@lunora/config 0.0.0 → 1.0.0-alpha.2

package/dist/packem_shared/applyAdditiveEdit-C-snTFEV.mjs

@@ -0,0 +1,228 @@
+import { Project, SyntaxKind } from 'ts-morph';
+import { collectCalls } from './parseSchema-DSeyktvG.mjs';
+
+const IDENTIFIER_PATTERN = /^[A-Za-z_$][\w$]*$/u;
+const VALIDATOR_METHODS = /* @__PURE__ */ new Set([
+  "any",
+  "array",
+  "bigint",
+  "boolean",
+  "bytes",
+  "date",
+  "id",
+  "literal",
+  "null",
+  "number",
+  "object",
+  "optional",
+  "record",
+  "storage",
+  "string",
+  "timestamp",
+  "union"
+]);
+const isValidatorExpression = (node) => {
+  if (node.getKind() === SyntaxKind.ParenthesizedExpression) {
+    return isValidatorExpression(node.asKindOrThrow(SyntaxKind.ParenthesizedExpression).getExpression());
+  }
+  if (node.getKind() !== SyntaxKind.CallExpression) {
+    return false;
+  }
+  const call = node.asKindOrThrow(SyntaxKind.CallExpression);
+  const callee = call.getExpression();
+  if (callee.getKind() !== SyntaxKind.PropertyAccessExpression) {
+    return false;
+  }
+  const access = callee.asKindOrThrow(SyntaxKind.PropertyAccessExpression);
+  if (access.getExpression().getKind() !== SyntaxKind.Identifier || access.getExpression().getText() !== "v" || !VALIDATOR_METHODS.has(access.getName())) {
+    return false;
+  }
+  return call.getArguments().every((argument) => isValidatorArgument(argument));
+};
+const isValidatorArgument = (node) => {
+  const kind = node.getKind();
+  if (kind === SyntaxKind.ParenthesizedExpression) {
+    return isValidatorArgument(node.asKindOrThrow(SyntaxKind.ParenthesizedExpression).getExpression());
+  }
+  if (kind === SyntaxKind.StringLiteral || kind === SyntaxKind.NumericLiteral || kind === SyntaxKind.TrueKeyword || kind === SyntaxKind.FalseKeyword || kind === SyntaxKind.NullKeyword) {
+    return true;
+  }
+  if (kind === SyntaxKind.PrefixUnaryExpression) {
+    const unary = node.asKindOrThrow(SyntaxKind.PrefixUnaryExpression);
+    return unary.getOperand().getKind() === SyntaxKind.NumericLiteral;
+  }
+  if (kind === SyntaxKind.ObjectLiteralExpression) {
+    return node.asKindOrThrow(SyntaxKind.ObjectLiteralExpression).getProperties().every((property) => {
+      if (property.getKind() !== SyntaxKind.PropertyAssignment) {
+        return false;
+      }
+      const initializer = property.getInitializer();
+      return initializer !== void 0 && isValidatorArgument(initializer);
+    });
+  }
+  if (kind === SyntaxKind.ArrayLiteralExpression) {
+    return node.asKindOrThrow(SyntaxKind.ArrayLiteralExpression).getElements().every((element) => isValidatorArgument(element));
+  }
+  return isValidatorExpression(node);
+};
+const isAllowedValidatorText = (validator) => {
+  if (typeof validator !== "string" || validator.trim().length === 0) {
+    return false;
+  }
+  const project = new Project({ compilerOptions: { allowJs: true }, useInMemoryFileSystem: true });
+  const sourceFile = project.createSourceFile("validator.ts", `const __v = (${validator});`, { overwrite: true });
+  if (project.getProgram().getSyntacticDiagnostics(sourceFile).length > 0) {
+    return false;
+  }
+  if (sourceFile.getStatements().length !== 1) {
+    return false;
+  }
+  const declaration = sourceFile.getVariableDeclaration("__v");
+  const initializer = declaration?.getInitializer();
+  return initializer !== void 0 && isValidatorExpression(initializer);
+};
+const ADDITIVE_KINDS = /* @__PURE__ */ new Set(["addIndex", "addOptionalColumn", "addTable"]);
+const classifyEdit = (edit) => ADDITIVE_KINDS.has(edit.kind) ? "additive" : "destructive";
+const isIdentifier = (value) => typeof value === "string" && IDENTIFIER_PATTERN.test(value);
+const validateAdditiveEdit = (edit) => {
+  if (!isIdentifier(edit.table)) {
+    return "invalid-identifier";
+  }
+  if (edit.kind === "addOptionalColumn") {
+    if (!isIdentifier(edit.column)) {
+      return "invalid-identifier";
+    }
+    if (!isAllowedValidatorText(edit.validator)) {
+      return "invalid-validator";
+    }
+  }
+  if (edit.kind === "addIndex") {
+    if (!isIdentifier(edit.name)) {
+      return "invalid-identifier";
+    }
+    if (!Array.isArray(edit.fields) || !edit.fields.every((field) => isIdentifier(field))) {
+      return "invalid-identifier";
+    }
+  }
+  return void 0;
+};
+const findTablesObject = (source) => {
+  const project = new Project({ compilerOptions: { allowJs: true }, useInMemoryFileSystem: true });
+  const sourceFile = project.createSourceFile("schema.ts", source, { overwrite: true });
+  let defineSchemaCall;
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    if (call.getExpression().getText() === "defineSchema") {
+      defineSchemaCall = call;
+      break;
+    }
+  }
+  if (defineSchemaCall === void 0) {
+    const aliased = sourceFile.getImportDeclarations().some((declaration) => declaration.getNamedImports().some((named) => named.getName() === "defineSchema" && named.getAliasNode() !== void 0));
+    return { reason: aliased ? "aliased-define-schema" : "no-define-schema" };
+  }
+  const tablesArgument = defineSchemaCall.getArguments()[0];
+  if (tablesArgument?.getKind() !== SyntaxKind.ObjectLiteralExpression) {
+    return { reason: "non-object-argument" };
+  }
+  return { object: tablesArgument.asKindOrThrow(SyntaxKind.ObjectLiteralExpression), sourceFile };
+};
+const findTableProperty = (tablesObject, table) => {
+  for (const property of tablesObject.getProperties()) {
+    if (property.getKind() === SyntaxKind.PropertyAssignment && property.getNameNode().getText().replaceAll(/["']/gu, "") === table) {
+      return property;
+    }
+  }
+  return void 0;
+};
+const findDefineTableShape = (tableProperty) => {
+  const defineTableCall = tableProperty.getInitializer()?.getDescendantsOfKind(SyntaxKind.CallExpression).find((call) => call.getExpression().getText() === "defineTable");
+  const shape = defineTableCall?.getArguments()[0];
+  return shape?.getKind() === SyntaxKind.ObjectLiteralExpression ? shape.asKindOrThrow(SyntaxKind.ObjectLiteralExpression) : void 0;
+};
+const applyAddTable = (tablesObject, edit) => {
+  if (findTableProperty(tablesObject, edit.table) !== void 0) {
+    return "duplicate-table";
+  }
+  tablesObject.addPropertyAssignment({
+    initializer: `defineTable({
+        // Add your column validators here.
+        // Example:
+        // text: v.string(),
+        // createdAt: v.number(),
+    })`,
+    name: edit.table
+  });
+  return void 0;
+};
+const applyAddOptionalColumn = (tablesObject, edit) => {
+  const tableProperty = findTableProperty(tablesObject, edit.table);
+  if (tableProperty === void 0) {
+    return "unknown-table";
+  }
+  const shape = findDefineTableShape(tableProperty);
+  if (shape === void 0) {
+    return "unknown-table";
+  }
+  const exists = shape.getProperties().some(
+    (property) => property.getKind() === SyntaxKind.PropertyAssignment && property.getNameNode().getText().replaceAll(/["']/gu, "") === edit.column
+  );
+  if (exists) {
+    return "duplicate-column";
+  }
+  shape.addPropertyAssignment({ initializer: `v.optional(${edit.validator})`, name: edit.column });
+  return void 0;
+};
+const applyAddIndex = (tableProperty, edit) => {
+  if (tableProperty === void 0) {
+    return "unknown-table";
+  }
+  const initializer = tableProperty.getInitializer();
+  if (initializer === void 0) {
+    return "unknown-table";
+  }
+  const duplicate = collectCalls(initializer).some((call) => {
+    const expression = call.getExpression();
+    if (expression.getKind() !== SyntaxKind.PropertyAccessExpression) {
+      return false;
+    }
+    const access = expression.asKindOrThrow(SyntaxKind.PropertyAccessExpression);
+    const [nameArgument] = call.getArguments();
+    return access.getName() === "index" && nameArgument?.getKind() === SyntaxKind.StringLiteral && nameArgument.asKindOrThrow(SyntaxKind.StringLiteral).getLiteralText() === edit.name;
+  });
+  if (duplicate) {
+    return "duplicate-index";
+  }
+  const fields = edit.fields.map((field) => JSON.stringify(field)).join(", ");
+  const options = edit.unique === true ? ", { unique: true }" : "";
+  tableProperty.setInitializer(`${initializer.getText()}.index(${JSON.stringify(edit.name)}, [${fields}]${options})`);
+  return void 0;
+};
+const applyAdditiveEdit = (source, edit) => {
+  if (classifyEdit(edit) === "destructive") {
+    return { ok: false, reason: "destructive" };
+  }
+  const additive = edit;
+  const invalid = validateAdditiveEdit(additive);
+  if (invalid !== void 0) {
+    return { ok: false, reason: invalid };
+  }
+  const located = findTablesObject(source);
+  if ("reason" in located) {
+    return { ok: false, reason: located.reason };
+  }
+  const { object: tablesObject, sourceFile } = located;
+  let failure;
+  if (additive.kind === "addTable") {
+    failure = applyAddTable(tablesObject, additive);
+  } else if (additive.kind === "addOptionalColumn") {
+    failure = applyAddOptionalColumn(tablesObject, additive);
+  } else {
+    failure = applyAddIndex(findTableProperty(tablesObject, additive.table), additive);
+  }
+  if (failure !== void 0) {
+    return { ok: false, reason: failure };
+  }
+  return { ok: true, text: sourceFile.getFullText() };
+};
+
+export { applyAdditiveEdit, classifyEdit };

package/dist/packem_shared/buildPackageSecretsBlock-S74dgmwy.mjs

@@ -0,0 +1,187 @@
+import { randomBytes } from 'node:crypto';
+import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { DEV_VARS_FILE, DEV_VARS_EXAMPLE_FILE, parseDevVariableEntries, DEV_VARS_NEWLINE, splitDevVariableLine, unquoteDevVariable } from './DEV_VARS_EXAMPLE_FILE-dJPNTEnK.mjs';
+import { secretsForPackages } from './PACKAGE_SECRETS_REGISTRY-CySy5vR_.mjs';
+
+const SECRET_BYTES = 32;
+const SECRET_KEY = /(?:KEY|PASSWORD|SECRET|TOKEN)$/u;
+const PLACEHOLDER_MARKERS = [
+  "replace",
+  "openssl",
+  "changeme",
+  "change-me",
+  "change_me",
+  "change-this",
+  "change_this",
+  "your-",
+  "your_",
+  "example",
+  "placeholder",
+  "todo",
+  "fill-me",
+  "fill_me",
+  "fill-in",
+  "fill_in",
+  "xxx"
+];
+const REGEXP_SPECIAL_CHARS = /[.*+?^${}()|[\]\\]/gu;
+const MARKER_ENDS_ALPHANUMERIC = /[a-z0-9]$/u;
+const isPlaceholderValue = (value) => {
+  const normalised = value.trim().toLowerCase();
+  if (normalised === "") {
+    return true;
+  }
+  if (normalised.startsWith("<") && normalised.endsWith(">")) {
+    return true;
+  }
+  return PLACEHOLDER_MARKERS.some((marker) => {
+    const escaped = marker.replaceAll(REGEXP_SPECIAL_CHARS, String.raw`\$&`);
+    const needsTrailingBoundary = MARKER_ENDS_ALPHANUMERIC.test(marker);
+    const pattern = needsTrailingBoundary ? `(^|[^a-z0-9])${escaped}([^a-z0-9]|$)` : `(^|[^a-z0-9])${escaped}`;
+    return new RegExp(pattern, "u").test(normalised);
+  });
+};
+const isPlaceholder = (rawValue) => isPlaceholderValue(unquoteDevVariable(rawValue.trim()));
+const defaultRandomHex = (bytes) => randomBytes(bytes).toString("hex");
+const generatedSecretFor = (key, rawValue, randomHex) => SECRET_KEY.test(key) && isPlaceholder(rawValue) ? randomHex(SECRET_BYTES) : void 0;
+const planDevVariablesScaffold = (input) => {
+  if (input.devVarsExists) {
+    return { status: "exists" };
+  }
+  if (input.exampleContent === void 0) {
+    return { status: "no-example" };
+  }
+  const randomHex = input.randomHex ?? defaultRandomHex;
+  const generatedKeys = [];
+  const lines = input.exampleContent.split(DEV_VARS_NEWLINE).map((line) => {
+    const parsed = splitDevVariableLine(line);
+    const secret = parsed ? generatedSecretFor(parsed.key, parsed.value, randomHex) : void 0;
+    if (!parsed || secret === void 0) {
+      return line;
+    }
+    generatedKeys.push(parsed.key);
+    return `${parsed.key}="${secret}"`;
+  });
+  return { content: lines.join("\n"), generatedKeys, status: "generate" };
+};
+const planDevVariablesAugment = (input) => {
+  const randomHex = input.randomHex ?? defaultRandomHex;
+  const present = new Set(parseDevVariableEntries(input.existingContent).map((entry) => entry.key));
+  const additions = [];
+  const generatedKeys = [];
+  const missingKeys = [];
+  for (const line of input.exampleContent.split(DEV_VARS_NEWLINE)) {
+    const parsed = splitDevVariableLine(line);
+    if (!parsed || present.has(parsed.key)) {
+      continue;
+    }
+    const secret = generatedSecretFor(parsed.key, parsed.value, randomHex);
+    missingKeys.push(parsed.key);
+    if (secret === void 0) {
+      additions.push(`${parsed.key}="${unquoteDevVariable(parsed.value)}"`);
+    } else {
+      generatedKeys.push(parsed.key);
+      additions.push(`${parsed.key}="${secret}"`);
+    }
+  }
+  return { additions, generatedKeys, missingKeys };
+};
+const generatedSuffix = (keys) => keys.length > 0 ? ` (generated ${keys.join(", ")})` : "";
+const atomicCreateDevVariables = (path, content) => {
+  const temporaryPath = `${path}.tmp-${String(process.pid)}`;
+  try {
+    writeFileSync(temporaryPath, content, { encoding: "utf8", flag: "wx", mode: 384 });
+    renameSync(temporaryPath, path);
+  } catch (error) {
+    rmSync(temporaryPath, { force: true });
+    throw error;
+  }
+};
+const appendDevVariables = (path, additions) => {
+  const existing = readFileSync(path, "utf8");
+  const separator = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+  const content = `${existing}${separator}${additions.join("\n")}
+`;
+  const temporaryPath = `${path}.tmp-${String(process.pid)}`;
+  try {
+    writeFileSync(temporaryPath, content, { encoding: "utf8", mode: 384 });
+    renameSync(temporaryPath, path);
+  } catch (error) {
+    rmSync(temporaryPath, { force: true });
+    throw error;
+  }
+};
+const ensureDevVariables = async (deps) => {
+  const devVariablesPath = join(deps.cwd, DEV_VARS_FILE);
+  const examplePath = join(deps.cwd, DEV_VARS_EXAMPLE_FILE);
+  if (!existsSync(examplePath)) {
+    return { addedKeys: [], generatedKeys: [], status: "no-example" };
+  }
+  const exampleContent = readFileSync(examplePath, "utf8");
+  if (!existsSync(devVariablesPath)) {
+    const plan = planDevVariablesScaffold({ devVarsExists: false, exampleContent, randomHex: deps.randomHex });
+    if (plan.status !== "generate") {
+      return { addedKeys: [], generatedKeys: [], status: "no-example" };
+    }
+    const proceed2 = deps.yes === true || await deps.confirm(`No ${DEV_VARS_FILE} found. Generate it from ${DEV_VARS_EXAMPLE_FILE} (secrets auto-filled)?`);
+    if (!proceed2) {
+      deps.info(`Skipped — copy ${DEV_VARS_EXAMPLE_FILE} to ${DEV_VARS_FILE} and fill it in when you're ready.`);
+      return { addedKeys: [], generatedKeys: [], status: "declined" };
+    }
+    if (existsSync(devVariablesPath)) {
+      return { addedKeys: [], generatedKeys: [], status: "skipped-exists" };
+    }
+    atomicCreateDevVariables(devVariablesPath, plan.content);
+    deps.info(`Created ${DEV_VARS_FILE}${generatedSuffix(plan.generatedKeys)}.`);
+    return { addedKeys: [], generatedKeys: plan.generatedKeys, status: "generated" };
+  }
+  const augment = planDevVariablesAugment({ existingContent: readFileSync(devVariablesPath, "utf8"), exampleContent, randomHex: deps.randomHex });
+  if (augment.missingKeys.length === 0) {
+    return { addedKeys: [], generatedKeys: [], status: "exists" };
+  }
+  const list = augment.missingKeys.join(", ");
+  const proceed = deps.yes === true || await deps.confirm(`${DEV_VARS_FILE} is missing ${String(augment.missingKeys.length)} key(s) from ${DEV_VARS_EXAMPLE_FILE} (${list}). Add them?`);
+  if (!proceed) {
+    deps.info(`Skipped — add ${list} to ${DEV_VARS_FILE} when you're ready.`);
+    return { addedKeys: [], generatedKeys: [], status: "declined" };
+  }
+  appendDevVariables(devVariablesPath, augment.additions);
+  deps.info(`Updated ${DEV_VARS_FILE} — added ${list}${generatedSuffix(augment.generatedKeys)}.`);
+  return { addedKeys: augment.missingKeys, generatedKeys: augment.generatedKeys, status: "augmented" };
+};
+const secretEntryBlock = (entry) => {
+  const lines = [`# ${entry.description}`, `# Docs: ${entry.docsUrl}`, `${entry.key}="${entry.placeholderValue}"`];
+  return lines.join("\n");
+};
+const buildPackageSecretsBlock = (packageNames, existingKeys) => {
+  const entries = secretsForPackages(packageNames).filter((entry) => !existingKeys.has(entry.key));
+  if (entries.length === 0) {
+    return "";
+  }
+  return entries.map((entry) => secretEntryBlock(entry)).join("\n\n");
+};
+const ensureDevVariablesExample = (cwd, packageNames) => {
+  const examplePath = join(cwd, DEV_VARS_EXAMPLE_FILE);
+  const existing = existsSync(examplePath) ? readFileSync(examplePath, "utf8") : "";
+  const existingKeys = new Set(parseDevVariableEntries(existing).map((entry) => entry.key));
+  const block = buildPackageSecretsBlock(packageNames, existingKeys);
+  if (block === "") {
+    return [];
+  }
+  const separator = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+  const newContent = `${existing}${separator}
+${block}
+`;
+  const temporaryPath = `${examplePath}.tmp-${String(process.pid)}`;
+  try {
+    writeFileSync(temporaryPath, newContent, { encoding: "utf8" });
+    renameSync(temporaryPath, examplePath);
+  } catch (error) {
+    rmSync(temporaryPath, { force: true });
+    throw error;
+  }
+  return secretsForPackages(packageNames).filter((entry) => !existingKeys.has(entry.key)).map((entry) => entry.key);
+};
+
+export { buildPackageSecretsBlock, ensureDevVariables, ensureDevVariablesExample as ensureDevVarsExample, isPlaceholderValue, planDevVariablesAugment, planDevVariablesScaffold };

package/dist/packem_shared/classifyPolicyEdit-BHeAqF8P.mjs

@@ -0,0 +1,99 @@
+import { Project, SyntaxKind } from 'ts-morph';
+
+const TERMINAL_METHODS = /* @__PURE__ */ new Set(["action", "mutation", "query", "stream"]);
+const IDENTIFIER_PATTERN = /^[A-Za-z_$][\w$]*$/u;
+const ADDITIVE_KINDS = /* @__PURE__ */ new Set(["scaffoldPolicy", "wireRls"]);
+const classifyPolicyEdit = (edit) => ADDITIVE_KINDS.has(edit.kind) ? "additive" : "destructive";
+const scaffoldPolicyFile = (edit) => {
+  if (typeof edit.name !== "string" || typeof edit.table !== "string" || !IDENTIFIER_PATTERN.test(edit.name) || !IDENTIFIER_PATTERN.test(edit.table)) {
+    return { ok: false, reason: "invalid-identifier" };
+  }
+  const policiesIdentifier = `${edit.name}Policies`;
+  const rolesIdentifier = `${edit.name}Roles`;
+  const table = JSON.stringify(edit.table);
+  const source = `import { definePermission, definePolicies, definePolicy, defineRole } from "@lunora/server";
+
+/**
+ * Access rules for the ${edit.table} table — scaffolded by the Lunora studio
+ * (plan 025). The \`when\` predicates below DENY by default (\`() => false\`);
+ * replace each TODO with the real condition, then wire \`${policiesIdentifier}\`
+ * into the procedures that read/write ${edit.table} via
+ * \`.use(rls(${policiesIdentifier}, { roles: ${rolesIdentifier} }))\`.
+ */
+export const ${policiesIdentifier} = definePolicies([
+    definePolicy({
+        on: "read",
+        table: ${table},
+        // TODO: return \`true\` to allow, a \`WhereInput\` to filter, or \`false\` to deny.
+        when: () => false,
+    }),
+]);
+
+/** Named permissions \`${policiesIdentifier}\` can check with \`ctx.auth.can(...)\`. */
+export const ${edit.name}View = definePermission("${edit.name}:view");
+
+/** Roles that grant the permissions above; register via \`rls(policies, { roles })\`. */
+export const ${rolesIdentifier} = [defineRole("${edit.name}-admin", { permissions: [${edit.name}View] })];
+`;
+  return { fileName: `${edit.name}.policies.ts`, ok: true, source };
+};
+const builderReceiver = (initializer) => {
+  const callee = initializer.getExpression();
+  if (callee.getKind() !== SyntaxKind.PropertyAccessExpression) {
+    return void 0;
+  }
+  const access = callee.asKindOrThrow(SyntaxKind.PropertyAccessExpression);
+  return TERMINAL_METHODS.has(access.getName()) ? access.getExpression() : void 0;
+};
+const ensureRlsImport = (sourceFile) => {
+  const serverImport = sourceFile.getImportDeclaration((declaration) => declaration.getModuleSpecifierValue() === "@lunora/server");
+  if (serverImport === void 0) {
+    sourceFile.addImportDeclaration({ moduleSpecifier: "@lunora/server", namedImports: ["rls"] });
+    return;
+  }
+  if (!serverImport.getNamedImports().some((named) => named.getName() === "rls")) {
+    serverImport.addNamedImport("rls");
+  }
+};
+const chainHasRls = (receiver) => {
+  const calls = receiver.getDescendantsOfKind(SyntaxKind.CallExpression);
+  if (receiver.getKind() === SyntaxKind.CallExpression) {
+    calls.push(receiver.asKindOrThrow(SyntaxKind.CallExpression));
+  }
+  for (const call of calls) {
+    const callee = call.getExpression();
+    if (callee.getKind() !== SyntaxKind.PropertyAccessExpression) {
+      continue;
+    }
+    const access = callee.asKindOrThrow(SyntaxKind.PropertyAccessExpression);
+    const [argument] = call.getArguments();
+    if (access.getName() === "use" && argument?.getKind() === SyntaxKind.CallExpression && argument.asKindOrThrow(SyntaxKind.CallExpression).getExpression().getText() === "rls") {
+      return true;
+    }
+  }
+  return false;
+};
+const wireRlsIntoProcedure = (source, edit) => {
+  if (typeof edit.policies !== "string" || !IDENTIFIER_PATTERN.test(edit.policies)) {
+    return { ok: false, reason: "invalid-identifier" };
+  }
+  const project = new Project({ compilerOptions: { allowJs: true }, useInMemoryFileSystem: true });
+  const sourceFile = project.createSourceFile("procedure.ts", source, { overwrite: true });
+  const declaration = sourceFile.getVariableDeclaration(edit.exportName);
+  const initializer = declaration?.getInitializer();
+  if (declaration === void 0 || initializer?.getKind() !== SyntaxKind.CallExpression) {
+    return { ok: false, reason: "unknown-procedure" };
+  }
+  const receiver = builderReceiver(initializer.asKindOrThrow(SyntaxKind.CallExpression));
+  if (receiver === void 0) {
+    return { ok: false, reason: "unsupported-procedure-shape" };
+  }
+  if (chainHasRls(receiver)) {
+    return { ok: false, reason: "already-wired" };
+  }
+  receiver.replaceWithText(`${receiver.getText()}.use(rls(${edit.policies}))`);
+  ensureRlsImport(sourceFile);
+  return { ok: true, text: sourceFile.getFullText() };
+};
+
+export { classifyPolicyEdit, scaffoldPolicyFile, wireRlsIntoProcedure };

package/dist/packem_shared/createConfirm-fvpdgJ9s.mjs

@@ -0,0 +1,100 @@
+import { createInterface } from 'node:readline';
+
+const MULTI_SELECT_SEPARATOR = /[\s,]+/u;
+const isInteractive = () => process.stdin.isTTY;
+const promptYesNo = async (prompt, options) => {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = await new Promise((resolve) => {
+      rl.question(prompt, (input) => {
+        resolve(input);
+      });
+    });
+    const normalised = answer.trim().toLowerCase();
+    if (normalised === "") {
+      return options?.defaultYes === true;
+    }
+    return normalised === "y" || normalised === "yes";
+  } finally {
+    rl.close();
+  }
+};
+const createConfirm = (prefix = "") => isInteractive() ? (message) => promptYesNo(`${prefix}${message} [Y/n] `, { defaultYes: true }) : () => Promise.resolve(false);
+const promptSelect = async (message, options, settings) => {
+  if (!isInteractive() || options.length === 0) {
+    return settings?.default;
+  }
+  const defaultIndex = settings?.default === void 0 ? -1 : options.findIndex((option) => option.value === settings.default);
+  const lines = options.map(
+    (option, index) => `  ${String(index + 1)}) ${option.label}${option.description === void 0 ? "" : ` — ${option.description}`}`
+  );
+  const promptText = `${message}
+${lines.join("\n")}
+> ${defaultIndex >= 0 ? `[${String(defaultIndex + 1)}] ` : ""}`;
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = await new Promise((resolve) => {
+      rl.question(promptText, (input) => {
+        resolve(input);
+      });
+    });
+    const trimmed = answer.trim();
+    if (trimmed === "") {
+      return settings?.default;
+    }
+    const choice = Number.parseInt(trimmed, 10);
+    if (Number.isInteger(choice) && choice >= 1 && choice <= options.length) {
+      return options[choice - 1]?.value;
+    }
+    const byText = options.find((option) => option.value === trimmed || option.label.toLowerCase() === trimmed.toLowerCase());
+    return byText?.value ?? settings?.default;
+  } finally {
+    rl.close();
+  }
+};
+const promptMultiSelect = async (message, options, settings) => {
+  const defaults = settings?.defaults ?? [];
+  if (!isInteractive() || options.length === 0) {
+    return [...defaults];
+  }
+  const lines = options.map(
+    (option, index) => `  ${String(index + 1)}) ${option.label}${option.description === void 0 ? "" : ` — ${option.description}`}`
+  );
+  const defaultHint = defaults.length === 0 ? "" : `[${defaults.join(", ")}] `;
+  const promptText = `${message} (comma-separated; Enter for default)
+${lines.join("\n")}
+> ${defaultHint}`;
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = await new Promise((resolve) => {
+      rl.question(promptText, (input) => {
+        resolve(input);
+      });
+    });
+    const trimmed = answer.trim();
+    if (trimmed === "") {
+      return [...defaults];
+    }
+    const tokens = trimmed.split(MULTI_SELECT_SEPARATOR).map((token) => token.trim()).filter((token) => token !== "");
+    const picked = /* @__PURE__ */ new Set();
+    for (const token of tokens) {
+      const choice = Number.parseInt(token, 10);
+      if (Number.isInteger(choice) && choice >= 1 && choice <= options.length && String(choice) === token) {
+        const byIndex = options[choice - 1]?.value;
+        if (byIndex !== void 0) {
+          picked.add(byIndex);
+        }
+        continue;
+      }
+      const byText = options.find((option) => option.value === token || option.label.toLowerCase() === token.toLowerCase());
+      if (byText !== void 0) {
+        picked.add(byText.value);
+      }
+    }
+    return options.filter((option) => picked.has(option.value)).map((option) => option.value);
+  } finally {
+    rl.close();
+  }
+};
+
+export { createConfirm, isInteractive, promptMultiSelect, promptSelect, promptYesNo };

package/dist/packem_shared/detectFramework-Br-BcPBq.mjs

@@ -0,0 +1,41 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const FRAMEWORK_SIGNATURES = [
+  { class: "A", dependency: "@tanstack/react-start", framework: "tanstack-start" },
+  { class: "A", dependency: "@tanstack/solid-start", framework: "tanstack-start-solid" },
+  { class: "A", dependency: "@react-router/dev", framework: "react-router" },
+  { class: "A", dependency: "@solidjs/start", framework: "solid-start" },
+  { class: "A", dependency: "solid-start", framework: "solid-start" },
+  { class: "B", dependency: "@sveltejs/kit", framework: "sveltekit" },
+  { class: "B", dependency: "nuxt", framework: "nuxt" },
+  { class: "B", dependency: "astro", framework: "astro" }
+];
+const STANDALONE = { class: "C", framework: "none" };
+const readDependencyNames = (root) => {
+  const packageJsonPath = join(root, "package.json");
+  if (!existsSync(packageJsonPath)) {
+    return /* @__PURE__ */ new Set();
+  }
+  try {
+    const raw = readFileSync(packageJsonPath, "utf8");
+    const parsed = JSON.parse(raw);
+    return /* @__PURE__ */ new Set([...Object.keys(parsed.dependencies ?? {}), ...Object.keys(parsed.devDependencies ?? {})]);
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+};
+const detectFramework = (root) => {
+  const dependencies = readDependencyNames(root);
+  if (dependencies.size === 0) {
+    return STANDALONE;
+  }
+  for (const signature of FRAMEWORK_SIGNATURES) {
+    if (dependencies.has(signature.dependency)) {
+      return { class: signature.class, framework: signature.framework };
+    }
+  }
+  return STANDALONE;
+};
+
+export { detectFramework };

package/dist/packem_shared/discoverContainerInfo-BXFs6Wav.mjs

@@ -0,0 +1,19 @@
+import { existsSync } from 'node:fs';
+import { CONTAINERS_FILENAME, discoverContainers } from '@lunora/codegen';
+import { Project } from 'ts-morph';
+import { join } from 'node:path';
+
+const discoverContainerInfo = (projectRoot, schemaDirectory) => {
+  const containersPath = join(projectRoot, schemaDirectory, CONTAINERS_FILENAME);
+  if (!existsSync(containersPath)) {
+    return { containers: [] };
+  }
+  try {
+    const project = new Project({ skipAddingFilesFromTsConfig: true, skipFileDependencyResolution: true, useInMemoryFileSystem: false });
+    return { containers: discoverContainers(project, join(projectRoot, schemaDirectory)) };
+  } catch (error) {
+    return { containers: [], error: error instanceof Error ? error.message : String(error) };
+  }
+};
+
+export { discoverContainerInfo };