportName))??{reason:cp(e.exportName)},dp=(e,t,s)=>{if("reason"in e)return{reason:e.reason};const n=lp(e,t);if("reason"in n)return n;const{to:i}=e;return s.has(i)?{drawn:n.map(o=>({from:o,kind:e.kind,to:i}))}:{reason:`${i} is not declared`}},St=e=>`${e.from}|${e.kind}|${e.to}`,up=e=>`${e.file}|${String(e.line)}|${e.kind}|${e.reason}`,fp=e=>{const{nodes:t,sites:s}=ap(e),n=new Map,i=new Map;for(const o of[...rp(e),...ip(e)]){const a=dp(o,s,t);if("drawn"in a)for(const c of a.drawn)n.set(St(c),c);else{const c={file:o.file,kind:o.kind,line:o.line,reason:a.reason};i.set(up(c),c)}}return{edges:[...n.values()].toSorted((o,a)=>St(o).localeCompare(St(a))),nodes:[...t.values()].toSorted((o,a)=>o.id.localeCompare(a.id)),modules:e.modules.map(o=>({...o.description===void 0?{}:{description:o.description},...o.installed===!0?{installed:!0}:{},...o.ownsFolder===!1?{ownsFolder:!1}:{},name:o.name,tables:[...o.tables]})),unresolved:[...i.values()].toSorted((o,a)=>o.file.localeCompare(a.file)||o.line-a.line),version:1}},gp=e=>`${Qr}export const architecture = ${Yr(e,"Record<string, unknown>")};
+`,an=(e,t="api")=>{const s=new Map;for(const n of e){const i=Ut(n),o=s.get(i);if(o===void 0){s.set(i,n);continue}if(o!==n){const a=t==="api"?`the generated api.ts would declare "${i}" twice and the dispatch key "${i}:<fn>" would be ambiguous`:`the generated api.ts would declare "${i}" twice in HttpStreamsRef and again in the httpStreams object literal`;throw new j("INTERNAL",`@lunora/codegen: "${o}" and "${n}" both map to the ${t} namespace "${i}" — ${a}. Rename one file so the two differ by more than a non-identifier character (\`-\`, \`.\`, \`/\` and \`_\` all sanitize to \`_\`).`,{status:500})}}},pp=(e,t={})=>{const{hasVectors:s=!0,scheduler:n=!1,storage:i=!1,usage:o}=t,a=[];e.tables.some(c=>Fn(c))&&a.push({name:"@lunora/d1",reason:"`.global()` tables are D1-backed, so `_generated/app.ts` imports the D1 `ctx.db` adapter"}),e.tables.some(c=>Dn(c))&&a.push({name:"@lunora/hyperdrive",reason:'`.global({ backend: "hyperdrive" })` tables route through `@lunora/hyperdrive/global`'},{name:"@lunora/sql-store",reason:'`.global({ backend: "hyperdrive" })` makes `_generated/app.ts` import the `SqlCtxDbOptions` / `SqlExec` types'}),n&&a.push({name:"@lunora/scheduler",reason:"a declared cron (or `ctx.scheduler` use) makes `_generated/app.ts` import `createScheduler`"}),i&&a.push({name:"@lunora/storage",reason:"a `v.storage()` column, a storage access rule (or `ctx.storage` use) makes `_generated/app.ts` import `createStorage`"}),e.vectorIndexes.length>0&&s&&a.push({name:"@lunora/bindings",reason:"`.vectorize()` indexes make `_generated/shard.ts` import `@lunora/bindings/vectors`"});for(const c of o===void 0?[]:Jr)c.requiredPackage!==void 0&&o?.[c.key]===!0&&a.push({name:c.requiredPackage,reason:`\`ctx.${c.contextProperty??c.key}\` usage makes \`_generated/\` import \`${c.moduleSpecifier}\``});return a.filter((c,l)=>a.findIndex(u=>u.name===c.name)===l)},mp=(e,t,s={})=>{if(t===void 0)return;const n=pp(e,s).filter(o=>!t.has(o.name));if(n.length===0)return;const i=n.map(o=>`  - ${o.name} — ${o.reason}`).join(`
+`);throw new j("INTERNAL",`@lunora/codegen: this schema's generated code imports packages the project does not declare:
+${i}
+
+Install them with your package manager, then re-run codegen.`)},hp="env.ts",vp=e=>{const t=e.getSymbol();if(!t)return e.getText()==="defineEnv";for(const s of t.getDeclarations())if(r.isImportSpecifier(s))return Qe(s.getImportDeclaration().getModuleSpecifierValue())?s.getNameNode().getText()==="defineEnv":!1;return!1},Ep=e=>{const t=e.getSymbol();if(!t)return!1;for(const s of t.getDeclarations()){if(!r.isNamespaceImport(s))continue;const n=s.getFirstAncestorByKind(d.ImportDeclaration);return n!==void 0&&Qe(n.getModuleSpecifierValue())}return!1},xp=e=>{if(r.isIdentifier(e))return vp(e);if(r.isPropertyAccessExpression(e)){const t=e.getExpression();return e.getName()==="defineEnv"&&r.isIdentifier(t)&&Ep(t)}return!1},Sp=e=>{const t=[];for(const s of e.getVariableDeclarations()){const n=s.getInitializer();if(n?.getKind()!==d.CallExpression||!xp(n.getExpression()))continue;const o=s.getNameNode();if(!r.isIdentifier(o)){if(s.getVariableStatement()?.hasExportKeyword()!==!0)continue;throw Ne(o,"defineEnv exports must be plain named exports (no destructuring)")}const a=Pn(s,"member");a!==void 0&&t.push({exportName:a})}return t},Ap=(e,t)=>{const s=v(t,hp);if(!M(s))return;const n=e.getSourceFile(s)??e.addSourceFileAtPath(s),i=Sp(n);if(i.length!==0){if(i.length>1)throw Ne(n,`lunora/env.ts declares ${i.length.toString()} defineEnv() contracts (${i.map(o=>o.exportName).join(", ")}); exactly one is allowed`);return i[0]}},yp={defineLiveStream:"liveStreams",defineRoom:"typedWebSockets",defineWebSocket:"typedWebSockets"},bp=new Set(["allowedHosts","deniedHosts","interceptHttps"]),Np=(e,t)=>{const s=h(t);if(s===void 0||!r.isIdentifier(s))return s;const n=s.getText();return h(e.getDescendantsOfKind(d.VariableDeclaration).find(i=>i.getName()===n)?.getInitializer())},Pp=(e,t)=>e!==void 0&&r.isObjectLiteralExpression(e)&&e.getProperties().some(s=>{if(r.isShorthandPropertyAssignment(s))return t.has(S(s));if(!r.isPropertyAssignment(s)||!t.has(S(s)))return!1;const n=h(s.getInitializer())?.getText();return n!=="false"&&n!=="undefined"}),wp=new Set(["durable"]),Ip=new Set(["rollback"]),bi=e=>{const t=e.getExpression();return r.isPropertyAccessExpression(t)?t.getName():t.getText()},Cp="defineApp",xe="app",cn=(e,t)=>e.getDescendantsOfKind(d.PropertyAssignment).some(s=>S(s)===xe&&s.getInitializer()?.getText()===t)||t===xe&&e.getDescendantsOfKind(d.ShorthandPropertyAssignment).some(s=>S(s)===xe),Tp=e=>{if(e===void 0||!ro.includes(e.getSourceFile().getBaseName()))return!1;if(r.isMethodDeclaration(e))return r.isObjectLiteralExpression(e.getParent())&&S(e)===xe;if(!(r.isArrowFunction(e)||r.isFunctionExpression(e)||r.isFunctionDeclaration(e)))return!1;const t=e.getParent();if(r.isPropertyAssignment(t))return S(t)===xe;if(r.isVariableDeclaration(t))return cn(e.getSourceFile(),t.getName());const s=r.isFunctionDeclaration(e)?e.getName():void 0;return s!==void 0&&cn(e.getSourceFile(),s)},Op="AppBuilder",Ni=e=>{const t=e.getSourceFile();return t.getBaseNameWithoutExtension()==="app"&&t.getDirectory().getBaseName()==="_generated"},kp=e=>{const t=e.getType(),s=(t.getConstraint()??t).getSymbol();return s?.getName()===Op&&s.getDeclarations().some(n=>Ni(n))},Rp=e=>e.getText()===Cp&&(e.getSymbol()?.getDeclarations()??[]).every(t=>r.isImportSpecifier(t)||r.isImportClause(t)||Ni(t)),Pi=(e,t,s=new Set)=>{const n=He(t);if(n===void 0||!r.isIdentifier(n))return!1;if(Rp(n))return!0;const i=n.getText();if(s.has(i))return!1;s.add(i);for(const o of n.getAncestors()){if(r.isParametered(o)&&o.getParameters().some(a=>a.getName()===i))return Tp(o);if(r.isBlock(o)||r.isSourceFile(o)){const a=o.getVariableStatements().flatMap(c=>c.getDeclarations()).find(c=>c.getName()===i);if(a!==void 0)return Pi(e,a.getInitializer(),s)}}return!1},wi=(e,t)=>{const s=Kt(t.getExpression());return s?.member==="deliveryAuthorization"&&(Pi(e,s.object)||kp(s.object))},Fp=new Map([["defineContainer",{keys:bp,signal:"containerEgressPolicy"}],["defineStep",{keys:Ip,signal:"workflowRollback"}],["stream",{keys:wp,signal:"durableStreams"}]]),Dp=(e,t)=>{const s=Fp.get(bi(t));if(s!==void 0)return t.getArguments().some(n=>Pp(Np(e,n),s.keys))?s.signal:void 0},Lp=(e,t)=>yp[bi(t)]??(wi(e,t)?"deliveryAuthorization":void 0),Mp=(e,t,s)=>{const n={containerEgressPolicy:!1,deliveryAuthorization:!1,durableStreams:!1,liveContext:!1,liveStreams:!1,secrets:!1,typedWebSockets:!1,workflowRollback:!1};for(const i of y(t)){const o=e.getSourceFile(i)??e.addSourceFileAtPath(i);if(!n.secrets||!n.liveContext){const a=no(o);n.secrets=n.secrets||a.has("secrets"),n.liveContext=n.liveContext||a.has("live")}for(const a of o.getDescendantsOfKind(d.CallExpression)){const c=Dp(o,a)??Lp(o,a);c!==void 0&&(n[c]=!0)}if(Object.values(n).every(Boolean))break}if(!n.deliveryAuthorization&&s!==void 0){const i=e.getSourceFile(s)??e.addSourceFileAtPath(s);n.deliveryAuthorization=i.getDescendantsOfKind(d.CallExpression).some(o=>wi(i,o))}return n},_p="createWorker",Kp="extend",ln=e=>e!==void 0&&(r.isStringLiteral(e)||r.isNoSubstitutionTemplateLiteral(e))?e.getLiteralValue():void 0,dn=e=>{const t=[],s=ln(R(e,"backupCron"));s!==void 0&&t.push(s);const n=R(e,"crons");if(n===void 0||!r.isObjectLiteralExpression(n))return t;for(const i of n.getProperties()){if(!r.isPropertyAssignment(i)&&!r.isMethodDeclaration(i))continue;const o=ln(i.getNameNode());o!==void 0&&t.push(o)}return t},zp=e=>{const t=N(e.getExpression()),[s]=e.getArguments();if(s===void 0)return[];if(t===_p)return r.isObjectLiteralExpression(s)?dn(s):[];if(t!==Kp||!(r.isArrowFunction(s)||r.isFunctionExpression(s)))return[];const n=Sn(s.getBody());return n===void 0?[]:dn(n)},Bp=(e,t)=>{const s=[];for(const{filePath:n}of je(t)){const i=e.getSourceFile(n)??e.addSourceFileAtPath(n);for(const o of i.getDescendantsOfKind(d.CallExpression))s.push(...zp(o))}return[...new Set(s)]},Ii=e=>{if(e.kind==="id")return e.tableName;if(!(e.kind!=="array"&&e.kind!=="optional"))return e.inner===void 0?void 0:Ii(e.inner)},$p=e=>{const t=new Set(e.tables.map(s=>s.name));return e.tables.some(s=>Object.values(s.shape).some(n=>{const i=Ii(n);return i!==void 0&&t.has(i)}))},Vp=(e,t)=>{const s=new Map,n=new Map;for(const i of e)s.set(i.name,`workflow "${i.exportName}"`),n.set(i.className,`workflow "${i.exportName}"`);for(const i of t){const o=s.get(i.name);if(o!==void 0)throw new j("DUPLICATE_WORKFLOW_NAME",`Duplicate deployed name "${i.name}": produced by both ${o} and agent "${i.exportName}". Workflow and agent names share one account-wide namespace and must be unique together.`,{status:500});const a=n.get(i.className);if(a!==void 0)throw new j("DUPLICATE_WORKFLOW_CLASS",`Duplicate generated class "${i.className}": produced by both ${a} and agent "${i.exportName}". Workflow and agent export names must yield unique generated class names.`,{status:500})}},Up=e=>{const{lunoraDirectory:t,project:s,projectRoot:n,schema:i}=e,o=Rl(s,t),a=Ap(s,t),c=Gr(s,t),{queues:l,topics:u}=ao(s,t),f=lo(n),g=eo(s,t);Vp(c,g);const p=to(s,t),E=uo(s,t),V=so(s,t,c,g),ce=Bp(s,t),P=Mp(s,t,oo(n)),K=co(s,t),$=io(s,t);$.browser=$.browser||K.usesSandboxBrowser;const F=bt(n,e.target),k=fo($,F,{agents:g.length>0,commitOrderedTables:i.tables.some(L=>L.commitOrdered===!0),cronTriggers:V.length>0,crossShardFanout:i.tables.some(L=>Eo(L)),containerEgressPolicy:P.containerEgressPolicy,containerRuntimeScheduling:p.some(L=>L.schedulingPolicy==="durable_object"),containerSandboxTools:p.some(L=>L.sandbox===!0),deliveryAuthorization:P.deliveryAuthorization,durableStreams:P.durableStreams,globalTables:i.tables.some(L=>L.shardMode==="global"),liveContext:P.liveContext,liveStreams:P.liveStreams,typedWebSockets:P.typedWebSockets,queues:l.length>0,relationGraph:$p(i),secrets:P.secrets,services:f.length>0,topics:u.length>0,vectorStore:i.vectorIndexes.length>0,workerLoaders:K.usesSandboxLoader,workflowRollback:P.workflowRollback,workflowSchedules:c.some(L=>L.schedules!==void 0)}),T=k.usage,Q=Zr(T),X=k.signals.vectorStore!==!1,te=k.signals.services===!1?[]:f,J=Ln(n),le=J??new Set,z=le.has("lunorash");mp(i,J,{hasVectors:X,scheduler:T.scheduler||V.length>0,storage:T.storage||E.rules.length>0||Object.keys(Mn(i)).length>0,usage:T});const b=M(v(t,"flags.ts")),O=M(v(t,"notify.ts"));return{agents:g,capabilities:Q,containers:p,crons:V,dataModelContent:yo(i),declaredDependencies:J,dependencies:le,entryCronTriggers:ce,env:a,featureUsage:T,hasFlags:b,hasNotify:O,identity:o,platformGate:{...k,diagnostics:[...go(n,e.target),...k.diagnostics,...po(F,i.vectorIndexes),...P.liveStreams&&P.deliveryAuthorization?[mo(F)]:[]]},queues:l,serverContent:So({agents:g,capabilities:Q,containers:p,env:a,hasVectors:X,hasFlags:b,hasNotify:O,identity:o,queues:l,schema:i,services:te,storageRuleBuckets:E.rules.map(L=>L.bucket),topics:u,useUmbrella:z,workflows:c}),services:te,storageRulesMetadata:E,topics:u,usesSandbox:K.usesSandboxBrowser||K.usesSandboxContainer||K.usesSandboxFs,useUmbrella:z,workflows:c}},Ci=(e,t)=>{if(!r.isPropertyAccessExpression(e))return;const s=e.getExpression();if(!r.isPropertyAccessExpression(s))return;const n=s.getExpression();return r.isPropertyAccessExpression(n)&&n.getName()===t?s.getName():void 0},Wp=e=>{if(!r.isPropertyAccessExpression(e))return!1;const t=e.getExpression();return r.isPropertyAccessExpression(t)&&t.getName()==="scheduler"||r.isIdentifier(t)&&t.getText()==="scheduler"},qp=new Map([["publish",{kind:"publish",surface:"topics"}],["publishBatch",{kind:"publish",surface:"topics"}],["send",{kind:"enqueue",surface:"queues"}],["sendBatch",{kind:"enqueue",surface:"queues"}]]),jp=/^[\w$]+:[\w$]+$/u,Hp=(e,t)=>{const s=Nn(t);return s!==void 0?{kind:"call",target:s}:e!=="run"&&t!==void 0?{kind:"call",reason:'the function reference is not a static api.* / internal.* chain or a "namespace:export" key'}:void 0},un=e=>{const t=[];for(const s of e.getProperties()){if(!r.isPropertyAssignment(s)&&!r.isShorthandPropertyAssignment(s))return;t.push(s.getName())}return t},Gp=e=>{if(e===void 0)return[];if(r.isObjectLiteralExpression(e))return un(e);if(r.isIdentifier(e)){const t=e.getSymbol()?.getDeclarations()[0];if(r.isVariableDeclaration(t)&&t.getVariableStatement()?.getDeclarationKind()===or.Const){const s=t.getInitializer();return r.isObjectLiteralExpression(s)?un(s):void 0}}},Yp=(e,t,s)=>({schedule:{argKeys:Gp(s),...e==="runAfter"&&t!==void 0&&r.isNumericLiteral(t)?{delayMs:t.getLiteralValue()}:{}}}),Qp=e=>{const t=e.getExpression();if(!r.isPropertyAccessExpression(t))return;const s=t.getName(),[n,i,o]=e.getArguments();if(bn.has(s))return Hp(s,n);if((s==="runAfter"||s==="runAt")&&Wp(t)){const l=Nn(i)??(r.isStringLiteral(i)&&jp.test(i.getLiteralText())?i.getLiteralText():void 0);return l===void 0?{kind:"schedule",reason:'the scheduled function is not a static api.* / internal.* chain or a "namespace:export" key'}:{kind:"schedule",target:l,...Yp(s,n,o)}}const a=qp.get(s),c=a===void 0?void 0:Ci(t,a.surface);return a===void 0||c===void 0?void 0:{kind:a.kind,target:c}},Xp=new Set([d.AmpersandAmpersandEqualsToken,d.AmpersandAmpersandToken,d.BarBarEqualsToken,d.BarBarToken,d.QuestionQuestionEqualsToken,d.QuestionQuestionToken]),Ti=e=>rr.isOptionalChain(e.compilerNode),Jp=(e,t)=>r.isIfStatement(t)?!A(e,t.getExpression()):r.isWhileStatement(t)||r.isForInStatement(t)||r.isForOfStatement(t)?A(e,t.getStatement()):r.isForStatement(t)?A(e,t.getStatement())||A(t.getIncrementor(),e):r.isCaseClause(t)||r.isDefaultClause(t)||r.isCatchClause(t)?!0:ie(t)?t.getFirstAncestor(ie)!==void 0:r.isConditionalExpression(t)?!A(e,t.getCondition()):r.isBinaryExpression(t)?!A(e,t.getLeft())&&Xp.has(t.getOperatorToken().getKind()):(r.isCallExpression(t)||r.isElementAccessExpression(t))&&Ti(t)?!A(e,t.getExpression()):r.isBlock(t)&&t.getStatements().some(s=>s.getEnd()<=e.getStart()&&ug(s)),Zp=e=>{let t=e,s=e.getParent();for(;s!==void 0&&(r.isAwaitExpression(s)||r.isParenthesizedExpression(s));)t=s,s=s.getParent();const n=r.isVariableDeclaration(s)||r.isBinaryExpression(s)&&A(t,s.getRight())&&s.getOperatorToken().getKind()===d.EqualsToken,i=e.getFirstAncestor(ie);return n||i?.getDescendantsOfKind(d.ThrowStatement).some(o=>o.getStart()>=e.getEnd()&&A(o.getFirstAncestor(ie),i))===!0},em=(e,t)=>(r.isWhileStatement(t)||r.isForInStatement(t)||r.isForOfStatement(t))&&A(e,t.getStatement())||r.isForStatement(t)&&(A(e,t.getStatement())||A(t.getIncrementor(),e)),tm=(e,t)=>{if(Ti(e)||t==="schedule"&&Zp(e))return"guard";let s=e,n=!1;for(let i=s.getParent();i!==void 0&&!r.isSourceFile(i);i=i.getParent()){if(Jp(s,i)){if(!em(s,i))return"guard";n=!0}s=i}return n?"loop":void 0},fn=(e,t,s)=>{if(s===void 0)return;const n=tm(e,s.kind);return{...s,...n===void 0?{}:{conditional:!0},...n==="loop"?{loopOnly:!0}:{},file:t,line:e.getStartLineNumber(),scope:x(e)}},sm=(e,t)=>[...C(e,t,(s,n)=>fn(s,n,Qp(s))),...se(e,t,d.PropertyAccessExpression,(s,n)=>{const i=Ci(s,"services");return fn(s,n,i===void 0?void 0:{kind:"invoke",target:i})})],nm=new Set(["boolean","number","object","string"]),im=e=>{const t=e.getName();if(!nm.has(t))return;const s=e.getExpression();return H(s,["flags"])||H(s,["flags","details"])?t:void 0},rm=e=>{const t=e.getExpression();if(!r.isPropertyAccessExpression(t))return;const s=im(t);if(s===void 0)return;const n=e.getArguments()[0];if(!n||!(r.isStringLiteral(n)||r.isNoSubstitutionTemplateLiteral(n)))return;const i=n.getLiteralValue();return i.length>0?{key:i,type:s}:void 0},om=(e,t)=>{const s=new Map;for(const n of y(t)){const i=e.getSourceFile(n)??e.addSourceFileAtPath(n);for(const o of i.getDescendantsOfKind(d.CallExpression)){const a=rm(o);a&&!s.has(a.key)&&s.set(a.key,a.type)}}return[...s.entries()].map(([n,i])=>({key:n,type:i})).toSorted((n,i)=>n.key.localeCompare(i.key))},am=e=>{const t=e.getType().getProperty("~standard");if(!t)return;const s=t.getTypeAtLocation(e).getProperty("types");if(!s)return;const n=s.getTypeAtLocation(e).getNonNullableType().getProperty("output");if(!n)return;const i=n.getTypeAtLocation(e),o=i.getText(e);if(!o||o==="any"||o==="never"||bo(o))return;const a=e.getSourceFile().getFilePath();if(No(i,e,a)){const c=Po(i,e,a,0,new Set);return c===void 0&&wo(o),c}return o},cm=e=>e.getProperties().some(t=>{if(r.isSpreadAssignment(t))return!0;const s=Nr(t.getNameNode());return s===void 0||s==="namespace"}),lm=(e,t)=>{for(const{filePath:s}of je(t)){const n=e.getSourceFile(s)??e.addSourceFileAtPath(s);for(const i of n.getDescendantsOfKind(d.CallExpression)){const o=i.getExpression(),[a]=i.getArguments();if(!(!r.isPropertyAccessExpression(o)||o.getName()!=="auth"||a===void 0)&&(!r.isObjectLiteralExpression(a)||cm(a)))return i}}},dm="https://lunora.sh/docs/concepts/data-residency#pinning-auth-and-voice",um=(e,t)=>{if(!(e.jurisdiction===void 0||e.jurisdictionPinsAuth===!0||t===void 0))throw Ne(t,`the schema pins Durable Objects to the "${e.jurisdiction}" jurisdiction, and this project also has DO-backed auth (users, sessions, accounts, credentials). Pinning the auth object resolves it to a NEW, EMPTY object: existing users stay in the unpinned one until you copy them across (${dm}). Acknowledge with \`.jurisdiction("${e.jurisdiction}", { pinAuth: true })\`, deploy, then run the copy. For D1-mode auth the acknowledgement changes nothing.`,{code:"JURISDICTION_MOVE",status:422})},fm=e=>r.isPropertyAssignment(e)||r.isMethodDeclaration(e)||r.isGetAccessorDeclaration(e)?r.isComputedPropertyName(e.getNameNode()):!1,gm=e=>r.isPropertyAssignment(e)||r.isShorthandPropertyAssignment(e)||r.isMethodDeclaration(e)||r.isGetAccessorDeclaration(e)?fm(e):!0,Oi=(e,t=!1)=>{for(const s of e.getProperties()){if(gm(s))return!0;if(t)continue;if(!r.isPropertyAssignment(s))return!0;const n=s.getInitializer();if(!n||!r.isObjectLiteralExpression(n)||Oi(n,!0))return!0}return!1},pm=(e,t)=>{for(const s of y(t)){const n=e.getSourceFile(s)??e.addSourceFileAtPath(s);for(const{receiver:i}of _n(n))for(const o of Vt(i)){const a=o.getArguments()[0];if(a!==void 0&&(!r.isObjectLiteralExpression(a)||Oi(a)))return!0}}return!1},mm=e=>{const t=e.getArguments()[0];if(!t||!r.isObjectLiteralExpression(t))return[];const s=[];for(const n of t.getProperties()){const i=ze(n);if(i===void 0||!r.isPropertyAssignment(n))continue;const o=n.getInitializer();if(!(!o||!r.isObjectLiteralExpression(o)))for(const a of o.getProperties()){const c=ze(a);c!==void 0&&s.push({column:c,strategy:Rn(a),table:i})}}return s},hm=(e,t)=>{const s=new Map;for(const n of y(t)){const i=e.getSourceFile(n)??e.addSourceFileAtPath(n);for(const{receiver:o}of _n(i))for(const a of Vt(o))for(const c of mm(a)){const l=`${c.table}\0${c.column}`;s.has(l)||s.set(l,c)}}return{columns:[...s.values()]}},vm=["providerSubscriptionId","state"],Em=["providerEventId","processedAt"],gn=(e,t)=>t.every(s=>s in e.shape),xm=e=>{const t=e.find(n=>n.name==="payment_subscriptions"),s=e.find(n=>n.name==="payment_events");return t!==void 0&&s!==void 0&&gn(t,vm)&&gn(s,Em)},Sm=["account","apikey","member","passkey","session","teamMember","twoFactor","user"],Am=(e,t)=>{const s={};for(const[n,i]of e)s[n]={dataset:i};for(const[n,i]of t)s[n]={excluded:i};return s},ym=(e,t)=>{const s=[];for(const n of e){const i=t[n];i===void 0?s.push({code:"unclassified",table:n}):"excluded"in i&&i.excluded.trim()===""&&s.push({code:"excluded_without_reason",table:n})}return s},bm="@lunora/privacy",ki="userId",Nm=e=>e.replaceAll("\\","/"),Pm="privacy",wm=new Set(["actionCacheDataset","authDataset","documentHistoryDataset"]),Ze=e=>e!==void 0&&(r.isStringLiteral(e)||r.isNoSubstitutionTemplateLiteral(e))?e.getLiteralText():void 0,et=e=>r.isPropertyAssignment(e)?e.getName().replaceAll(/^["']|["']$/gu,""):"",Jt=e=>e.getProperties().filter(t=>r.isPropertyAssignment(t)),Im=(e,t)=>{const s=e.getProperty(t),n=r.isPropertyAssignment(s)?s.getInitializer():void 0;return n!==void 0&&r.isObjectLiteralExpression(n)?n:void 0},tt=e=>{const t=e.getExpression();return r.isIdentifier(t)?t.getText():void 0},Cm=(e,t)=>{const s=e.getArguments()[1];if(s===void 0||!r.isObjectLiteralExpression(s))return;const n=Im(s,"tables"),i=Ze(e.getArguments()[0])??"defineDataset";for(const o of n===void 0?[]:Jt(n).map(a=>et(a)))t.datasets.set(o,i)},Tm=(e,t)=>{const s=e.getArguments()[0],n=s!==void 0&&r.isObjectLiteralExpression(s)?Jt(s):[],i=new Set(n.map(o=>et(o)));for(const o of Sm)i.has(o)||t.datasets.set(o,"authDataset");for(const o of n){const a=r.isPropertyAssignment(o)?Ze(o.getInitializer()):void 0;a!==void 0&&t.datasets.set(a,"authDataset")}},pn=(e,t,s)=>{t.datasets.set(Ze(e.getArguments()[0])??s,s)},Zt=8,be=(e,t=0)=>{if(t>Zt)return;if(r.isAsExpression(e)||r.isSatisfiesExpression(e)||r.isParenthesizedExpression(e))return be(e.getExpression(),t+1);if(!r.isIdentifier(e))return e;const s=e.getSymbol(),n=(s?.isAlias()===!0?s.getAliasedSymbol():s)?.getValueDeclaration(),i=r.isVariableDeclaration(n)?n.getInitializer():void 0;return i===void 0?void 0:be(i,t+1)},Om=e=>{if(r.isPropertyAssignment(e)){const t=e.getInitializer();return t===void 0?void 0:[et(e),t]}if(r.isShorthandPropertyAssignment(e)){const t=e.getValueSymbol(),s=(t?.isAlias()===!0?t.getAliasedSymbol():t)?.getValueDeclaration(),n=r.isVariableDeclaration(s)?s.getInitializer():void 0;return[e.getName(),n??e.getNameNode()]}},Ri=(e,t=0)=>{const s=be(e,t);if(s===void 0||!r.isObjectLiteralExpression(s)||t>Zt)return;const n=new Map;for(const i of s.getProperties()){const o=r.isSpreadAssignment(i)?Ri(i.getExpression(),t+1):[Om(i)];if(o===void 0)return;for(const a of o)a!==void 0&&n.set(a[0],a[1])}return n},km=e=>{const t=e.getArguments()[0];return t===void 0?void 0:Ri(t)},Rm=(e,t)=>{const s=e?.get("exclude"),n=s===void 0?void 0:be(s);for(const i of n!==void 0&&r.isObjectLiteralExpression(n)?Jt(n):[])t.excluded.set(et(i),r.isPropertyAssignment(i)?Ze(i.getInitializer())??"":"")},Fm=(e,t)=>{switch(tt(e)){case"actionCacheDataset":{pn(e,t,"actionCache");break}case"authDataset":{Tm(e,t);break}case"defineDataset":{Cm(e,t);break}case"documentHistoryDataset":{pn(e,t,"documentHistory");break}}},es=e=>e!==void 0&&r.isCallExpression(e)&&tt(e)==="defineDataset",Fi=e=>e!==void 0&&r.isCallExpression(e)&&wm.has(tt(e)??""),Dm=e=>{const t=e.getSymbol(),n=(t?.isAlias()===!0?t.getAliasedSymbol():t)?.getValueDeclaration(),i=r.isVariableDeclaration(n)?n.getInitializer():void 0;return r.isVariableDeclaration(n)&&(es(i)||Fi(i))?n:void 0},Di=(e,t,s=0)=>{const n=be(e,s);if(n===void 0||!r.isArrayLiteralExpression(n)||s>Zt)return!1;for(const i of n.getElements())if(r.isSpreadElement(i)){if(!Di(i.getExpression(),t,s+1))return!1}else if(!es(i)&&!Fi(i)){const o=r.isIdentifier(i)?Dm(i):void 0;if(o===void 0)return!1;t.add(o)}return!0},Lm=e=>{if(e===void 0)return;const t=e.get("datasets"),s=new Set;return t===void 0||Di(t,s)?s:void 0},Mm=(e,t)=>{const s=[];for(const i of e.getDescendantsOfKind(d.CallExpression))if(Fm(i,t),tt(i)==="definePrivacy"){const o=km(i);Rm(o,t),s.push({location:`${e.getFilePath()}:${String(i.getStartLineNumber())}`,passed:Lm(o)})}return{declared:e.getDescendantsOfKind(d.VariableDeclaration).filter(i=>es(i.getInitializer())).map(i=>({declaration:i,name:i.getName()})),privacyCalls:s}},_m=(e,t)=>{const s=v(t,"schema.ts"),n=[...y(t),...M(s)?[s]:[]];for(const o of n)e.getSourceFile(o)===void 0&&e.addSourceFileAtPath(o);const i=new Set(n.map(o=>Nm(o)));return e.getSourceFiles().filter(o=>i.has(o.getFilePath()))},Km=(e,t,s)=>{if(s?.has(bm)!==!0)return{classifications:{},enabled:!1,unusedDatasets:[]};const n={datasets:new Map,excluded:new Map},i=[],o=[];for(const f of _m(e,t)){const g=Mm(f,n);i.push(...g.declared),o.push(...g.privacyCalls)}const a=new Set;for(const f of o){for(const g of f.passed??[])a.add(g);f.passed===void 0&&console.warn(`@lunora/codegen: privacy_datasets_unresolved: the definePrivacy call at ${f.location} passes datasets codegen cannot read, so a defineDataset it leaves out is not reported. Pass an array of dataset constants, directly or through a spread of a config object literal.`)}const l=o.every(f=>f.passed!==void 0)?i.filter(f=>!a.has(f.declaration)).map(f=>f.name):[];return{classifications:Am(n.datasets,n.excluded),enabled:o.length>0,unusedDatasets:l}},zm=e=>e.extensionKey!==Pm&&ki in e.shape,Bm=e=>e.code==="excluded_without_reason"?`privacy_exclusion_unexplained: "${e.table}" is excluded without a reason. Give one in definePrivacy({ exclude }).`:`privacy_table_unclassified: "${e.table}" holds user data (it has a "${ki}" column) but no dataset exports it. Add it to a defineDataset, or exclude it in definePrivacy({ exclude }) with a reason.`,$m=(e,t)=>{if(!t.enabled)return;const s=e.filter(o=>zm(o)).map(o=>o.name),[n]=ym(s,t.classifications);if(n!==void 0)throw new j("PRIVACY_COVERAGE",Bm(n));const[i]=t.unusedDatasets;if(i!==void 0)throw new j("PRIVACY_COVERAGE",`privacy_dataset_unused: "${i}" is declared with defineDataset but never passed to definePrivacy({ datasets }). Pass it, or delete it.`)},Vm=(e,t)=>{const s=ho(t.target);return{...s===void 0?{}:{platform:s},analytics:e.analytics||t.dependencies.has("@lunora/bindings"),auth:t.dependencies.has("@lunora/auth"),containers:e.container||t.containerCount>0||t.dependencies.has("@lunora/container"),flags:e.flags||t.dependencies.has("@lunora/flags"),kv:e.kv||t.dependencies.has("@lunora/bindings"),mail:e.mail||t.dependencies.has("@lunora/mail"),notifications:e.notify||t.dependencies.has("@lunora/notify"),payments:e.payments||t.hasPaymentTables,privacy:t.dependencies.has("@lunora/privacy"),queues:t.queueCount>0||t.dependencies.has("@lunora/queue"),scheduler:e.scheduler||t.cronCount>0||t.dependencies.has("@lunora/scheduler"),storage:e.storage||t.storageRuleCount>0||t.storageColumnCount>0||t.dependencies.has("@lunora/storage"),vectors:t.vectorStoreSupported&&t.vectorIndexCount>0,workflows:e.workflows||t.workflowCount>0||t.dependencies.has("@lunora/workflow")}},Um=new Set(["delete","hardDelete","patch","replace","restore"]),Wm=new Set(["insertMany","insertManyUnsafe","patchIf","patchWhere"]),qm=new Set(["delete","deleteMany","hardDelete","insert","insertMany","patch","patchMany","replace","restore","upsert","upsertMany"]),mn=(e,t)=>{const s=e.getNonNullableType().getProperty("__table")?.getTypeAtLocation(t);if(s===void 0)return[];const n=s.isUnion()?s.getUnionTypes():[s],i=n.map(o=>o.getLiteralValue()).filter(o=>typeof o=="string");return i.length===n.length?i:[]},jm=(e,t)=>{const s=e.getType();if(t==="deleteMany"||t==="patchMany"){const n=s.getArrayElementType();if(n===void 0)return[];const i=t==="patchMany"?n.getProperty("id")?.getTypeAtLocation(e):n;return i===void 0?[]:mn(i,e)}return mn(s,e)},hn="",Hm=(e,t)=>{if(t!=="patch"&&t!=="patchMany")return;const s=e.getArguments()[1];if(s===void 0||!r.isObjectLiteralExpression(s))return;const n=[];for(const i of s.getProperties()){if(!r.isPropertyAssignment(i)&&!r.isShorthandPropertyAssignment(i))return;n.push(i.getName())}return n},Gm=(e,t)=>{if(Wm.has(e))return{method:e,tables:[t!==void 0&&r.isStringLiteral(t)?t.getLiteralText():hn]};if(Um.has(e)||e==="deleteMany"||e==="patchMany"){const s=t===void 0?[]:jm(t,e);return{method:e,tables:s.length===0?[hn]:s}}},vn=(e,t)=>e===void 0?void 0:{...e,fields:Hm(t,e.method)},Ym=e=>{const t=e.getExpression();if(!r.isPropertyAccessExpression(t))return;const s=t.getName(),n=t.getExpression();if(_(n))return vn(Gm(s,e.getArguments()[0]),e);if(qm.has(s)&&r.isPropertyAccessExpression(n)&&_(n.getExpression()))return vn({method:s,tables:[n.getName()]},e)},Qm=(e,t)=>C(e,t,(s,n)=>{const i=Ym(s);if(i===void 0)return;const o=x(s),a=s.getStartLineNumber();return i.tables.map(c=>({...i.fields===void 0?{}:{fields:i.fields},file:n,line:a,method:i.method,scope:o,table:c}))}),Xm=(e,t,s)=>({cacheKey:`procedure_arguments_unreadable:${e}:${t}`,categories:["SCHEMA"],description:"Codegen reads an argument record statically. One built at runtime — a factory call, or a property off a value it cannot follow — has no literal to read, so the generated `FunctionReference` carries only the arguments it could see while the runtime validator still enforces all of them.",detail:`\`${t}\` in \`${e}\` (line ${s.toString()}) declares arguments codegen could not read, so its generated type is missing some of them.`,facing:"INTERNAL",level:"WARN",metadata:{exportName:t,filePath:e,line:s},name:"procedure_arguments_unreadable",remediation:`Declare the arguments as an object literal, or as a \`const\` object literal the chain names — \`const ${t}Args = { … };\` then \`.input(${t}Args)\`. Both resolve; a record returned by a call does not.`,title:"Procedure arguments are missing from the generated type"}),Jm=(e,t)=>{if(t===void 0){const s=e.getArguments()[0];if(s===void 0||!r.isObjectLiteralExpression(s)||B(s,"args")===void 0)return!1}return qt(e,t).opaque},Zm=(e,t)=>{const s=[],n=(i,o)=>{const a=i.getInitializer();if(a===void 0||!r.isCallExpression(a))return;const c=ee(a);c!==void 0&&Jm(a,c.receiver)&&s.push(Xm(t,o,a.getStartLineNumber()))};for(const i of e.getVariableStatements().filter(o=>o.isExported()))for(const o of i.getDeclarations())n(o,o.getName());return s},eh=(e,t)=>{const s=[];for(const n of y(t)){const i=e.getSourceFile(n);i!==void 0&&s.push(...Zm(i,I(t,n)))}return s.toSorted((n,i)=>n.cacheKey.localeCompare(i.cacheKey))},th=new Map([["AgentDefinition",{call:"defineAgent({ … })",file:"agents"}],["ContainerDefinition",{call:"defineContainer({ … })",file:"containers"}],["QueueDefinition",{call:"defineQueue({ … })",file:"queues",note:"A dropped queue has no caller to fail — its consumer is simply never wired."}],["RegisteredAction",{call:"action.input({ … }).action(handler)"}],["RegisteredLifecycleHook",{call:"onConnect(handler)",note:"Substitute the hook you called: `onConnect`, `onDisconnect` and `onShardInit` share one type, so codegen cannot tell which you wrote. A dropped hook has no caller to fail — it silently never fires."}],["RegisteredMigration",{call:"defineMigration({ … })",note:"A dropped migration never runs, so `lunora migrate up` reports nothing to do."}],["RegisteredMutation",{call:"mutation.input({ … }).mutation(handler)"}],["RegisteredMutator",{call:"defineMutator({ … })",file:"mutators"}],["RegisteredQuery",{call:"query.input({ … }).query(handler)"}],["RegisteredReactor",{call:"onQueryChange(select, handler)",note:"A dropped reactor has no caller to fail — it silently never runs."}],["RegisteredRoom",{call:"defineRoom({ … })",note:"A dropped room has no caller to fail — its whisper topic is never wired to a handler, so joins, messages and broadcasts are silently ignored."}],["RegisteredShape",{call:"defineShape({ … })",file:"shapes"}],["RegisteredStream",{call:"query.input({ … }).stream(handler)"}],["RegisteredWhisperAuthorizer",{call:"onWhisper(handler)",note:"A dropped authorizer has no caller to fail — the whisper topics it was meant to gate silently stay open to every socket on the shard."}],["SubscriptionDefinition",{call:"defineSubscription(topic, { … })",file:"queues",note:"A dropped subscription is never published to — its topic's messages simply never reach it."}],["WorkflowDefinition",{call:"defineWorkflow({ … })",file:"workflows"}]]),qe=({byName:e,byPath:t},s,n)=>t.has(`${s}:${n}`)||e.has(n),Li=e=>!e.isAny(),Mi=e=>{const t=e.getType();if(!Li(t))return;const s=t.getAliasSymbol()?.getName()??t.getSymbol()?.getName(),n=s===void 0?void 0:th.get(s);return n===void 0||s===void 0?void 0:{...n,typeName:s}},sh=e=>{const t=e.getInitializer();return t===void 0?!1:r.isCallExpression(t)||r.isIdentifier(t)||r.isPropertyAccessExpression(t)},_i={cause:"codegen recognises a registration only when the initializer is the registering call itself, and this one comes from a factory or an alias",remediation:"A factory that returns a registration cannot be read statically — inline it, or export what the factory builds."},nh=e=>({cause:`codegen reads this kind of registration only from \`lunora/${e}.ts\`, and this is a different module`,remediation:`Move it into \`lunora/${e}.ts\` — the declaration itself is fine.`}),ih={cause:"it is exported only under a string name that is not an identifier, which the generated `api.ts` and dispatch table cannot address as `<module>.<name>`",remediation:"Export it under an identifier name as well (or instead)."},rh=new Set(["AgentDefinition","ContainerDefinition","QueueDefinition","RegisteredShape","SubscriptionDefinition","WorkflowDefinition"]),oh={cause:"it is exported only as `default` or under a reserved word, and this kind's name becomes an import binding and a generated class / binding name, where that is a syntax error",remediation:"Export it under a plain identifier: `export const <name> = …` (an extra `export default <name>` is fine)."},ah=(e,t,s)=>{if(!t.some(i=>hr(i)))return ih;const n=e.getVariableStatement()?.hasExportKeyword()===!0;return rh.has(s.typeName)&&!n&&!t.some(i=>_o(i))?oh:_i},Ki=(e,t,s,n,i)=>{const{call:o,file:a,note:c,typeName:l}=s,u=a!==void 0&&e!==a?a:void 0,f=u===void 0?i:nh(u),g=c===void 0?f.remediation:`${c} ${f.remediation}`;return{cacheKey:`procedure_not_registered:${e}:${t}`,categories:["SCHEMA"],description:"Codegen registers an export only when its initializer is literally the registering call and the module exports it under an identifier name — by the `export` keyword, a local `export { … }`, or `export default`. Written any other way it exists at runtime but never reaches the generated output — `_generated/api.ts` for a procedure, the lifecycle manifest for a hook or reactor — so a caller cannot address it and a hook never fires.",detail:`\`${t}\` in \`${e}\` (line ${n.toString()}) has type \`${l}\` but was not registered — ${f.cause}.`,facing:"INTERNAL",level:"WARN",metadata:{exportName:t,filePath:e,line:n,typeName:l},name:"procedure_not_registered",remediation:u===void 0?`Assign the registration directly: \`export const ${t} = ${o};\`. ${g}`:g,title:"Procedure exists at runtime but is missing from the generated API"}},ch=(e,t,s)=>{const n=[];for(const i of Y(e)){const o=r.isIdentifier(i.getNameNode())?yt(i):[i.getName()],c=o.some(u=>qe(s,t,u))||!sh(i)?void 0:Mi(i),[l=i.getName()]=o;c!==void 0&&n.push(Ki(t,l,c,i.getStartLineNumber(),ah(i,o,c)))}return n},lh=(e,t,s)=>{if(qe(s,t,"default"))return[];const n=[];for(const i of e.getExportAssignments().filter(o=>!o.isExportEquals()&&!r.isIdentifier(o.getExpression()))){const o=Mi(i.getExpression());o!==void 0&&n.push(Ki(t,"default",o,i.getStartLineNumber(),_i))}return n},dh=(e,t,s)=>[...ch(e,t,s),...lh(e,t,s)],uh=(e,t,s)=>e.getVariableStatements().flatMap(n=>n.getDeclarations()).filter(n=>r.isIdentifier(n.getNameNode())).filter(n=>yt(n).some(i=>qe(s,t,i))).filter(n=>{const i=n.getInitializer();return i!==void 0&&r.isCallExpression(i)&&r.isPropertyAccessExpression(i.getExpression())}).map(n=>{const i=yt(n).find(o=>qe(s,t,o))??n.getName();return{declaration:n,exportName:i,relativePath:t}}),fh=({exportName:e,relativePath:t})=>({cacheKey:"procedure_type_check_unavailable",categories:["SCHEMA"],description:"Codegen cross-checks every export in `lunora/` against its TYPE to catch a procedure the syntactic scan dropped — a factory-assigned export, an alias, a separate `export { … }`. That check needs the type checker to resolve `@lunora/server`; when it cannot, the check reports nothing regardless of what the code does.",detail:`Type resolution for \`lunora/\` is unavailable — the registered procedure \`${e}\` in \`${t}\` types as \`any\`, as does every other one — so codegen cannot tell you when an export is dropped from \`_generated/api.ts\`. A dropped procedure will surface as \`Property '<name>' does not exist\` at its call site instead.`,facing:"INTERNAL",level:"WARN",metadata:{exportName:e,filePath:t},name:"procedure_type_check_unavailable",remediation:`Check what codegen sees: \`${e}\` should have a procedure type, not \`any\`. It needs a \`tsconfig.json\` at or above \`lunora/\` — the one codegen finds walking up from there, which is not necessarily the one your editor uses — resolving \`lunorash\` / \`@lunora/server\` to declarations that exist on disk (a workspace dependency has to be built first).`,title:"Codegen cannot type-check `lunora/`, so dropped procedures go unreported"}),gh=(e,t,s)=>{const n=[],i=[];for(const a of y(t)){const c=e.getSourceFile(a);if(c===void 0)continue;const l=I(t,a);n.push(...dh(c,l,s)),i.push(...uh(c,l,s))}const[o]=i;return o!==void 0&&i.every(({declaration:a})=>!Li(a.getType()))&&n.push(fh(o)),n.toSorted((a,c)=>a.cacheKey.localeCompare(c.cacheKey))},ph=e=>{const t=e.getExpression();if(!r.isPropertyAccessExpression(t)||t.getName()!=="get")return!1;const s=t.getExpression();return r.isPropertyAccessExpression(s)?s.getName()==="workflows":r.isIdentifier(s)&&s.getText()==="workflows"},mh=e=>{const t=e.getArguments()[0];return t&&r.isStringLiteral(t)?t.getLiteralText():""},hh=(e,t)=>C(e,t,(s,n)=>ph(s)?{file:n,line:s.getStartLineNumber(),scope:x(s),workflow:mh(s)}:void 0),Pe=(e,t)=>{M(e)&&er(e,"utf8")===t||tr(e,t,"utf8")},vh=(e,t)=>{if(t===""){Se(e,{force:!0});return}Pe(e,t)},Eh=(e,t)=>{const s=v(e,"services");if(Object.keys(t).length===0){Se(s,{force:!0,recursive:!0});return}if(M(s))for(const n of En(s,{recursive:!0,withFileTypes:!0})){const i=v(n.parentPath,n.name);n.isFile()&&t[xn(e,i)]===void 0&&Se(i)}for(const[n,i]of Object.entries(t))Mt(_t(v(e,n)),{recursive:!0}),Pe(v(e,n),i)},xh=(e,t,s)=>{const n=v(e,t);if(Object.keys(s).length===0){Se(n,{force:!0,recursive:!0});return}if(M(n))for(const i of En(n,{recursive:!0,withFileTypes:!0})){const o=v(i.parentPath,i.name);i.isFile()&&s[xn(n,o)]===void 0&&Se(o)}for(const[i,o]of Object.entries(s)){const a=v(n,i);Mt(_t(a),{recursive:!0}),Pe(a,o)}},Sh=e=>{try{const t=zo(v(e,"package.json"));return typeof t.version=="string"&&t.version!==""?t.version:void 0}catch{return}},Ke=(e,t,s)=>{const n=e.getSourceFile(t);if(n===void 0){e.createSourceFile(t,s,{overwrite:!0});return}n.getFullText()!==s&&n.replaceWithText(s)},Ah=(e,t,s)=>e.getSourceFile(t)?.getFullText()===s,yh=(e,t)=>{M(e)||Mt(e,{recursive:!0});const s=[];for(const n of t)switch(n.kind){case"always":{Pe(v(e,n.name),n.content),s.push(n.name);break}case"directory":{xh(e,n.name,n.files),s.push(...Object.keys(n.files).map(i=>v(n.name,i)));break}case"services":{Eh(e,n.files),s.push(...Object.keys(n.files));break}default:vh(v(e,n.name),n.content),n.content!==""&&s.push(n.name)}return s},bh=e=>{const t=Sh(e.projectRoot),s=e.wantsArchitecture?e.modules:[],n=$o({functions:e.functions,httpRoutes:e.httpRoutes,modules:s,version:t}),i=Uo({functions:e.functions,modules:s,version:t});return{openApiContent:`${JSON.stringify(n,void 0,2)}
+`,openApiModuleContent:Vo(n),openRpcContent:`${JSON.stringify(i,void 0,2)}
+`,openRpcModuleContent:Wo(i)}},Nh=".lunora-schema.json",Ph=()=>{const e=process.env.LUNORA_CODEGEN_TIMING;return e!==void 0&&e!==""},wh=(e,t,s)=>{if(s&&e.length>0){const o=e.map(a=>`"${a.exportName}"`).join(", ");throw new j("MASK_UNSUPPORTED",`This project declares a \`mask(...)\` policy whose argument isn't a plain object literal (e.g. \`mask(sharedPolicies)\` referencing a hoisted variable), or contains a spread (\`...shared\`) or computed key (\`[name]:\`) codegen can't enumerate, so codegen can't tell which columns it masks. Because the project also declares replication shape(s) (${o}), codegen can't verify none of them replicate a table that policy masks — inline every table and column as literal keys so codegen can verify it, or remove the affected shape(s).`,{status:422})}const n=new Map;for(const o of t.columns){const a=n.get(o.table)??[];a.push(o.column),n.set(o.table,a)}const i=t.columns.length>0;for(const o of e){if(o.table===void 0){if(i)throw new j("MASK_UNSUPPORTED",`defineShape "${o.exportName}" has a non-literal \`table\` (a variable or expression, not a string literal), so codegen can't statically verify it doesn't replicate a table that masks a column. This project masks at least one column elsewhere, so the combination can't be proven safe — change "${o.exportName}"'s \`table\` to a plain string literal so codegen can verify it, or remove the mask(s) on the table it targets.`,{status:422});continue}const a=n.get(o.table);if(a===void 0)continue;const c=a.map(l=>`"${l}"`).join(", ");throw new j("MASK_UNSUPPORTED",`defineShape "${o.exportName}" replicates table "${o.table}", which masks column(s) ${c} on at least one procedure. A shape runs no procedure, so \`.use(mask(...))\` never applies to its replicated rows — remove the shape, unmask the table, or wait for shape-masking support.`,{status:422})}},Ih=8,Ch=e=>{const{agents:t,apiPath:s,generatedFunctionsPath:n,internalPath:i,lazyFunctions:o,lunoraDirectory:a,migrations:c,project:l,roomsSupported:u,shapes:f,usesSandbox:g,useUmbrella:p,workflows:E}=e,V=()=>Co(()=>{const F=To(l,a,{lazyFunctions:o}),k=Dr(l,a);return{functions:F,httpRoutes:Oo(l,a),mutators:k}});let{erased:ce,value:{functions:P,httpRoutes:K,mutators:$}}=V();an([...P,...$].map(F=>F.filePath)),an(K.filter(F=>F.stream).map(F=>F.filePath),"http-stream");for(let F=1;;F+=1){const k=u?P:P.filter(b=>b.channel?.kind!=="room"),T=Jo({agents:t,functions:k,httpRoutes:K,mutators:$,useUmbrella:p,workflows:E}),Q={agents:t,functions:k,lazyFunctions:o,migrations:c,mutators:$,shapes:f,useUmbrella:p,usesSandbox:g},X=aa(Q),te=ca(Q),J=Zo({functions:P,useUmbrella:p}),le=v(a,"_generated",Kn),z=[[s,T],[i,J],[n,X],...Object.entries(te).map(([b,O])=>[v(le,b),O])];if(F>=Ih||z.every(([b,O])=>Ah(l,b,O)))return{apiContent:T,erased:ce,functions:P,functionModulesContent:te,functionsContent:X,httpRoutes:K,internalContent:J,mutators:$};for(const[b,O]of z)Ke(l,b,O);({erased:ce,value:{functions:P,httpRoutes:K,mutators:$}}=V())}},qv=e=>{const t=Ph(),s=t?ut.now():0,n=v(e.projectRoot,e.lunoraDirectory??"lunora"),i=e.lazyFunctions===!0,o=v(n,"schema.ts");if(!M(o))throw new j("INTERNAL",`schema.ts not found at ${o}`);const a=e.project??Xr(n);Ir(am);const c=Lo(a,o,e.projectRoot);$m(c.tables,Km(a,n,Ln(e.projectRoot)));const{agents:l,capabilities:u,containers:f,crons:g,dataModelContent:p,dependencies:E,entryCronTriggers:V,env:ce,featureUsage:P,hasFlags:K,hasNotify:$,identity:F,platformGate:k,queues:T,serverContent:Q,services:X,storageRulesMetadata:te,topics:J,usesSandbox:le,useUmbrella:z,workflows:b}=Up({lunoraDirectory:n,project:a,projectRoot:e.projectRoot,schema:c,target:e.target});um(c,c.jurisdiction===void 0?void 0:lm(a,n));const O=v(n,"_generated"),L=v(O,"dataModel.ts"),zi=v(O,"server.ts"),Bi=v(O,"api.ts"),$i=v(O,"internal.ts"),Vi=v(O,"functions.ts");Ke(a,L,p),Ke(a,zi,Q);const ts=Object.fromEntries(X.filter(m=>m.rpcEntrypoint!==void 0).flatMap(m=>Object.entries(Ao(m,O))));for(const[m,dt]of Object.entries(ts))Ke(a,v(O,m),dt);const we=Ro(a,n),de=Mo(a,n),ss=k.signals.typedWebSockets!==!1,{apiContent:ns,erased:Ui,functions:re,functionModulesContent:is,functionsContent:rs,httpRoutes:st,internalContent:os,mutators:nt}=Ch({agents:l,apiPath:Bi,generatedFunctionsPath:Vi,internalPath:$i,lazyFunctions:i,roomsSupported:ss,lunoraDirectory:n,migrations:we,project:a,shapes:de,useUmbrella:z,usesSandbox:le,workflows:b}),as=qr(a,n),it=jr(as,c,[...re,...st].map(m=>m.filePath)),Ie=as.length>0,Ce=e.lint===!1&&!Ie?void 0:{callEdges:sm(a,n),inserts:ko(a,n),queries:Fo(a,n,re),tableWrites:Qm(a,n),workflowCalls:hh(a,n)},Te=e.lint===!1||Ce===void 0?void 0:Wg(a,n,{callSites:Ce,containers:f,crons:g,functions:re,modules:it,mutators:nt,queues:T,schema:c,shapes:de,workflows:b,wranglerVariables:e.wranglerVariables}),cs=Te===void 0?[]:Xg(e.projectRoot,[...sr(Te,{source:"static"}),...gh(a,n,{byName:new Set([...b,...T,...l,...f].map(m=>m.exportName)),byPath:new Set([...re,...nt,...de,...we].map(m=>`${m.filePath}:${m.exportName}`))}),...eh(a,n),...Io(Ui,n),...qo(T,e.wranglerQueueProducers)]),Wi=Do(a,n),ls=hm(a,n);wh(de,ls,pm(a,n));const qi=K?om(a,n):[],rt=k.signals.vectorStore!==!1,ji=vo(bt(e.projectRoot,e.target),"deliveryAuthorization"),ge=Vm(P,{containerCount:f.length,cronCount:g.length,dependencies:E,hasPaymentTables:xm(c.tables),queueCount:T.length,storageColumnCount:Object.keys(Mn(c)).length,storageRuleCount:te.rules.length,vectorIndexCount:c.vectorIndexes.length,target:bt(e.projectRoot,e.target),vectorStoreSupported:rt,workflowCount:b.length}),ds=t?ut.now():0,ot=Bo(c,we.map(m=>m.id)),us=xo({advisories:cs.filter(m=>m.name!=="procedure_type_check_unavailable"),advisorProcedures:Te?.procedureProtections??[],agents:l,capabilities:u,containers:f,env:ce,flagKeys:qi,hasFlags:K,hasNotify:$,hasRooms:ss&&re.some(m=>m.channel?.kind==="room"),lazyFunctions:i,hasVectors:rt,liveStreams:k.signals.liveStreams===!0,maskMetadata:ls,mutators:nt,queues:T,rlsMetadata:Wi,schema:c,schemaSnapshot:ot,shapes:de,services:X,storageRules:te,studioFeatures:ge,topics:J,useUmbrella:z,workflows:b}),fs=Qo(de,E.has("@lunora/db"),z),gs=jo(f,c.jurisdiction),ps=Ho(b),ms=Go(l),hs=Yo(T,e.wranglerQueueProducers),vs=ea(g),Hi=ta(ge.scheduler),Gi=sa(c.tables,z),Yi=Pr(e.projectRoot)?na(z):"",Es=ia(c.vectorIndexes),Oe=oa(c,z),xs=Xo(E.has("@lunora/seed")),ke=e.apiSpec??"openapi",at=ke==="openapi"||ke==="both",ct=ke==="openrpc"||ke==="both",Ss=Ko({capabilities:u,emailAgents:l.filter(m=>m.onEmail===!0).map(m=>({className:m.className,exportName:m.exportName})),hasAccess:E.has("@lunora/cloudflare-access"),hasAuth:E.has("@lunora/auth"),hasFramework:E.has("@lunora/astro")||E.has("@lunora/svelte")||E.has("@lunora/vue")||M(v(e.projectRoot,"src","worker.ts")),hasGlobal:c.tables.some(m=>Fn(m)),hasHyperdriveGlobal:c.tables.some(m=>Dn(m)),hasKvIntrospector:ge.kv,hasNotify:$,hasQueue:T.some(m=>m.mode==="push"),liveStreams:k.signals.liveStreams===!0,liveStreamsWithheld:k.liveStreamsWithheld,hasScheduler:ge.scheduler,hasSourcedTables:c.tables.some(m=>m.externalSource!==void 0),hasStorage:ge.storage,hasDeliveryAuthorization:ji,hasVectors:rt,hasWorkflow:b.length>0,identity:F,jurisdiction:c.jurisdiction,jurisdictionPinsAuth:c.jurisdictionPinsAuth===!0,tables:c.tables.map(m=>({name:m.name,shardMode:m.shardMode})),useUmbrella:z,vectorIndexCount:c.vectorIndexes.length,voiceAgents:l.filter(m=>m.voice===!0&&m.voiceBindingName!==void 0).map(m=>({bindingName:m.voiceBindingName,exportName:m.exportName})),wantsArchitecture:Ie,wantsOpenApi:at,wantsOpenRpc:ct}),{openApiContent:As,openApiModuleContent:ys,openRpcContent:bs,openRpcModuleContent:Ns}=bh({functions:re,httpRoutes:st,modules:it,projectRoot:e.projectRoot,wantsArchitecture:Ie}),pe=Ie&&Ce!==void 0?fp({...Ce,crons:g,functions:re,httpRoutes:st,modules:it,queues:T,schema:c,services:X,topics:J,workflows:b}):void 0,lt=v(n,Nh),Qi=M(lt),Xi=e.dryRun?[]:yh(O,[{content:Ss,kind:"always",name:"app.ts"},{content:p,kind:"always",name:"dataModel.ts"},{content:ns,kind:"always",name:"api.ts"},{content:os,kind:"always",name:"internal.ts"},{content:Q,kind:"always",name:"server.ts"},{content:rs,kind:"always",name:"functions.ts"},{files:is,kind:"directory",name:Kn},{content:us,kind:"always",name:"shard.ts"},{content:vs,kind:"always",name:"crons.ts"},{content:Es,kind:"always",name:"vectors.ts"},{content:Oe.global,kind:"always",name:"drizzle.global.ts"},{content:Oe.shard,kind:"always",name:"drizzle.shard.ts"},{content:gs,kind:"optional",name:"containers.ts"},{content:ps,kind:"optional",name:"workflows.ts"},{content:ms,kind:"optional",name:"agents.ts"},{content:hs,kind:"optional",name:"queues.ts"},{content:Hi,kind:"optional",name:"scheduler.ts"},{content:Gi,kind:"optional",name:"shardRegistry.ts"},{content:Yi,kind:"optional",name:"durableObjects.ts"},{content:xs,kind:"optional",name:"seed.ts"},{content:fs,kind:"optional",name:"collections.ts"},{files:ts,kind:"services"},{content:at?As:"",kind:"optional",name:"openapi.json"},{content:at?ys:"",kind:"optional",name:"openapi.ts"},{content:ct?bs:"",kind:"optional",name:"openrpc.json"},{content:ct?Ns:"",kind:"optional",name:"openrpc.ts"},{content:pe===void 0?"":`${JSON.stringify(pe,void 0,2)}
+`,kind:"optional",name:"architecture.json"},{content:pe===void 0?"":gp(pe),kind:"optional",name:"architecture.ts"}]);if(!e.dryRun&&(!Qi||e.updateSchemaBaseline===!0)&&Pe(lt,nr(ot)),t){const m=ut.now(),dt=Math.round(m-s),Ji=Math.round(ds-s),Zi=Math.round(m-ds);console.error(`@lunora/codegen: codegen took ${dt.toString()}ms (discovery ${Ji.toString()}ms, emit ${Zi.toString()}ms)`)}return{advisories:cs,advisorContext:Te,agents:l,architecture:pe,containers:f,cronTriggers:[...new Set([...ra(g),...V])],generated:{agents:ms,api:ns,app:Ss,collections:fs,containers:gs,crons:vs,dataModel:p,drizzleGlobal:Oe.global,drizzleShard:Oe.shard,functionModules:is,functions:rs,internal:os,openApi:As,openApiModule:ys,openRpc:bs,openRpcModule:Ns,queues:hs,seed:xs,server:Q,shard:us,vectors:Es,workflows:ps},migrations:we,outputDirectory:O,platformDiagnostics:k.diagnostics,queues:T,schemaSnapshot:ot,schemaSnapshotPath:lt,workflows:b,writtenFiles:Xi}};export{Nh as SCHEMA_SNAPSHOT_FILENAME,Xr as createCodegenProject,Gv as findTsconfig,Yv as refreshCodegenProject,qv as runCodegen};

package/dist/packem_shared/capabilitiesUsedBy-D3pvpeAt.mjs

@@ -0,0 +1 @@
+import{SyntaxKind as c,Node as r}from"ts-morph";import{CAPABILITIES as m}from"./CAPABILITY_PROBES-brcmKenl.mjs";import{bindingKeyName as p,listLunoraSourceFiles as g}from"./isTestPath-B81lOULB.mjs";import{scanImportDeclaration as u,noSandboxUsage as l}from"./discoverSandboxUsage-w6Q3RvxZ.mjs";const d="ctx",E=(e,t,o)=>{for(const n of e.getDescendantsOfKind(c.ElementAccessExpression)){const s=n.getArgumentExpression();t(n.getExpression())&&s!==void 0&&(r.isStringLiteral(s)||r.isNoSubstitutionTemplateLiteral(s))&&o.add(s.getLiteralValue())}},x=e=>{const t=new Set,o=new Set([d]),n=i=>{if(r.isObjectBindingPattern(i))for(const a of i.getElements()){const f=p(a);f&&t.add(f)}};for(const i of e.getDescendantsOfKind(c.BindingElement)){if(p(i)!==d)continue;const a=i.getNameNode();r.isIdentifier(a)?o.add(a.getText()):n(a)}const s=i=>r.isIdentifier(i)&&o.has(i.getText());for(const i of e.getDescendantsOfKind(c.PropertyAccessExpression))s(i.getExpression())&&t.add(i.getName());E(e,s,t);for(const i of e.getDescendantsOfKind(c.VariableDeclaration)){const a=i.getInitializer();a!==void 0&&s(a)&&n(i.getNameNode())}return t},y=e=>{if(e.isTypeOnly())return!0;if(r.isExportDeclaration(e)){const o=e.getNamedExports();return!e.isNamespaceExport()&&o.length>0&&o.every(n=>n.isTypeOnly())}const t=e.getNamedImports();return e.getDefaultImport()===void 0&&e.getNamespaceImport()===void 0&&t.length>0&&t.every(o=>o.isTypeOnly())},N=new Map(m.flatMap(({bindingFreeExports:e,moduleSpecifier:t})=>e===void 0?[]:[[t,new Set(e)]])),I=(e,t)=>{const o=N.get(t);if(o===void 0||r.isImportDeclaration(e)&&(e.getDefaultImport()!==void 0||e.getNamespaceImport()!==void 0))return!1;const n=r.isExportDeclaration(e)?e.getNamedExports():e.getNamedImports();return n.length>0&&n.every(s=>s.isTypeOnly()||o.has(s.getName()))},S=e=>{const t=new Set;for(const o of e.getDescendantsOfKind(c.CallExpression)){const[n]=o.getArguments();o.getExpression().getKind()===c.ImportKeyword&&(r.isStringLiteral(n)||r.isNoSubstitutionTemplateLiteral(n))&&t.add(n.getLiteralValue())}return t},T=e=>{const t=e.getImportDeclarations(),o=l();for(const n of t){const s=u(n);for(const i of Object.keys(o))o[i]||=s[i]}return{contextReads:x(e),dynamicImports:S(e),sandboxTools:o,valueImports:new Set([...t,...e.getExportDeclarations()].flatMap(n=>{const s=n.getModuleSpecifierValue();return s===void 0||y(n)||I(n,s)?[]:[s]}))}},b=e=>{const t=new Set,o=new Set,n=l(),s=new Set;for(const i of e){for(const a of i.contextReads)t.add(a);for(const a of i.dynamicImports)o.add(a);for(const a of i.valueImports)s.add(a);for(const a of Object.keys(n))n[a]||=i.sandboxTools[a]}return{contextReads:t,dynamicImports:o,sandboxTools:n,valueImports:s}},O=e=>new Set(m.filter(({contextProperty:t,moduleSpecifier:o})=>e.valueImports.has(o)||t!==void 0&&e.contextReads.has(t)).map(({key:t})=>t)),v=new RegExp(String.raw`\b${d}\b`,"u"),w=new RegExp(String.raw`\b(?:${m.flatMap(({contextProperty:e})=>e===void 0?[]:[e]).join("|")})\b`,"u"),K=e=>v.test(e)&&w.test(e),L=(e,t)=>{const o=b(g(t).map(s=>T(e.getSourceFile(s)??e.addSourceFileAtPath(s)))),n=O(o);return Object.fromEntries(m.map(({key:s})=>[s,n.has(s)]))};export{O as capabilitiesUsedBy,x as contextPropertiesRead,L as discoverFeatureUsage,b as foldCapabilitySignals,K as mayReadCapabilityContext,T as sourceCapabilitySignals};

package/dist/packem_shared/{emitApp-K6otnCNZ.mjs → emitApp-DuJW6LKD.mjs}

@@ -336,7 +336,7 @@ const buildGlobalCdcApplier =
 
         return request.changes.length;
     };
-`:"",C=e=>[...e.hasStorage?["/** `.storage(...)` declaration — one bucket (required) plus optional extra named buckets and signed-URL config. Backs `ctx.storage` AND the studio file browser. */\ninterface StorageDeclaration<Env> {\n    /** The default R2 bucket binding (the bare `ctx.storage`). */\n    bucket: Selector<Env, R2BucketLike>;\n    /** Extra named buckets, reached via `ctx.storage.bucket(\"name\")` and the studio's bucket picker. */\n    buckets?: Record<string, Selector<Env, R2BucketLike>>;\n    /** Public base URL signed/public object URLs resolve against. Omit it and `ctx.storage` in a mutation, action or HTTP handler (and the studio's copy-URL) signs against the origin the request reached the worker on — no per-environment value to ship. Queries get no such fallback (a live query re-runs with no request behind it), so a query that signs URLs needs this set. */\n    publicBaseUrl?: Selector<Env, string>;\n    /** R2 S3-API credentials (`{ accountId, accessKeyId, secretAccessKey, bucket, jurisdiction? }`) enabling `ctx.storage.getPresignedUrl` — native S3 presigned URLs that hit R2 directly, bypassing the worker. Omit to use only the worker-signed `getSignedUrl` path. */\n    s3?: Selector<Env, R2S3Credentials>;\n    /** HMAC secret for signed URLs. */\n    signingSecret?: Selector<Env, string>;\n}"]:[],...e.hasScheduler?["/** `.scheduler(...)` declaration — the `SchedulerDO` namespace. Backs `ctx.scheduler` AND the studio's scheduled-jobs view. The origin its callbacks dispatch back to is not declared here: the DO reads `env.LUNORA_ORIGIN_URL` at fire time, because a caller-supplied dispatch target would be an SSRF vector. */\ninterface SchedulerDeclaration<Env> {\n    /** The `SchedulerDO` namespace binding (typically `env.SCHEDULER`). */\n    namespace: Selector<Env, DurableObjectNamespaceLike & ShardNamespaceLike>;\n}"]:[],...e.hasGlobal?["/** `.global(...)` declaration — the D1 binding backing `.global()` tables. Backs cross-tenant `ctx.db` reads/writes AND the studio's global data browser. */\ninterface GlobalDeclaration<Env> {\n    /** The D1 binding (typically `env.DB`). */\n    d1: Selector<Env, D1DatabaseLike>;\n    /** The worker origin used to fan reverse cross-backend relations across shards. Without it, such a relation throws a clear error. */\n    origin?: Selector<Env, string>;\n}"]:[],...e.hasHyperdriveGlobal?['/** `.hyperdriveGlobal(...)` declaration — backs `.global({ backend: "hyperdrive" })` tables on a Postgres/MySQL database via Hyperdrive. Stays reactive: the writer is injected as `globalDb` and the broadcast hook drives live queries. */\ninterface HyperdriveGlobalDeclaration<Env> {\n    /** The Hyperdrive engine — selects the Postgres or MySQL dialect. */\n    engine: HyperdriveEngine;\n    /** Build the `SqlExec` from `env` — e.g. `buildPgExec(fromPostgresJs(postgres(env.HYPERDRIVE.connectionString)))`. Cache the driver on the DO instance; rebuild lazily after hibernation. */\n    exec: (env: Env) => SqlExec;\n    /** The worker origin used to fan reverse cross-backend relations across shards. Without it, such a relation throws a clear error. */\n    origin?: Selector<Env, string>;\n}']:[],...e.hasAuth?['/** `.auth(...)` declaration — better-auth options plus the storage the adapter reads. Give it `d1` (the default) or `namespace` (a Durable Object that hosts the auth tables), never both. The builder owns the lazy build + `ensureMigrated` dance and wires `authHandler` / `resolveIdentity` / `authAdmin`. */\ninterface AuthDeclaration<Env> {\n    /** The D1 binding the auth SQL adapter is wired over (via `lunoraD1Adapter`). Omit only when using `namespace`. */\n    d1?: Selector<Env, unknown>;\n    /** Shared secret the worker presents on the object\'s internal session route. REQUIRED with `namespace`: the binding is reachable from any worker bound to it, so the secret — not the binding — is the authorization boundary. Without it identity resolution fails closed. */\n    internalSecret?: Selector<Env, string>;\n    /** Name of the Durable Object instance holding the auth tables. Defaults to `"auth"`. Set it to run separate auth objects (per deployment, per tenant) off one namespace. */\n    objectName?: Selector<Env, string>;\n    /** The auth Durable Object namespace — the DO-backed mode. Needed for `@better-auth/scim`, which requires native transactions that D1 has none of. The object owns the auth tables, so `/api/auth/*` and identity resolution both go through it. Typed as `AuthNamespaceLike` because `createDoAuthWiring` resolves through `idFromName` + `get` and has no `getByName` fallback — both members are load-bearing here, and `ShardNamespaceLike` leaves both optional. */\n    namespace?: Selector<Env, AuthNamespaceLike>;\n    /** Build the better-auth options from `env` (secret, plugins, email/password, …). */\n    options: (env: Env) => LunoraAuthOptions;\n}']:[]],O=e=>[...e.hasAccess?["    private accessSelector?: Selector<Env, CreateAccessResolverOptions | undefined>;"]:[],"    private adminToken?: Selector<Env, string>;",...e.hasAuth?["    private authDeclaration?: AuthDeclaration<Env>;"]:[],"    private cdcEnabled = false;",'    private deliveryAuthorizationSelector?: ShardConfig["deliveryAuthorization"];',"    private reactiveCacheConfig: boolean | { maxBytes?: number; maxEntries?: number } = false;",'    private maxRelationKeysLimit?: ShardConfig["maxRelationKeys"];','    private observabilitySink?: ShardConfig["observability"];','    private relationExistsPushDownMode?: ShardConfig["relationExistsPushDown"];',"    private readonly extendFns: ((env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>)[] = [];",...e.hasGlobal?["    private globalDeclaration?: GlobalDeclaration<Env>;"]:[],...e.hasHyperdriveGlobal?["    private hyperdriveGlobalDeclaration?: HyperdriveGlobalDeclaration<Env>;"]:[],"    private httpRouterApp?: HttpRouterLike;","    private readonly routeMap: Record<string, Route> = {};",...e.hasScheduler?["    private schedulerDeclaration?: SchedulerDeclaration<Env>;"]:[],...g(e)?["    private readonly shardExtras: Partial<ShardConfig> = {};"]:[],...d(e)?["    private shardRegistrySelector?: Selector<Env, ShardNamespaceLike>;"]:[],"    private shardSelector?: Selector<Env, ShardNamespaceLike>;",...e.hasSourcedTables?['    private sourceClientFactory?: NonNullable<ShardConfig["sourceClient"]>;']:[],...e.hasStorage?["    private storageDeclaration?: StorageDeclaration<Env>;"]:[]],T=e=>m(e).map(({configKey:r,doc:t,method:a})=>`    /** ${t} */
+`:"",C=e=>[...e.hasStorage?["/** `.storage(...)` declaration — one bucket (required) plus optional extra named buckets and signed-URL config. Backs `ctx.storage` AND the studio file browser. */\ninterface StorageDeclaration<Env> {\n    /** The default R2 bucket binding (the bare `ctx.storage`). */\n    bucket: Selector<Env, R2BucketLike>;\n    /** Extra named buckets, reached via `ctx.storage.bucket(\"name\")` and the studio's bucket picker. */\n    buckets?: Record<string, Selector<Env, R2BucketLike>>;\n    /** Public base URL signed/public object URLs resolve against. Omit it and `ctx.storage` in a mutation, action or HTTP handler (and the studio's copy-URL) signs against the origin the request reached the worker on — no per-environment value to ship. Queries get no such fallback (a live query re-runs with no request behind it), so a query that signs URLs needs this set. */\n    publicBaseUrl?: Selector<Env, string>;\n    /** R2 S3-API credentials (`{ accountId, accessKeyId, secretAccessKey, bucket, jurisdiction? }`) enabling `ctx.storage.getPresignedUrl` — native S3 presigned URLs that hit R2 directly, bypassing the worker. Omit to use only the worker-signed `getSignedUrl` path. */\n    s3?: Selector<Env, R2S3Credentials>;\n    /** HMAC secret for signed URLs. */\n    signingSecret?: Selector<Env, string>;\n}"]:[],...e.hasScheduler?["/** `.scheduler(...)` declaration — the `SchedulerDO` namespace. Backs `ctx.scheduler` AND the studio's scheduled-jobs view. The origin its callbacks dispatch back to is not declared here: the DO reads `env.LUNORA_ORIGIN_URL` at fire time, because a caller-supplied dispatch target would be an SSRF vector. */\ninterface SchedulerDeclaration<Env> {\n    /** The `SchedulerDO` namespace binding (typically `env.SCHEDULER`). */\n    namespace: Selector<Env, DurableObjectNamespaceLike & ShardNamespaceLike>;\n}"]:[],...e.hasGlobal?["/** `.global(...)` declaration — the D1 binding backing `.global()` tables. Backs cross-tenant `ctx.db` reads/writes AND the studio's global data browser. */\ninterface GlobalDeclaration<Env> {\n    /** The D1 binding (typically `env.DB`). */\n    d1: Selector<Env, D1DatabaseLike>;\n    /** The worker origin used to fan reverse cross-backend relations across shards. Without it, such a relation throws a clear error. */\n    origin?: Selector<Env, string>;\n}"]:[],...e.hasHyperdriveGlobal?['/** `.hyperdriveGlobal(...)` declaration — backs `.global({ backend: "hyperdrive" })` tables on a Postgres/MySQL database via Hyperdrive. Stays reactive: the writer is injected as `globalDb` and the broadcast hook drives live queries. */\ninterface HyperdriveGlobalDeclaration<Env> {\n    /** The Hyperdrive engine — selects the Postgres or MySQL dialect. */\n    engine: HyperdriveEngine;\n    /** Build the `SqlExec` from `env` — e.g. `buildPgExec(fromPostgresJs(postgres(env.HYPERDRIVE.connectionString)))`. Cache the driver on the DO instance; rebuild lazily after hibernation. */\n    exec: (env: Env) => SqlExec;\n    /** The worker origin used to fan reverse cross-backend relations across shards. Without it, such a relation throws a clear error. */\n    origin?: Selector<Env, string>;\n}']:[],...e.hasAuth?['/** `.auth(...)` declaration — better-auth options plus the storage the adapter reads. Give it `d1` (the default) or `namespace` (a Durable Object that hosts the auth tables), never both. The builder owns the lazy build + `ensureMigrated` dance and wires `authHandler` / `resolveIdentity` / `authAdmin`. */\ninterface AuthDeclaration<Env> {\n    /** The D1 binding the auth SQL adapter is wired over (via `lunoraD1Adapter`). Omit only when using `namespace`. */\n    d1?: Selector<Env, unknown>;\n    /** Shared secret the worker presents on the object\'s internal session route. REQUIRED with `namespace`: the binding is reachable from any worker bound to it, so the secret — not the binding — is the authorization boundary. Without it identity resolution fails closed. */\n    internalSecret?: Selector<Env, string>;\n    /** Name of the Durable Object instance holding the auth tables. Defaults to `"auth"`. Set it to run separate auth objects (per deployment, per tenant) off one namespace. */\n    objectName?: Selector<Env, string>;\n    /** The auth Durable Object namespace — the DO-backed mode. Needed for `@better-auth/scim`, which requires native transactions that D1 has none of. The object owns the auth tables, so `/api/auth/*` and identity resolution both go through it. Typed as `AuthNamespaceLike` because `createDoAuthWiring` resolves through `idFromName` + `get` and has no `getByName` fallback — both members are load-bearing here, and `ShardNamespaceLike` leaves both optional. */\n    namespace?: Selector<Env, AuthNamespaceLike>;\n    /** Build the better-auth options from `env` (secret, plugins, email/password, …). */\n    options: (env: Env) => LunoraAuthOptions;\n}']:[]],O=e=>[...e.hasAccess?["    private accessSelector?: Selector<Env, CreateAccessResolverOptions | undefined>;"]:[],"    private adminToken?: Selector<Env, string>;",...e.hasAuth?["    private authDeclaration?: AuthDeclaration<Env>;"]:[],"    private cdcEnabled = false;",...e.hasDeliveryAuthorization===!1?[]:['    private deliveryAuthorizationSelector?: ShardConfig["deliveryAuthorization"];'],"    private reactiveCacheConfig: boolean | { maxBytes?: number; maxEntries?: number } = false;",'    private maxRelationKeysLimit?: ShardConfig["maxRelationKeys"];','    private observabilitySink?: ShardConfig["observability"];','    private relationExistsPushDownMode?: ShardConfig["relationExistsPushDown"];',"    private readonly extendFns: ((env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>)[] = [];",...e.hasGlobal?["    private globalDeclaration?: GlobalDeclaration<Env>;"]:[],...e.hasHyperdriveGlobal?["    private hyperdriveGlobalDeclaration?: HyperdriveGlobalDeclaration<Env>;"]:[],"    private httpRouterApp?: HttpRouterLike;","    private readonly routeMap: Record<string, Route> = {};",...e.hasScheduler?["    private schedulerDeclaration?: SchedulerDeclaration<Env>;"]:[],...g(e)?["    private readonly shardExtras: Partial<ShardConfig> = {};"]:[],...d(e)?["    private shardRegistrySelector?: Selector<Env, ShardNamespaceLike>;"]:[],"    private shardSelector?: Selector<Env, ShardNamespaceLike>;",...e.hasSourcedTables?['    private sourceClientFactory?: NonNullable<ShardConfig["sourceClient"]>;']:[],...e.hasStorage?["    private storageDeclaration?: StorageDeclaration<Env>;"]:[]],T=e=>m(e).map(({configKey:r,doc:t,method:a})=>`    /** ${t} */
     public ${a}(factory: (env: Env) => ReturnType<NonNullable<ShardConfig["${r}"]>>): this {
         this.shardExtras.${r} = factory as NonNullable<ShardConfig["${r}"]>;
 
@@ -360,12 +360,12 @@ const buildGlobalCdcApplier =
         this.maxRelationKeysLimit = limit;
 
         return this;
-    }`,"    /**\n     * Route the shard's `ctx.log` lines, `ctx.trace` spans and `ctx.metrics` measurements to a telemetry sink.\n     *\n     * The DO half of observability: without it every in-handler signal stays in the shard's local ring buffer (the studio Logs panel) and reaches no collector. The worker half — one `onRpc` event per dispatched RPC — is a `createWorker` option; pass the SAME sink to both via `.extend((env) => ({ observability: sink(env) }))` to correlate them.\n     */\n    public observability(selector: NonNullable<ShardConfig[\"observability\"]>): this {\n        this.observabilitySink = selector;\n\n        return this;\n    }",'    /** Resolution policy for a relation-crossing `where` whose child is co-located in this shard: `"auto"` (cost-based, the engine default), `"always"` (inline correlated EXISTS) or `"never"` (universal semijoin). All three return identical rows. */\n    public relationExistsPushDown(mode: NonNullable<ShardConfig["relationExistsPushDown"]>): this {\n        this.relationExistsPushDownMode = mode;\n\n        return this;\n    }',`    /** Authorize each RPC/subscription read and fence its eventual delivery against durable authority epochs. */
+    }`,"    /**\n     * Route the shard's `ctx.log` lines, `ctx.trace` spans and `ctx.metrics` measurements to a telemetry sink.\n     *\n     * The DO half of observability: without it every in-handler signal stays in the shard's local ring buffer (the studio Logs panel) and reaches no collector. The worker half — one `onRpc` event per dispatched RPC — is a `createWorker` option; pass the SAME sink to both via `.extend((env) => ({ observability: sink(env) }))` to correlate them.\n     */\n    public observability(selector: NonNullable<ShardConfig[\"observability\"]>): this {\n        this.observabilitySink = selector;\n\n        return this;\n    }",'    /** Resolution policy for a relation-crossing `where` whose child is co-located in this shard: `"auto"` (cost-based, the engine default), `"always"` (inline correlated EXISTS) or `"never"` (universal semijoin). All three return identical rows. */\n    public relationExistsPushDown(mode: NonNullable<ShardConfig["relationExistsPushDown"]>): this {\n        this.relationExistsPushDownMode = mode;\n\n        return this;\n    }',...e.hasDeliveryAuthorization===!1?[]:[`    /** Authorize each RPC/subscription read and fence its eventual delivery against durable authority epochs. */
     public deliveryAuthorization(selector: (env: Env) => ReturnType<NonNullable<ShardConfig["deliveryAuthorization"]>>): this {
         this.deliveryAuthorizationSelector = selector as NonNullable<ShardConfig["deliveryAuthorization"]>;
 
         return this;
-    }`,...e.hasAuth?['    /** Wire better-auth — the builder lazily builds the instance, runs `ensureMigrated`, and dispatches `/api/auth/*` inside the worker (instrumented for the auth-failure SLO). Pass `d1` for the D1-backed default, or `namespace` + `internalSecret` to host the auth tables in a Durable Object (what `@better-auth/scim` needs). */\n    public auth(declaration: AuthDeclaration<Env>): this {\n        // Reject the ambiguous and the empty shapes here rather than at the first\n        // request: with neither storage set, auth would silently never answer, and\n        // with both it is unclear which one owns the tables.\n        if (declaration.d1 && declaration.namespace) {\n            throw new Error(".auth(): pass either `d1` or `namespace`, not both — they are two different homes for the same tables.");\n        }\n\n        if (!declaration.d1 && !declaration.namespace) {\n            throw new Error(".auth(): needs `d1` (D1-backed) or `namespace` (Durable-Object-backed) to know where the auth tables live.");\n        }\n\n        if (declaration.namespace && !declaration.internalSecret) {\n            throw new Error(\n                ".auth(): `namespace` requires `internalSecret` — the auth DO binding is reachable from any worker bound to it, so identity resolution is gated on a shared secret and would otherwise fail closed on every request.",\n            );\n        }\n\n        this.authDeclaration = declaration;\n\n        return this;\n    }']:[],"    /** Escape hatch — merge raw `WorkerOptions` (anything not yet sugared) over the derived options at build time. The second `derived` argument is a snapshot of the options assembled so far (after `.auth(...)` etc.), so you can compose rather than clobber — e.g. wrap `derived.resolveIdentity` instead of replacing it. */\n    public extend(fn: (env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>): this {\n        this.extendFns.push(fn);\n\n        return this;\n    }",...e.hasGlobal?[`    /** Back \`.global()\` (cross-tenant) tables with D1 — wires \`ctx.db\` routing, the studio global browser, and reverse cross-shard relations. */
+    }`],...e.hasAuth?['    /** Wire better-auth — the builder lazily builds the instance, runs `ensureMigrated`, and dispatches `/api/auth/*` inside the worker (instrumented for the auth-failure SLO). Pass `d1` for the D1-backed default, or `namespace` + `internalSecret` to host the auth tables in a Durable Object (what `@better-auth/scim` needs). */\n    public auth(declaration: AuthDeclaration<Env>): this {\n        // Reject the ambiguous and the empty shapes here rather than at the first\n        // request: with neither storage set, auth would silently never answer, and\n        // with both it is unclear which one owns the tables.\n        if (declaration.d1 && declaration.namespace) {\n            throw new Error(".auth(): pass either `d1` or `namespace`, not both — they are two different homes for the same tables.");\n        }\n\n        if (!declaration.d1 && !declaration.namespace) {\n            throw new Error(".auth(): needs `d1` (D1-backed) or `namespace` (Durable-Object-backed) to know where the auth tables live.");\n        }\n\n        if (declaration.namespace && !declaration.internalSecret) {\n            throw new Error(\n                ".auth(): `namespace` requires `internalSecret` — the auth DO binding is reachable from any worker bound to it, so identity resolution is gated on a shared secret and would otherwise fail closed on every request.",\n            );\n        }\n\n        this.authDeclaration = declaration;\n\n        return this;\n    }']:[],"    /** Escape hatch — merge raw `WorkerOptions` (anything not yet sugared) over the derived options at build time. The second `derived` argument is a snapshot of the options assembled so far (after `.auth(...)` etc.), so you can compose rather than clobber — e.g. wrap `derived.resolveIdentity` instead of replacing it. */\n    public extend(fn: (env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>): this {\n        this.extendFns.push(fn);\n\n        return this;\n    }",...e.hasGlobal?[`    /** Back \`.global()\` (cross-tenant) tables with D1 — wires \`ctx.db\` routing, the studio global browser, and reverse cross-shard relations. */
     public global(declaration: GlobalDeclaration<Env>): this {
         this.globalDeclaration = declaration;
 
@@ -405,8 +405,8 @@ const buildGlobalCdcApplier =
         this.storageDeclaration = declaration;
 
         return this;
-    }`]:[],...T(e)],I=e=>{const r=a=>e.hasScheduler?`
-                              ...(this.schedulerDeclaration ? { scheduler: this.resolveScheduler(env) as unknown as ${a}["scheduler"] } : {}),`:"",t=["            cdc: this.cdcEnabled,","            reactiveCache: this.reactiveCacheConfig,","            ...(this.maxRelationKeysLimit === undefined ? {} : { maxRelationKeys: this.maxRelationKeysLimit }),","            ...(this.observabilitySink === undefined ? {} : { observability: this.observabilitySink }),","            ...(this.deliveryAuthorizationSelector === undefined ? {} : { deliveryAuthorization: this.deliveryAuthorizationSelector }),","            ...(this.relationExistsPushDownMode === undefined ? {} : { relationExistsPushDown: this.relationExistsPushDownMode }),",...e.hasGlobal?[`            ...(this.globalDeclaration
+    }`]:[],...T(e)],q=e=>{const r=a=>e.hasScheduler?`
+                              ...(this.schedulerDeclaration ? { scheduler: this.resolveScheduler(env) as unknown as ${a}["scheduler"] } : {}),`:"",t=["            cdc: this.cdcEnabled,","            reactiveCache: this.reactiveCacheConfig,","            ...(this.maxRelationKeysLimit === undefined ? {} : { maxRelationKeys: this.maxRelationKeysLimit }),","            ...(this.observabilitySink === undefined ? {} : { observability: this.observabilitySink }),",...e.hasDeliveryAuthorization===!1?[]:["            ...(this.deliveryAuthorizationSelector === undefined ? {} : { deliveryAuthorization: this.deliveryAuthorizationSelector }),"],"            ...(this.relationExistsPushDownMode === undefined ? {} : { relationExistsPushDown: this.relationExistsPushDownMode }),",...e.hasGlobal?[`            ...(this.globalDeclaration
                 ? {
                       d1: (rawEnv: Record<string, unknown>, request?: { bookmark?: string; cdc?: boolean; cdcRetentionMs?: number; identity?: Record<string, unknown>; onBookmark?: (bookmark: string | undefined) => void; userId?: string | null }) => {
                           const env = rawEnv as Env;
@@ -488,7 +488,7 @@ const buildGlobalCdcApplier =
                 : {}),`]:[],...d(e)?["            ...(this.shardRegistrySelector ? { shardRegistry: (rawEnv: Record<string, unknown>) => this.shardRegistrySelector?.(rawEnv as Env) } : {}),"]:[],...e.hasSourcedTables?["            ...(this.sourceClientFactory === undefined ? {} : { sourceClient: this.sourceClientFactory }),"]:[],...e.hasStorage?["            ...(this.storageDeclaration ? { storage: (rawEnv: Record<string, unknown>, origin?: string) => this.resolveStorage(rawEnv as Env, origin) } : {}),"]:[],...g(e)?["            ...this.shardExtras,"]:[]];return t.length>0?`
 ${t.join(`
 `)}
-        `:""},q=e=>e?['import * as lunoraIdentityContract from "../identity.js";']:[],L=(e,r)=>e?['import type { CreateAccessResolverOptions } from "@lunora/cloudflare-access";',`import { createAccessResolver${r?", composeResolvers":""} } from "@lunora/cloudflare-access";`]:[],j=e=>e?['import { createKvIntrospectorFromEnv } from "@lunora/bindings/kv";']:[],B=e=>e?['import { createVectorAdminIntrospector } from "@lunora/bindings/vectors";']:[],P=e=>e?['import type { D1CtxDbOptions, D1DatabaseLike, D1Exec } from "@lunora/d1";','import { applyCdcChanges, createD1CtxDb, emitD1QueryCost, exportGlobalRows, facetGlobalColumn, importGlobalRows, listGlobalTables, readD1CdcChanges, readGlobalTablePage, retryingExec } from "@lunora/d1";']:[],G=e=>e?['import notifyConfig from "../notify.js";']:[],_=e=>v(e)?['import { dispatchAgentEmail } from "@lunora/agent/inbound";']:[],W=e=>v(e)?['import * as lunoraAgentDefinitions from "../agents.js";']:[],M=e=>{const{hasFramework:r,hasGlobal:t,hasHyperdriveGlobal:a,hasQueue:n,useUmbrella:o}=e,i=o?"lunorash/runtime":"@lunora/runtime",c=["ExecutionContextLike","HttpRouterLike","LunoraWorker","Route","ScheduledControllerLike","ShardNamespaceLike","WorkerOptions",...n?["TriggerTrace"]:[],...t?["GlobalIntrospector"]:[],...e.tables.length>0?["ShardingInfo"]:[],...r?["FrameworkHostHandler"]:[]],l=[...t||a?["createCrossShardRelationCapabilities"]:[],...d(e)?["createDynamicShardRegistry","createQueryCoordinator"]:[],"createWorker",...e.jurisdiction?["declareAppJurisdiction"]:[],"resolveLogArchiveFromEnv",...e.hasAuth?["memoizeIdentity"]:[],...r?["withFrameworkWorker"]:[]].join(", ");return[`import type { ${[...c].toSorted((s,h)=>s.localeCompare(h)).join(", ")} } from "${i}";`,`import { ${l} } from "${i}";`]},H=e=>{const{hasAccess:r,hasAuth:t,hasGlobal:a,hasHyperdriveGlobal:n,hasKvIntrospector:o,hasQueue:i,hasScheduler:c,hasStorage:l,hasWorkflow:s,wantsOpenApi:h,wantsOpenRpc:u}=e;return[...t?['import type { AuthNamespaceLike, LunoraAuth, LunoraAuthOptions } from "@lunora/auth";','import { authDiscoveryPathsFor, createAuth, createAuthAdmin, createAuthAuditReader, createDoAuthWiring, d1Executor, handleAuthDiscoveryRequest, handleAuthRequest, lunoraD1Adapter } from "@lunora/auth";']:[],...L(r,t),...P(a),...n?['import type { HyperdriveEngine } from "@lunora/hyperdrive/global";','import { createHyperdriveGlobalCtxDb } from "@lunora/hyperdrive/global";','import type { SqlCtxDbOptions, SqlExec } from "@lunora/sql-store";']:[],...j(o),...B(e.hasVectors),...c?['import type { DurableObjectNamespaceLike } from "@lunora/scheduler";','import { createScheduler } from "@lunora/scheduler";']:[],...l?['import type { R2BucketLike, R2S3Credentials, Storage } from "@lunora/storage";','import { createBucketStorage, createStorage } from "@lunora/storage";']:[],...s?['import { createWorkflowsRestClient } from "@lunora/workflow";']:[],..._(e),...M(e),"",...q(e.identity),...W(e),...a||n?['import schema from "../schema.js";']:[],...G(e.hasNotify),'import { LUNORA_CRONS } from "./crons.js";','import { LUNORA_FUNCTIONS } from "./functions.js";',...i?['import { createQueueCaptureSink, dispatchQueueBatch, shouldCaptureQueue } from "@lunora/queue";','import { LUNORA_QUEUE_REGISTRY } from "./queues.js";']:[],...e.wantsArchitecture?['import { architecture } from "./architecture.js";']:[],...h?['import { openApiSpec } from "./openapi.js";']:[],...u?['import { openRpcSpec } from "./openrpc.js";']:[],'import { createShardDO } from "./shard.js";',...e.hasVectors?['import { LUNORA_VECTOR_INDEXES } from "./vectors.js";']:[]]},$=e=>e.jurisdiction&&e.jurisdictionPinsAuth===!0?`
+        `:""},I=e=>e?['import * as lunoraIdentityContract from "../identity.js";']:[],L=(e,r)=>e?['import type { CreateAccessResolverOptions } from "@lunora/cloudflare-access";',`import { createAccessResolver${r?", composeResolvers":""} } from "@lunora/cloudflare-access";`]:[],j=e=>e?['import { createKvIntrospectorFromEnv } from "@lunora/bindings/kv";']:[],B=e=>e?['import { createVectorAdminIntrospector } from "@lunora/bindings/vectors";']:[],P=e=>e?['import type { D1CtxDbOptions, D1DatabaseLike, D1Exec } from "@lunora/d1";','import { applyCdcChanges, createD1CtxDb, emitD1QueryCost, exportGlobalRows, facetGlobalColumn, importGlobalRows, listGlobalTables, readD1CdcChanges, readGlobalTablePage, retryingExec } from "@lunora/d1";']:[],G=e=>e?['import notifyConfig from "../notify.js";']:[],_=e=>v(e)?['import { dispatchAgentEmail } from "@lunora/agent/inbound";']:[],W=e=>v(e)?['import * as lunoraAgentDefinitions from "../agents.js";']:[],M=e=>{const{hasFramework:r,hasGlobal:t,hasHyperdriveGlobal:a,hasQueue:s,useUmbrella:o}=e,i=o?"lunorash/runtime":"@lunora/runtime",c=["ExecutionContextLike","HttpRouterLike","LunoraWorker","Route","ScheduledControllerLike","ShardNamespaceLike","WorkerOptions",...s?["TriggerTrace"]:[],...t?["GlobalIntrospector"]:[],...e.tables.length>0?["ShardingInfo"]:[],...r?["FrameworkHostHandler"]:[]],l=[...t||a?["createCrossShardRelationCapabilities"]:[],...d(e)?["createDynamicShardRegistry","createQueryCoordinator"]:[],"createWorker",...e.jurisdiction?["declareAppJurisdiction"]:[],"resolveLogArchiveFromEnv",...e.hasAuth?["memoizeIdentity"]:[],...r?["withFrameworkWorker"]:[]].join(", ");return[`import type { ${[...c].toSorted((n,h)=>n.localeCompare(h)).join(", ")} } from "${i}";`,`import { ${l} } from "${i}";`]},H=e=>{const{hasAccess:r,hasAuth:t,hasGlobal:a,hasHyperdriveGlobal:s,hasKvIntrospector:o,hasQueue:i,hasScheduler:c,hasStorage:l,hasWorkflow:n,wantsOpenApi:h,wantsOpenRpc:u}=e;return[...t?['import type { AuthNamespaceLike, LunoraAuth, LunoraAuthOptions } from "@lunora/auth";','import { authDiscoveryPathsFor, createAuth, createAuthAdmin, createAuthAuditReader, createDoAuthWiring, d1Executor, handleAuthDiscoveryRequest, handleAuthRequest, lunoraD1Adapter } from "@lunora/auth";']:[],...L(r,t),...P(a),...s?['import type { HyperdriveEngine } from "@lunora/hyperdrive/global";','import { createHyperdriveGlobalCtxDb } from "@lunora/hyperdrive/global";','import type { SqlCtxDbOptions, SqlExec } from "@lunora/sql-store";']:[],...j(o),...B(e.hasVectors),...c?['import type { DurableObjectNamespaceLike } from "@lunora/scheduler";','import { createScheduler } from "@lunora/scheduler";']:[],...l?['import type { R2BucketLike, R2S3Credentials, Storage } from "@lunora/storage";','import { createBucketStorage, createStorage } from "@lunora/storage";']:[],...n?['import { createWorkflowsRestClient } from "@lunora/workflow";']:[],..._(e),...M(e),"",...I(e.identity),...W(e),...a||s?['import schema from "../schema.js";']:[],...G(e.hasNotify),'import { LUNORA_CRONS } from "./crons.js";','import { LUNORA_FUNCTIONS } from "./functions.js";',...i?['import { createQueueCaptureSink, dispatchQueueBatch, shouldCaptureQueue } from "@lunora/queue";','import { LUNORA_QUEUE_REGISTRY } from "./queues.js";']:[],...e.wantsArchitecture?['import { architecture } from "./architecture.js";']:[],...h?['import { openApiSpec } from "./openapi.js";']:[],...u?['import { openRpcSpec } from "./openrpc.js";']:[],'import { createShardDO } from "./shard.js";',...e.hasVectors?['import { LUNORA_VECTOR_INDEXES } from "./vectors.js";']:[]]},$=e=>e.jurisdiction&&e.jurisdictionPinsAuth===!0?`
                 // The schema's jurisdiction pins the auth object like every other DO.
                 jurisdiction: ${JSON.stringify(e.jurisdiction)},`:"",U=e=>typeof e=="string"?`{ mode: { kind: ${JSON.stringify(e)} } }`:`{ mode: { field: ${JSON.stringify(e.field)}, kind: "shardBy" } }`,F=e=>[...e.tables.length>0?[`        const tableSharding = new Map<string, ShardingInfo>([
 ${e.tables.map(r=>`            [${JSON.stringify(r.name)}, ${U(r.shardMode)}],`).join(`
@@ -748,10 +748,10 @@ ${e.tables.map(r=>`            [${JSON.stringify(r.name)}, ${U(r.shardMode)}],`)
         }`]:[],...e.voiceAgents&&e.voiceAgents.length>0?[`        options.voiceAgents = {
 ${e.voiceAgents.map(r=>`            ${JSON.stringify(r.exportName)}: (env as Record<string, unknown>)[${JSON.stringify(r.bindingName)}] as ShardNamespaceLike,`).join(`
 `)}
-        };`]:[]],z=e=>["            cronJobs: LUNORA_CRONS,","            functions: LUNORA_FUNCTIONS,",...e.identity?[`            identity: lunoraIdentityContract.${e.identity.exportName},`]:[],...e.jurisdiction?[`            jurisdiction: ${JSON.stringify(e.jurisdiction)},`]:[],...e.wantsArchitecture?["            architecture,"]:[],...e.wantsOpenApi?["            openApiSpec,"]:[],...e.wantsOpenRpc?["            openRpcSpec,"]:[],...e.hasQueue?["            queue: (batch: unknown, queueEnv: unknown, _context: ExecutionContextLike, trigger: TriggerTrace): Promise<void> =>","                dispatchQueueBatch(batch as Parameters<typeof dispatchQueueBatch>[0], LUNORA_QUEUE_REGISTRY, {","                    capture: shouldCaptureQueue(queueEnv as Record<string, unknown>)",`                        ? createQueueCaptureSink(queueEnv as Record<string, unknown>${e.jurisdiction?`, { jurisdiction: ${JSON.stringify(e.jurisdiction)} }`:""})`,"                        : undefined,","                    env: queueEnv as Record<string, unknown>,","                    traceparent: trigger.traceparent,","                }),"]:[],"            ...(this.httpRouterApp ? { httpRouter: this.httpRouterApp } : {}),","            routes: this.routeMap,","            shardDO: this.shardSelector?.(env) ?? (undefined as unknown as ShardNamespaceLike),"],J=e=>e?`
+        };`]:[]],z=e=>["            cronJobs: LUNORA_CRONS,","            functions: LUNORA_FUNCTIONS,",...e.identity?[`            identity: lunoraIdentityContract.${e.identity.exportName},`]:[],...e.jurisdiction?[`            jurisdiction: ${JSON.stringify(e.jurisdiction)},`]:[],...e.wantsArchitecture?["            architecture,"]:[],...e.wantsOpenApi?["            openApiSpec,"]:[],...e.wantsOpenRpc?["            openRpcSpec,"]:[],...e.hasQueue?[`            queue: (batch: unknown, queueEnv: unknown, _context: ExecutionContextLike, trigger: TriggerTrace, ${e.liveStreams?"queueLive":"_live"}: Parameters<typeof dispatchQueueBatch>[2]["live"], queueFetch: Parameters<typeof dispatchQueueBatch>[2]["fetchImpl"]): Promise<void> =>`,"                dispatchQueueBatch(batch as Parameters<typeof dispatchQueueBatch>[0], LUNORA_QUEUE_REGISTRY, {","                    capture: shouldCaptureQueue(queueEnv as Record<string, unknown>)",`                        ? createQueueCaptureSink(queueEnv as Record<string, unknown>${e.jurisdiction?`, { jurisdiction: ${JSON.stringify(e.jurisdiction)} }`:""})`,"                        : undefined,","                    env: queueEnv as Record<string, unknown>,","                    traceparent: trigger.traceparent,","                    fetchImpl: queueFetch,",...e.liveStreams?["                    live: queueLive,"]:[],"                }),"]:[],"            ...(this.httpRouterApp ? { httpRouter: this.httpRouterApp } : {}),","            routes: this.routeMap,",...e.liveStreamsWithheld?["            liveStreams: false,"]:[],"            shardDO: this.shardSelector?.(env) ?? (undefined as unknown as ShardNamespaceLike),"],J=e=>e?`
 /** The identity memo per \`env\` object, owned by one assembled worker. */
 type IdentityMemoStore = WeakMap<object, ReturnType<typeof memoizeIdentity>>;
-`:"",K=e=>[...e.hasAuth?["AuthDeclaration"]:[],"ComposedApp",...e.hasGlobal?["GlobalDeclaration"]:[],"LunoraConfig",...e.hasScheduler?["SchedulerDeclaration"]:[],"Selector",...e.hasStorage?["StorageDeclaration"]:[]].toSorted((r,t)=>r.localeCompare(t)).join(", "),Z=e=>{const r=(e.hasVectors??!0)&&(e.vectorIndexCount??0)>0,t={...e,hasVectors:r},{hasAuth:a}=t,n=C(t),o=Q(t),i=a?`        let auth: LunoraAuth | null = null;
+`:"",K=e=>[...e.hasAuth?["AuthDeclaration"]:[],"ComposedApp",...e.hasGlobal?["GlobalDeclaration"]:[],"LunoraConfig",...e.hasScheduler?["SchedulerDeclaration"]:[],"Selector",...e.hasStorage?["StorageDeclaration"]:[]].toSorted((r,t)=>r.localeCompare(t)).join(", "),Z=e=>{const r=(e.hasVectors??!0)&&(e.vectorIndexCount??0)>0,t={...e,hasVectors:r},{hasAuth:a}=t,s=C(t),o=Q(t),i=a?`        let auth: LunoraAuth | null = null;
         let authInit: Promise<void> | null = null;
         // One memo per env for THIS assembled worker: a framework-hosted worker rebuilds its options per
         // request and must reuse it, but a second \`assemble()\` has its own auth closure and must not share.
@@ -809,8 +809,8 @@ type IdentityMemoStore = WeakMap<object, ReturnType<typeof memoizeIdentity>>;
                 throw error;
             }));
 `:"",l=a?`
-                await ensureAuth(env);`:"",s=a?"() => auth, identityMemos":"() => null",h=a?"getAuth: () => LunoraAuth | null, identityMemos: IdentityMemoStore":"_getAuth: () => null",u=t.hasFramework?`        const buildWorker = (env: Env): LunoraWorker =>
-            host ? withFrameworkWorker(host, (hostEnv) => this.buildWorkerOptions(hostEnv as Env, ${s})) : createWorker(this.buildWorkerOptions(env, ${s}));`:`        const buildWorker = (env: Env): LunoraWorker => createWorker(this.buildWorkerOptions(env, ${s}));`,y=t.hasFramework?"host?: FrameworkHostHandler":"",p=t.emailAgents??[],f=p.length>0?`        composed.email = dispatchAgentEmail([
+                await ensureAuth(env);`:"",n=a?"() => auth, identityMemos":"() => null",h=a?"getAuth: () => LunoraAuth | null, identityMemos: IdentityMemoStore":"_getAuth: () => null",u=t.hasFramework?`        const buildWorker = (env: Env): LunoraWorker =>
+            host ? withFrameworkWorker(host, (hostEnv) => this.buildWorkerOptions(hostEnv as Env, ${n})) : createWorker(this.buildWorkerOptions(env, ${n}));`:`        const buildWorker = (env: Env): LunoraWorker => createWorker(this.buildWorkerOptions(env, ${n}));`,y=t.hasFramework?"host?: FrameworkHostHandler":"",p=t.emailAgents??[],f=p.length>0?`        composed.email = dispatchAgentEmail([
 ${p.map(b=>`            { agent: lunoraAgentDefinitions.${b.exportName}, className: ${JSON.stringify(b.className)} },`).join(`
 `)}
         ]);
@@ -832,9 +832,9 @@ ${J(a)}${t.jurisdiction?`
 // \`@lunora/mail\` reads it to pin its shard RPC like every other DO path.
 declareAppJurisdiction(${JSON.stringify(t.jurisdiction)});
 `:""}
-${n.join(`
+${s.join(`
 
-`)}${n.length>0?`
+`)}${s.length>0?`
 
 `:""}/** The composed app: a Cloudflare module worker (\`fetch\` / \`scheduled\` / optional \`email\`) plus the \`ShardDO\` class binding. */
 interface ComposedApp extends LunoraWorker {
@@ -864,7 +864,7 @@ ${w}
 
     /** Build the shard DO + compose the worker (standalone or framework-hosted), wrapping the lazy per-isolate singletons + auth init. */
     private assemble(${y}): ComposedApp {
-        const ShardDO = createShardDO({${I(t)}});
+        const ShardDO = createShardDO({${q(t)}});
 
         // Per-isolate singletons: the worker (and auth instance) are expensive to
         // build, so the first request constructs them and every later request on