@lunora/codegen 1.0.0-alpha.5 → 1.0.0-alpha.50

package/dist/packem_shared/SCHEMA_SNAPSHOT_FILENAME-G5dkcxPR.mjs

@@ -0,0 +1,3502 @@
+import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { performance } from 'node:perf_hooks';
+import { LunoraError } from '@lunora/errors';
+import { Node, SyntaxKind, Project } from 'ts-morph';
+import { lintSchema } from './formatAdvisories-BmF7Mplc.mjs';
+import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall, inlineHandler as inlineHandler$1, procedureHandler, chainUsesWrappedCall, isDatabaseAccessor, chainHasStep, discoverFunctions } from './discoverFunctions-BJ-qR7Rg.mjs';
+import { discoverAgents } from './AGENTS_FILENAME-Cxx7wiSs.mjs';
+import discoverAuthApiCalls from './discoverAuthApiCalls-Dx3K42rk.mjs';
+import { discoverContainers } from './CONTAINERS_FILENAME-DjpXMqhp.mjs';
+import discoverCrons from './discoverCrons-DvqkEWdx.mjs';
+import { diagnosticAt } from './CodegenDiagnosticError-DyQ5FwkM.mjs';
+import { C as CAPABILITIES, n as buildStorageColumns, f as emitDataModel, a as emitApi, i as emitServer, h as emitFunctions, j as emitShard, b as emitCollections, c as emitContainers, l as emitWorkflows, e as emitAgents, o as emitQueues, d as emitCrons, k as emitVectors, g as emitDrizzleSchema, p as emitSeed, m as emitWranglerCronTriggers } from './emit-ClTbCLy4.mjs';
+import { discoverFlagKeys } from './FLAGS_FILENAME-Dg4mKUuz.mjs';
+import discoverHttpRoutes from './discoverHttpRoutes-daCzuTe8.mjs';
+import discoverInserts from './discoverInserts-DI4q5NxE.mjs';
+import discoverMaskProcedures, { discoverMaskStrategies, discoverMaskMetadata } from './discoverMaskProcedures-BcTOEKNU.mjs';
+import discoverMigrations from './discoverMigrations-VNUFvCwr.mjs';
+import { MUTATORS_FILENAME, isDefineMutatorCallee, discoverMutators } from './MUTATORS_FILENAME-BZOfUhlY.mjs';
+import discoverNondeterministicCalls from './discoverNondeterministicCalls-S0N2xLCq.mjs';
+import discoverQueries from './discoverQueries-CJnnnLpd.mjs';
+import { discoverQueues } from './QUEUES_FILENAME-Xv6Vy-Ku.mjs';
+import discoverR2sqlCalls from './discoverR2sqlCalls-pnpicWfz.mjs';
+import discoverRlsProcedures, { discoverRlsMetadata } from './discoverRlsMetadata-DppniPUH.mjs';
+import { discoverSandboxUsage } from './discoverSandboxUsage-BUM2r90k.mjs';
+import discoverSchema from './discoverSchema-BaSAvooG.mjs';
+import { secretKindOf, redact } from './redact-oTmsol5A.mjs';
+import { discoverShapes } from './SHAPES_FILENAME-DOhPGi-6.mjs';
+import discoverStorageRulesMetadata from './discoverStorageRulesMetadata-CnHl2rXD.mjs';
+import { e as enclosingExportName$2 } from './discover-ast-CT6BgBr4.mjs';
+import { discoverWorkflows } from './WORKFLOWS_FILENAME-Dtuzvluc.mjs';
+import { emitApp } from './emitApp-CzzrjVqH.mjs';
+import { buildOpenApiDocument, emitOpenApiModule } from './buildOpenApiDocument-B7mEdzA2.mjs';
+import { buildOpenRpcDocument, emitOpenRpcModule } from './OPENRPC_VERSION-7A2weq2u.mjs';
+import { buildSchemaSnapshot, serializeSchemaSnapshot } from './SCHEMA_SNAPSHOT_VERSION-D0ARY6rL.mjs';
+
+const HTTP_VERBS$1 = /* @__PURE__ */ new Set(["delete", "get", "head", "options", "patch", "post", "put"]);
+const TERMINAL_STEPS$1 = /* @__PURE__ */ new Set(["handler", "stream"]);
+const ADMIN_PATH_RE = /\/(?:_|admin|internal|superuser|sudo|root|debug)/iu;
+const GUARD_NAMES = /* @__PURE__ */ new Set([
+  "ADMIN_TOKEN",
+  "adminToken",
+  "assertAdmin",
+  "assertAuth",
+  "auth",
+  "Authorization",
+  "getSession",
+  "identity",
+  "isAdmin",
+  "requireAdmin",
+  "requireAuth",
+  "requireRole",
+  "verifyAdmin"
+]);
+const readRootVerb = (node) => {
+  if (!Node.isCallExpression(node)) {
+    return void 0;
+  }
+  const callee = node.getExpression();
+  if (!Node.isPropertyAccessExpression(callee) || !HTTP_VERBS$1.has(callee.getName())) {
+    return void 0;
+  }
+  const receiver = callee.getExpression();
+  if (!Node.isIdentifier(receiver) || receiver.getText() !== "httpRoute") {
+    return void 0;
+  }
+  const first = node.getArguments()[0];
+  if (!first || !Node.isStringLiteral(first)) {
+    return void 0;
+  }
+  return { method: callee.getName().toUpperCase(), path: first.getLiteralValue() };
+};
+const rootOfChain = (terminalCall) => {
+  const terminalCallee = terminalCall.getExpression();
+  if (!Node.isPropertyAccessExpression(terminalCallee)) {
+    return void 0;
+  }
+  let node = terminalCallee.getExpression();
+  while (Node.isCallExpression(node)) {
+    const callee = node.getExpression();
+    if (!Node.isPropertyAccessExpression(callee)) {
+      break;
+    }
+    if (HTTP_VERBS$1.has(callee.getName())) {
+      break;
+    }
+    node = callee.getExpression();
+  }
+  return readRootVerb(node);
+};
+const handlerReferencesGuard = (handlerBody) => {
+  for (const access of handlerBody.getDescendantsOfKind(SyntaxKind.PropertyAccessExpression)) {
+    if (GUARD_NAMES.has(access.getName())) {
+      return true;
+    }
+  }
+  for (const call of handlerBody.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const callee = call.getExpression();
+    if (Node.isIdentifier(callee) && GUARD_NAMES.has(callee.getText())) {
+      return true;
+    }
+  }
+  return false;
+};
+const adminRouteFromDeclaration = (declaration, relativePath) => {
+  const initializer = declaration.getInitializer();
+  if (!initializer || !Node.isCallExpression(initializer)) {
+    return void 0;
+  }
+  const callee = initializer.getExpression();
+  if (!Node.isPropertyAccessExpression(callee) || !TERMINAL_STEPS$1.has(callee.getName())) {
+    return void 0;
+  }
+  const root = rootOfChain(initializer);
+  if (!root || !ADMIN_PATH_RE.test(root.path)) {
+    return void 0;
+  }
+  const handlerArgument = initializer.getArguments()[0];
+  const usesGuard = handlerArgument !== void 0 && (Node.isArrowFunction(handlerArgument) || Node.isFunctionExpression(handlerArgument)) && handlerReferencesGuard(handlerArgument);
+  return { exportName: declaration.getName(), file: relativePath, method: root.method, path: root.path, usesGuard };
+};
+const adminRoutesInSourceFile = (sourceFile, relativePath) => {
+  const found = [];
+  for (const statement of sourceFile.getVariableStatements()) {
+    if (!statement.isExported()) {
+      continue;
+    }
+    for (const declaration of statement.getDeclarations()) {
+      const ir = adminRouteFromDeclaration(declaration, relativePath);
+      if (ir) {
+        found.push(ir);
+      }
+    }
+  }
+  return found;
+};
+const discoverAdminRoutes = (project, lunoraDirectory) => {
+  const routes = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    routes.push(...adminRoutesInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+  }
+  return routes;
+};
+
+const isArgsValueReference = (identifier) => {
+  if (identifier.getText() !== "args") {
+    return false;
+  }
+  const parent = identifier.getParent();
+  if (Node.isPropertyAccessExpression(parent) && parent.getNameNode() === identifier) {
+    return false;
+  }
+  return !(Node.isPropertyAssignment(parent) && parent.getNameNode() === identifier);
+};
+const isContextValueReference = (identifier) => {
+  if (identifier.getText() !== "ctx") {
+    return false;
+  }
+  const parent = identifier.getParent();
+  if (Node.isPropertyAccessExpression(parent) && parent.getNameNode() === identifier) {
+    return false;
+  }
+  return !(Node.isPropertyAssignment(parent) && parent.getNameNode() === identifier);
+};
+const textuallyReferencesContext = (node) => {
+  if (Node.isIdentifier(node)) {
+    return isContextValueReference(node);
+  }
+  return node.getDescendantsOfKind(SyntaxKind.Identifier).some((identifier) => isContextValueReference(identifier));
+};
+const isRequestValueReference = (identifier, requestName) => {
+  if (identifier.getText() !== requestName) {
+    return false;
+  }
+  const parent = identifier.getParent();
+  if (Node.isPropertyAccessExpression(parent) && parent.getNameNode() === identifier) {
+    return false;
+  }
+  return !(Node.isPropertyAssignment(parent) && parent.getNameNode() === identifier);
+};
+const memberAccessRootIdentifier = (node) => {
+  let current = node;
+  while (Node.isPropertyAccessExpression(current) || Node.isElementAccessExpression(current) || Node.isNonNullExpression(current)) {
+    current = current.getExpression();
+  }
+  return Node.isIdentifier(current) ? current : void 0;
+};
+const calleeName$2 = (expression) => {
+  if (Node.isIdentifier(expression)) {
+    return expression.getText();
+  }
+  if (Node.isPropertyAccessExpression(expression)) {
+    return expression.getName();
+  }
+  return void 0;
+};
+const referencesArgs = (node) => {
+  if (Node.isIdentifier(node)) {
+    return isArgsValueReference(node);
+  }
+  return node.getDescendantsOfKind(SyntaxKind.Identifier).some((identifier) => isArgsValueReference(identifier));
+};
+const singleHopInitializer = (node) => {
+  if (!Node.isIdentifier(node)) {
+    return void 0;
+  }
+  const name = node.getText();
+  const enclosingFunction = node.getFirstAncestor(
+    (ancestor) => Node.isArrowFunction(ancestor) || Node.isFunctionExpression(ancestor) || Node.isFunctionDeclaration(ancestor)
+  );
+  if (enclosingFunction === void 0) {
+    return void 0;
+  }
+  const usePosition = node.getStart();
+  let nearest;
+  let nearestPosition = -1;
+  for (const variable of enclosingFunction.getDescendantsOfKind(SyntaxKind.VariableDeclaration)) {
+    if (variable.getName() !== name) {
+      continue;
+    }
+    const initializer = variable.getInitializer();
+    const declarationPosition = variable.getStart();
+    if (initializer !== void 0 && declarationPosition < usePosition && declarationPosition > nearestPosition) {
+      nearest = initializer;
+      nearestPosition = declarationPosition;
+    }
+  }
+  return nearest;
+};
+const isArgumentDerived = (expression) => {
+  if (referencesArgs(expression)) {
+    return true;
+  }
+  const initializer = singleHopInitializer(expression);
+  return initializer !== void 0 && referencesArgs(initializer);
+};
+const isScopedByContext = (node) => {
+  if (textuallyReferencesContext(node)) {
+    return true;
+  }
+  const initializer = singleHopInitializer(node);
+  if (initializer !== void 0 && textuallyReferencesContext(initializer)) {
+    return true;
+  }
+  const composed = initializer ?? node;
+  const identifiers = Node.isIdentifier(composed) ? [composed] : composed.getDescendantsOfKind(SyntaxKind.Identifier);
+  return identifiers.some((identifier) => {
+    const boundInitializer = singleHopInitializer(identifier);
+    return boundInitializer !== void 0 && textuallyReferencesContext(boundInitializer);
+  });
+};
+const referencesRequestInput = (node, requestName) => {
+  if (Node.isIdentifier(node)) {
+    return isRequestValueReference(node, requestName);
+  }
+  return node.getDescendantsOfKind(SyntaxKind.Identifier).some((identifier) => isRequestValueReference(identifier, requestName));
+};
+const isRequestInputDerived = (node, requestName) => {
+  if (referencesRequestInput(node, requestName)) {
+    return true;
+  }
+  const initializer = singleHopInitializer(node);
+  if (initializer !== void 0 && referencesRequestInput(initializer, requestName)) {
+    return true;
+  }
+  const root = memberAccessRootIdentifier(node);
+  if (root !== void 0) {
+    const rootInitializer = singleHopInitializer(root);
+    return rootInitializer !== void 0 && referencesRequestInput(rootInitializer, requestName);
+  }
+  return false;
+};
+const enclosingExportName$1 = (node) => {
+  for (const ancestor of node.getAncestors()) {
+    if (Node.isVariableDeclaration(ancestor) && ancestor.getVariableStatement()?.hasExportKeyword() === true) {
+      return ancestor.getName();
+    }
+  }
+  return "<module>";
+};
+
+const isContextAiRunCallee = (node) => {
+  if (!Node.isPropertyAccessExpression(node) || node.getName() !== "run") {
+    return false;
+  }
+  return node.getExpression().getText() === "ctx.ai";
+};
+const aiRawRunInCall = (call, relativePath) => {
+  if (!isContextAiRunCallee(call.getExpression())) {
+    return void 0;
+  }
+  const model = call.getArguments()[0];
+  if (!model || !isArgumentDerived(model) || isScopedByContext(model)) {
+    return void 0;
+  }
+  return { exportName: enclosingExportName$1(call), file: relativePath, line: call.getStartLineNumber() };
+};
+const aiRawRunsInSourceFile = (sourceFile, relativePath) => {
+  const found = [];
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const row = aiRawRunInCall(call, relativePath);
+    if (row) {
+      found.push(row);
+    }
+  }
+  return found;
+};
+const discoverAiRawRuns = (project, lunoraDirectory) => {
+  const rows = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    rows.push(...aiRawRunsInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+  }
+  return rows;
+};
+
+const GENERATION_CALLEES = /* @__PURE__ */ new Set(["generateText", "streamText"]);
+const MODEL_INPUT_KEYS = /* @__PURE__ */ new Set(["messages", "prompt", "system"]);
+const SIDE_EFFECT_SINKS = [
+  // Database writes.
+  { methods: /* @__PURE__ */ new Set(["delete", "insert", "insertManyUnsafe", "patch", "replace"]), prefixes: ["context.db", "ctx.db"] },
+  // Function dispatch (runs another mutation / action with the caller's authority).
+  { methods: /* @__PURE__ */ new Set(["run", "runAction", "runMutation"]), prefixes: ["context", "ctx"] },
+  // Outbound network / mail / queue sends.
+  { methods: /* @__PURE__ */ new Set(["fetch"]), prefixes: ["context", "ctx"] },
+  { methods: /* @__PURE__ */ new Set(["queue", "send"]), prefixes: ["context.email", "context.mail", "ctx.email", "ctx.mail"] }
+];
+const sideEffectLabel = (call) => {
+  const callee = call.getExpression();
+  if (!Node.isPropertyAccessExpression(callee)) {
+    return void 0;
+  }
+  const method = callee.getName();
+  const receiver = callee.getExpression().getText();
+  for (const sink of SIDE_EFFECT_SINKS) {
+    if (sink.methods.has(method) && sink.prefixes.some((prefix) => receiver === prefix || receiver.startsWith(`${prefix}.`))) {
+      return `${receiver}.${method}`;
+    }
+  }
+  return void 0;
+};
+const toolSideEffect = (toolCall) => {
+  for (const call of toolCall.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const label = sideEffectLabel(call);
+    if (label !== void 0) {
+      return label;
+    }
+  }
+  return void 0;
+};
+const destructuredArgumentNames = (node) => {
+  const names = /* @__PURE__ */ new Set();
+  const enclosingFunction = node.getFirstAncestor(
+    (ancestor) => Node.isArrowFunction(ancestor) || Node.isFunctionExpression(ancestor) || Node.isFunctionDeclaration(ancestor)
+  );
+  const [firstParameter] = enclosingFunction?.getParameters() ?? [];
+  const pattern = firstParameter?.getNameNode();
+  if (pattern === void 0 || !Node.isObjectBindingPattern(pattern)) {
+    return names;
+  }
+  for (const element of pattern.getElements()) {
+    const propertyName = element.getPropertyNameNode()?.getText() ?? element.getName();
+    const valueNode = element.getNameNode();
+    if (propertyName === "args" && Node.isObjectBindingPattern(valueNode)) {
+      for (const nested of valueNode.getElements()) {
+        names.add(nested.getName());
+      }
+    }
+  }
+  return names;
+};
+const isUserInputDerived = (inputNode) => {
+  if (referencesArgs(inputNode)) {
+    return true;
+  }
+  const names = destructuredArgumentNames(inputNode);
+  if (names.size === 0) {
+    return false;
+  }
+  return inputNode.getDescendantsOfKind(SyntaxKind.Identifier).some((identifier) => names.has(identifier.getText()));
+};
+const hasUserDerivedInput = (optionsObject) => {
+  for (const property of optionsObject.getProperties()) {
+    if (!Node.isPropertyAssignment(property) || !MODEL_INPUT_KEYS.has(property.getName())) {
+      continue;
+    }
+    const initializer = property.getInitializer();
+    if (initializer !== void 0 && isUserInputDerived(initializer)) {
+      return true;
+    }
+  }
+  return false;
+};
+const generationsInSourceFile = (sourceFile, relativePath) => {
+  const rows = [];
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const callee = calleeName$2(call.getExpression());
+    if (callee === void 0 || !GENERATION_CALLEES.has(callee)) {
+      continue;
+    }
+    const [optionsArgument] = call.getArguments();
+    if (optionsArgument === void 0 || !Node.isObjectLiteralExpression(optionsArgument)) {
+      continue;
+    }
+    let sideEffect;
+    for (const toolCall of optionsArgument.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+      if (calleeName$2(toolCall.getExpression()) !== "tool") {
+        continue;
+      }
+      sideEffect = toolSideEffect(toolCall);
+      if (sideEffect !== void 0) {
+        break;
+      }
+    }
+    if (sideEffect === void 0) {
+      continue;
+    }
+    rows.push({
+      exportName: enclosingExportName$1(call),
+      file: relativePath,
+      line: call.getStartLineNumber(),
+      method: callee,
+      sideEffect,
+      userInputDerived: hasUserDerivedInput(optionsArgument)
+    });
+  }
+  return rows;
+};
+const discoverAiToolSideEffects = (project, lunoraDirectory) => {
+  const rows = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    rows.push(...generationsInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+  }
+  return rows;
+};
+
+const isContextFetchCallee = (node) => {
+  if (!Node.isPropertyAccessExpression(node) || node.getName() !== "fetch") {
+    return false;
+  }
+  const receiver = node.getExpression();
+  return Node.isIdentifier(receiver) && receiver.getText() === "ctx";
+};
+const fetchInCall = (call, relativePath) => {
+  if (!isContextFetchCallee(call.getExpression())) {
+    return void 0;
+  }
+  const url = call.getArguments()[0];
+  if (!url || !isArgumentDerived(url)) {
+    return void 0;
+  }
+  return { exportName: enclosingExportName$1(call), file: relativePath, line: call.getStartLineNumber() };
+};
+const fetchesInSourceFile = (sourceFile, relativePath) => {
+  const found = [];
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const fetchCall = fetchInCall(call, relativePath);
+    if (fetchCall) {
+      found.push(fetchCall);
+    }
+  }
+  return found;
+};
+const discoverArgumentDerivedFetches = (project, lunoraDirectory) => {
+  const fetches = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    fetches.push(...fetchesInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+  }
+  return fetches;
+};
+
+const BOUND_RE = /\.check\(|\.meta\(|length|max/iu;
+const ANY_VALIDATOR_RE = /\bv\.any\s*\(/u;
+const STRING_VALIDATOR_RE = /\bv\.string\s*\(/u;
+const isAnyValidator = (text) => ANY_VALIDATOR_RE.test(text);
+const isUnboundedString = (text) => STRING_VALIDATOR_RE.test(text) && !BOUND_RE.test(text);
+const argsObjectOfFactory = (call) => {
+  const first = call.getArguments()[0];
+  if (!first || !Node.isObjectLiteralExpression(first)) {
+    return void 0;
+  }
+  const argsProperty = first.getProperty("args");
+  if (!argsProperty || !Node.isPropertyAssignment(argsProperty)) {
+    return void 0;
+  }
+  const initializer = argsProperty.getInitializer();
+  return initializer && Node.isObjectLiteralExpression(initializer) ? initializer : void 0;
+};
+const inputObjectsInChain = (receiver) => {
+  const objects = [];
+  let node = receiver;
+  while (Node.isCallExpression(node)) {
+    const chainCallee = node.getExpression();
+    if (!Node.isPropertyAccessExpression(chainCallee)) {
+      break;
+    }
+    if (chainCallee.getName() === "input") {
+      const argument = node.getArguments()[0];
+      if (argument && Node.isObjectLiteralExpression(argument)) {
+        objects.push(argument);
+      }
+    }
+    node = chainCallee.getExpression();
+  }
+  return objects;
+};
+const classifyArgs = (objects) => {
+  const anyArgs = [];
+  const unboundedStringArgs = [];
+  for (const object of objects) {
+    for (const property of object.getProperties()) {
+      if (!Node.isPropertyAssignment(property)) {
+        continue;
+      }
+      const initializer = property.getInitializer();
+      if (!initializer) {
+        continue;
+      }
+      const text = initializer.getText();
+      const name = property.getName();
+      if (isAnyValidator(text)) {
+        anyArgs.push(name);
+      } else if (isUnboundedString(text)) {
+        unboundedStringArgs.push(name);
+      }
+    }
+  }
+  return { anyArgs, unboundedStringArgs };
+};
+const argumentValidatorIrFromDeclaration = (declaration, relativePath) => {
+  const initializer = declaration.getInitializer();
+  if (!initializer || !Node.isCallExpression(initializer)) {
+    return void 0;
+  }
+  const classified = classifyProcedureCall(initializer);
+  if (classified?.visibility !== "public") {
+    return void 0;
+  }
+  const objects = classified.receiver ? inputObjectsInChain(classified.receiver) : [argsObjectOfFactory(initializer)].filter((object) => object !== void 0);
+  const { anyArgs, unboundedStringArgs } = classifyArgs(objects);
+  if (anyArgs.length === 0 && unboundedStringArgs.length === 0) {
+    return void 0;
+  }
+  return {
+    anyArgs,
+    exportName: declaration.getName(),
+    file: relativePath,
+    line: initializer.getStartLineNumber(),
+    unboundedStringArgs
+  };
+};
+const argumentValidatorsInSourceFile = (sourceFile, relativePath) => {
+  const found = [];
+  for (const statement of sourceFile.getVariableStatements()) {
+    if (!statement.isExported()) {
+      continue;
+    }
+    for (const declaration of statement.getDeclarations()) {
+      const ir = argumentValidatorIrFromDeclaration(declaration, relativePath);
+      if (ir) {
+        found.push(ir);
+      }
+    }
+  }
+  return found;
+};
+const discoverArgumentValidators = (project, lunoraDirectory) => {
+  const procedures = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    procedures.push(...argumentValidatorsInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+  }
+  return procedures;
+};
+
+const propertyInitializer = (object, name) => {
+  if (!object || !Node.isObjectLiteralExpression(object)) {
+    return void 0;
+  }
+  const property = object.getProperty(name);
+  return property && Node.isPropertyAssignment(property) ? property.getInitializer() : void 0;
+};
+const isTrueLiteral = (node) => node?.getKind() === SyntaxKind.TrueKeyword;
+const isFalseLiteral = (node) => node?.getKind() === SyntaxKind.FalseKeyword;
+const isZeroLiteral = (node) => node !== void 0 && Node.isNumericLiteral(node) && node.getLiteralValue() === 0;
+const hasWildcardOrigin = (node) => {
+  if (!node || !Node.isArrayLiteralExpression(node)) {
+    return false;
+  }
+  return node.getElements().some((element) => Node.isStringLiteral(element) && element.getLiteralText() === "*");
+};
+const readAuthConfig = (config) => {
+  const advanced = propertyInitializer(config, "advanced");
+  const emailAndPassword = propertyInitializer(config, "emailAndPassword");
+  const session = propertyInitializer(config, "session");
+  return {
+    analyzable: true,
+    disableCsrfCheck: isTrueLiteral(propertyInitializer(advanced, "disableCSRFCheck")),
+    emailPasswordEnabled: isTrueLiteral(propertyInitializer(emailAndPassword, "enabled")),
+    requireEmailVerification: isTrueLiteral(propertyInitializer(emailAndPassword, "requireEmailVerification")),
+    // gitleaks:allow -- ts-morph property-name lookup, not a secret
+    secureCookiesDisabled: isFalseLiteral(propertyInitializer(advanced, "useSecureCookies")),
+    sessionFreshAgeZero: isZeroLiteral(propertyInitializer(session, "freshAge")),
+    trustedOriginsWildcard: hasWildcardOrigin(propertyInitializer(config, "trustedOrigins"))
+  };
+};
+const unanalyzableAuthConfig = () => {
+  return {
+    analyzable: false,
+    disableCsrfCheck: false,
+    emailPasswordEnabled: false,
+    requireEmailVerification: false,
+    secureCookiesDisabled: false,
+    sessionFreshAgeZero: false,
+    trustedOriginsWildcard: false
+  };
+};
+const authConfigInCall = (call, relativePath) => {
+  if (calleeName$2(call.getExpression()) !== "createAuth") {
+    return void 0;
+  }
+  const argument = call.getArguments()[0];
+  const hasSpread = argument !== void 0 && Node.isObjectLiteralExpression(argument) && argument.getProperties().some((property) => Node.isSpreadAssignment(property));
+  const facts = argument !== void 0 && Node.isObjectLiteralExpression(argument) && !hasSpread ? readAuthConfig(argument) : unanalyzableAuthConfig();
+  return { exportName: enclosingExportName$1(call), file: relativePath, line: call.getStartLineNumber(), ...facts };
+};
+const authConfigsInSourceFile = (sourceFile, relativePath) => {
+  const found = [];
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const row = authConfigInCall(call, relativePath);
+    if (row) {
+      found.push(row);
+    }
+  }
+  return found;
+};
+const discoverAuthConfig = (project, lunoraDirectory) => {
+  const rows = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    rows.push(...authConfigsInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+  }
+  return rows;
+};
+
+const sinkMethod = (node, config) => {
+  if (!Node.isPropertyAccessExpression(node)) {
+    return void 0;
+  }
+  const method = node.getName();
+  if (!config.methods.has(method)) {
+    return void 0;
+  }
+  return config.matchReceiver(node.getExpression().getText()) ? method : void 0;
+};
+const accessInCall = (call, relativePath, config) => {
+  const method = sinkMethod(call.getExpression(), config);
+  if (method === void 0) {
+    return void 0;
+  }
+  const key = call.getArguments()[config.argIndex];
+  if (!key || !isArgumentDerived(key) || isScopedByContext(key)) {
+    return void 0;
+  }
+  return { exportName: enclosingExportName$1(call), file: relativePath, line: call.getStartLineNumber(), method };
+};
+const accessesInSourceFile = (sourceFile, relativePath, config) => {
+  const found = [];
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const access = accessInCall(call, relativePath, config);
+    if (access) {
+      found.push(access);
+    }
+  }
+  return found;
+};
+const discoverArgumentDerivedAccesses = (project, lunoraDirectory, config) => {
+  const accesses = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    accesses.push(...accessesInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath), config));
+  }
+  return accesses;
+};
+
+const BROWSER_URL_METHODS = /* @__PURE__ */ new Set(["content", "pdf", "scrape", "screenshot"]);
+const discoverBrowserUrlAccesses = (project, lunoraDirectory) => discoverArgumentDerivedAccesses(project, lunoraDirectory, {
+  argIndex: 0,
+  matchReceiver: (receiver) => receiver === "ctx.browser",
+  methods: BROWSER_URL_METHODS
+});
+
+const FUNCTION_CALLEES = /* @__PURE__ */ new Set(["createBrowser", "createInboundEmailHandler", "createPayment"]);
+const CONSTRUCTOR_CALLEES = /* @__PURE__ */ new Set(["RateLimiter"]);
+const CALLBACK_CALLEES = /* @__PURE__ */ new Set(["extend"]);
+const keysFromObjectLiteral = (objectLiteral) => {
+  const presentKeys = [];
+  const trueKeys = [];
+  let hasSpread = false;
+  for (const property of objectLiteral.getProperties()) {
+    if (Node.isSpreadAssignment(property)) {
+      hasSpread = true;
+      continue;
+    }
+    if (Node.isPropertyAssignment(property)) {
+      const name = property.getName();
+      presentKeys.push(name);
+      const initializer = property.getInitializer();
+      if (initializer?.getKind() === SyntaxKind.TrueKeyword) {
+        trueKeys.push(name);
+      }
+      continue;
+    }
+    if (Node.isShorthandPropertyAssignment(property) || Node.isMethodDeclaration(property)) {
+      presentKeys.push(property.getName());
+    }
+  }
+  return { analyzable: !hasSpread, presentKeys, trueKeys };
+};
+const readConfigArgument = (argument) => argument && Node.isObjectLiteralExpression(argument) ? keysFromObjectLiteral(argument) : { analyzable: false, presentKeys: [], trueKeys: [] };
+const objectLiteralFromReturnBlock = (block) => {
+  const statements = block.getStatements();
+  const [statement] = statements;
+  if (statements.length !== 1 || statement === void 0 || !Node.isReturnStatement(statement)) {
+    return void 0;
+  }
+  const expression = statement.getExpression();
+  return expression !== void 0 && Node.isObjectLiteralExpression(expression) ? expression : void 0;
+};
+const objectLiteralFromCallbackBody = (body) => {
+  if (Node.isObjectLiteralExpression(body)) {
+    return body;
+  }
+  if (Node.isParenthesizedExpression(body)) {
+    const inner = body.getExpression();
+    return Node.isObjectLiteralExpression(inner) ? inner : void 0;
+  }
+  return Node.isBlock(body) ? objectLiteralFromReturnBlock(body) : void 0;
+};
+const readCallbackArgument = (argument) => {
+  const callback = argument && (Node.isArrowFunction(argument) || Node.isFunctionExpression(argument)) ? argument : void 0;
+  const objectLiteral = callback && objectLiteralFromCallbackBody(callback.getBody());
+  return objectLiteral ? keysFromObjectLiteral(objectLiteral) : { analyzable: false, presentKeys: [], trueKeys: [] };
+};
+const configCallsInSourceFile = (sourceFile, relativePath) => {
+  const found = [];
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const name = calleeName$2(call.getExpression());
+    if (name === void 0) {
+      continue;
+    }
+    if (FUNCTION_CALLEES.has(name)) {
+      found.push({ callee: name, file: relativePath, line: call.getStartLineNumber(), ...readConfigArgument(call.getArguments()[0]) });
+    } else if (CALLBACK_CALLEES.has(name)) {
+      found.push({ callee: name, file: relativePath, line: call.getStartLineNumber(), ...readCallbackArgument(call.getArguments()[0]) });
+    }
+  }
+  for (const construction of sourceFile.getDescendantsOfKind(SyntaxKind.NewExpression)) {
+    const name = calleeName$2(construction.getExpression());
+    if (name === void 0 || !CONSTRUCTOR_CALLEES.has(name)) {
+      continue;
+    }
+    found.push({
+      callee: name,
+      file: relativePath,
+      line: construction.getStartLineNumber(),
+      ...readConfigArgument(construction.getArguments()[0])
+    });
+  }
+  return found;
+};
+const discoverConfigCalls = (project, lunoraDirectory) => {
+  const calls = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    calls.push(...configCallsInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+  }
+  return calls;
+};
+
+const CONTAINER_ACCESSOR_PREFIX = "ctx.containers.";
+const isContainerInstanceReceiver = (receiver) => {
+  if (!receiver.startsWith(CONTAINER_ACCESSOR_PREFIX)) {
+    return false;
+  }
+  const remainder = receiver.slice(CONTAINER_ACCESSOR_PREFIX.length);
+  return remainder.length > 0 && !remainder.includes(".");
+};
+const discoverContainerKeyAccesses = (project, lunoraDirectory) => discoverArgumentDerivedAccesses(project, lunoraDirectory, {
+  argIndex: 0,
+  matchReceiver: isContainerInstanceReceiver,
+  methods: /* @__PURE__ */ new Set(["get"])
+});
+
+const EGRESS_MUTATING_METHODS = /* @__PURE__ */ new Set(["allow", "deny", "setAllowed"]);
+const hasEnableInternetTrue = (call) => {
+  const argument = call.getArguments()[0];
+  if (!argument || !Node.isObjectLiteralExpression(argument)) {
+    return false;
+  }
+  const property = argument.getProperty("enableInternet");
+  return property !== void 0 && Node.isPropertyAssignment(property) && Node.isTrueLiteral(property.getInitializerOrThrow());
+};
+const enableInternetOverrideInCall = (call, relativePath) => {
+  const callee = call.getExpression();
+  if (!Node.isPropertyAccessExpression(callee) || callee.getName() !== "start" || !hasEnableInternetTrue(call)) {
+    return void 0;
+  }
+  return {
+    detail: "enableInternet: true",
+    exportName: enclosingExportName$1(call),
+    file: relativePath,
+    kind: "enable_internet",
+    line: call.getStartLineNumber()
+  };
+};
+const egressRelaxationInCall = (call, relativePath) => {
+  const callee = call.getExpression();
+  if (!Node.isPropertyAccessExpression(callee) || !EGRESS_MUTATING_METHODS.has(callee.getName())) {
+    return void 0;
+  }
+  const receiver = callee.getExpression();
+  if (!Node.isPropertyAccessExpression(receiver) || receiver.getName() !== "egress") {
+    return void 0;
+  }
+  return {
+    detail: callee.getName(),
+    exportName: enclosingExportName$1(call),
+    file: relativePath,
+    kind: "egress_relaxation",
+    line: call.getStartLineNumber()
+  };
+};
+const containerOverrideInCall = (call, relativePath) => enableInternetOverrideInCall(call, relativePath) ?? egressRelaxationInCall(call, relativePath);
+const containerOverridesInSourceFile = (sourceFile, relativePath) => {
+  const found = [];
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const row = containerOverrideInCall(call, relativePath);
+    if (row) {
+      found.push(row);
+    }
+  }
+  return found;
+};
+const discoverContainerOverrides = (project, lunoraDirectory) => {
+  const rows = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    rows.push(...containerOverridesInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+  }
+  return rows;
+};
+
+const ENV_FILENAME = "env.ts";
+const ENV_MODULE_SPECIFIERS = /* @__PURE__ */ new Set(["@lunora/server", "lunorash/server"]);
+const isDefineEnv = (identifier) => {
+  const symbol = identifier.getSymbol();
+  if (!symbol) {
+    return identifier.getText() === "defineEnv";
+  }
+  for (const declaration of symbol.getDeclarations()) {
+    if (!Node.isImportSpecifier(declaration)) {
+      continue;
+    }
+    if (!ENV_MODULE_SPECIFIERS.has(declaration.getImportDeclaration().getModuleSpecifierValue())) {
+      return false;
+    }
+    return declaration.getNameNode().getText() === "defineEnv";
+  }
+  return false;
+};
+const isEnvNamespaceImport = (identifier) => {
+  const symbol = identifier.getSymbol();
+  if (!symbol) {
+    return false;
+  }
+  for (const declaration of symbol.getDeclarations()) {
+    if (!Node.isNamespaceImport(declaration)) {
+      continue;
+    }
+    const importDeclaration = declaration.getFirstAncestorByKind(SyntaxKind.ImportDeclaration);
+    return importDeclaration !== void 0 && ENV_MODULE_SPECIFIERS.has(importDeclaration.getModuleSpecifierValue());
+  }
+  return false;
+};
+const isDefineEnvCallee = (callee) => {
+  if (Node.isIdentifier(callee)) {
+    return isDefineEnv(callee);
+  }
+  if (Node.isPropertyAccessExpression(callee)) {
+    const object = callee.getExpression();
+    return callee.getName() === "defineEnv" && Node.isIdentifier(object) && isEnvNamespaceImport(object);
+  }
+  return false;
+};
+const environmentsFromSource = (source) => {
+  const environments = [];
+  for (const declaration of source.getVariableDeclarations()) {
+    if (!declaration.isExported()) {
+      continue;
+    }
+    const initializer = declaration.getInitializer();
+    if (initializer?.getKind() !== SyntaxKind.CallExpression) {
+      continue;
+    }
+    const callExpression = initializer;
+    if (!isDefineEnvCallee(callExpression.getExpression())) {
+      continue;
+    }
+    const nameNode = declaration.getNameNode();
+    if (!Node.isIdentifier(nameNode)) {
+      throw diagnosticAt(nameNode, "defineEnv exports must be plain named exports (no destructuring)");
+    }
+    environments.push({ exportName: nameNode.getText() });
+  }
+  return environments;
+};
+const discoverEnv = (project, lunoraDirectory) => {
+  const envPath = join(lunoraDirectory, ENV_FILENAME);
+  if (!existsSync(envPath)) {
+    return void 0;
+  }
+  const source = project.getSourceFile(envPath) ?? project.addSourceFileAtPath(envPath);
+  const environments = environmentsFromSource(source);
+  if (environments.length === 0) {
+    return void 0;
+  }
+  if (environments.length > 1) {
+    throw diagnosticAt(
+      source,
+      `lunora/env.ts declares ${environments.length.toString()} defineEnv() contracts (${environments.map((env) => env.exportName).join(", ")}); exactly one is allowed`
+    );
+  }
+  return environments[0];
+};
+
+const OPTIONS_ARGUMENT_INDEX$1 = /* @__PURE__ */ new Map([
+  ["dbRateLimit", 2],
+  ["rateLimit", 2],
+  ["verifyTurnstileMiddleware", 0]
+]);
+const RATE_LIMIT_CALLEES = /* @__PURE__ */ new Set(["dbRateLimit", "rateLimit"]);
+const setsFailOpenTrue = (options) => {
+  if (!options || !Node.isObjectLiteralExpression(options)) {
+    return false;
+  }
+  const property = options.getProperty("failOpen");
+  return property !== void 0 && Node.isPropertyAssignment(property) && property.getInitializer()?.getKind() === SyntaxKind.TrueKeyword;
+};
+const limitNameOf$1 = (call) => {
+  const argument = call.getArguments()[1];
+  return argument && Node.isStringLiteral(argument) ? argument.getLiteralValue() : "";
+};
+const failOpenGuardInCall = (call, relativePath) => {
+  const callee = calleeName$2(call.getExpression());
+  if (callee === void 0) {
+    return void 0;
+  }
+  const optionsIndex = OPTIONS_ARGUMENT_INDEX$1.get(callee);
+  if (optionsIndex === void 0) {
+    return void 0;
+  }
+  return {
+    callee,
+    exportName: enclosingExportName$1(call),
+    failOpen: setsFailOpenTrue(call.getArguments()[optionsIndex]),
+    file: relativePath,
+    limitName: RATE_LIMIT_CALLEES.has(callee) ? limitNameOf$1(call) : "",
+    line: call.getStartLineNumber()
+  };
+};
+const failOpenGuardsInSourceFile = (sourceFile, relativePath) => {
+  const found = [];
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const guard = failOpenGuardInCall(call, relativePath);
+    if (guard) {
+      found.push(guard);
+    }
+  }
+  return found;
+};
+const discoverFailOpenGuards = (project, lunoraDirectory) => {
+  const guards = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    guards.push(...failOpenGuardsInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+  }
+  return guards;
+};
+
+const contextPropertiesRead = (sourceFile) => {
+  const reachesContext = (receiver) => Node.isIdentifier(receiver) && receiver.getText() === "ctx";
+  const names = /* @__PURE__ */ new Set();
+  for (const access of sourceFile.getDescendantsOfKind(SyntaxKind.PropertyAccessExpression)) {
+    if (reachesContext(access.getExpression())) {
+      names.add(access.getName());
+    }
+  }
+  for (const declaration of sourceFile.getDescendantsOfKind(SyntaxKind.VariableDeclaration)) {
+    const initializer = declaration.getInitializer();
+    const nameNode = declaration.getNameNode();
+    if (initializer === void 0 || !reachesContext(initializer) || !Node.isObjectBindingPattern(nameNode)) {
+      continue;
+    }
+    for (const element of nameNode.getElements()) {
+      const name = element.getPropertyNameNode()?.getText() ?? element.getName();
+      if (name) {
+        names.add(name);
+      }
+    }
+  }
+  return names;
+};
+const discoverFeatureUsage = (project, lunoraDirectory) => {
+  const usage = Object.fromEntries(CAPABILITIES.map((capability) => [capability.key, false]));
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    const importSpecifiers = new Set(sourceFile.getImportDeclarations().map((declaration) => declaration.getModuleSpecifierValue()));
+    const contextProperties = contextPropertiesRead(sourceFile);
+    for (const capability of CAPABILITIES) {
+      if (usage[capability.key]) {
+        continue;
+      }
+      if (importSpecifiers.has(capability.moduleSpecifier)) {
+        usage[capability.key] = true;
+        continue;
+      }
+      if (capability.contextProperty !== void 0 && contextProperties.has(capability.contextProperty)) {
+        usage[capability.key] = true;
+      }
+    }
+    if (CAPABILITIES.every((capability) => usage[capability.key])) {
+      break;
+    }
+  }
+  return usage;
+};
+const buildStudioFeatures = (usage, signals) => {
+  return {
+    analytics: usage.analytics || signals.dependencies.has("@lunora/bindings/analytics"),
+    auth: signals.dependencies.has("@lunora/auth"),
+    containers: usage.container || signals.containerCount > 0 || signals.dependencies.has("@lunora/container"),
+    flags: usage.flags || signals.dependencies.has("@lunora/flags"),
+    kv: usage.kv || signals.dependencies.has("@lunora/bindings/kv"),
+    mail: usage.mail || signals.dependencies.has("@lunora/mail"),
+    payments: usage.payments || signals.dependencies.has("@lunora/payment"),
+    queues: signals.queueCount > 0 || signals.dependencies.has("@lunora/queue"),
+    scheduler: usage.scheduler || signals.cronCount > 0 || signals.dependencies.has("@lunora/scheduler"),
+    storage: usage.storage || signals.storageRuleCount > 0 || signals.storageColumnCount > 0 || signals.dependencies.has("@lunora/storage"),
+    vectors: usage.vectors || signals.vectorIndexCount > 0 || signals.dependencies.has("@lunora/bindings/vectors"),
+    workflows: usage.workflows || signals.workflowCount > 0 || signals.dependencies.has("@lunora/workflow")
+  };
+};
+
+const isContextIdentifier = (node) => Node.isIdentifier(node) && node.getText() === "ctx";
+const isFlagBooleanRead = (callee) => {
+  if (!Node.isPropertyAccessExpression(callee) || callee.getName() !== "boolean") {
+    return false;
+  }
+  const receiver = callee.getExpression();
+  return Node.isPropertyAccessExpression(receiver) && receiver.getName() === "flags" && isContextIdentifier(receiver.getExpression());
+};
+const booleanLiteralValue = (node) => {
+  if (node?.getKind() === SyntaxKind.TrueKeyword) {
+    return true;
+  }
+  if (node?.getKind() === SyntaxKind.FalseKeyword) {
+    return false;
+  }
+  return void 0;
+};
+const flagSecurityDefaultInCall = (call, relativePath) => {
+  if (!isFlagBooleanRead(call.getExpression())) {
+    return void 0;
+  }
+  const [keyArgument, defaultArgument] = call.getArguments();
+  if (!keyArgument || !(Node.isStringLiteral(keyArgument) || Node.isNoSubstitutionTemplateLiteral(keyArgument))) {
+    return void 0;
+  }
+  const key = keyArgument.getLiteralValue();
+  const defaultValue = booleanLiteralValue(defaultArgument);
+  if (key.length === 0 || defaultValue === void 0) {
+    return void 0;
+  }
+  return { defaultValue, exportName: enclosingExportName$1(call), file: relativePath, key, line: call.getStartLineNumber() };
+};
+const flagSecurityDefaultsInSourceFile = (sourceFile, relativePath) => {
+  const found = [];
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const flag = flagSecurityDefaultInCall(call, relativePath);
+    if (flag) {
+      found.push(flag);
+    }
+  }
+  return found;
+};
+const discoverFlagSecurityDefaults = (project, lunoraDirectory) => {
+  const flags = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    flags.push(...flagSecurityDefaultsInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+  }
+  return flags;
+};
+
+const HTTP_VERBS = /* @__PURE__ */ new Set(["delete", "get", "head", "options", "patch", "post", "put"]);
+const TERMINAL_STEPS = /* @__PURE__ */ new Set(["handler", "stream"]);
+const RUN_SIDE_EFFECTS = /* @__PURE__ */ new Set(["runAction", "runMutation"]);
+const DB_WRITE_METHODS = /* @__PURE__ */ new Set(["delete", "insert", "insertManyUnsafe", "patch", "replace"]);
+const isIdentifierNamed = (node, name) => node !== void 0 && Node.isIdentifier(node) && node.getText() === name;
+const inlineHandler = (argument) => argument !== void 0 && (Node.isArrowFunction(argument) || Node.isFunctionExpression(argument)) ? argument : void 0;
+const contextBinding = (handler, isHttpAction) => {
+  const parameter = handler.getParameters()[0];
+  if (parameter === void 0) {
+    return void 0;
+  }
+  const nameNode = parameter.getNameNode();
+  if (isHttpAction) {
+    return Node.isIdentifier(nameNode) ? nameNode.getText() : void 0;
+  }
+  if (!Node.isObjectBindingPattern(nameNode)) {
+    return void 0;
+  }
+  for (const element of nameNode.getElements()) {
+    const property = element.getPropertyNameNode()?.getText() ?? element.getNameNode().getText();
+    if (property === "ctx") {
+      const local = element.getNameNode();
+      return Node.isIdentifier(local) ? local.getText() : void 0;
+    }
+  }
+  return void 0;
+};
+const firstSideEffect = (handler, contextName) => {
+  const body = handler.getBody();
+  const calls = body.getDescendantsOfKind(SyntaxKind.CallExpression);
+  if (Node.isCallExpression(body)) {
+    calls.unshift(body);
+  }
+  for (const call of calls) {
+    const callee = call.getExpression();
+    if (!Node.isPropertyAccessExpression(callee)) {
+      continue;
+    }
+    const method = callee.getName();
+    const receiver = callee.getExpression();
+    if (RUN_SIDE_EFFECTS.has(method) && isIdentifierNamed(receiver, contextName)) {
+      return method;
+    }
+    if (DB_WRITE_METHODS.has(method) && Node.isPropertyAccessExpression(receiver) && receiver.getName() === "db" && isIdentifierNamed(receiver.getExpression(), contextName)) {
+      return `db.${method}`;
+    }
+  }
+  return void 0;
+};
+const readsContextAuth = (handler, contextName) => {
+  const body = handler.getBody();
+  for (const access of body.getDescendantsOfKind(SyntaxKind.PropertyAccessExpression)) {
+    if (access.getName() === "auth" && isIdentifierNamed(access.getExpression(), contextName)) {
+      return true;
+    }
+  }
+  for (const declaration of body.getDescendantsOfKind(SyntaxKind.VariableDeclaration)) {
+    const nameNode = declaration.getNameNode();
+    if (!Node.isObjectBindingPattern(nameNode) || !isIdentifierNamed(declaration.getInitializer(), contextName)) {
+      continue;
+    }
+    for (const element of nameNode.getElements()) {
+      const property = element.getPropertyNameNode()?.getText() ?? element.getNameNode().getText();
+      if (property === "auth") {
+        return true;
+      }
+    }
+  }
+  return false;
+};
+const httpRouteVerbOfTerminal = (terminalCall) => {
+  const terminalCallee = terminalCall.getExpression();
+  if (!Node.isPropertyAccessExpression(terminalCallee) || !TERMINAL_STEPS.has(terminalCallee.getName())) {
+    return void 0;
+  }
+  let node = terminalCallee.getExpression();
+  while (Node.isCallExpression(node)) {
+    const callee = node.getExpression();
+    if (!Node.isPropertyAccessExpression(callee)) {
+      return void 0;
+    }
+    const step = callee.getName();
+    if (HTTP_VERBS.has(step)) {
+      const receiver = callee.getExpression();
+      return Node.isIdentifier(receiver) && receiver.getText() === "httpRoute" ? step.toUpperCase() : void 0;
+    }
+    node = callee.getExpression();
+  }
+  return void 0;
+};
+const guardRowFromCall = (call, relativePath) => {
+  const callee = call.getExpression();
+  if (Node.isIdentifier(callee) && callee.getText() === "httpAction") {
+    const handler2 = inlineHandler(call.getArguments()[0]);
+    const contextName2 = handler2 && contextBinding(handler2, true);
+    if (!handler2 || contextName2 === void 0) {
+      return void 0;
+    }
+    const sideEffect2 = firstSideEffect(handler2, contextName2);
+    return sideEffect2 === void 0 ? void 0 : {
+      exportName: enclosingExportName$1(call),
+      file: relativePath,
+      kind: "httpAction",
+      line: call.getStartLineNumber(),
+      readsAuth: readsContextAuth(handler2, contextName2),
+      sideEffect: sideEffect2
+    };
+  }
+  const method = httpRouteVerbOfTerminal(call);
+  if (method === void 0) {
+    return void 0;
+  }
+  const handler = inlineHandler(call.getArguments()[0]);
+  const contextName = handler && contextBinding(handler, false);
+  if (!handler || contextName === void 0) {
+    return void 0;
+  }
+  const sideEffect = firstSideEffect(handler, contextName);
+  return sideEffect === void 0 ? void 0 : {
+    exportName: enclosingExportName$1(call),
+    file: relativePath,
+    kind: "httpRoute",
+    line: call.getStartLineNumber(),
+    method,
+    readsAuth: readsContextAuth(handler, contextName),
+    sideEffect
+  };
+};
+const guardsInSourceFile = (sourceFile, relativePath) => {
+  const rows = [];
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const row = guardRowFromCall(call, relativePath);
+    if (row) {
+      rows.push(row);
+    }
+  }
+  return rows;
+};
+const discoverHttpActionGuards = (project, lunoraDirectory) => {
+  const rows = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    rows.push(...guardsInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+  }
+  return rows;
+};
+
+const SANITIZER_CALLEES = /* @__PURE__ */ new Set(["btoa", "encodeURI", "encodeURIComponent", "isSafeHeaderValue", "Number", "parseFloat", "parseInt"]);
+const HEADER_MUTATORS = /* @__PURE__ */ new Set(["append", "set"]);
+const calleeName$1 = (callee) => {
+  if (Node.isIdentifier(callee)) {
+    return callee.getText();
+  }
+  return Node.isPropertyAccessExpression(callee) ? callee.getName() : "";
+};
+const staticHeaderName = (node) => {
+  if (node !== void 0 && (Node.isStringLiteral(node) || Node.isNoSubstitutionTemplateLiteral(node))) {
+    return node.getLiteralText();
+  }
+  return "";
+};
+const sanitizesRequestInput = (root, requestName) => {
+  const calls = Node.isCallExpression(root) ? [root, ...root.getDescendantsOfKind(SyntaxKind.CallExpression)] : root.getDescendantsOfKind(SyntaxKind.CallExpression);
+  return calls.some((call) => SANITIZER_CALLEES.has(calleeName$1(call.getExpression())) && referencesRequestInput(call, requestName));
+};
+const isSanitized = (valueNode, requestName) => {
+  if (sanitizesRequestInput(valueNode, requestName)) {
+    return true;
+  }
+  const hop = singleHopInitializer(valueNode);
+  return hop !== void 0 && sanitizesRequestInput(hop, requestName);
+};
+const isUnsafe = (valueNode, requestName) => isRequestInputDerived(valueNode, requestName) && !isSanitized(valueNode, requestName);
+const isHeadersReceiver = (receiver) => {
+  if (Node.isPropertyAccessExpression(receiver) && receiver.getName() === "headers") {
+    return true;
+  }
+  const hop = singleHopInitializer(receiver);
+  return hop !== void 0 && Node.isNewExpression(hop) && calleeName$1(hop.getExpression()) === "Headers";
+};
+const resolveObjectLiteral = (node) => {
+  if (node === void 0) {
+    return void 0;
+  }
+  if (Node.isObjectLiteralExpression(node)) {
+    return node;
+  }
+  const hop = singleHopInitializer(node);
+  return hop !== void 0 && Node.isObjectLiteralExpression(hop) ? hop : void 0;
+};
+const collectFromHeadersObject = (headersObject, via, context) => {
+  for (const property of headersObject.getProperties()) {
+    if (Node.isPropertyAssignment(property)) {
+      const valueNode = property.getInitializer();
+      if (valueNode !== void 0 && isUnsafe(valueNode, context.requestName)) {
+        context.rows.push({
+          exportName: context.exportName,
+          file: context.relativePath,
+          headerName: staticHeaderName(property.getNameNode()),
+          line: valueNode.getStartLineNumber(),
+          via
+        });
+      }
+    } else if (Node.isShorthandPropertyAssignment(property)) {
+      const valueNode = property.getNameNode();
+      if (isUnsafe(valueNode, context.requestName)) {
+        context.rows.push({
+          exportName: context.exportName,
+          file: context.relativePath,
+          headerName: property.getName(),
+          line: valueNode.getStartLineNumber(),
+          via
+        });
+      }
+    } else if (Node.isSpreadAssignment(property)) {
+      const nested = resolveObjectLiteral(property.getExpression());
+      if (nested !== void 0) {
+        collectFromHeadersObject(nested, via, context);
+      }
+    }
+  }
+};
+const collectFromResponseInit = (init, context) => {
+  const initObject = resolveObjectLiteral(init);
+  if (initObject === void 0) {
+    return;
+  }
+  const headersProperty = initObject.getProperty("headers");
+  if (headersProperty === void 0 || !Node.isPropertyAssignment(headersProperty)) {
+    return;
+  }
+  const headersObject = resolveObjectLiteral(headersProperty.getInitializer());
+  if (headersObject !== void 0) {
+    collectFromHeadersObject(headersObject, "response-init", context);
+  }
+};
+const collectFromNewExpression = (newExpression, context) => {
+  const name = calleeName$1(newExpression.getExpression());
+  if (name === "Response") {
+    collectFromResponseInit(newExpression.getArguments()[1], context);
+  } else if (name === "Headers") {
+    const headersObject = resolveObjectLiteral(newExpression.getArguments()[0]);
+    if (headersObject !== void 0) {
+      collectFromHeadersObject(headersObject, "headers-ctor", context);
+    }
+  }
+};
+const collectFromCallExpression = (call, context) => {
+  const callee = call.getExpression();
+  if (!Node.isPropertyAccessExpression(callee)) {
+    return;
+  }
+  const method = callee.getName();
+  const receiver = callee.getExpression();
+  if (method === "json" && Node.isIdentifier(receiver) && receiver.getText() === "Response") {
+    collectFromResponseInit(call.getArguments()[1], context);
+    return;
+  }
+  if (HEADER_MUTATORS.has(method) && isHeadersReceiver(receiver)) {
+    const valueNode = call.getArguments()[1];
+    if (valueNode !== void 0 && isUnsafe(valueNode, context.requestName)) {
+      context.rows.push({
+        exportName: context.exportName,
+        file: context.relativePath,
+        headerName: staticHeaderName(call.getArguments()[0]),
+        line: valueNode.getStartLineNumber(),
+        // `method` is guarded to the two `HEADER_MUTATORS` above, so this covers every case.
+        via: method === "set" ? "headers-set" : "headers-append"
+      });
+    }
+  }
+};
+const headerWritesInHandler = (handler, context) => {
+  for (const newExpression of handler.getDescendantsOfKind(SyntaxKind.NewExpression)) {
+    collectFromNewExpression(newExpression, context);
+  }
+  for (const call of handler.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    collectFromCallExpression(call, context);
+  }
+};
+const headerWritesFromCall = (call, relativePath) => {
+  const callee = call.getExpression();
+  if (!Node.isIdentifier(callee) || callee.getText() !== "httpAction") {
+    return [];
+  }
+  const handler = inlineHandler$1(call.getArguments()[0]);
+  if (handler === void 0) {
+    return [];
+  }
+  const requestParameter = handler.getParameters()[1];
+  if (requestParameter === void 0) {
+    return [];
+  }
+  const nameNode = requestParameter.getNameNode();
+  if (!Node.isIdentifier(nameNode)) {
+    return [];
+  }
+  const rows = [];
+  headerWritesInHandler(handler, { exportName: enclosingExportName$1(call), relativePath, requestName: nameNode.getText(), rows });
+  return rows;
+};
+const headerWritesInSourceFile = (sourceFile, relativePath) => {
+  const rows = [];
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    rows.push(...headerWritesFromCall(call, relativePath));
+  }
+  return rows;
+};
+const discoverHttpHeaderWrites = (project, lunoraDirectory) => {
+  const rows = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    rows.push(...headerWritesInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+  }
+  return rows;
+};
+
+const IDENTITY_FILENAME = "identity.ts";
+const IDENTITY_MODULE_SPECIFIERS = /* @__PURE__ */ new Set(["@lunora/server", "lunorash/server"]);
+const isDefineIdentity = (identifier) => {
+  const symbol = identifier.getSymbol();
+  if (!symbol) {
+    return identifier.getText() === "defineIdentity";
+  }
+  for (const declaration of symbol.getDeclarations()) {
+    if (!Node.isImportSpecifier(declaration)) {
+      continue;
+    }
+    if (!IDENTITY_MODULE_SPECIFIERS.has(declaration.getImportDeclaration().getModuleSpecifierValue())) {
+      return false;
+    }
+    return declaration.getNameNode().getText() === "defineIdentity";
+  }
+  return false;
+};
+const isIdentityNamespaceImport = (identifier) => {
+  const symbol = identifier.getSymbol();
+  if (!symbol) {
+    return false;
+  }
+  for (const declaration of symbol.getDeclarations()) {
+    if (!Node.isNamespaceImport(declaration)) {
+      continue;
+    }
+    const importDeclaration = declaration.getFirstAncestorByKind(SyntaxKind.ImportDeclaration);
+    return importDeclaration !== void 0 && IDENTITY_MODULE_SPECIFIERS.has(importDeclaration.getModuleSpecifierValue());
+  }
+  return false;
+};
+const isDefineIdentityCallee = (callee) => {
+  if (Node.isIdentifier(callee)) {
+    return isDefineIdentity(callee);
+  }
+  if (Node.isPropertyAccessExpression(callee)) {
+    const object = callee.getExpression();
+    return callee.getName() === "defineIdentity" && Node.isIdentifier(object) && isIdentityNamespaceImport(object);
+  }
+  return false;
+};
+const identitiesFromSource = (source) => {
+  const identities = [];
+  for (const declaration of source.getVariableDeclarations()) {
+    if (!declaration.isExported()) {
+      continue;
+    }
+    const initializer = declaration.getInitializer();
+    if (initializer?.getKind() !== SyntaxKind.CallExpression) {
+      continue;
+    }
+    const callExpression = initializer;
+    if (!isDefineIdentityCallee(callExpression.getExpression())) {
+      continue;
+    }
+    const nameNode = declaration.getNameNode();
+    if (!Node.isIdentifier(nameNode)) {
+      throw diagnosticAt(nameNode, "defineIdentity exports must be plain named exports (no destructuring)");
+    }
+    identities.push({ exportName: nameNode.getText() });
+  }
+  return identities;
+};
+const discoverIdentity = (project, lunoraDirectory) => {
+  const identityPath = join(lunoraDirectory, IDENTITY_FILENAME);
+  if (!existsSync(identityPath)) {
+    return void 0;
+  }
+  const source = project.getSourceFile(identityPath) ?? project.addSourceFileAtPath(identityPath);
+  const identities = identitiesFromSource(source);
+  if (identities.length === 0) {
+    return void 0;
+  }
+  if (identities.length > 1) {
+    throw diagnosticAt(
+      source,
+      `lunora/identity.ts declares ${identities.length.toString()} defineIdentity() contracts (${identities.map((identity) => identity.exportName).join(", ")}); exactly one is allowed`
+    );
+  }
+  return identities[0];
+};
+
+const IDENTITY_RECEIVERS = /* @__PURE__ */ new Set(["auth", "context.auth", "ctx.auth"]);
+const ALWAYS_DECLARED_CLAIM = "userId";
+const declaredClaimKeys = (objectLiteral) => {
+  const keys = /* @__PURE__ */ new Set();
+  for (const property of objectLiteral.getProperties()) {
+    if (Node.isSpreadAssignment(property)) {
+      return void 0;
+    }
+    if (Node.isPropertyAssignment(property) || Node.isShorthandPropertyAssignment(property) || Node.isMethodDeclaration(property)) {
+      keys.add(property.getName());
+    }
+  }
+  return keys;
+};
+const resolveDeclaredClaims = (project, lunoraDirectory) => {
+  const identityPath = join(lunoraDirectory, IDENTITY_FILENAME);
+  if (!existsSync(identityPath)) {
+    return void 0;
+  }
+  const source = project.getSourceFile(identityPath) ?? project.addSourceFileAtPath(identityPath);
+  for (const call of source.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    if (calleeName$2(call.getExpression()) !== "defineIdentity") {
+      continue;
+    }
+    const [argument] = call.getArguments();
+    return argument && Node.isObjectLiteralExpression(argument) ? declaredClaimKeys(argument) : void 0;
+  }
+  return void 0;
+};
+const identityBagAccess = (node) => {
+  if (node === void 0 || !Node.isPropertyAccessExpression(node) || node.getName() !== "identity") {
+    return void 0;
+  }
+  return IDENTITY_RECEIVERS.has(node.getExpression().getText()) ? node : void 0;
+};
+const claimKeyRead = (node) => {
+  if (Node.isPropertyAccessExpression(node) && identityBagAccess(node.getExpression()) !== void 0) {
+    return node.getName();
+  }
+  if (Node.isElementAccessExpression(node) && identityBagAccess(node.getExpression()) !== void 0) {
+    const argument = node.getArgumentExpression();
+    return argument && Node.isStringLiteral(argument) ? argument.getLiteralValue() : void 0;
+  }
+  return void 0;
+};
+const claimReadsInSourceFile = (sourceFile, relativePath, declared) => {
+  const found = [];
+  for (const node of sourceFile.getDescendants()) {
+    const key = claimKeyRead(node);
+    if (key === void 0) {
+      continue;
+    }
+    found.push({
+      declared: key === ALWAYS_DECLARED_CLAIM || declared.has(key),
+      exportName: enclosingExportName$1(node),
+      file: relativePath,
+      key,
+      line: node.getStartLineNumber()
+    });
+  }
+  return found;
+};
+const discoverIdentityClaimReads = (project, lunoraDirectory) => {
+  const declared = resolveDeclaredClaims(project, lunoraDirectory);
+  if (declared === void 0) {
+    return [];
+  }
+  const rows = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    rows.push(...claimReadsInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath), declared));
+  }
+  return rows;
+};
+
+const keyInitializer$1 = (options) => {
+  if (!Node.isObjectLiteralExpression(options)) {
+    return void 0;
+  }
+  const property = options.getProperty("key");
+  return property && Node.isPropertyAssignment(property) ? property.getInitializer() : void 0;
+};
+const imageDeliveryUrlAccessInCall = (call, relativePath) => {
+  if (calleeName$2(call.getExpression()) !== "buildImageDeliveryUrl") {
+    return void 0;
+  }
+  const options = call.getArguments()[0];
+  if (!options) {
+    return void 0;
+  }
+  const key = keyInitializer$1(options);
+  if (!key || !isArgumentDerived(key) || isScopedByContext(key)) {
+    return void 0;
+  }
+  return { exportName: enclosingExportName$1(call), file: relativePath, line: call.getStartLineNumber() };
+};
+const imageDeliveryUrlAccessesInSourceFile = (sourceFile, relativePath) => {
+  const found = [];
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const access = imageDeliveryUrlAccessInCall(call, relativePath);
+    if (access) {
+      found.push(access);
+    }
+  }
+  return found;
+};
+const discoverImageDeliveryUrlAccesses = (project, lunoraDirectory) => {
+  const accesses = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    accesses.push(...imageDeliveryUrlAccessesInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+  }
+  return accesses;
+};
+
+const KV_KEY_METHODS = /* @__PURE__ */ new Set(["delete", "get", "getRaw", "getWithMetadata", "put"]);
+const discoverKvKeyAccesses = (project, lunoraDirectory) => discoverArgumentDerivedAccesses(project, lunoraDirectory, {
+  argIndex: 0,
+  matchReceiver: (receiver) => receiver === "ctx.kv" || receiver.startsWith("ctx.kv."),
+  methods: KV_KEY_METHODS
+});
+
+const MAIL_METHODS = /* @__PURE__ */ new Set(["queue", "send"]);
+const RECIPIENT_FIELDS = /* @__PURE__ */ new Set(["bcc", "cc", "to"]);
+const mailRecipientMethod = (node) => {
+  if (!Node.isPropertyAccessExpression(node)) {
+    return void 0;
+  }
+  const method = node.getName();
+  if (!MAIL_METHODS.has(method)) {
+    return void 0;
+  }
+  const receiver = node.getExpression().getText();
+  return receiver === "ctx.mail" || receiver === "ctx.email" ? method : void 0;
+};
+const hasUnscopedArgumentDerivedRecipient = (argument) => {
+  if (!Node.isObjectLiteralExpression(argument)) {
+    return false;
+  }
+  return argument.getProperties().some((property) => {
+    if (Node.isShorthandPropertyAssignment(property)) {
+      const value2 = property.getNameNode();
+      return RECIPIENT_FIELDS.has(property.getName()) && isArgumentDerived(value2) && !isScopedByContext(value2);
+    }
+    if (!Node.isPropertyAssignment(property) || !RECIPIENT_FIELDS.has(property.getName())) {
+      return false;
+    }
+    const value = property.getInitializer();
+    return value !== void 0 && isArgumentDerived(value) && !isScopedByContext(value);
+  });
+};
+const mailAccessInCall = (call, relativePath) => {
+  const method = mailRecipientMethod(call.getExpression());
+  if (method === void 0) {
+    return void 0;
+  }
+  const options = call.getArguments()[0];
+  if (!options || !hasUnscopedArgumentDerivedRecipient(options)) {
+    return void 0;
+  }
+  return { exportName: enclosingExportName$1(call), file: relativePath, line: call.getStartLineNumber(), method };
+};
+const mailAccessesInSourceFile = (sourceFile, relativePath) => {
+  const found = [];
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const access = mailAccessInCall(call, relativePath);
+    if (access) {
+      found.push(access);
+    }
+  }
+  return found;
+};
+const discoverMailRecipientAccesses = (project, lunoraDirectory) => {
+  const accesses = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    accesses.push(...mailAccessesInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+  }
+  return accesses;
+};
+
+const isDatabaseReplaceCall = (call) => {
+  const callee = call.getExpression();
+  if (!Node.isPropertyAccessExpression(callee) || callee.getName() !== "replace") {
+    return false;
+  }
+  const receiver = callee.getExpression();
+  if (Node.isPropertyAccessExpression(receiver)) {
+    return receiver.getName() === "db";
+  }
+  return Node.isIdentifier(receiver) && receiver.getText() === "db";
+};
+const serverImplNode = (call) => {
+  const argument = call.getArguments()[0];
+  if (argument === void 0 || !Node.isObjectLiteralExpression(argument)) {
+    return void 0;
+  }
+  const property = argument.getProperty("server");
+  if (property === void 0) {
+    return void 0;
+  }
+  return Node.isPropertyAssignment(property) ? property.getInitializer() : property;
+};
+const exportedDefineMutatorCall = (declaration) => {
+  if (!declaration.isExported()) {
+    return void 0;
+  }
+  const initializer = declaration.getInitializer();
+  if (initializer?.getKind() !== SyntaxKind.CallExpression) {
+    return void 0;
+  }
+  const call = initializer;
+  return isDefineMutatorCallee(call.getExpression()) ? call : void 0;
+};
+const writesFromDeclaration = (declaration) => {
+  const call = exportedDefineMutatorCall(declaration);
+  const serverImpl = call === void 0 ? void 0 : serverImplNode(call);
+  if (serverImpl === void 0) {
+    return [];
+  }
+  const nameNode = declaration.getNameNode();
+  const exportName = Node.isIdentifier(nameNode) ? nameNode.getText() : "";
+  return serverImpl.getDescendantsOfKind(SyntaxKind.CallExpression).filter((replaceCall) => isDatabaseReplaceCall(replaceCall)).map((replaceCall) => {
+    return { exportName, file: "lunora/mutators.ts", line: replaceCall.getStartLineNumber() };
+  });
+};
+const mutatorWritesFromSource = (source) => source.getVariableDeclarations().flatMap((declaration) => writesFromDeclaration(declaration));
+const discoverMutatorWrites = (project, lunoraDirectory) => {
+  const mutatorsPath = join(lunoraDirectory, MUTATORS_FILENAME);
+  if (!existsSync(mutatorsPath)) {
+    return [];
+  }
+  const source = project.getSourceFile(mutatorsPath) ?? project.addSourceFileAtPath(mutatorsPath);
+  return mutatorWritesFromSource(source);
+};
+
+const SINK_METHODS = /* @__PURE__ */ new Set(["delete", "get", "patch"]);
+const OWNERSHIP_IDENTIFIER_NAMES = /* @__PURE__ */ new Set([
+  "accountId",
+  "authorId",
+  "companyId",
+  "createdBy",
+  "createdById",
+  "customerId",
+  "groupId",
+  "memberId",
+  "organizationId",
+  "orgId",
+  "ownerId",
+  "projectId",
+  "teamId",
+  "tenantId",
+  "userId",
+  "workspaceId"
+]);
+const IDENTITY_ACCESSORS = /* @__PURE__ */ new Set(["auth", "identity", "session", "user"]);
+const EQUALITY_OPERATORS = /* @__PURE__ */ new Set([
+  SyntaxKind.EqualsEqualsEqualsToken,
+  SyntaxKind.EqualsEqualsToken,
+  SyntaxKind.ExclamationEqualsEqualsToken,
+  SyntaxKind.ExclamationEqualsToken
+]);
+const normalizeIdTable = (call) => {
+  const callee = call.getExpression();
+  if (!Node.isPropertyAccessExpression(callee) || callee.getName() !== "normalizeId" || !isDatabaseAccessor(callee.getExpression())) {
+    return void 0;
+  }
+  const first = call.getArguments()[0];
+  return first && Node.isStringLiteral(first) ? first.getLiteralText() : "";
+};
+const bindingNameOf = (call) => {
+  let node = call;
+  let parent = node.getParent();
+  while (parent !== void 0 && (Node.isAsExpression(parent) || Node.isParenthesizedExpression(parent) || Node.isNonNullExpression(parent))) {
+    node = parent;
+    parent = node.getParent();
+  }
+  if (parent === void 0 || !Node.isVariableDeclaration(parent)) {
+    return void 0;
+  }
+  const nameNode = parent.getNameNode();
+  return Node.isIdentifier(nameNode) ? nameNode.getText() : void 0;
+};
+const conditionReferences = (condition, name) => condition.getDescendantsOfKind(SyntaxKind.Identifier).some((identifier) => identifier.getText() === name);
+const exitsControlFlow = (node) => Node.isThrowStatement(node) || Node.isReturnStatement(node) || node.getDescendantsOfKind(SyntaxKind.ThrowStatement).length > 0 || node.getDescendantsOfKind(SyntaxKind.ReturnStatement).length > 0;
+const hasNullGate = (handler, name) => handler.getDescendantsOfKind(SyntaxKind.IfStatement).some((ifStatement) => conditionReferences(ifStatement.getExpression(), name) && exitsControlFlow(ifStatement.getThenStatement()));
+const idSinkMethod = (handler, name) => {
+  for (const call of handler.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const callee = call.getExpression();
+    if (!Node.isPropertyAccessExpression(callee)) {
+      continue;
+    }
+    const method = callee.getName();
+    if (!SINK_METHODS.has(method)) {
+      continue;
+    }
+    const receiver = callee.getExpression();
+    const onDatabase = isDatabaseAccessor(receiver) || Node.isPropertyAccessExpression(receiver) && isDatabaseAccessor(receiver.getExpression());
+    if (!onDatabase) {
+      continue;
+    }
+    const first = call.getArguments()[0];
+    if (first !== void 0 && Node.isIdentifier(first) && first.getText() === name) {
+      return method;
+    }
+  }
+  return void 0;
+};
+const rootIdentifierName = (node) => {
+  let current = node;
+  while (Node.isPropertyAccessExpression(current) || Node.isElementAccessExpression(current) || Node.isNonNullExpression(current) || Node.isParenthesizedExpression(current) || Node.isAsExpression(current) || Node.isAwaitExpression(current)) {
+    current = current.getExpression();
+  }
+  return Node.isIdentifier(current) ? current.getText() : void 0;
+};
+const delegatesContextToHelper = (handler) => handler.getDescendantsOfKind(SyntaxKind.CallExpression).some((call) => call.getArguments().some((argument) => rootIdentifierName(argument) === "ctx"));
+const comparesRowProperty = (handler) => handler.getDescendantsOfKind(SyntaxKind.BinaryExpression).some((binary) => {
+  if (!EQUALITY_OPERATORS.has(binary.getOperatorToken().getKind())) {
+    return false;
+  }
+  return Node.isPropertyAccessExpression(binary.getLeft()) || Node.isPropertyAccessExpression(binary.getRight());
+});
+const handlerMentionsOwnership = (handler) => {
+  for (const identifier of handler.getDescendantsOfKind(SyntaxKind.Identifier)) {
+    if (OWNERSHIP_IDENTIFIER_NAMES.has(identifier.getText())) {
+      return true;
+    }
+  }
+  for (const access of handler.getDescendantsOfKind(SyntaxKind.PropertyAccessExpression)) {
+    const root = access.getExpression();
+    if (Node.isIdentifier(root) && root.getText() === "ctx" && IDENTITY_ACCESSORS.has(access.getName())) {
+      return true;
+    }
+  }
+  return delegatesContextToHelper(handler) || comparesRowProperty(handler);
+};
+const normalizeIdAuthorizationsInDeclaration = (declaration, relativePath) => {
+  if (!Node.isVariableDeclaration(declaration)) {
+    return [];
+  }
+  const initializer = declaration.getInitializer();
+  if (initializer === void 0 || !Node.isCallExpression(initializer)) {
+    return [];
+  }
+  const classified = classifyProcedureCall(initializer);
+  if (classified?.kind !== "query" && classified?.kind !== "mutation") {
+    return [];
+  }
+  const handler = procedureHandler(initializer);
+  if (handler === void 0) {
+    return [];
+  }
+  const usesRls = classified.receiver !== void 0 && chainUsesWrappedCall(classified.receiver, "use", "rls");
+  const mentionsOwnership = handlerMentionsOwnership(handler);
+  const seen = /* @__PURE__ */ new Set();
+  const rows = [];
+  for (const call of handler.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const table = normalizeIdTable(call);
+    if (table === void 0) {
+      continue;
+    }
+    const name = bindingNameOf(call);
+    if (name === void 0 || seen.has(name) || !hasNullGate(handler, name)) {
+      continue;
+    }
+    const sinkMethod = idSinkMethod(handler, name);
+    if (sinkMethod === void 0) {
+      continue;
+    }
+    seen.add(name);
+    rows.push({
+      exportName: declaration.getName(),
+      file: relativePath,
+      line: call.getStartLineNumber(),
+      mentionsOwnership,
+      sinkMethod,
+      table,
+      usesRls,
+      visibility: classified.visibility
+    });
+  }
+  return rows;
+};
+const discoverNormalizeIdAuthorization = (project, lunoraDirectory) => {
+  const rows = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    const relativePath = lunoraRelativePath(lunoraDirectory, filePath);
+    for (const statement of sourceFile.getVariableStatements()) {
+      if (!statement.isExported()) {
+        continue;
+      }
+      for (const declaration of statement.getDeclarations()) {
+        rows.push(...normalizeIdAuthorizationsInDeclaration(declaration, relativePath));
+      }
+    }
+  }
+  return rows;
+};
+
+const IDENTITY_FIELDS = /* @__PURE__ */ new Set([
+  "accountId",
+  "authorId",
+  "createdBy",
+  "createdById",
+  "organizationId",
+  "orgId",
+  "ownerId",
+  "tenantId",
+  "updatedBy",
+  "userId",
+  "workspaceId"
+]);
+const IDENTITY_WRITE_METHODS = /* @__PURE__ */ new Set(["insert", "insertManyUnsafe", "patch", "replace"]);
+const contextDatabaseWriteMethod = (node) => {
+  if (!Node.isPropertyAccessExpression(node)) {
+    return void 0;
+  }
+  const method = node.getName();
+  if (!IDENTITY_WRITE_METHODS.has(method)) {
+    return void 0;
+  }
+  const database = node.getExpression();
+  if (!Node.isPropertyAccessExpression(database) || database.getName() !== "db") {
+    return void 0;
+  }
+  const context = database.getExpression();
+  return Node.isIdentifier(context) && context.getText() === "ctx" ? method : void 0;
+};
+const documentObjectLiterals = (documentArgument, method) => {
+  if (method !== "insertManyUnsafe") {
+    return Node.isObjectLiteralExpression(documentArgument) ? [documentArgument] : [];
+  }
+  if (!Node.isArrayLiteralExpression(documentArgument)) {
+    return [];
+  }
+  const objectLiterals = [];
+  for (const element of documentArgument.getElements()) {
+    if (Node.isObjectLiteralExpression(element)) {
+      objectLiterals.push(element);
+    }
+  }
+  return objectLiterals;
+};
+const identityWritesInObjectLiteral = (objectLiteral, method, call, relativePath) => {
+  const rows = [];
+  for (const property of objectLiteral.getProperties()) {
+    let name;
+    let value;
+    if (Node.isPropertyAssignment(property)) {
+      name = property.getName();
+      value = property.getInitializer();
+    } else if (Node.isShorthandPropertyAssignment(property)) {
+      name = property.getName();
+      value = property.getNameNode();
+    }
+    if (name === void 0 || value === void 0 || !IDENTITY_FIELDS.has(name)) {
+      continue;
+    }
+    if (isArgumentDerived(value) && !isScopedByContext(value)) {
+      rows.push({ exportName: enclosingExportName$1(call), field: name, file: relativePath, line: call.getStartLineNumber(), method });
+    }
+  }
+  return rows;
+};
+const ownerFieldWritesInCall = (call, relativePath) => {
+  const method = contextDatabaseWriteMethod(call.getExpression());
+  if (method === void 0) {
+    return [];
+  }
+  const documentArgument = call.getArguments()[1];
+  if (!documentArgument) {
+    return [];
+  }
+  return documentObjectLiterals(documentArgument, method).flatMap(
+    (objectLiteral) => identityWritesInObjectLiteral(objectLiteral, method, call, relativePath)
+  );
+};
+const ownerFieldWritesInSourceFile = (sourceFile, relativePath) => {
+  const found = [];
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    found.push(...ownerFieldWritesInCall(call, relativePath));
+  }
+  return found;
+};
+const discoverOwnerFieldWrites = (project, lunoraDirectory) => {
+  const writes = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    writes.push(...ownerFieldWritesInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+  }
+  return writes;
+};
+
+const discoverPackageDependencies = (projectRoot) => {
+  const manifestPath = join(projectRoot, "package.json");
+  if (!existsSync(manifestPath)) {
+    return /* @__PURE__ */ new Set();
+  }
+  try {
+    const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+    const names = /* @__PURE__ */ new Set();
+    for (const field of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
+      const section = manifest[field];
+      if (section !== null && typeof section === "object") {
+        for (const name of Object.keys(section)) {
+          names.add(name);
+        }
+      }
+    }
+    return names;
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+};
+
+const WEBHOOK_ADAPTER_CALLEES = /* @__PURE__ */ new Set(["createAutumnAdapter", "createDodoPaymentsAdapter", "createPolarAdapter", "createStripeAdapter"]);
+const numericLiteralValue$1 = (node) => node && Node.isNumericLiteral(node) ? Number(node.getText()) : void 0;
+const toleranceFromOptions = (objectLiteral) => {
+  const property = objectLiteral.getProperty("webhookToleranceSeconds");
+  return property && Node.isPropertyAssignment(property) ? numericLiteralValue$1(property.getInitializer()) : void 0;
+};
+const paymentWebhooksInSourceFile = (sourceFile, relativePath) => {
+  const rows = [];
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const callee = calleeName$2(call.getExpression());
+    if (callee === void 0 || !WEBHOOK_ADAPTER_CALLEES.has(callee)) {
+      continue;
+    }
+    const [argument] = call.getArguments();
+    const toleranceSeconds = argument && Node.isObjectLiteralExpression(argument) ? toleranceFromOptions(argument) : void 0;
+    rows.push({
+      callee,
+      exportName: enclosingExportName$1(call),
+      file: relativePath,
+      line: call.getStartLineNumber(),
+      ...toleranceSeconds === void 0 ? {} : { toleranceSeconds }
+    });
+  }
+  return rows;
+};
+const discoverPaymentWebhooks = (project, lunoraDirectory) => {
+  const rows = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    rows.push(...paymentWebhooksInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+  }
+  return rows;
+};
+
+const HANDLER_FACTORIES = /* @__PURE__ */ new Set(["defineQueue", "defineWorkflow"]);
+const DISPATCH_METHODS = /* @__PURE__ */ new Set(["run", "runAction", "runMutation", "runQuery"]);
+const REFERENCE_ROOTS = /* @__PURE__ */ new Set(["api", "internal"]);
+const calleeName = (call) => {
+  const expression = call.getExpression();
+  return Node.isIdentifier(expression) ? expression.getText() : void 0;
+};
+const handlerFunctionOf = (call) => {
+  const config = call.getArguments()[0];
+  if (!config || !Node.isObjectLiteralExpression(config)) {
+    return void 0;
+  }
+  const property = config.getProperty("handler");
+  if (property === void 0 || !Node.isPropertyAssignment(property)) {
+    return void 0;
+  }
+  const initializer = property.getInitializer();
+  if (initializer && (Node.isArrowFunction(initializer) || Node.isFunctionExpression(initializer))) {
+    return initializer;
+  }
+  return void 0;
+};
+const parameterName = (handler, index) => {
+  const nameNode = handler.getParameters()[index]?.getNameNode();
+  return nameNode && Node.isIdentifier(nameNode) ? nameNode.getText() : void 0;
+};
+const isUnderPath = (text, prefix) => text === prefix || text.startsWith(`${prefix}.`);
+const propertyAccessesIn = (node) => {
+  const accesses = node.getDescendantsOfKind(SyntaxKind.PropertyAccessExpression);
+  if (Node.isPropertyAccessExpression(node)) {
+    accesses.push(node);
+  }
+  return accesses;
+};
+const isReferenceIdentifier = (identifier) => {
+  const parent = identifier.getParent();
+  if (Node.isPropertyAccessExpression(parent) && parent.getNameNode() === identifier) {
+    return false;
+  }
+  if (Node.isPropertyAssignment(parent) && parent.getNameNode() === identifier) {
+    return false;
+  }
+  return !(Node.isBindingElement(parent) && parent.getNameNode() === identifier);
+};
+const identifiersIn = (node) => {
+  const identifiers = node.getDescendantsOfKind(SyntaxKind.Identifier).filter((identifier) => isReferenceIdentifier(identifier));
+  if (Node.isIdentifier(node) && isReferenceIdentifier(node)) {
+    identifiers.push(node);
+  }
+  return identifiers;
+};
+const declaredNames = (declaration) => {
+  if (!Node.isVariableDeclaration(declaration)) {
+    return [];
+  }
+  const nameNode = declaration.getNameNode();
+  if (Node.isIdentifier(nameNode)) {
+    return [nameNode.getText()];
+  }
+  return nameNode.getDescendantsOfKind(SyntaxKind.BindingElement).map((element) => element.getName());
+};
+const queuePayloadPrefixes = (handler) => {
+  const batchParameter = parameterName(handler, 1);
+  if (batchParameter === void 0) {
+    return [];
+  }
+  const prefixes = [`${batchParameter}.messages`];
+  for (const loop of handler.getDescendantsOfKind(SyntaxKind.ForOfStatement)) {
+    if (loop.getExpression().getText() !== `${batchParameter}.messages`) {
+      continue;
+    }
+    const declarations = loop.getInitializer();
+    const binding = Node.isVariableDeclarationList(declarations) ? declarations.getDeclarations()[0]?.getNameNode() : void 0;
+    if (binding && Node.isIdentifier(binding)) {
+      prefixes.push(`${binding.getText()}.body`);
+    }
+  }
+  return prefixes;
+};
+const collectPayload = (handler, kind, contextParameter) => {
+  const prefixes = kind === "workflow" ? [`${contextParameter}.params`] : queuePayloadPrefixes(handler);
+  const names = /* @__PURE__ */ new Set();
+  const referencesPayload = (node) => {
+    if (propertyAccessesIn(node).some((access) => prefixes.some((prefix) => isUnderPath(access.getText(), prefix)))) {
+      return true;
+    }
+    return identifiersIn(node).some((identifier) => names.has(identifier.getText()));
+  };
+  for (const declaration of handler.getDescendantsOfKind(SyntaxKind.VariableDeclaration)) {
+    const initializer = declaration.getInitializer();
+    if (initializer && referencesPayload(initializer)) {
+      for (const name of declaredNames(declaration)) {
+        names.add(name);
+      }
+    }
+  }
+  return { names, prefixes };
+};
+const argumentsReferencePayload = (argsNode, payload) => {
+  if (propertyAccessesIn(argsNode).some((access) => payload.prefixes.some((prefix) => isUnderPath(access.getText(), prefix)))) {
+    return true;
+  }
+  return identifiersIn(argsNode).some((identifier) => payload.names.has(identifier.getText()));
+};
+const resolveTarget = (node) => {
+  if (node === void 0 || !Node.isPropertyAccessExpression(node)) {
+    return void 0;
+  }
+  const segments = [];
+  let current = node;
+  while (Node.isPropertyAccessExpression(current)) {
+    segments.unshift(current.getName());
+    current = current.getExpression();
+  }
+  const exportName = segments.at(-1);
+  if (exportName === void 0 || !Node.isIdentifier(current) || !REFERENCE_ROOTS.has(current.getText()) || segments.length < 2) {
+    return void 0;
+  }
+  return { exportName, file: segments.slice(0, -1).join("/") };
+};
+const dispatchesInHandler = (handler, kind, relativePath) => {
+  const contextParameter = parameterName(handler, 0);
+  if (contextParameter === void 0) {
+    return [];
+  }
+  const payload = collectPayload(handler, kind, contextParameter);
+  const found = [];
+  for (const call of handler.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const receiver = call.getExpression();
+    if (!Node.isPropertyAccessExpression(receiver) || !DISPATCH_METHODS.has(receiver.getName()) || receiver.getExpression().getText() !== contextParameter) {
+      continue;
+    }
+    const argumentsObject = call.getArguments()[1];
+    if (!argumentsObject || !argumentsReferencePayload(argumentsObject, payload)) {
+      continue;
+    }
+    const target = resolveTarget(call.getArguments()[0]);
+    if (target === void 0) {
+      continue;
+    }
+    found.push({
+      dispatchKind: kind,
+      file: relativePath,
+      handlerExport: enclosingExportName$1(call),
+      line: call.getStartLineNumber(),
+      targetExport: target.exportName,
+      targetFile: target.file
+    });
+  }
+  return found;
+};
+const dispatchesInSourceFile = (sourceFile, relativePath) => {
+  const found = [];
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const name = calleeName(call);
+    if (name === void 0 || !HANDLER_FACTORIES.has(name)) {
+      continue;
+    }
+    const handler = handlerFunctionOf(call);
+    if (handler === void 0) {
+      continue;
+    }
+    found.push(...dispatchesInHandler(handler, name === "defineQueue" ? "queue" : "workflow", relativePath));
+  }
+  return found;
+};
+const discoverPrivilegedDispatches = (project, lunoraDirectory) => {
+  const rows = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    rows.push(...dispatchesInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+  }
+  return rows;
+};
+
+const MIDDLEWARE_FLAGS = {
+  dbRateLimit: "usesRateLimit",
+  mask: "usesMask",
+  rateLimit: "usesRateLimit",
+  rls: "usesRls",
+  verifyTurnstile: "usesCaptcha",
+  verifyTurnstileMiddleware: "usesCaptcha"
+};
+const USER_TABLE_RE = /account|credential|member|passkey|session|user/iu;
+const calleeNameOf = (call) => {
+  const callee = call.getExpression();
+  if (Node.isIdentifier(callee)) {
+    return callee.getText();
+  }
+  if (Node.isPropertyAccessExpression(callee)) {
+    return callee.getName();
+  }
+  return void 0;
+};
+const protectPublicFlags = (call) => {
+  const argument = call.getArguments()[0];
+  if (!argument || !Node.isObjectLiteralExpression(argument)) {
+    return { usesCaptcha: false, usesRateLimit: false };
+  }
+  return { usesCaptcha: Boolean(argument.getProperty("captcha")), usesRateLimit: Boolean(argument.getProperty("rateLimit")) };
+};
+const resolveUseArgumentCall = (argument) => {
+  if (Node.isCallExpression(argument)) {
+    return argument;
+  }
+  if (!Node.isIdentifier(argument)) {
+    return void 0;
+  }
+  const declaration = argument.getSourceFile().getVariableDeclaration(argument.getText());
+  const initializer = declaration?.getInitializer();
+  return initializer && Node.isCallExpression(initializer) ? initializer : void 0;
+};
+const NO_PROTECTIONS = { usesCaptcha: false, usesMask: false, usesRateLimit: false, usesRls: false };
+const useStepProtections = (useArgument) => {
+  const argument = resolveUseArgumentCall(useArgument);
+  const name = argument ? calleeNameOf(argument) : void 0;
+  if (argument && name === "protectPublic") {
+    const bundle = protectPublicFlags(argument);
+    return { ...NO_PROTECTIONS, usesCaptcha: bundle.usesCaptcha, usesRateLimit: bundle.usesRateLimit };
+  }
+  if (name !== void 0 && name in MIDDLEWARE_FLAGS) {
+    return { ...NO_PROTECTIONS, [MIDDLEWARE_FLAGS[name]]: true };
+  }
+  return NO_PROTECTIONS;
+};
+const protectionsInChain = (receiver) => {
+  const protections = { ...NO_PROTECTIONS };
+  let node = receiver;
+  while (Node.isCallExpression(node)) {
+    const chainCallee = node.getExpression();
+    if (!Node.isPropertyAccessExpression(chainCallee)) {
+      break;
+    }
+    const useArgument = chainCallee.getName() === "use" ? node.getArguments()[0] : void 0;
+    if (useArgument) {
+      const step = useStepProtections(useArgument);
+      protections.usesCaptcha ||= step.usesCaptcha;
+      protections.usesMask ||= step.usesMask;
+      protections.usesRateLimit ||= step.usesRateLimit;
+      protections.usesRls ||= step.usesRls;
+    }
+    node = chainCallee.getExpression();
+  }
+  return protections;
+};
+const isUserTableInsert = (call) => {
+  const callee = call.getExpression();
+  if (!Node.isPropertyAccessExpression(callee) || callee.getName() !== "insert") {
+    return false;
+  }
+  const receiver = callee.getExpression();
+  const onDatabase = Node.isPropertyAccessExpression(receiver) ? receiver.getName() === "db" : Node.isIdentifier(receiver) && receiver.getText() === "db";
+  if (!onDatabase) {
+    return false;
+  }
+  const tableArgument = call.getArguments()[0];
+  return Boolean(tableArgument && Node.isStringLiteral(tableArgument) && USER_TABLE_RE.test(tableArgument.getLiteralText()));
+};
+const FANOUT_METHODS = /* @__PURE__ */ new Set(["create", "runAfter", "runAt", "send", "sendBatch"]);
+const FANOUT_SURFACES = /* @__PURE__ */ new Set(["queues", "scheduler", "workflows"]);
+const isFanOutCall = (call) => {
+  const callee = call.getExpression();
+  if (!Node.isPropertyAccessExpression(callee) || !FANOUT_METHODS.has(callee.getName())) {
+    return false;
+  }
+  let node = callee.getExpression();
+  while (Node.isCallExpression(node) || Node.isElementAccessExpression(node) || Node.isPropertyAccessExpression(node)) {
+    if (Node.isPropertyAccessExpression(node) && FANOUT_SURFACES.has(node.getName())) {
+      const receiver = node.getExpression();
+      if (Node.isIdentifier(receiver) && receiver.getText() === "ctx") {
+        return true;
+      }
+    }
+    node = node.getExpression();
+  }
+  return false;
+};
+const isUnsafeInsert = (call) => {
+  const callee = call.getExpression();
+  if (!Node.isPropertyAccessExpression(callee) || callee.getName() !== "insertManyUnsafe") {
+    return false;
+  }
+  const receiver = callee.getExpression();
+  return Node.isPropertyAccessExpression(receiver) ? receiver.getName() === "db" : Node.isIdentifier(receiver) && receiver.getText() === "db";
+};
+const AI_GENERATION_CALLEES = /* @__PURE__ */ new Set(["generateObject", "generateText", "streamObject", "streamText"]);
+const isUnboundedAiGeneration = (call) => {
+  const name = calleeNameOf(call);
+  if (name === void 0 || !AI_GENERATION_CALLEES.has(name)) {
+    return false;
+  }
+  const argument = call.getArguments()[0];
+  if (!argument || !Node.isObjectLiteralExpression(argument)) {
+    return false;
+  }
+  if (argument.getProperties().some((property) => Node.isSpreadAssignment(property))) {
+    return false;
+  }
+  return !argument.getProperty("maxOutputTokens");
+};
+const referencesMail = (declaration) => declaration.getDescendantsOfKind(SyntaxKind.PropertyAccessExpression).some((access) => {
+  const name = access.getName();
+  if (name !== "mail" && name !== "email") {
+    return false;
+  }
+  const receiver = access.getExpression();
+  return Node.isIdentifier(receiver) && receiver.getText() === "ctx";
+});
+const behaviourOf = (declaration) => {
+  let fanOut = false;
+  let unboundedAiGeneration = false;
+  let usesInsertManyUnsafe = false;
+  let writesUserTable = false;
+  for (const call of declaration.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    if (isUserTableInsert(call)) {
+      writesUserTable = true;
+    }
+    if (isFanOutCall(call)) {
+      fanOut = true;
+    }
+    if (isUnsafeInsert(call)) {
+      usesInsertManyUnsafe = true;
+    }
+    if (isUnboundedAiGeneration(call)) {
+      unboundedAiGeneration = true;
+    }
+    if (writesUserTable && fanOut && usesInsertManyUnsafe && unboundedAiGeneration) {
+      break;
+    }
+  }
+  return { callsMail: referencesMail(declaration), fanOut, unboundedAiGeneration, usesInsertManyUnsafe, writesUserTable };
+};
+const middlewareIrFromDeclaration = (declaration, relativePath) => {
+  const initializer = declaration.getInitializer();
+  if (!initializer || !Node.isCallExpression(initializer)) {
+    return void 0;
+  }
+  const classified = classifyProcedureCall(initializer);
+  if (!classified || classified.kind !== "query" && classified.kind !== "mutation" && classified.kind !== "action") {
+    return void 0;
+  }
+  const protections = classified.receiver ? protectionsInChain(classified.receiver) : { usesCaptcha: false, usesMask: false, usesRateLimit: false, usesRls: false };
+  const { callsMail, fanOut, unboundedAiGeneration, usesInsertManyUnsafe, writesUserTable } = behaviourOf(declaration);
+  return {
+    callsMail,
+    exportName: declaration.getName(),
+    fanOut,
+    file: relativePath,
+    kind: classified.kind,
+    unboundedAiGeneration,
+    usesCaptcha: protections.usesCaptcha,
+    usesInsertManyUnsafe,
+    usesMask: protections.usesMask,
+    usesRateLimit: protections.usesRateLimit,
+    usesRls: protections.usesRls,
+    visibility: classified.visibility,
+    writesUserTable
+  };
+};
+const middlewareInSourceFile = (sourceFile, relativePath) => {
+  const found = [];
+  for (const statement of sourceFile.getVariableStatements()) {
+    if (!statement.isExported()) {
+      continue;
+    }
+    for (const declaration of statement.getDeclarations()) {
+      const ir = middlewareIrFromDeclaration(declaration, relativePath);
+      if (ir) {
+        found.push(ir);
+      }
+    }
+  }
+  return found;
+};
+const discoverProcedureMiddleware = (project, lunoraDirectory) => {
+  const procedures = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    procedures.push(...middlewareInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+  }
+  return procedures;
+};
+
+const RATELIMIT_CALLEES = /* @__PURE__ */ new Set(["dbRateLimit", "rateLimit"]);
+const keyInitializer = (options) => {
+  if (!Node.isObjectLiteralExpression(options)) {
+    return void 0;
+  }
+  const property = options.getProperty("key");
+  return property && Node.isPropertyAssignment(property) ? property.getInitializer() : void 0;
+};
+const limitNameOf = (call) => {
+  const argument = call.getArguments()[1];
+  return argument && Node.isStringLiteral(argument) ? argument.getLiteralValue() : "";
+};
+const selectorBody = (key) => Node.isArrowFunction(key) ? key.getBody() : key;
+const ratelimitKeySelectorInCall = (call, relativePath) => {
+  const callee = calleeName$2(call.getExpression());
+  if (callee === void 0 || !RATELIMIT_CALLEES.has(callee)) {
+    return void 0;
+  }
+  const options = call.getArguments()[2];
+  if (!options) {
+    return void 0;
+  }
+  const key = keyInitializer(options);
+  if (!key) {
+    return void 0;
+  }
+  const body = selectorBody(key);
+  if (!isArgumentDerived(body) || isScopedByContext(body)) {
+    return void 0;
+  }
+  return { callee, exportName: enclosingExportName$1(call), file: relativePath, limitName: limitNameOf(call), line: call.getStartLineNumber() };
+};
+const ratelimitKeySelectorsInSourceFile = (sourceFile, relativePath) => {
+  const found = [];
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const selector = ratelimitKeySelectorInCall(call, relativePath);
+    if (selector) {
+      found.push(selector);
+    }
+  }
+  return found;
+};
+const discoverRatelimitKeySelectors = (project, lunoraDirectory) => {
+  const selectors = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    selectors.push(...ratelimitKeySelectorsInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+  }
+  return selectors;
+};
+
+const ROW_READ_METHODS = /* @__PURE__ */ new Set(["findFirst", "findFirstOrThrow", "findMany", "get"]);
+const directRowReadTable = (call) => {
+  const callee = call.getExpression();
+  if (!Node.isPropertyAccessExpression(callee) || !ROW_READ_METHODS.has(callee.getName())) {
+    return void 0;
+  }
+  const receiver = callee.getExpression();
+  if (isDatabaseAccessor(receiver)) {
+    const first = call.getArguments()[0];
+    return first && Node.isStringLiteral(first) ? first.getLiteralText() : "";
+  }
+  if (Node.isPropertyAccessExpression(receiver) && isDatabaseAccessor(receiver.getExpression())) {
+    return receiver.getName();
+  }
+  return void 0;
+};
+const fluentReaderTable = (call) => {
+  let node = call;
+  while (Node.isCallExpression(node)) {
+    const callee = node.getExpression();
+    if (!Node.isPropertyAccessExpression(callee)) {
+      return void 0;
+    }
+    if (callee.getName() === "query" && isDatabaseAccessor(callee.getExpression())) {
+      const first = node.getArguments()[0];
+      return first && Node.isStringLiteral(first) ? first.getLiteralText() : "";
+    }
+    node = callee.getExpression();
+  }
+  return void 0;
+};
+const unwrapExpression = (node) => {
+  let current = node;
+  while (Node.isAwaitExpression(current) || Node.isParenthesizedExpression(current) || Node.isNonNullExpression(current) || Node.isAsExpression(current)) {
+    current = current.getExpression();
+  }
+  return current;
+};
+const rawRowReadTable = (expression, hopped = false) => {
+  const node = unwrapExpression(expression);
+  if (Node.isIdentifier(node)) {
+    if (hopped) {
+      return void 0;
+    }
+    const initializer = singleHopInitializer(node);
+    return initializer === void 0 ? void 0 : rawRowReadTable(initializer, true);
+  }
+  if (!Node.isCallExpression(node)) {
+    return void 0;
+  }
+  return directRowReadTable(node) ?? fluentReaderTable(node);
+};
+const handlerReturnExpressions = (handler) => {
+  const body = handler.getBody();
+  if (!Node.isBlock(body)) {
+    return [body];
+  }
+  const expressions = [];
+  for (const statement of handler.getDescendantsOfKind(SyntaxKind.ReturnStatement)) {
+    const enclosing = statement.getFirstAncestor(
+      (ancestor) => Node.isArrowFunction(ancestor) || Node.isFunctionExpression(ancestor) || Node.isFunctionDeclaration(ancestor)
+    );
+    const expression = statement.getExpression();
+    if (enclosing === handler && expression !== void 0) {
+      expressions.push(expression);
+    }
+  }
+  return expressions;
+};
+const rawRowReturnsInDeclaration = (declaration, relativePath) => {
+  if (!Node.isVariableDeclaration(declaration)) {
+    return [];
+  }
+  const initializer = declaration.getInitializer();
+  if (initializer === void 0 || !Node.isCallExpression(initializer)) {
+    return [];
+  }
+  const classified = classifyProcedureCall(initializer);
+  if (classified?.kind !== "query") {
+    return [];
+  }
+  const handler = procedureHandler(initializer);
+  if (handler === void 0) {
+    return [];
+  }
+  const usesOutput = classified.receiver !== void 0 && chainHasStep(classified.receiver, "output");
+  const usesMask = classified.receiver !== void 0 && chainUsesWrappedCall(classified.receiver, "use", "mask");
+  const seen = /* @__PURE__ */ new Set();
+  const rows = [];
+  for (const expression of handlerReturnExpressions(handler)) {
+    const table = rawRowReadTable(expression);
+    if (table === void 0 || seen.has(table)) {
+      continue;
+    }
+    seen.add(table);
+    rows.push({
+      exportName: declaration.getName(),
+      file: relativePath,
+      line: expression.getStartLineNumber(),
+      table,
+      usesMask,
+      usesOutput,
+      visibility: classified.visibility
+    });
+  }
+  return rows;
+};
+const discoverRawRowReturns = (project, lunoraDirectory) => {
+  const rows = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    const relativePath = lunoraRelativePath(lunoraDirectory, filePath);
+    for (const statement of sourceFile.getVariableStatements()) {
+      if (!statement.isExported()) {
+        continue;
+      }
+      for (const declaration of statement.getDeclarations()) {
+        rows.push(...rawRowReturnsInDeclaration(declaration, relativePath));
+      }
+    }
+  }
+  return rows;
+};
+
+const READ_METHODS$1 = /* @__PURE__ */ new Set(["findFirst", "findFirstOrThrow", "findMany"]);
+const readTargetOf$1 = (call) => {
+  const callee = call.getExpression();
+  if (!Node.isPropertyAccessExpression(callee) || !READ_METHODS$1.has(callee.getName())) {
+    return void 0;
+  }
+  const receiver = callee.getExpression();
+  if (Node.isPropertyAccessExpression(receiver) && receiver.getName() === "db" || Node.isIdentifier(receiver) && receiver.getText() === "db") {
+    const first = call.getArguments()[0];
+    return { options: call.getArguments()[1], table: first && Node.isStringLiteral(first) ? first.getLiteralText() : "" };
+  }
+  if (Node.isPropertyAccessExpression(receiver)) {
+    const inner = receiver.getExpression();
+    const onDatabase = Node.isPropertyAccessExpression(inner) && inner.getName() === "db" || Node.isIdentifier(inner) && inner.getText() === "db";
+    if (onDatabase) {
+      return { options: call.getArguments()[0], table: receiver.getName() };
+    }
+  }
+  return void 0;
+};
+const relationNamesOf = (withValue) => {
+  if (!withValue || !Node.isObjectLiteralExpression(withValue)) {
+    return [];
+  }
+  const names = [];
+  for (const member of withValue.getProperties()) {
+    if (Node.isPropertyAssignment(member) || Node.isShorthandPropertyAssignment(member) || Node.isMethodDeclaration(member) || Node.isGetAccessorDeclaration(member)) {
+      names.push(member.getName());
+    }
+  }
+  return names;
+};
+const optionValue$1 = (options, key) => {
+  if (!options || !Node.isObjectLiteralExpression(options)) {
+    return void 0;
+  }
+  const property = options.getProperty(key);
+  return property && Node.isPropertyAssignment(property) ? property.getInitializer() : void 0;
+};
+const relationLoadsInDeclaration = (declaration, relativePath) => {
+  if (!Node.isVariableDeclaration(declaration)) {
+    return [];
+  }
+  const initializer = declaration.getInitializer();
+  const classified = initializer && Node.isCallExpression(initializer) ? classifyProcedureCall(initializer) : void 0;
+  if (!classified) {
+    return [];
+  }
+  const rows = [];
+  for (const call of declaration.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const target = readTargetOf$1(call);
+    if (target === void 0) {
+      continue;
+    }
+    const relations = relationNamesOf(optionValue$1(target.options, "with"));
+    if (relations.length === 0) {
+      continue;
+    }
+    rows.push({
+      exportName: declaration.getName(),
+      file: relativePath,
+      line: call.getStartLineNumber(),
+      parentTable: target.table,
+      relations,
+      visibility: classified.visibility
+    });
+  }
+  return rows;
+};
+const discoverRelationLoads = (project, lunoraDirectory) => {
+  const rows = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    const relativePath = lunoraRelativePath(lunoraDirectory, filePath);
+    for (const statement of sourceFile.getVariableStatements()) {
+      if (!statement.isExported()) {
+        continue;
+      }
+      for (const declaration of statement.getDeclarations()) {
+        rows.push(...relationLoadsInDeclaration(declaration, relativePath));
+      }
+    }
+  }
+  return rows;
+};
+
+const literalValueOf = (node) => {
+  if (Node.isStringLiteral(node) || Node.isNoSubstitutionTemplateLiteral(node)) {
+    return node.getLiteralText();
+  }
+  if (Node.isBinaryExpression(node) && node.getOperatorToken().getKind() === SyntaxKind.PlusToken) {
+    const left = literalValueOf(node.getLeft());
+    const right = literalValueOf(node.getRight());
+    return left !== void 0 && right !== void 0 ? left + right : void 0;
+  }
+  return void 0;
+};
+const isFoldedConcatenationOperand = (node) => {
+  let root = node;
+  let parent = root.getParent();
+  while (parent !== void 0 && Node.isBinaryExpression(parent) && parent.getOperatorToken().getKind() === SyntaxKind.PlusToken) {
+    root = parent;
+    parent = root.getParent();
+  }
+  return root !== node && literalValueOf(root) !== void 0;
+};
+const secretsInSourceFile = (sourceFile, relativePath) => {
+  const found = [];
+  const nodes = [
+    // Top-level `+` concatenations are folded; their string-literal operands are
+    // skipped below so a secret split across literals is reported once, at the root.
+    ...sourceFile.getDescendantsOfKind(SyntaxKind.BinaryExpression),
+    ...sourceFile.getDescendantsOfKind(SyntaxKind.StringLiteral),
+    ...sourceFile.getDescendantsOfKind(SyntaxKind.NoSubstitutionTemplateLiteral)
+  ];
+  const seen = /* @__PURE__ */ new Set();
+  for (const node of nodes) {
+    if (isFoldedConcatenationOperand(node)) {
+      continue;
+    }
+    const value = literalValueOf(node);
+    if (value === void 0) {
+      continue;
+    }
+    const kind = secretKindOf(value);
+    if (kind === void 0) {
+      continue;
+    }
+    const line = node.getStartLineNumber();
+    const dedupeKey = `${String(line)}:${kind}`;
+    if (seen.has(dedupeKey)) {
+      continue;
+    }
+    seen.add(dedupeKey);
+    found.push({ file: relativePath, kind, line, preview: redact(value) });
+  }
+  return found;
+};
+const discoverSecrets = (project, lunoraDirectory) => {
+  const secrets = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    secrets.push(...secretsInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+  }
+  return secrets;
+};
+
+const READ_METHODS = /* @__PURE__ */ new Set(["findFirst", "findFirstOrThrow", "findMany"]);
+const readTargetOf = (call) => {
+  const callee = call.getExpression();
+  if (!Node.isPropertyAccessExpression(callee) || !READ_METHODS.has(callee.getName())) {
+    return void 0;
+  }
+  const receiver = callee.getExpression();
+  if (Node.isPropertyAccessExpression(receiver) && receiver.getName() === "db" || Node.isIdentifier(receiver) && receiver.getText() === "db") {
+    const first = call.getArguments()[0];
+    return { options: call.getArguments()[1], table: first && Node.isStringLiteral(first) ? first.getLiteralText() : "" };
+  }
+  if (Node.isPropertyAccessExpression(receiver)) {
+    const inner = receiver.getExpression();
+    const onDatabase = Node.isPropertyAccessExpression(inner) && inner.getName() === "db" || Node.isIdentifier(inner) && inner.getText() === "db";
+    if (onDatabase) {
+      return { options: call.getArguments()[0], table: receiver.getName() };
+    }
+  }
+  return void 0;
+};
+const optionValue = (options, key) => {
+  if (!options || !Node.isObjectLiteralExpression(options)) {
+    return void 0;
+  }
+  const property = options.getProperty(key);
+  return property && Node.isPropertyAssignment(property) ? property.getInitializer() : void 0;
+};
+const softDeleteReadsInDeclaration = (declaration, relativePath) => {
+  if (!Node.isVariableDeclaration(declaration)) {
+    return [];
+  }
+  const initializer = declaration.getInitializer();
+  const classified = initializer && Node.isCallExpression(initializer) ? classifyProcedureCall(initializer) : void 0;
+  if (!classified) {
+    return [];
+  }
+  const rows = [];
+  for (const call of declaration.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const target = readTargetOf(call);
+    if (target === void 0) {
+      continue;
+    }
+    const value = optionValue(target.options, "includeDeleted");
+    if (value === void 0) {
+      continue;
+    }
+    const hardcodedTrue = Node.isTrueLiteral(value);
+    const fromArgs = !hardcodedTrue && isArgumentDerived(value);
+    if (!hardcodedTrue && !fromArgs) {
+      continue;
+    }
+    rows.push({
+      exportName: declaration.getName(),
+      file: relativePath,
+      fromArgs,
+      hardcodedTrue,
+      line: call.getStartLineNumber(),
+      table: target.table,
+      visibility: classified.visibility
+    });
+  }
+  return rows;
+};
+const discoverSoftDeleteReads = (project, lunoraDirectory) => {
+  const rows = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    const relativePath = lunoraRelativePath(lunoraDirectory, filePath);
+    for (const statement of sourceFile.getVariableStatements()) {
+      if (!statement.isExported()) {
+        continue;
+      }
+      for (const declaration of statement.getDeclarations()) {
+        rows.push(...softDeleteReadsInDeclaration(declaration, relativePath));
+      }
+    }
+  }
+  return rows;
+};
+
+const SQL_TEXT_METHODS = /* @__PURE__ */ new Set(["query", "unsafe"]);
+const isContextSqlTextCallee = (node) => {
+  if (!Node.isPropertyAccessExpression(node) || !SQL_TEXT_METHODS.has(node.getName())) {
+    return false;
+  }
+  const sqlAccess = node.getExpression();
+  if (!Node.isPropertyAccessExpression(sqlAccess) || sqlAccess.getName() !== "sql") {
+    return false;
+  }
+  const receiver = sqlAccess.getExpression();
+  return Node.isIdentifier(receiver) && receiver.getText() === "ctx";
+};
+const isStringBuildingText = (expression) => Node.isBinaryExpression(expression) || Node.isTemplateExpression(expression);
+const enclosingExportName = (node) => {
+  const declaration = node.getFirstAncestorByKind(SyntaxKind.VariableDeclaration);
+  return declaration?.getName() ?? "<module>";
+};
+const interpolationInCall = (call, relativePath) => {
+  if (!isContextSqlTextCallee(call.getExpression())) {
+    return void 0;
+  }
+  const text = call.getArguments()[0];
+  if (!text || !isStringBuildingText(text)) {
+    return void 0;
+  }
+  return { exportName: enclosingExportName(call), file: relativePath, line: text.getStartLineNumber() };
+};
+const interpolationsInSourceFile = (sourceFile, relativePath) => {
+  const found = [];
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const interpolation = interpolationInCall(call, relativePath);
+    if (interpolation) {
+      found.push(interpolation);
+    }
+  }
+  return found;
+};
+const discoverSqlInterpolation = (project, lunoraDirectory) => {
+  const interpolations = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    interpolations.push(...interpolationsInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+  }
+  return interpolations;
+};
+
+const KEY_TAKING_METHODS = /* @__PURE__ */ new Set([
+  "createMultipartUpload",
+  "delete",
+  "download",
+  "generateUploadUrl",
+  "get",
+  "getMetadata",
+  "getPresignedUrl",
+  "getSignedUrl",
+  "getUrl",
+  "head",
+  "put",
+  "resumeMultipartUpload",
+  "store",
+  "upload"
+]);
+const discoverStorageKeyAccesses = (project, lunoraDirectory) => discoverArgumentDerivedAccesses(project, lunoraDirectory, {
+  argIndex: 0,
+  matchReceiver: (receiver) => receiver === "ctx.storage" || receiver.startsWith("ctx.storage."),
+  methods: KEY_TAKING_METHODS
+});
+
+const OPTIONS_ARGUMENT_INDEX = /* @__PURE__ */ new Map([
+  ["generateUploadUrl", 1],
+  ["getPresignedUrl", 1],
+  ["getSignedUrl", 1],
+  ["store", 2],
+  ["upload", 2]
+]);
+const numericLiteralValue = (node) => node && Node.isNumericLiteral(node) ? Number(node.getText()) : void 0;
+const readOptionsArgument = (argument) => {
+  if (argument === void 0) {
+    return { analyzable: true, presentKeys: [] };
+  }
+  if (!Node.isObjectLiteralExpression(argument)) {
+    return { analyzable: false, presentKeys: [] };
+  }
+  const presentKeys = [];
+  let expiresInSeconds;
+  let hasSpread = false;
+  for (const property of argument.getProperties()) {
+    if (Node.isSpreadAssignment(property)) {
+      hasSpread = true;
+      continue;
+    }
+    if (Node.isPropertyAssignment(property)) {
+      const name = property.getName();
+      presentKeys.push(name);
+      if (name === "expiresInSeconds") {
+        expiresInSeconds = numericLiteralValue(property.getInitializer());
+      }
+      continue;
+    }
+    if (Node.isShorthandPropertyAssignment(property) || Node.isMethodDeclaration(property)) {
+      presentKeys.push(property.getName());
+    }
+  }
+  return { analyzable: !hasSpread, expiresInSeconds, presentKeys };
+};
+const storageUploadMethod = (node) => {
+  if (!Node.isPropertyAccessExpression(node)) {
+    return void 0;
+  }
+  const method = node.getName();
+  const optionsIndex = OPTIONS_ARGUMENT_INDEX.get(method);
+  if (optionsIndex === void 0) {
+    return void 0;
+  }
+  const receiver = node.getExpression().getText();
+  return receiver === "ctx.storage" || receiver.startsWith("ctx.storage.") ? { method, optionsIndex } : void 0;
+};
+const storageUploadInCall = (call, relativePath) => {
+  const matched = storageUploadMethod(call.getExpression());
+  if (matched === void 0) {
+    return void 0;
+  }
+  return {
+    exportName: enclosingExportName$1(call),
+    file: relativePath,
+    line: call.getStartLineNumber(),
+    method: matched.method,
+    ...readOptionsArgument(call.getArguments()[matched.optionsIndex])
+  };
+};
+const storageUploadsInSourceFile = (sourceFile, relativePath) => {
+  const found = [];
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const row = storageUploadInCall(call, relativePath);
+    if (row) {
+      found.push(row);
+    }
+  }
+  return found;
+};
+const discoverStorageUploads = (project, lunoraDirectory) => {
+  const rows = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    rows.push(...storageUploadsInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+  }
+  return rows;
+};
+
+const VECTOR_NAMESPACE_METHODS = /* @__PURE__ */ new Set(["query", "upsert", "upsertMany"]);
+const vectorsNamespaceMethod = (node) => {
+  if (!Node.isPropertyAccessExpression(node)) {
+    return void 0;
+  }
+  const method = node.getName();
+  if (!VECTOR_NAMESPACE_METHODS.has(method)) {
+    return void 0;
+  }
+  return node.getExpression().getText() === "ctx.vectors" ? method : void 0;
+};
+const namespaceInitializer = (input) => {
+  if (!Node.isObjectLiteralExpression(input)) {
+    return void 0;
+  }
+  const property = input.getProperty("namespace");
+  return property && Node.isPropertyAssignment(property) ? property.getInitializer() : void 0;
+};
+const vectorNamespaceAccessInCall = (call, relativePath) => {
+  const method = vectorsNamespaceMethod(call.getExpression());
+  if (method === void 0) {
+    return void 0;
+  }
+  const input = call.getArguments()[1];
+  if (!input) {
+    return void 0;
+  }
+  const namespace = namespaceInitializer(input);
+  if (!namespace || !isArgumentDerived(namespace) || isScopedByContext(namespace)) {
+    return void 0;
+  }
+  return { exportName: enclosingExportName$1(call), file: relativePath, line: call.getStartLineNumber(), method };
+};
+const vectorNamespaceAccessesInSourceFile = (sourceFile, relativePath) => {
+  const found = [];
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const access = vectorNamespaceAccessInCall(call, relativePath);
+    if (access) {
+      found.push(access);
+    }
+  }
+  return found;
+};
+const discoverVectorNamespaceAccesses = (project, lunoraDirectory) => {
+  const accesses = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    accesses.push(...vectorNamespaceAccessesInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+  }
+  return accesses;
+};
+
+const isWorkflowGetCall = (call) => {
+  const callee = call.getExpression();
+  if (!Node.isPropertyAccessExpression(callee) || callee.getName() !== "get") {
+    return false;
+  }
+  const receiver = callee.getExpression();
+  if (Node.isPropertyAccessExpression(receiver)) {
+    return receiver.getName() === "workflows";
+  }
+  return Node.isIdentifier(receiver) && receiver.getText() === "workflows";
+};
+const workflowOf = (call) => {
+  const argument = call.getArguments()[0];
+  return argument && Node.isStringLiteral(argument) ? argument.getLiteralText() : "";
+};
+const discoverWorkflowCalls = (project, lunoraDirectory) => {
+  const calls = [];
+  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
+    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
+    const relativePath = lunoraRelativePath(lunoraDirectory, filePath);
+    for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+      if (!isWorkflowGetCall(call)) {
+        continue;
+      }
+      const exportName = enclosingExportName$2(call);
+      if (exportName === "") {
+        continue;
+      }
+      calls.push({ exportName, file: relativePath, line: call.getStartLineNumber(), workflow: workflowOf(call) });
+    }
+  }
+  return calls;
+};
+
+const SCHEMA_SNAPSHOT_FILENAME = ".lunora-schema.json";
+const writeIfChanged = (filePath, content) => {
+  if (existsSync(filePath)) {
+    const existing = readFileSync(filePath, "utf8");
+    if (existing === content) {
+      return;
+    }
+  }
+  writeFileSync(filePath, content, "utf8");
+};
+const writeIfPresent = (filePath, content) => {
+  if (content === "") {
+    rmSync(filePath, { force: true });
+    return;
+  }
+  writeIfChanged(filePath, content);
+};
+const readProjectVersion = (projectRoot) => {
+  const manifestPath = join(projectRoot, "package.json");
+  if (!existsSync(manifestPath)) {
+    return void 0;
+  }
+  try {
+    const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+    return typeof manifest["version"] === "string" && manifest["version"] !== "" ? manifest["version"] : void 0;
+  } catch {
+    return void 0;
+  }
+};
+const isTimingEnabled = () => {
+  const flag = process.env["LUNORA_CODEGEN_TIMING"];
+  return flag !== void 0 && flag !== "";
+};
+const findTsconfig = (startPath) => {
+  let directory = existsSync(startPath) ? startPath : dirname(startPath);
+  while (directory && directory !== dirname(directory)) {
+    const candidate = join(directory, "tsconfig.json");
+    if (existsSync(candidate)) {
+      return candidate;
+    }
+    directory = dirname(directory);
+  }
+  return void 0;
+};
+const toPosixPath = (path) => path.replaceAll("\\", "/");
+const assertNoWorkflowAgentCollision = (workflows, agents) => {
+  const namesByLabel = /* @__PURE__ */ new Map();
+  const bindingsByLabel = /* @__PURE__ */ new Map();
+  const classesByLabel = /* @__PURE__ */ new Map();
+  for (const workflow of workflows) {
+    namesByLabel.set(workflow.name, `workflow "${workflow.exportName}"`);
+    bindingsByLabel.set(workflow.bindingName, `workflow "${workflow.exportName}"`);
+    classesByLabel.set(workflow.className, `workflow "${workflow.exportName}"`);
+  }
+  for (const agent of agents) {
+    const priorName = namesByLabel.get(agent.name);
+    if (priorName !== void 0) {
+      throw new LunoraError(
+        // eslint-disable-next-line no-secrets/no-secrets -- an error code, not a secret
+        "DUPLICATE_WORKFLOW_NAME",
+        `Duplicate deployed name "${agent.name}": produced by both ${priorName} and agent "${agent.exportName}". Workflow and agent names share the same wrangler workflows[] array and must be unique together.`,
+        { status: 500 }
+      );
+    }
+    const priorBinding = bindingsByLabel.get(agent.bindingName);
+    if (priorBinding !== void 0) {
+      throw new LunoraError(
+        // eslint-disable-next-line no-secrets/no-secrets -- an error code, not a secret
+        "DUPLICATE_WORKFLOW_BINDING",
+        `Duplicate binding "${agent.bindingName}": produced by both ${priorBinding} and agent "${agent.exportName}". Workflow and agent bindings share the same wrangler workflows[] array and must be unique together.`,
+        { status: 500 }
+      );
+    }
+    const priorClass = classesByLabel.get(agent.className);
+    if (priorClass !== void 0) {
+      throw new LunoraError(
+        "DUPLICATE_WORKFLOW_CLASS",
+        `Duplicate generated class "${agent.className}": produced by both ${priorClass} and agent "${agent.exportName}". Workflow and agent export names must yield unique generated class names.`,
+        { status: 500 }
+      );
+    }
+  }
+};
+const createCodegenProject = (lunoraDirectory) => {
+  const tsconfigPath = findTsconfig(lunoraDirectory);
+  return tsconfigPath ? new Project({ skipAddingFilesFromTsConfig: false, tsConfigFilePath: tsconfigPath, useInMemoryFileSystem: false }) : new Project({ skipAddingFilesFromTsConfig: true, useInMemoryFileSystem: false });
+};
+const refreshCodegenProject = (project, lunoraDirectory) => {
+  const diskPaths = listLunoraSourceFiles(lunoraDirectory);
+  const schemaPath = join(lunoraDirectory, "schema.ts");
+  if (existsSync(schemaPath)) {
+    diskPaths.push(schemaPath);
+  }
+  for (const path of diskPaths) {
+    const existing = project.getSourceFile(path);
+    if (existing === void 0) {
+      project.addSourceFileAtPath(path);
+    } else {
+      existing.refreshFromFileSystemSync();
+    }
+  }
+  const onDisk = new Set(diskPaths.map((path) => toPosixPath(path)));
+  const lunoraRoot = toPosixPath(lunoraDirectory);
+  const lunoraPrefix = `${lunoraRoot}/`;
+  for (const sourceFile of project.getSourceFiles()) {
+    const filePath = sourceFile.getFilePath();
+    if ((filePath === lunoraRoot || filePath.startsWith(lunoraPrefix)) && !onDisk.has(filePath)) {
+      project.removeSourceFile(sourceFile);
+    }
+  }
+};
+const runCodegen = (options) => {
+  const timingEnabled = isTimingEnabled();
+  const startedAt = timingEnabled ? performance.now() : 0;
+  const lunoraDirectory = join(options.projectRoot, options.lunoraDirectory ?? "lunora");
+  const schemaPath = join(lunoraDirectory, "schema.ts");
+  if (!existsSync(schemaPath)) {
+    throw new LunoraError("INTERNAL", `schema.ts not found at ${schemaPath}`);
+  }
+  const project = options.project ?? createCodegenProject(lunoraDirectory);
+  const schema = discoverSchema(project, schemaPath, options.projectRoot);
+  const functions = discoverFunctions(project, lunoraDirectory);
+  const httpRoutes = discoverHttpRoutes(project, lunoraDirectory);
+  const migrations = discoverMigrations(project, lunoraDirectory);
+  const shapes = discoverShapes(project, lunoraDirectory);
+  const mutators = discoverMutators(project, lunoraDirectory);
+  const identity = discoverIdentity(project, lunoraDirectory);
+  const env = discoverEnv(project, lunoraDirectory);
+  const workflows = discoverWorkflows(project, lunoraDirectory);
+  const queues = discoverQueues(project, lunoraDirectory);
+  const agents = discoverAgents(project, lunoraDirectory);
+  assertNoWorkflowAgentCollision(workflows, agents);
+  const crons = discoverCrons(project, lunoraDirectory, workflows, agents);
+  const containers = discoverContainers(project, lunoraDirectory);
+  const advisories = options.lint === false ? [] : lintSchema({
+    adminRoutes: discoverAdminRoutes(project, lunoraDirectory),
+    aiRawRuns: discoverAiRawRuns(project, lunoraDirectory),
+    aiToolSideEffects: discoverAiToolSideEffects(project, lunoraDirectory),
+    argumentDerivedFetches: discoverArgumentDerivedFetches(project, lunoraDirectory),
+    argumentValidators: discoverArgumentValidators(project, lunoraDirectory),
+    authApiCalls: discoverAuthApiCalls(project, lunoraDirectory),
+    authConfigs: discoverAuthConfig(project, lunoraDirectory),
+    browserUrlAccesses: discoverBrowserUrlAccesses(project, lunoraDirectory),
+    configCalls: discoverConfigCalls(project, lunoraDirectory),
+    containerKeyAccesses: discoverContainerKeyAccesses(project, lunoraDirectory),
+    containerOverrides: discoverContainerOverrides(project, lunoraDirectory),
+    containers,
+    failOpenGuards: discoverFailOpenGuards(project, lunoraDirectory),
+    flagSecurityDefaults: discoverFlagSecurityDefaults(project, lunoraDirectory),
+    httpActionGuards: discoverHttpActionGuards(project, lunoraDirectory),
+    httpHeaderWrites: discoverHttpHeaderWrites(project, lunoraDirectory),
+    identityClaimReads: discoverIdentityClaimReads(project, lunoraDirectory),
+    imageDeliveryUrlAccesses: discoverImageDeliveryUrlAccesses(project, lunoraDirectory),
+    inserts: discoverInserts(project, lunoraDirectory),
+    kvKeyAccesses: discoverKvKeyAccesses(project, lunoraDirectory),
+    mailRecipientAccesses: discoverMailRecipientAccesses(project, lunoraDirectory),
+    maskProcedures: discoverMaskProcedures(project, lunoraDirectory),
+    maskStrategies: discoverMaskStrategies(project, lunoraDirectory),
+    mutatorWrites: discoverMutatorWrites(project, lunoraDirectory),
+    nondeterministicCalls: discoverNondeterministicCalls(project, lunoraDirectory),
+    normalizeIdAuthorizations: discoverNormalizeIdAuthorization(project, lunoraDirectory),
+    ownerFieldWrites: discoverOwnerFieldWrites(project, lunoraDirectory),
+    paymentWebhooks: discoverPaymentWebhooks(project, lunoraDirectory),
+    privilegedDispatches: discoverPrivilegedDispatches(project, lunoraDirectory),
+    procedureProtections: discoverProcedureMiddleware(project, lunoraDirectory),
+    queries: discoverQueries(project, lunoraDirectory),
+    queues,
+    r2sqlCalls: discoverR2sqlCalls(project, lunoraDirectory),
+    ratelimitKeySelectors: discoverRatelimitKeySelectors(project, lunoraDirectory),
+    rawRowReturns: discoverRawRowReturns(project, lunoraDirectory),
+    relationLoads: discoverRelationLoads(project, lunoraDirectory),
+    rlsProcedures: discoverRlsProcedures(project, lunoraDirectory),
+    schema,
+    secretLiterals: discoverSecrets(project, lunoraDirectory),
+    shapes,
+    softDeleteReads: discoverSoftDeleteReads(project, lunoraDirectory),
+    sqlInterpolations: discoverSqlInterpolation(project, lunoraDirectory),
+    storageKeyAccesses: discoverStorageKeyAccesses(project, lunoraDirectory),
+    storageUploads: discoverStorageUploads(project, lunoraDirectory),
+    vectorNamespaceAccesses: discoverVectorNamespaceAccesses(project, lunoraDirectory),
+    workflowCalls: discoverWorkflowCalls(project, lunoraDirectory),
+    workflows,
+    wranglerVariables: options.wranglerVariables
+  });
+  const rlsMetadata = discoverRlsMetadata(project, lunoraDirectory);
+  const maskMetadata = discoverMaskMetadata(project, lunoraDirectory);
+  const storageRulesMetadata = discoverStorageRulesMetadata(project, lunoraDirectory);
+  const featureUsage = discoverFeatureUsage(project, lunoraDirectory);
+  const hasAi = featureUsage.ai;
+  const hasPayments = featureUsage.payments;
+  const hasKv = featureUsage.kv;
+  const hasAccessFacade = featureUsage.access;
+  const hasFlags = existsSync(join(lunoraDirectory, "flags.ts"));
+  const flagKeys = hasFlags ? discoverFlagKeys(project, lunoraDirectory) : [];
+  const hasHyperdrive = featureUsage.hyperdrive;
+  const sandboxUsage = discoverSandboxUsage(project, lunoraDirectory);
+  const usesSandbox = sandboxUsage.usesSandboxBrowser || sandboxUsage.usesSandboxContainer;
+  const hasBrowser = featureUsage.browser || sandboxUsage.usesSandboxBrowser;
+  const hasImages = featureUsage.images;
+  const hasAnalytics = featureUsage.analytics;
+  const hasPipelines = featureUsage.pipelines;
+  const hasR2sql = featureUsage.r2sql;
+  const hasX402 = featureUsage.x402;
+  const dependencies = discoverPackageDependencies(options.projectRoot);
+  const studioFeatures = buildStudioFeatures(featureUsage, {
+    containerCount: containers.length,
+    cronCount: crons.length,
+    dependencies,
+    queueCount: queues.length,
+    storageColumnCount: Object.keys(buildStorageColumns(schema)).length,
+    storageRuleCount: storageRulesMetadata.rules.length,
+    vectorIndexCount: schema.vectorIndexes.length,
+    workflowCount: workflows.length
+  });
+  const useUmbrella = dependencies.has("lunorash");
+  const emitStartedAt = timingEnabled ? performance.now() : 0;
+  const dataModelContent = emitDataModel(schema, useUmbrella);
+  const apiContent = emitApi({ agents, functions, httpRoutes, useUmbrella, workflows });
+  const serverContent = emitServer({
+    agents,
+    containers,
+    env,
+    hasAccessFacade,
+    hasAi,
+    hasAnalytics,
+    hasBrowser,
+    hasFlags,
+    hasHyperdrive,
+    hasImages,
+    hasKv,
+    hasPayments,
+    hasPipelines,
+    hasR2sql,
+    hasX402,
+    identity,
+    queues,
+    schema,
+    storageRuleBuckets: storageRulesMetadata.rules.map((rule) => rule.bucket),
+    useUmbrella,
+    workflows
+  });
+  const functionsContent = emitFunctions({ agents, functions, migrations, mutators, shapes, useUmbrella, usesSandbox });
+  const shardContent = emitShard({
+    advisories,
+    agents,
+    containers,
+    env,
+    flagKeys,
+    hasAccessFacade,
+    hasAi,
+    hasAnalytics,
+    hasBrowser,
+    hasFlags,
+    hasHyperdrive,
+    hasImages,
+    hasKv,
+    hasPayments,
+    hasPipelines,
+    hasR2sql,
+    hasX402,
+    maskMetadata,
+    mutators,
+    queues,
+    rlsMetadata,
+    schema,
+    shapes,
+    storageRules: storageRulesMetadata,
+    studioFeatures,
+    useUmbrella,
+    workflows
+  });
+  const collectionsContent = emitCollections(shapes, dependencies.has("@lunora/db"), useUmbrella);
+  const containersContent = emitContainers(containers, schema.jurisdiction);
+  const workflowsContent = emitWorkflows(workflows);
+  const agentsContent = emitAgents(agents);
+  const queuesContent = emitQueues(queues);
+  const cronsContent = emitCrons(crons);
+  const vectorsContent = emitVectors(schema.vectorIndexes);
+  const drizzleFiles = emitDrizzleSchema(schema, useUmbrella);
+  const seedContent = emitSeed(dependencies.has("@lunora/seed"));
+  const apiSpec = options.apiSpec ?? "openapi";
+  const wantsOpenApi = apiSpec === "openapi" || apiSpec === "both";
+  const wantsOpenRpc = apiSpec === "openrpc" || apiSpec === "both";
+  const appContent = emitApp({
+    // Inbound-email agents (`defineAgent({ onEmail })`) → wire the worker's
+    // top-level `email()` handler to each agent's `AGENT_*` Workflow binding so
+    // received mail starts a durable run. Empty for email-free (and agent-free)
+    // projects, so the emitted app.ts stays byte-identical.
+    emailAgents: agents.filter((agent) => agent.onEmail === true).map((agent) => {
+      return { bindingName: agent.bindingName, exportName: agent.exportName };
+    }),
+    hasAccess: dependencies.has("@lunora/cloudflare-access"),
+    hasAi,
+    hasAnalytics,
+    hasAuth: dependencies.has("@lunora/auth"),
+    hasBrowser,
+    // Worker-composition framework adapters expose a `withLunora` over
+    // `withFrameworkWorker`; when one is installed, surface `.buildFrameworkWorker()`.
+    hasFramework: dependencies.has("@lunora/astro") || dependencies.has("@lunora/svelte") || dependencies.has("@lunora/vue"),
+    // `hasGlobal` means **D1-backed** global tables (the `.global()` / D1
+    // app-builder wiring); Hyperdrive-backed globals are gated separately by
+    // `hasHyperdriveGlobal` so an app picks the right binding+package.
+    hasGlobal: schema.tables.some((table) => table.shardMode === "global" && table.globalBackend !== "hyperdrive"),
+    hasHyperdrive,
+    hasHyperdriveGlobal: schema.tables.some((table) => table.shardMode === "global" && table.globalBackend === "hyperdrive"),
+    hasImages,
+    // Auto-wire the studio's KV introspector on the SAME condition the nav
+    // gates its tab on (`studioFeatures.kv` = ctx.kv usage OR a declared
+    // `@lunora/bindings/kv` dep), so a visible KV tab always has a working
+    // backend — never the reverse. The `ctx.kv` type-seam stays usage-only.
+    hasKv: studioFeatures.kv,
+    hasPayments,
+    hasR2sql,
+    hasQueue: queues.some((queue) => queue.mode === "push"),
+    hasScheduler: studioFeatures.scheduler,
+    hasStorage: studioFeatures.storage,
+    hasVectors: schema.vectorIndexes.length > 0,
+    hasWorkflow: workflows.length > 0,
+    hasX402,
+    // The single `defineIdentity(...)` contract (Plan 080). Wires
+    // `options.identity` so the runtime trust boundary validates every
+    // resolved identity before it becomes `ctx.auth`; `undefined` keeps the
+    // emitted app.ts byte-identical to before this feature.
+    identity,
+    // Schema `.jurisdiction("…")` → pin the generated worker's DOs to the region.
+    jurisdiction: schema.jurisdiction,
+    useUmbrella,
+    // Voice-enabled agents (`defineAgent({ voice: … })`) → wire the worker's
+    // `/_lunora/voice/<exportName>` route to each agent's `VOICE_*` DO
+    // namespace. Empty for voice-free (and agent-free) projects, so the
+    // emitted app.ts stays byte-identical.
+    voiceAgents: agents.filter((agent) => agent.voice === true && agent.voiceBindingName !== void 0).map((agent) => {
+      return { bindingName: agent.voiceBindingName, exportName: agent.exportName };
+    }),
+    wantsOpenApi,
+    wantsOpenRpc
+  });
+  const projectVersion = readProjectVersion(options.projectRoot);
+  const openApiDocument = buildOpenApiDocument({ functions, httpRoutes, version: projectVersion });
+  const openRpcDocument = buildOpenRpcDocument({ functions, version: projectVersion });
+  const openApiContent = `${JSON.stringify(openApiDocument, void 0, 2)}
+`;
+  const openRpcContent = `${JSON.stringify(openRpcDocument, void 0, 2)}
+`;
+  const openApiModuleContent = emitOpenApiModule(openApiDocument);
+  const openRpcModuleContent = emitOpenRpcModule(openRpcDocument);
+  const schemaSnapshot = buildSchemaSnapshot(
+    schema,
+    migrations.map((migration) => migration.id)
+  );
+  const schemaSnapshotPath = join(lunoraDirectory, SCHEMA_SNAPSHOT_FILENAME);
+  const schemaSnapshotExists = existsSync(schemaSnapshotPath);
+  const outputDirectory = join(lunoraDirectory, "_generated");
+  if (!options.dryRun) {
+    if (!existsSync(outputDirectory)) {
+      mkdirSync(outputDirectory, { recursive: true });
+    }
+    writeIfChanged(join(outputDirectory, "app.ts"), appContent);
+    writeIfChanged(join(outputDirectory, "dataModel.ts"), dataModelContent);
+    writeIfChanged(join(outputDirectory, "api.ts"), apiContent);
+    writeIfChanged(join(outputDirectory, "server.ts"), serverContent);
+    writeIfChanged(join(outputDirectory, "functions.ts"), functionsContent);
+    writeIfChanged(join(outputDirectory, "shard.ts"), shardContent);
+    writeIfChanged(join(outputDirectory, "crons.ts"), cronsContent);
+    writeIfChanged(join(outputDirectory, "vectors.ts"), vectorsContent);
+    writeIfChanged(join(outputDirectory, "drizzle.global.ts"), drizzleFiles.global);
+    writeIfChanged(join(outputDirectory, "drizzle.shard.ts"), drizzleFiles.shard);
+    writeIfPresent(join(outputDirectory, "containers.ts"), containersContent);
+    writeIfPresent(join(outputDirectory, "workflows.ts"), workflowsContent);
+    writeIfPresent(join(outputDirectory, "agents.ts"), agentsContent);
+    writeIfPresent(join(outputDirectory, "queues.ts"), queuesContent);
+    writeIfPresent(join(outputDirectory, "seed.ts"), seedContent);
+    writeIfPresent(join(outputDirectory, "collections.ts"), collectionsContent);
+    writeIfPresent(join(outputDirectory, "openapi.json"), wantsOpenApi ? openApiContent : "");
+    writeIfPresent(join(outputDirectory, "openapi.ts"), wantsOpenApi ? openApiModuleContent : "");
+    writeIfPresent(join(outputDirectory, "openrpc.json"), wantsOpenRpc ? openRpcContent : "");
+    writeIfPresent(join(outputDirectory, "openrpc.ts"), wantsOpenRpc ? openRpcModuleContent : "");
+    if (!schemaSnapshotExists || options.updateSchemaBaseline === true) {
+      writeIfChanged(schemaSnapshotPath, serializeSchemaSnapshot(schemaSnapshot));
+    }
+  }
+  if (timingEnabled) {
+    const finishedAt = performance.now();
+    const total = Math.round(finishedAt - startedAt);
+    const discovery = Math.round(emitStartedAt - startedAt);
+    const emit = Math.round(finishedAt - emitStartedAt);
+    console.error(`@lunora/codegen: codegen took ${total.toString()}ms (discovery ${discovery.toString()}ms, emit ${emit.toString()}ms)`);
+  }
+  return {
+    advisories,
+    agents,
+    containers,
+    cronTriggers: emitWranglerCronTriggers(crons),
+    generated: {
+      agents: agentsContent,
+      api: apiContent,
+      app: appContent,
+      collections: collectionsContent,
+      containers: containersContent,
+      crons: cronsContent,
+      dataModel: dataModelContent,
+      drizzleGlobal: drizzleFiles.global,
+      drizzleShard: drizzleFiles.shard,
+      functions: functionsContent,
+      openApi: openApiContent,
+      openApiModule: openApiModuleContent,
+      openRpc: openRpcContent,
+      openRpcModule: openRpcModuleContent,
+      queues: queuesContent,
+      seed: seedContent,
+      server: serverContent,
+      shard: shardContent,
+      vectors: vectorsContent,
+      workflows: workflowsContent
+    },
+    outputDirectory,
+    queues,
+    schemaSnapshot,
+    schemaSnapshotPath,
+    workflows
+  };
+};
+
+export { SCHEMA_SNAPSHOT_FILENAME, createCodegenProject, refreshCodegenProject, runCodegen };