@lunora/codegen 1.0.0-alpha.5 → 1.0.0-alpha.50

package/dist/packem_shared/SCHEMA_SNAPSHOT_FILENAME-BqOtU2lC.mjs

@@ -1,922 +0,0 @@
-import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'node:fs';
-import { join, dirname } from 'node:path';
-import { Node, SyntaxKind, Project } from 'ts-morph';
-import { lintSchema } from './formatAdvisories-8NIv1k0I.mjs';
-import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall, discoverFunctions } from './discoverFunctions-DEgAcRuD.mjs';
-import discoverAuthApiCalls from './discoverAuthApiCalls-C35R6z0T.mjs';
-import { discoverContainers } from './CONTAINERS_FILENAME-0K-pjNb8.mjs';
-import discoverCrons from './discoverCrons-BL6iGuJ3.mjs';
-import discoverHttpRoutes from './discoverHttpRoutes-C978pBiG.mjs';
-import discoverInserts from './discoverInserts-CRQdXvHO.mjs';
-import discoverMaskProcedures, { discoverMaskMetadata } from './discoverMaskProcedures-B64zA740.mjs';
-import discoverMigrations from './discoverMigrations-Doj_-BAA.mjs';
-import discoverNondeterministicCalls from './discoverNondeterministicCalls-4KiPQxQU.mjs';
-import discoverQueries from './discoverQueries-BkIi0dBD.mjs';
-import discoverR2sqlCalls from './discoverR2sqlCalls-BpDqvcUn.mjs';
-import discoverRlsProcedures, { discoverRlsMetadata } from './discoverRlsMetadata-DpRB1HMe.mjs';
-import discoverSchema from './discoverSchema-DB_QrIQe.mjs';
-import discoverStorageRulesMetadata from './discoverStorageRulesMetadata-DAqJUxUv.mjs';
-import { e as enclosingExportName$1 } from './discover-ast-CT6BgBr4.mjs';
-import { discoverWorkflows } from './WORKFLOWS_FILENAME-DRDQdhfq.mjs';
-import { buildStorageColumns, emitDataModel, emitApi, emitServer, emitFunctions, emitShard, emitContainers, emitWorkflows, emitCrons, emitVectors, emitDrizzleSchema, emitSeed, emitWranglerCronTriggers } from './GENERATED_HEADER-DF1hQcix.mjs';
-import { emitApp } from './emitApp-Ci_hcJNO.mjs';
-import { buildOpenApiDocument, emitOpenApiModule } from './buildOpenApiDocument-Cns1EkCQ.mjs';
-import { buildOpenRpcDocument, emitOpenRpcModule } from './OPENRPC_VERSION-C7zKVeKi.mjs';
-import { buildSchemaSnapshot, serializeSchemaSnapshot } from './SCHEMA_SNAPSHOT_VERSION-DzLDbWk3.mjs';
-
-const HTTP_VERBS = /* @__PURE__ */ new Set(["delete", "get", "head", "options", "patch", "post", "put"]);
-const TERMINAL_STEPS = /* @__PURE__ */ new Set(["handler", "stream"]);
-const ADMIN_PATH_RE = /\/(?:_|admin|internal|superuser|sudo|root|debug)/iu;
-const GUARD_NAMES = /* @__PURE__ */ new Set([
-  "ADMIN_TOKEN",
-  "adminToken",
-  "assertAdmin",
-  "assertAuth",
-  "auth",
-  "Authorization",
-  "getSession",
-  "identity",
-  "isAdmin",
-  "requireAdmin",
-  "requireAuth",
-  "requireRole",
-  "verifyAdmin"
-]);
-const readRootVerb = (node) => {
-  if (!Node.isCallExpression(node)) {
-    return void 0;
-  }
-  const callee = node.getExpression();
-  if (!Node.isPropertyAccessExpression(callee) || !HTTP_VERBS.has(callee.getName())) {
-    return void 0;
-  }
-  const receiver = callee.getExpression();
-  if (!Node.isIdentifier(receiver) || receiver.getText() !== "httpRoute") {
-    return void 0;
-  }
-  const first = node.getArguments()[0];
-  if (!first || !Node.isStringLiteral(first)) {
-    return void 0;
-  }
-  return { method: callee.getName().toUpperCase(), path: first.getLiteralValue() };
-};
-const rootOfChain = (terminalCall) => {
-  const terminalCallee = terminalCall.getExpression();
-  if (!Node.isPropertyAccessExpression(terminalCallee)) {
-    return void 0;
-  }
-  let node = terminalCallee.getExpression();
-  while (Node.isCallExpression(node)) {
-    const callee = node.getExpression();
-    if (!Node.isPropertyAccessExpression(callee)) {
-      break;
-    }
-    if (HTTP_VERBS.has(callee.getName())) {
-      break;
-    }
-    node = callee.getExpression();
-  }
-  return readRootVerb(node);
-};
-const handlerReferencesGuard = (handlerBody) => {
-  for (const access of handlerBody.getDescendantsOfKind(SyntaxKind.PropertyAccessExpression)) {
-    if (GUARD_NAMES.has(access.getName())) {
-      return true;
-    }
-  }
-  for (const call of handlerBody.getDescendantsOfKind(SyntaxKind.CallExpression)) {
-    const callee = call.getExpression();
-    if (Node.isIdentifier(callee) && GUARD_NAMES.has(callee.getText())) {
-      return true;
-    }
-  }
-  return false;
-};
-const adminRouteFromDeclaration = (declaration, relativePath) => {
-  const initializer = declaration.getInitializer();
-  if (!initializer || !Node.isCallExpression(initializer)) {
-    return void 0;
-  }
-  const callee = initializer.getExpression();
-  if (!Node.isPropertyAccessExpression(callee) || !TERMINAL_STEPS.has(callee.getName())) {
-    return void 0;
-  }
-  const root = rootOfChain(initializer);
-  if (!root || !ADMIN_PATH_RE.test(root.path)) {
-    return void 0;
-  }
-  const handlerArgument = initializer.getArguments()[0];
-  const usesGuard = handlerArgument !== void 0 && (Node.isArrowFunction(handlerArgument) || Node.isFunctionExpression(handlerArgument)) && handlerReferencesGuard(handlerArgument);
-  return { exportName: declaration.getName(), file: relativePath, method: root.method, path: root.path, usesGuard };
-};
-const adminRoutesInSourceFile = (sourceFile, relativePath) => {
-  const found = [];
-  for (const statement of sourceFile.getVariableStatements()) {
-    if (!statement.isExported()) {
-      continue;
-    }
-    for (const declaration of statement.getDeclarations()) {
-      const ir = adminRouteFromDeclaration(declaration, relativePath);
-      if (ir) {
-        found.push(ir);
-      }
-    }
-  }
-  return found;
-};
-const discoverAdminRoutes = (project, lunoraDirectory) => {
-  const routes = [];
-  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
-    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
-    routes.push(...adminRoutesInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
-  }
-  return routes;
-};
-
-const BOUND_RE = /\.check\(|\.meta\(|length|max/iu;
-const ANY_VALIDATOR_RE = /\bv\.any\s*\(/u;
-const STRING_VALIDATOR_RE = /\bv\.string\s*\(/u;
-const isAnyValidator = (text) => ANY_VALIDATOR_RE.test(text);
-const isUnboundedString = (text) => STRING_VALIDATOR_RE.test(text) && !BOUND_RE.test(text);
-const argsObjectOfFactory = (call) => {
-  const first = call.getArguments()[0];
-  if (!first || !Node.isObjectLiteralExpression(first)) {
-    return void 0;
-  }
-  const argsProperty = first.getProperty("args");
-  if (!argsProperty || !Node.isPropertyAssignment(argsProperty)) {
-    return void 0;
-  }
-  const initializer = argsProperty.getInitializer();
-  return initializer && Node.isObjectLiteralExpression(initializer) ? initializer : void 0;
-};
-const inputObjectsInChain = (receiver) => {
-  const objects = [];
-  let node = receiver;
-  while (Node.isCallExpression(node)) {
-    const chainCallee = node.getExpression();
-    if (!Node.isPropertyAccessExpression(chainCallee)) {
-      break;
-    }
-    if (chainCallee.getName() === "input") {
-      const argument = node.getArguments()[0];
-      if (argument && Node.isObjectLiteralExpression(argument)) {
-        objects.push(argument);
-      }
-    }
-    node = chainCallee.getExpression();
-  }
-  return objects;
-};
-const classifyArgs = (objects) => {
-  const anyArgs = [];
-  const unboundedStringArgs = [];
-  for (const object of objects) {
-    for (const property of object.getProperties()) {
-      if (!Node.isPropertyAssignment(property)) {
-        continue;
-      }
-      const initializer = property.getInitializer();
-      if (!initializer) {
-        continue;
-      }
-      const text = initializer.getText();
-      const name = property.getName();
-      if (isAnyValidator(text)) {
-        anyArgs.push(name);
-      } else if (isUnboundedString(text)) {
-        unboundedStringArgs.push(name);
-      }
-    }
-  }
-  return { anyArgs, unboundedStringArgs };
-};
-const argumentValidatorIrFromDeclaration = (declaration, relativePath) => {
-  const initializer = declaration.getInitializer();
-  if (!initializer || !Node.isCallExpression(initializer)) {
-    return void 0;
-  }
-  const classified = classifyProcedureCall(initializer);
-  if (classified?.visibility !== "public") {
-    return void 0;
-  }
-  const objects = classified.receiver ? inputObjectsInChain(classified.receiver) : [argsObjectOfFactory(initializer)].filter((object) => object !== void 0);
-  const { anyArgs, unboundedStringArgs } = classifyArgs(objects);
-  if (anyArgs.length === 0 && unboundedStringArgs.length === 0) {
-    return void 0;
-  }
-  return {
-    anyArgs,
-    exportName: declaration.getName(),
-    file: relativePath,
-    line: initializer.getStartLineNumber(),
-    unboundedStringArgs
-  };
-};
-const argumentValidatorsInSourceFile = (sourceFile, relativePath) => {
-  const found = [];
-  for (const statement of sourceFile.getVariableStatements()) {
-    if (!statement.isExported()) {
-      continue;
-    }
-    for (const declaration of statement.getDeclarations()) {
-      const ir = argumentValidatorIrFromDeclaration(declaration, relativePath);
-      if (ir) {
-        found.push(ir);
-      }
-    }
-  }
-  return found;
-};
-const discoverArgumentValidators = (project, lunoraDirectory) => {
-  const procedures = [];
-  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
-    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
-    procedures.push(...argumentValidatorsInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
-  }
-  return procedures;
-};
-
-const PROBES = {
-  ai: { contextProperty: "ai", moduleSpecifier: "@lunora/ai" },
-  analytics: { contextProperty: "analytics", moduleSpecifier: "@lunora/analytics" },
-  browser: { contextProperty: "browser", moduleSpecifier: "@lunora/browser" },
-  hyperdrive: { contextProperty: "sql", moduleSpecifier: "@lunora/hyperdrive" },
-  images: { contextProperty: "images", moduleSpecifier: "@lunora/images" },
-  kv: { contextProperty: "kv", moduleSpecifier: "@lunora/kv" },
-  mail: { moduleSpecifier: "@lunora/mail" },
-  payments: { contextProperty: "payments", moduleSpecifier: "@lunora/payment" },
-  pipelines: { contextProperty: "pipelines", moduleSpecifier: "@lunora/pipelines" },
-  r2sql: { contextProperty: "r2sql", moduleSpecifier: "@lunora/r2sql" },
-  scheduler: { contextProperty: "scheduler", moduleSpecifier: "@lunora/scheduler" },
-  storage: { contextProperty: "storage", moduleSpecifier: "@lunora/storage" },
-  vectors: { contextProperty: "vectors", moduleSpecifier: "@lunora/vectors" },
-  workflows: { contextProperty: "workflows", moduleSpecifier: "@lunora/workflow" }
-};
-const readsContextProperty = (sourceFile, property) => {
-  const reachesContext = (receiver) => Node.isIdentifier(receiver) && receiver.getText() === "ctx";
-  const directAccess = sourceFile.getDescendantsOfKind(SyntaxKind.PropertyAccessExpression).some((access) => access.getName() === property && reachesContext(access.getExpression()));
-  if (directAccess) {
-    return true;
-  }
-  return sourceFile.getDescendantsOfKind(SyntaxKind.VariableDeclaration).some((declaration) => {
-    const initializer = declaration.getInitializer();
-    const nameNode = declaration.getNameNode();
-    if (initializer === void 0 || !reachesContext(initializer) || !Node.isObjectBindingPattern(nameNode)) {
-      return false;
-    }
-    return nameNode.getElements().some((element) => element.getPropertyNameNode()?.getText() === property || element.getName() === property);
-  });
-};
-const discoverFeatureUsage = (project, lunoraDirectory) => {
-  const usage = {
-    ai: false,
-    analytics: false,
-    browser: false,
-    hyperdrive: false,
-    images: false,
-    kv: false,
-    mail: false,
-    payments: false,
-    pipelines: false,
-    r2sql: false,
-    scheduler: false,
-    storage: false,
-    vectors: false,
-    workflows: false
-  };
-  const keys = Object.keys(PROBES);
-  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
-    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
-    const importSpecifiers = new Set(sourceFile.getImportDeclarations().map((declaration) => declaration.getModuleSpecifierValue()));
-    for (const key of keys) {
-      if (usage[key]) {
-        continue;
-      }
-      const probe = PROBES[key];
-      if (importSpecifiers.has(probe.moduleSpecifier)) {
-        usage[key] = true;
-        continue;
-      }
-      if (probe.contextProperty !== void 0 && readsContextProperty(sourceFile, probe.contextProperty)) {
-        usage[key] = true;
-      }
-    }
-    if (keys.every((key) => usage[key])) {
-      break;
-    }
-  }
-  return usage;
-};
-const buildStudioFeatures = (usage, signals) => {
-  return {
-    mail: usage.mail || signals.dependencies.has("@lunora/mail"),
-    payments: usage.payments || signals.dependencies.has("@lunora/payment"),
-    scheduler: usage.scheduler || signals.cronCount > 0 || signals.dependencies.has("@lunora/scheduler"),
-    storage: usage.storage || signals.storageRuleCount > 0 || signals.storageColumnCount > 0 || signals.dependencies.has("@lunora/storage"),
-    vectors: usage.vectors || signals.vectorIndexCount > 0 || signals.dependencies.has("@lunora/vectors"),
-    workflows: usage.workflows || signals.workflowCount > 0 || signals.dependencies.has("@lunora/workflow")
-  };
-};
-
-const discoverPackageDependencies = (projectRoot) => {
-  const manifestPath = join(projectRoot, "package.json");
-  if (!existsSync(manifestPath)) {
-    return /* @__PURE__ */ new Set();
-  }
-  try {
-    const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
-    const names = /* @__PURE__ */ new Set();
-    for (const field of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
-      const section = manifest[field];
-      if (section !== null && typeof section === "object") {
-        for (const name of Object.keys(section)) {
-          names.add(name);
-        }
-      }
-    }
-    return names;
-  } catch {
-    return /* @__PURE__ */ new Set();
-  }
-};
-
-const MIDDLEWARE_FLAGS = {
-  dbRateLimit: "usesRateLimit",
-  mask: "usesMask",
-  rateLimit: "usesRateLimit",
-  rls: "usesRls",
-  verifyTurnstile: "usesCaptcha",
-  verifyTurnstileMiddleware: "usesCaptcha"
-};
-const USER_TABLE_RE = /account|credential|member|passkey|session|user/iu;
-const calleeNameOf = (call) => {
-  const callee = call.getExpression();
-  if (Node.isIdentifier(callee)) {
-    return callee.getText();
-  }
-  if (Node.isPropertyAccessExpression(callee)) {
-    return callee.getName();
-  }
-  return void 0;
-};
-const protectPublicFlags = (call) => {
-  const argument = call.getArguments()[0];
-  if (!argument || !Node.isObjectLiteralExpression(argument)) {
-    return { usesCaptcha: false, usesRateLimit: false };
-  }
-  return { usesCaptcha: Boolean(argument.getProperty("captcha")), usesRateLimit: Boolean(argument.getProperty("rateLimit")) };
-};
-const resolveUseArgumentCall = (argument) => {
-  if (Node.isCallExpression(argument)) {
-    return argument;
-  }
-  if (!Node.isIdentifier(argument)) {
-    return void 0;
-  }
-  const declaration = argument.getSourceFile().getVariableDeclaration(argument.getText());
-  const initializer = declaration?.getInitializer();
-  return initializer && Node.isCallExpression(initializer) ? initializer : void 0;
-};
-const NO_PROTECTIONS = { usesCaptcha: false, usesMask: false, usesRateLimit: false, usesRls: false };
-const useStepProtections = (useArgument) => {
-  const argument = resolveUseArgumentCall(useArgument);
-  const name = argument ? calleeNameOf(argument) : void 0;
-  if (argument && name === "protectPublic") {
-    const bundle = protectPublicFlags(argument);
-    return { ...NO_PROTECTIONS, usesCaptcha: bundle.usesCaptcha, usesRateLimit: bundle.usesRateLimit };
-  }
-  if (name !== void 0 && name in MIDDLEWARE_FLAGS) {
-    return { ...NO_PROTECTIONS, [MIDDLEWARE_FLAGS[name]]: true };
-  }
-  return NO_PROTECTIONS;
-};
-const protectionsInChain = (receiver) => {
-  const protections = { ...NO_PROTECTIONS };
-  let node = receiver;
-  while (Node.isCallExpression(node)) {
-    const chainCallee = node.getExpression();
-    if (!Node.isPropertyAccessExpression(chainCallee)) {
-      break;
-    }
-    const useArgument = chainCallee.getName() === "use" ? node.getArguments()[0] : void 0;
-    if (useArgument) {
-      const step = useStepProtections(useArgument);
-      protections.usesCaptcha ||= step.usesCaptcha;
-      protections.usesMask ||= step.usesMask;
-      protections.usesRateLimit ||= step.usesRateLimit;
-      protections.usesRls ||= step.usesRls;
-    }
-    node = chainCallee.getExpression();
-  }
-  return protections;
-};
-const isUserTableInsert = (call) => {
-  const callee = call.getExpression();
-  if (!Node.isPropertyAccessExpression(callee) || callee.getName() !== "insert") {
-    return false;
-  }
-  const receiver = callee.getExpression();
-  const onDatabase = Node.isPropertyAccessExpression(receiver) ? receiver.getName() === "db" : Node.isIdentifier(receiver) && receiver.getText() === "db";
-  if (!onDatabase) {
-    return false;
-  }
-  const tableArgument = call.getArguments()[0];
-  return Boolean(tableArgument && Node.isStringLiteral(tableArgument) && USER_TABLE_RE.test(tableArgument.getLiteralText()));
-};
-const referencesMail = (declaration) => declaration.getDescendantsOfKind(SyntaxKind.PropertyAccessExpression).some((access) => {
-  const name = access.getName();
-  if (name !== "mail" && name !== "email") {
-    return false;
-  }
-  const receiver = access.getExpression();
-  return Node.isIdentifier(receiver) && receiver.getText() === "ctx";
-});
-const behaviourOf = (declaration) => {
-  let writesUserTable = false;
-  for (const call of declaration.getDescendantsOfKind(SyntaxKind.CallExpression)) {
-    if (isUserTableInsert(call)) {
-      writesUserTable = true;
-      break;
-    }
-  }
-  return { callsMail: referencesMail(declaration), writesUserTable };
-};
-const middlewareIrFromDeclaration = (declaration, relativePath) => {
-  const initializer = declaration.getInitializer();
-  if (!initializer || !Node.isCallExpression(initializer)) {
-    return void 0;
-  }
-  const classified = classifyProcedureCall(initializer);
-  if (!classified || classified.kind !== "query" && classified.kind !== "mutation" && classified.kind !== "action") {
-    return void 0;
-  }
-  const protections = classified.receiver ? protectionsInChain(classified.receiver) : { usesCaptcha: false, usesMask: false, usesRateLimit: false, usesRls: false };
-  const { callsMail, writesUserTable } = behaviourOf(declaration);
-  return {
-    callsMail,
-    exportName: declaration.getName(),
-    file: relativePath,
-    kind: classified.kind,
-    usesCaptcha: protections.usesCaptcha,
-    usesMask: protections.usesMask,
-    usesRateLimit: protections.usesRateLimit,
-    usesRls: protections.usesRls,
-    visibility: classified.visibility,
-    writesUserTable
-  };
-};
-const middlewareInSourceFile = (sourceFile, relativePath) => {
-  const found = [];
-  for (const statement of sourceFile.getVariableStatements()) {
-    if (!statement.isExported()) {
-      continue;
-    }
-    for (const declaration of statement.getDeclarations()) {
-      const ir = middlewareIrFromDeclaration(declaration, relativePath);
-      if (ir) {
-        found.push(ir);
-      }
-    }
-  }
-  return found;
-};
-const discoverProcedureMiddleware = (project, lunoraDirectory) => {
-  const procedures = [];
-  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
-    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
-    procedures.push(...middlewareInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
-  }
-  return procedures;
-};
-
-const HIGH_ENTROPY_TOKEN_RE = /[\w+/=-]{40,}/u;
-const LOWER_RE = /[a-z]/u;
-const UPPER_RE = /[A-Z]/u;
-const DIGIT_RE = /\d/u;
-const HEX_SECRET_RE = /\b(?:[\da-f]{32,}|[\dA-F]{32,})\b/u;
-const isHighEntropy = (value) => {
-  const token = HIGH_ENTROPY_TOKEN_RE.exec(value)?.[0];
-  if (token === void 0) {
-    return false;
-  }
-  return LOWER_RE.test(token) && UPPER_RE.test(token) && DIGIT_RE.test(token);
-};
-const isHexSecret = (value) => HEX_SECRET_RE.test(value);
-const STRIPE_LIVE_KEY_RE = /\b(?:sk|rk)_live_[\dA-Za-z]{20,}/u;
-const AWS_ACCESS_KEY_RE = /\bAKIA[\dA-Z]{16}\b/u;
-const GITHUB_TOKEN_RE = /\bgh[posru]_[\dA-Za-z]{36,}/u;
-const OPENAI_KEY_RE = /\bsk-[\dA-Za-z]{32,}/u;
-const SLACK_TOKEN_RE = /\bxox[abprs]-[\dA-Za-z-]{10,}/u;
-const PRIVATE_KEY_RE = /-----BEGIN(?: [A-Z]+)? PRIVATE KEY-----/u;
-const SECRET_RULES = [
-  { kind: "stripe_live_key", test: (value) => STRIPE_LIVE_KEY_RE.test(value) },
-  { kind: "aws_access_key", test: (value) => AWS_ACCESS_KEY_RE.test(value) },
-  { kind: "github_token", test: (value) => GITHUB_TOKEN_RE.test(value) },
-  { kind: "openai_key", test: (value) => OPENAI_KEY_RE.test(value) },
-  { kind: "slack_token", test: (value) => SLACK_TOKEN_RE.test(value) },
-  { kind: "private_key", test: (value) => PRIVATE_KEY_RE.test(value) },
-  { kind: "high_entropy", test: isHighEntropy },
-  { kind: "hex_secret", test: isHexSecret }
-];
-const secretKindOf = (value) => SECRET_RULES.find((rule) => rule.test(value))?.kind;
-const redact = (value) => `${value.slice(0, 4)}…(${String(value.length)} chars)`;
-const literalValueOf = (node) => {
-  if (Node.isStringLiteral(node) || Node.isNoSubstitutionTemplateLiteral(node)) {
-    return node.getLiteralText();
-  }
-  if (Node.isBinaryExpression(node) && node.getOperatorToken().getKind() === SyntaxKind.PlusToken) {
-    const left = literalValueOf(node.getLeft());
-    const right = literalValueOf(node.getRight());
-    return left !== void 0 && right !== void 0 ? left + right : void 0;
-  }
-  return void 0;
-};
-const isConcatenationOperand = (node) => {
-  const parent = node.getParent();
-  return parent !== void 0 && Node.isBinaryExpression(parent) && parent.getOperatorToken().getKind() === SyntaxKind.PlusToken;
-};
-const secretsInSourceFile = (sourceFile, relativePath) => {
-  const found = [];
-  const nodes = [
-    // Top-level `+` concatenations are folded; their string-literal operands are
-    // skipped below so a secret split across literals is reported once, at the root.
-    ...sourceFile.getDescendantsOfKind(SyntaxKind.BinaryExpression),
-    ...sourceFile.getDescendantsOfKind(SyntaxKind.StringLiteral),
-    ...sourceFile.getDescendantsOfKind(SyntaxKind.NoSubstitutionTemplateLiteral)
-  ];
-  for (const node of nodes) {
-    if (isConcatenationOperand(node)) {
-      continue;
-    }
-    const value = literalValueOf(node);
-    if (value === void 0) {
-      continue;
-    }
-    const kind = secretKindOf(value);
-    if (kind !== void 0) {
-      found.push({ file: relativePath, kind, line: node.getStartLineNumber(), preview: redact(value) });
-    }
-  }
-  return found;
-};
-const discoverSecrets = (project, lunoraDirectory) => {
-  const secrets = [];
-  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
-    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
-    secrets.push(...secretsInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
-  }
-  return secrets;
-};
-
-const SQL_TEXT_METHODS = /* @__PURE__ */ new Set(["query", "unsafe"]);
-const isContextSqlTextCallee = (node) => {
-  if (!Node.isPropertyAccessExpression(node) || !SQL_TEXT_METHODS.has(node.getName())) {
-    return false;
-  }
-  const sqlAccess = node.getExpression();
-  if (!Node.isPropertyAccessExpression(sqlAccess) || sqlAccess.getName() !== "sql") {
-    return false;
-  }
-  const receiver = sqlAccess.getExpression();
-  return Node.isIdentifier(receiver) && receiver.getText() === "ctx";
-};
-const isStringBuildingText = (expression) => Node.isBinaryExpression(expression) || Node.isTemplateExpression(expression);
-const enclosingExportName = (node) => {
-  const declaration = node.getFirstAncestorByKind(SyntaxKind.VariableDeclaration);
-  return declaration?.getName() ?? "<module>";
-};
-const interpolationInCall = (call, relativePath) => {
-  if (!isContextSqlTextCallee(call.getExpression())) {
-    return void 0;
-  }
-  const text = call.getArguments()[0];
-  if (!text || !isStringBuildingText(text)) {
-    return void 0;
-  }
-  return { exportName: enclosingExportName(call), file: relativePath, line: text.getStartLineNumber() };
-};
-const interpolationsInSourceFile = (sourceFile, relativePath) => {
-  const found = [];
-  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
-    const interpolation = interpolationInCall(call, relativePath);
-    if (interpolation) {
-      found.push(interpolation);
-    }
-  }
-  return found;
-};
-const discoverSqlInterpolation = (project, lunoraDirectory) => {
-  const interpolations = [];
-  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
-    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
-    interpolations.push(...interpolationsInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
-  }
-  return interpolations;
-};
-
-const isWorkflowGetCall = (call) => {
-  const callee = call.getExpression();
-  if (!Node.isPropertyAccessExpression(callee) || callee.getName() !== "get") {
-    return false;
-  }
-  const receiver = callee.getExpression();
-  if (Node.isPropertyAccessExpression(receiver)) {
-    return receiver.getName() === "workflows";
-  }
-  return Node.isIdentifier(receiver) && receiver.getText() === "workflows";
-};
-const workflowOf = (call) => {
-  const argument = call.getArguments()[0];
-  return argument && Node.isStringLiteral(argument) ? argument.getLiteralText() : "";
-};
-const discoverWorkflowCalls = (project, lunoraDirectory) => {
-  const calls = [];
-  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
-    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
-    const relativePath = lunoraRelativePath(lunoraDirectory, filePath);
-    for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
-      if (!isWorkflowGetCall(call)) {
-        continue;
-      }
-      const exportName = enclosingExportName$1(call);
-      if (exportName === "") {
-        continue;
-      }
-      calls.push({ exportName, file: relativePath, line: call.getStartLineNumber(), workflow: workflowOf(call) });
-    }
-  }
-  return calls;
-};
-
-const SCHEMA_SNAPSHOT_FILENAME = ".lunora-schema.json";
-const writeIfChanged = (filePath, content) => {
-  if (existsSync(filePath)) {
-    const existing = readFileSync(filePath, "utf8");
-    if (existing === content) {
-      return;
-    }
-  }
-  writeFileSync(filePath, content, "utf8");
-};
-const writeIfPresent = (filePath, content) => {
-  if (content !== "") {
-    writeIfChanged(filePath, content);
-  }
-};
-const readProjectVersion = (projectRoot) => {
-  const manifestPath = join(projectRoot, "package.json");
-  if (!existsSync(manifestPath)) {
-    return void 0;
-  }
-  try {
-    const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
-    return typeof manifest["version"] === "string" && manifest["version"] !== "" ? manifest["version"] : void 0;
-  } catch {
-    return void 0;
-  }
-};
-const findTsconfig = (startPath) => {
-  let directory = existsSync(startPath) ? startPath : dirname(startPath);
-  while (directory && directory !== dirname(directory)) {
-    const candidate = join(directory, "tsconfig.json");
-    if (existsSync(candidate)) {
-      return candidate;
-    }
-    directory = dirname(directory);
-  }
-  return void 0;
-};
-const toPosixPath = (path) => path.replaceAll("\\", "/");
-const createCodegenProject = (lunoraDirectory) => {
-  const tsconfigPath = findTsconfig(lunoraDirectory);
-  return tsconfigPath ? new Project({ skipAddingFilesFromTsConfig: false, tsConfigFilePath: tsconfigPath, useInMemoryFileSystem: false }) : new Project({ skipAddingFilesFromTsConfig: true, useInMemoryFileSystem: false });
-};
-const refreshCodegenProject = (project, lunoraDirectory) => {
-  const diskPaths = listLunoraSourceFiles(lunoraDirectory);
-  const schemaPath = join(lunoraDirectory, "schema.ts");
-  if (existsSync(schemaPath)) {
-    diskPaths.push(schemaPath);
-  }
-  for (const path of diskPaths) {
-    const existing = project.getSourceFile(path);
-    if (existing === void 0) {
-      project.addSourceFileAtPath(path);
-    } else {
-      existing.refreshFromFileSystemSync();
-    }
-  }
-  const onDisk = new Set(diskPaths.map((path) => toPosixPath(path)));
-  const lunoraRoot = toPosixPath(lunoraDirectory);
-  const lunoraPrefix = `${lunoraRoot}/`;
-  for (const sourceFile of project.getSourceFiles()) {
-    const filePath = sourceFile.getFilePath();
-    if ((filePath === lunoraRoot || filePath.startsWith(lunoraPrefix)) && !onDisk.has(filePath)) {
-      project.removeSourceFile(sourceFile);
-    }
-  }
-};
-const runCodegen = (options) => {
-  const lunoraDirectory = join(options.projectRoot, options.lunoraDirectory ?? "lunora");
-  const schemaPath = join(lunoraDirectory, "schema.ts");
-  if (!existsSync(schemaPath)) {
-    throw new Error(`schema.ts not found at ${schemaPath}`);
-  }
-  const project = options.project ?? createCodegenProject(lunoraDirectory);
-  const schema = discoverSchema(project, schemaPath);
-  const functions = discoverFunctions(project, lunoraDirectory);
-  const httpRoutes = discoverHttpRoutes(project, lunoraDirectory);
-  const migrations = discoverMigrations(project, lunoraDirectory);
-  const workflows = discoverWorkflows(project, lunoraDirectory);
-  const crons = discoverCrons(project, lunoraDirectory, workflows);
-  const containers = discoverContainers(project, lunoraDirectory);
-  const advisories = options.lint === false ? [] : lintSchema(
-    schema,
-    discoverQueries(project, lunoraDirectory),
-    discoverInserts(project, lunoraDirectory),
-    discoverAuthApiCalls(project, lunoraDirectory),
-    discoverRlsProcedures(project, lunoraDirectory),
-    containers,
-    workflows,
-    discoverWorkflowCalls(project, lunoraDirectory),
-    discoverMaskProcedures(project, lunoraDirectory),
-    discoverNondeterministicCalls(project, lunoraDirectory),
-    discoverProcedureMiddleware(project, lunoraDirectory),
-    discoverArgumentValidators(project, lunoraDirectory),
-    discoverSecrets(project, lunoraDirectory),
-    discoverSqlInterpolation(project, lunoraDirectory),
-    discoverAdminRoutes(project, lunoraDirectory),
-    discoverR2sqlCalls(project, lunoraDirectory)
-  );
-  const rlsMetadata = discoverRlsMetadata(project, lunoraDirectory);
-  const maskMetadata = discoverMaskMetadata(project, lunoraDirectory);
-  const storageRulesMetadata = discoverStorageRulesMetadata(project, lunoraDirectory);
-  const featureUsage = discoverFeatureUsage(project, lunoraDirectory);
-  const hasAi = featureUsage.ai;
-  const hasPayments = featureUsage.payments;
-  const hasKv = featureUsage.kv;
-  const hasHyperdrive = featureUsage.hyperdrive;
-  const hasBrowser = featureUsage.browser;
-  const hasImages = featureUsage.images;
-  const hasAnalytics = featureUsage.analytics;
-  const hasPipelines = featureUsage.pipelines;
-  const hasR2sql = featureUsage.r2sql;
-  const dependencies = discoverPackageDependencies(options.projectRoot);
-  const studioFeatures = buildStudioFeatures(featureUsage, {
-    cronCount: crons.length,
-    dependencies,
-    storageColumnCount: Object.keys(buildStorageColumns(schema)).length,
-    storageRuleCount: storageRulesMetadata.rules.length,
-    vectorIndexCount: schema.vectorIndexes.length,
-    workflowCount: workflows.length
-  });
-  const useUmbrella = dependencies.has("lunorash");
-  const dataModelContent = emitDataModel(schema, useUmbrella);
-  const apiContent = emitApi(functions, workflows, useUmbrella);
-  const serverContent = emitServer({
-    containers,
-    hasAi,
-    hasAnalytics,
-    hasBrowser,
-    hasHyperdrive,
-    hasImages,
-    hasKv,
-    hasPayments,
-    hasPipelines,
-    hasR2sql,
-    schema,
-    storageRuleBuckets: storageRulesMetadata.rules.map((rule) => rule.bucket),
-    useUmbrella,
-    workflows
-  });
-  const functionsContent = emitFunctions(functions, migrations);
-  const shardContent = emitShard({
-    advisories,
-    containers,
-    hasAi,
-    hasAnalytics,
-    hasBrowser,
-    hasHyperdrive,
-    hasImages,
-    hasKv,
-    hasPayments,
-    hasR2sql,
-    maskMetadata,
-    rlsMetadata,
-    schema,
-    storageRules: storageRulesMetadata,
-    studioFeatures,
-    useUmbrella,
-    workflows
-  });
-  const containersContent = emitContainers(containers);
-  const workflowsContent = emitWorkflows(workflows);
-  const cronsContent = emitCrons(crons);
-  const vectorsContent = emitVectors(schema.vectorIndexes);
-  const drizzleFiles = emitDrizzleSchema(schema, useUmbrella);
-  const seedContent = emitSeed(dependencies.has("@lunora/seed"));
-  const apiSpec = options.apiSpec ?? "openapi";
-  const wantsOpenApi = apiSpec === "openapi" || apiSpec === "both";
-  const wantsOpenRpc = apiSpec === "openrpc" || apiSpec === "both";
-  const appContent = emitApp({
-    hasAi,
-    hasAnalytics,
-    hasAuth: dependencies.has("@lunora/auth"),
-    hasBrowser,
-    // Worker-composition framework adapters expose a `withLunora` over
-    // `withFrameworkWorker`; when one is installed, surface `.buildFrameworkWorker()`.
-    hasFramework: dependencies.has("@lunora/astro") || dependencies.has("@lunora/svelte") || dependencies.has("@lunora/vue"),
-    // `hasGlobal` means **D1-backed** global tables (the `.global()` / D1
-    // app-builder wiring); Hyperdrive-backed globals are gated separately by
-    // `hasHyperdriveGlobal` so an app picks the right binding+package.
-    hasGlobal: schema.tables.some((table) => table.shardMode === "global" && table.globalBackend !== "hyperdrive"),
-    hasHyperdrive,
-    hasHyperdriveGlobal: schema.tables.some((table) => table.shardMode === "global" && table.globalBackend === "hyperdrive"),
-    hasImages,
-    hasKv,
-    hasPayments,
-    hasR2sql,
-    hasScheduler: studioFeatures.scheduler,
-    hasStorage: studioFeatures.storage,
-    hasVectors: schema.vectorIndexes.length > 0,
-    hasWorkflow: workflows.length > 0,
-    useUmbrella,
-    wantsOpenApi,
-    wantsOpenRpc
-  });
-  const projectVersion = readProjectVersion(options.projectRoot);
-  const openApiDocument = buildOpenApiDocument({ functions, httpRoutes, version: projectVersion });
-  const openRpcDocument = buildOpenRpcDocument({ functions, version: projectVersion });
-  const openApiContent = `${JSON.stringify(openApiDocument, void 0, 2)}
-`;
-  const openRpcContent = `${JSON.stringify(openRpcDocument, void 0, 2)}
-`;
-  const openApiModuleContent = emitOpenApiModule(openApiDocument);
-  const openRpcModuleContent = emitOpenRpcModule(openRpcDocument);
-  const schemaSnapshot = buildSchemaSnapshot(
-    schema,
-    migrations.map((migration) => migration.id)
-  );
-  const schemaSnapshotPath = join(lunoraDirectory, SCHEMA_SNAPSHOT_FILENAME);
-  const schemaSnapshotExists = existsSync(schemaSnapshotPath);
-  const outputDirectory = join(lunoraDirectory, "_generated");
-  if (!options.dryRun) {
-    if (!existsSync(outputDirectory)) {
-      mkdirSync(outputDirectory, { recursive: true });
-    }
-    writeIfChanged(join(outputDirectory, "app.ts"), appContent);
-    writeIfChanged(join(outputDirectory, "dataModel.ts"), dataModelContent);
-    writeIfChanged(join(outputDirectory, "api.ts"), apiContent);
-    writeIfChanged(join(outputDirectory, "server.ts"), serverContent);
-    writeIfChanged(join(outputDirectory, "functions.ts"), functionsContent);
-    writeIfChanged(join(outputDirectory, "shard.ts"), shardContent);
-    writeIfChanged(join(outputDirectory, "crons.ts"), cronsContent);
-    writeIfChanged(join(outputDirectory, "vectors.ts"), vectorsContent);
-    writeIfChanged(join(outputDirectory, "drizzle.global.ts"), drizzleFiles.global);
-    writeIfChanged(join(outputDirectory, "drizzle.shard.ts"), drizzleFiles.shard);
-    writeIfPresent(join(outputDirectory, "containers.ts"), containersContent);
-    writeIfPresent(join(outputDirectory, "workflows.ts"), workflowsContent);
-    writeIfPresent(join(outputDirectory, "seed.ts"), seedContent);
-    if (wantsOpenApi) {
-      writeIfChanged(join(outputDirectory, "openapi.json"), openApiContent);
-      writeIfChanged(join(outputDirectory, "openapi.ts"), openApiModuleContent);
-    }
-    if (wantsOpenRpc) {
-      writeIfChanged(join(outputDirectory, "openrpc.json"), openRpcContent);
-      writeIfChanged(join(outputDirectory, "openrpc.ts"), openRpcModuleContent);
-    }
-    if (!schemaSnapshotExists || options.updateSchemaBaseline === true) {
-      writeIfChanged(schemaSnapshotPath, serializeSchemaSnapshot(schemaSnapshot));
-    }
-  }
-  return {
-    advisories,
-    containers,
-    cronTriggers: emitWranglerCronTriggers(crons),
-    generated: {
-      api: apiContent,
-      app: appContent,
-      containers: containersContent,
-      crons: cronsContent,
-      dataModel: dataModelContent,
-      drizzleGlobal: drizzleFiles.global,
-      drizzleShard: drizzleFiles.shard,
-      functions: functionsContent,
-      openApi: openApiContent,
-      openApiModule: openApiModuleContent,
-      openRpc: openRpcContent,
-      openRpcModule: openRpcModuleContent,
-      seed: seedContent,
-      server: serverContent,
-      shard: shardContent,
-      vectors: vectorsContent,
-      workflows: workflowsContent
-    },
-    outputDirectory,
-    schemaSnapshot,
-    schemaSnapshotPath,
-    workflows
-  };
-};
-
-export { SCHEMA_SNAPSHOT_FILENAME, createCodegenProject, refreshCodegenProject, runCodegen };