@lunora/config 0.0.0 → 1.0.0-alpha.2

package/dist/packem_shared/inferLunoraBindings-0W3eRdIP.mjs

@@ -0,0 +1,302 @@
+import { existsSync, statSync, readFileSync, readdirSync } from 'node:fs';
+import { init, parse } from 'es-module-lexer';
+import { discoverContainerInfo } from './discoverContainerInfo-BXFs6Wav.mjs';
+import { discoverSchemaInfo } from './discoverSchemaInfo-DWtypqpP.mjs';
+import { discoverWorkflowInfo } from './discoverWorkflowInfo-CedvR0mn.mjs';
+import { WRANGLER_FILES, readWranglerJsonc } from './findWranglerFile-DwSuC-Kn.mjs';
+import { join } from 'node:path';
+
+const SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([".cjs", ".cts", ".js", ".jsx", ".mjs", ".mts", ".ts", ".tsx"]);
+const IGNORED_DIRECTORIES = /* @__PURE__ */ new Set([".git", ".lunora-cache", ".wrangler", "_generated", "dist", "node_modules"]);
+const DEFAULT_SCAN_DIRECTORIES = ["lunora", "src"];
+const WORKER_ENTRY_FALLBACKS = ["src/server/index.ts", "src/server/index.tsx", "src/index.ts", "src/worker.ts"];
+const DURABLE_OBJECT_BINDINGS = {
+  SchedulerDO: "SCHEDULER",
+  SessionDO: "SESSION",
+  ShardDO: "SHARD"
+};
+const DURABLE_OBJECT_CLASSES = Object.keys(DURABLE_OBJECT_BINDINGS);
+const TYPE_ONLY_EXPORT_PATTERNS = {
+  SchedulerDO: /\btype\s+SchedulerDO\b/,
+  SessionDO: /\btype\s+SessionDO\b/,
+  ShardDO: /\btype\s+ShardDO\b/
+};
+const ENV_DB_PATTERN = /\benv\s*\.\s*DB\b/;
+const ENV_AI_PATTERN = /\benv\s*\.\s*AI\b/;
+const TYPE_ONLY_IMPORT_PATTERN = /^\s*import\s+type\b/;
+const CAPABILITY_SOURCES = {
+  usesAi: { pattern: /\bfrom\s+["']@lunora\/ai["']/, source: "@lunora/ai" },
+  usesAnalytics: { pattern: /\bfrom\s+["']@lunora\/analytics["']/, source: "@lunora/analytics" },
+  usesAuth: { pattern: /\bfrom\s+["']@lunora\/auth["']/, source: "@lunora/auth" },
+  usesBrowser: { pattern: /\bfrom\s+["']@lunora\/browser["']/, source: "@lunora/browser" },
+  usesHyperdrive: { pattern: /\bfrom\s+["']@lunora\/hyperdrive["']/, source: "@lunora/hyperdrive" },
+  usesImages: { pattern: /\bfrom\s+["']@lunora\/images["']/, source: "@lunora/images" },
+  usesKv: { pattern: /\bfrom\s+["']@lunora\/kv["']/, source: "@lunora/kv" },
+  usesMail: { pattern: /\bfrom\s+["']@lunora\/mail["']/, source: "@lunora/mail" },
+  usesPayment: { pattern: /\bfrom\s+["']@lunora\/payment["']/, source: "@lunora/payment" },
+  usesPipelines: { pattern: /\bfrom\s+["']@lunora\/pipelines["']/, source: "@lunora/pipelines" },
+  usesScheduler: { pattern: /\bfrom\s+["']@lunora\/scheduler["']/, source: "@lunora/scheduler" },
+  usesStorage: { pattern: /\bfrom\s+["']@lunora\/storage["']/, source: "@lunora/storage" }
+};
+const CAPABILITY_FLAGS = Object.keys(CAPABILITY_SOURCES);
+const PAYMENT_PROVIDER_SECRETS = "STRIPE_SECRET_KEY + STRIPE_WEBHOOK_SECRET (Stripe) or POLAR_ACCESS_TOKEN + POLAR_WEBHOOK_SECRET (Polar)";
+const ALL_CAPABILITY_KEYS = [...CAPABILITY_FLAGS, "needsD1"];
+const emptyCapabilities = () => {
+  const base = {};
+  for (const key of ALL_CAPABILITY_KEYS) {
+    base[key] = false;
+  }
+  return base;
+};
+const NO_CAPABILITIES = Object.freeze(emptyCapabilities());
+const mergeCapabilities = (a, b) => {
+  const merged = {};
+  for (const key of ALL_CAPABILITY_KEYS) {
+    merged[key] = a[key] || b[key];
+  }
+  return merged;
+};
+const capabilityForImportSource = (source) => {
+  for (const flag of CAPABILITY_FLAGS) {
+    if (CAPABILITY_SOURCES[flag].source === source) {
+      return { ...NO_CAPABILITIES, [flag]: true };
+    }
+  }
+  return NO_CAPABILITIES;
+};
+const lexCapabilities = (code) => {
+  const [imports] = parse(code);
+  let capabilities = NO_CAPABILITIES;
+  for (const entry of imports) {
+    const source = entry.n;
+    if (!source || TYPE_ONLY_IMPORT_PATTERN.test(code.slice(entry.ss, entry.se))) {
+      continue;
+    }
+    capabilities = mergeCapabilities(capabilities, capabilityForImportSource(source));
+  }
+  return capabilities;
+};
+const regexCapabilities = (code) => {
+  const capabilities = { ...NO_CAPABILITIES };
+  for (const flag of CAPABILITY_FLAGS) {
+    capabilities[flag] = CAPABILITY_SOURCES[flag].pattern.test(code);
+  }
+  return capabilities;
+};
+const capabilitiesFromSource = (code) => {
+  let capabilities;
+  try {
+    capabilities = lexCapabilities(code);
+  } catch {
+    capabilities = regexCapabilities(code);
+  }
+  return mergeCapabilities(capabilities, { ...NO_CAPABILITIES, needsD1: ENV_DB_PATTERN.test(code), usesAi: ENV_AI_PATTERN.test(code) });
+};
+const collectSourceFiles = (directory, accumulator) => {
+  let entries;
+  try {
+    entries = readdirSync(directory, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (!IGNORED_DIRECTORIES.has(entry.name)) {
+        collectSourceFiles(join(directory, entry.name), accumulator);
+      }
+      continue;
+    }
+    const dotIndex = entry.name.lastIndexOf(".");
+    if (dotIndex !== -1 && SOURCE_EXTENSIONS.has(entry.name.slice(dotIndex))) {
+      accumulator.push(join(directory, entry.name));
+    }
+  }
+};
+const resolveWorkerEntry = (projectRoot) => {
+  for (const candidate of WRANGLER_FILES) {
+    const wranglerPath = join(projectRoot, candidate);
+    if (!existsSync(wranglerPath)) {
+      continue;
+    }
+    const { parsed } = readWranglerJsonc(wranglerPath);
+    const main = parsed?.main;
+    if (typeof main === "string" && existsSync(join(projectRoot, main))) {
+      return join(projectRoot, main);
+    }
+    break;
+  }
+  for (const fallback of WORKER_ENTRY_FALLBACKS) {
+    const fullPath = join(projectRoot, fallback);
+    if (existsSync(fullPath)) {
+      return fullPath;
+    }
+  }
+  return void 0;
+};
+const detectExportedDurableObjects = (entryPath) => {
+  const code = readFileSync(entryPath, "utf8");
+  let exportedNames;
+  try {
+    const [, exports$1] = parse(code);
+    exportedNames = new Set(exports$1.map((entry) => entry.n));
+  } catch {
+    exportedNames = new Set(DURABLE_OBJECT_CLASSES.filter((className) => new RegExp(String.raw`\bexport\b[^\n;]*\b${className}\b`).test(code)));
+  }
+  return DURABLE_OBJECT_CLASSES.filter((className) => exportedNames.has(className) && !TYPE_ONLY_EXPORT_PATTERNS[className].test(code)).map((className) => {
+    return {
+      binding: DURABLE_OBJECT_BINDINGS[className],
+      className
+    };
+  });
+};
+const CONTAINERS_STAR_REEXPORT_PATTERN = /\bexport\s*\*\s*from\s*["'][^"']*_generated\/containers(?:\.js)?["']/;
+const detectContainerExports = (entryPath, containers) => {
+  if (containers.length === 0) {
+    return [];
+  }
+  if (entryPath === void 0) {
+    return containers.map((container) => {
+      return { ...container, exported: false };
+    });
+  }
+  const code = readFileSync(entryPath, "utf8");
+  const starReexport = CONTAINERS_STAR_REEXPORT_PATTERN.test(code);
+  let exportedNames;
+  try {
+    const [, exports$1] = parse(code);
+    exportedNames = new Set(exports$1.map((entry) => entry.n));
+  } catch {
+    exportedNames = new Set(
+      containers.map((container) => container.className).filter((className) => new RegExp(String.raw`\bexport\b[^\n;]*\b${className}\b`).test(code))
+    );
+  }
+  return containers.map((container) => {
+    return { ...container, exported: starReexport || exportedNames.has(container.className) };
+  });
+};
+const WORKFLOWS_STAR_REEXPORT_PATTERN = /\bexport\s*\*\s*from\s*["'][^"']*_generated\/workflows(?:\.js)?["']/;
+const detectWorkflowExports = (entryPath, workflows) => {
+  if (workflows.length === 0) {
+    return [];
+  }
+  if (entryPath === void 0) {
+    return workflows.map((workflow) => {
+      return { ...workflow, exported: false };
+    });
+  }
+  const code = readFileSync(entryPath, "utf8");
+  const starReexport = WORKFLOWS_STAR_REEXPORT_PATTERN.test(code);
+  let exportedNames;
+  try {
+    const [, exports$1] = parse(code);
+    exportedNames = new Set(exports$1.map((entry) => entry.n));
+  } catch {
+    exportedNames = new Set(
+      workflows.map((workflow) => workflow.className).filter((className) => new RegExp(String.raw`\bexport\b[^\n;]*\b${className}\b`).test(code))
+    );
+  }
+  return workflows.map((workflow) => {
+    return { ...workflow, exported: starReexport || exportedNames.has(workflow.className) };
+  });
+};
+const schemaNeedsD1 = (projectRoot, schemaDirectory) => discoverSchemaInfo(projectRoot, schemaDirectory).info?.hasGlobalTable ?? false;
+const scanCapabilities = (projectRoot, scanDirectories) => {
+  let merged = NO_CAPABILITIES;
+  for (const relativeDirectory of scanDirectories) {
+    const absolute = join(projectRoot, relativeDirectory);
+    if (!existsSync(absolute) || !statSync(absolute).isDirectory()) {
+      continue;
+    }
+    const files = [];
+    collectSourceFiles(absolute, files);
+    for (const file of files) {
+      merged = mergeCapabilities(merged, capabilitiesFromSource(readFileSync(file, "utf8")));
+    }
+  }
+  return merged;
+};
+const describeDeclaredExports = (containers, workflows) => [
+  ...containers.map(
+    (container) => container.exported ? `${container.bindingName}/${container.className} (container "${container.exportName}" declared and exported)` : `hint: container "${container.exportName}" is declared but ${container.className} is not exported by the worker entry — add \`export * from "./lunora/_generated/containers"\``
+  ),
+  ...workflows.map(
+    (workflow) => workflow.exported ? `${workflow.bindingName}/${workflow.className} (workflow "${workflow.exportName}" declared and exported)` : `hint: workflow "${workflow.exportName}" is declared but ${workflow.className} is not exported by the worker entry — add \`export * from "./lunora/_generated/workflows"\``
+  )
+];
+const describeCapabilitySignals = (capabilities, exported) => {
+  const rules = [
+    [capabilities.usesAi, "AI (@lunora/ai imported or env.AI used)"],
+    [
+      capabilities.usesAuth && !exported.has("SessionDO"),
+      "hint: @lunora/auth is imported but no SessionDO is exported (sessions are D1-backed, or export SessionDO for DO-backed sessions)"
+    ],
+    [capabilities.usesScheduler && !exported.has("SchedulerDO"), "hint: @lunora/scheduler is imported but no SchedulerDO is exported by the worker entry"],
+    [capabilities.usesStorage, "hint: @lunora/storage is imported; add an r2_buckets binding (bucket binding names are user-defined)"],
+    [capabilities.usesMail, "hint: @lunora/mail is imported; set RESEND_API_KEY in .dev.vars (obtain at https://resend.com/api-keys)"],
+    [capabilities.usesPayment, `hint: @lunora/payment is imported; set the provider secrets in .dev.vars — ${PAYMENT_PROVIDER_SECRETS}`],
+    // Self-describing bindings: the binding name is the whole config (no remote
+    // id to mint), so reconcile auto-writes them like the DO/D1 bindings.
+    [capabilities.usesBrowser, "browser (@lunora/browser imported) — self-describing { binding: BROWSER }"],
+    [capabilities.usesImages, "images (@lunora/images imported) — self-describing { binding: IMAGES }"],
+    [capabilities.usesAnalytics, "analytics_engine_datasets (@lunora/analytics imported) — self-describing { binding: ANALYTICS, dataset }"],
+    // Hint bindings: each needs a remote resource Lunora can't fabricate (a KV
+    // namespace id, a Hyperdrive id, a Pipelines pipeline name), so they surface
+    // as hints — never an auto-write — exactly like R2's user-defined bucket name.
+    [
+      capabilities.usesKv,
+      "hint: @lunora/kv is imported; add a kv_namespaces binding ({ binding, id }) and pass env.<BINDING> to createKv() — the namespace id can't be auto-provisioned"
+    ],
+    [
+      capabilities.usesHyperdrive,
+      "hint: @lunora/hyperdrive is imported; run 'wrangler hyperdrive create' and add a 'hyperdrive' binding ({ binding, id }) — the id can't be auto-provisioned"
+    ],
+    [
+      capabilities.usesPipelines,
+      "hint: @lunora/pipelines is imported; run 'wrangler pipelines create <name>' and add a 'pipelines' binding ({ binding, pipeline }) — the pipeline resource can't be auto-provisioned"
+    ]
+  ];
+  return rules.filter(([active]) => active).map(([, signal]) => signal);
+};
+const describeSignals = (durableObjects, needsD1, capabilities, containers = [], workflows = []) => {
+  const exported = new Set(durableObjects.map((object) => object.className));
+  const signals = durableObjects.map((object) => `${object.binding}/${object.className} (exported by worker entry)`);
+  if (needsD1) {
+    signals.push("DB (.global() table declared)");
+  }
+  signals.push(...describeDeclaredExports(containers, workflows), ...describeCapabilitySignals(capabilities, exported));
+  return signals;
+};
+const inferLunoraBindings = async (options) => {
+  await init;
+  const schemaDirectory = options.schemaDir ?? "lunora";
+  const scanDirectories = options.scanDirs ?? DEFAULT_SCAN_DIRECTORIES;
+  const capabilities = scanCapabilities(options.projectRoot, scanDirectories);
+  const entryPath = resolveWorkerEntry(options.projectRoot);
+  const durableObjects = entryPath ? detectExportedDurableObjects(entryPath) : [];
+  const needsD1 = capabilities.needsD1 || schemaNeedsD1(options.projectRoot, schemaDirectory);
+  const containers = detectContainerExports(entryPath, discoverContainerInfo(options.projectRoot, schemaDirectory).containers);
+  const workflows = detectWorkflowExports(entryPath, discoverWorkflowInfo(options.projectRoot, schemaDirectory).workflows);
+  const capabilityFlags = {};
+  for (const flag of CAPABILITY_FLAGS) {
+    capabilityFlags[flag] = capabilities[flag];
+  }
+  return {
+    containers,
+    durableObjects,
+    needsD1,
+    signals: describeSignals(durableObjects, needsD1, capabilities, containers, workflows),
+    workflows,
+    ...capabilityFlags
+  };
+};
+const packageNamesFromBindings = (bindings) => {
+  const names = [];
+  for (const flag of CAPABILITY_FLAGS) {
+    if (bindings[flag]) {
+      names.push(CAPABILITY_SOURCES[flag].source);
+    }
+  }
+  return names;
+};
+
+export { inferLunoraBindings, packageNamesFromBindings };

package/dist/packem_shared/injectRemoteFlags-C-WZAKLY.mjs

@@ -0,0 +1,105 @@
+import { writeFileSync, rmSync } from 'node:fs';
+import { modify, applyEdits } from 'jsonc-parser';
+import { findWranglerFile, readWranglerJsonc } from './findWranglerFile-DwSuC-Kn.mjs';
+import { join } from 'node:path';
+
+const FORMATTING = { formattingOptions: { insertSpaces: true, tabSize: 4 } };
+const REMOTE_ELIGIBLE_KEYS = {
+  ai: { label: "AI", shape: "object" },
+  d1_databases: { label: "D1", shape: "array" },
+  kv_namespaces: { label: "KV", shape: "array" },
+  queues: { label: "Queue", shape: "producers" },
+  r2_buckets: { label: "R2", shape: "array" },
+  services: { label: "Service", shape: "array" },
+  vectorize: { label: "Vectorize", shape: "array" }
+};
+const REMOTE_ELIGIBLE_KEY_LIST = Object.keys(REMOTE_ELIGIBLE_KEYS);
+const entryName = (entry, fallback) => typeof entry.binding === "string" ? entry.binding : fallback;
+const planArrayEntries = (section, entries, kind, pathPrefix) => {
+  const plans = [];
+  for (const [index, entry] of entries.entries()) {
+    if (entry === null || entry === void 0) {
+      continue;
+    }
+    plans.push({ binding: entryName(entry, `#${String(index)}`), kind, path: [...pathPrefix, index], section });
+  }
+  return plans;
+};
+const planSection = (section, parsed) => {
+  const { label, shape } = REMOTE_ELIGIBLE_KEYS[section];
+  if (shape === "array") {
+    const entries = parsed[section] ?? [];
+    return planArrayEntries(section, entries, label, []);
+  }
+  if (shape === "producers") {
+    return planArrayEntries(section, parsed.queues?.producers ?? [], label, ["producers"]);
+  }
+  const entry = parsed.ai;
+  return entry === null || entry === void 0 ? [] : [{ binding: entryName(entry, section), kind: label, path: [], section }];
+};
+const planRemoteBindings = (parsed) => REMOTE_ELIGIBLE_KEY_LIST.flatMap((section) => planSection(section, parsed));
+const applyModify = (text, path, value) => {
+  const edits = modify(text, [...path], value, FORMATTING);
+  return edits.length > 0 ? applyEdits(text, edits) : text;
+};
+const injectRemoteFlags = (text, plans) => {
+  let next = text;
+  for (const plan of plans) {
+    next = applyModify(next, [plan.section, ...plan.path, "remote"], true);
+  }
+  return next;
+};
+const noopCleanup = () => {
+};
+const createCleanup = (path) => {
+  let done = false;
+  return () => {
+    if (done) {
+      return;
+    }
+    done = true;
+    try {
+      rmSync(path, { force: true, recursive: true });
+    } catch {
+    }
+  };
+};
+const remoteConfigBasename = () => `.wrangler.lunora-remote.${String(process.pid)}.jsonc`;
+const materializeRemoteWranglerConfig = (options) => {
+  if (!options.enabled) {
+    return { cleanup: noopCleanup, enabled: false, remoteBindings: [] };
+  }
+  const wranglerPath = findWranglerFile(options.projectRoot);
+  if (!wranglerPath) {
+    return { cleanup: noopCleanup, enabled: true, reason: "wrangler.jsonc not found", remoteBindings: [] };
+  }
+  const { parsed, text } = readWranglerJsonc(wranglerPath);
+  if (parsed === void 0) {
+    return { cleanup: noopCleanup, enabled: true, reason: `failed to parse ${wranglerPath} as JSONC`, remoteBindings: [] };
+  }
+  const plans = planRemoteBindings(parsed);
+  if (plans.length === 0) {
+    return { cleanup: noopCleanup, enabled: true, reason: "no remote-eligible bindings to proxy", remoteBindings: [] };
+  }
+  const configPath = join(options.projectRoot, remoteConfigBasename());
+  writeFileSync(configPath, injectRemoteFlags(text, plans), "utf8");
+  return { cleanup: createCleanup(configPath), configPath, enabled: true, remoteBindings: plans };
+};
+const isRemoteEnvEnabled = (value) => {
+  if (value === void 0) {
+    return false;
+  }
+  const normalized = value.trim().toLowerCase();
+  return normalized === "1" || normalized === "true";
+};
+const resolveRemoteEnabled = (inputs) => {
+  if (inputs.flag === true) {
+    return true;
+  }
+  if (isRemoteEnvEnabled(inputs.envValue)) {
+    return true;
+  }
+  return inputs.configPreference ?? false;
+};
+
+export { REMOTE_ELIGIBLE_KEYS, injectRemoteFlags, isRemoteEnvEnabled, materializeRemoteWranglerConfig, planRemoteBindings, resolveRemoteEnabled };

package/dist/packem_shared/interpretRemote-CtcIcB5-.mjs

@@ -0,0 +1,34 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { parse } from 'jsonc-parser';
+import { join } from 'node:path';
+
+const LUNORA_CONFIG_FILE = "lunora.json";
+const interpretRemote = (value) => {
+  if (typeof value === "boolean") {
+    return value;
+  }
+  if (value !== null && typeof value === "object") {
+    return true;
+  }
+  return void 0;
+};
+const readProjectRemotePreference = (projectRoot) => {
+  const configPath = join(projectRoot, LUNORA_CONFIG_FILE);
+  if (!existsSync(configPath)) {
+    return void 0;
+  }
+  let text;
+  try {
+    text = readFileSync(configPath, "utf8");
+  } catch {
+    return void 0;
+  }
+  const parseErrors = [];
+  const parsed = parse(text, parseErrors, { allowTrailingComma: true });
+  if (parseErrors.length > 0 || parsed === null || typeof parsed !== "object") {
+    return void 0;
+  }
+  return interpretRemote(parsed.remote);
+};
+
+export { LUNORA_CONFIG_FILE, interpretRemote, readProjectRemotePreference };

package/dist/packem_shared/parseDevVariable-CJiq2IwE.mjs

@@ -0,0 +1,30 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const LINE_BREAK = /\r?\n/u;
+const parseDevVariable = (contents, key) => {
+  for (const raw of contents.split(LINE_BREAK)) {
+    const line = raw.trim();
+    const eq = line.indexOf("=");
+    if (line === "" || line.startsWith("#") || eq === -1 || line.slice(0, eq).trim() !== key) {
+      continue;
+    }
+    const value = line.slice(eq + 1).trim();
+    const unquoted = value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'") ? value.slice(1, -1) : value;
+    return unquoted === "" ? void 0 : unquoted;
+  }
+  return void 0;
+};
+const resolveAdminToken = (root) => {
+  const fromEnv = process.env["LUNORA_ADMIN_TOKEN"];
+  if (typeof fromEnv === "string" && fromEnv !== "") {
+    return fromEnv;
+  }
+  try {
+    return parseDevVariable(readFileSync(join(root, ".dev.vars"), "utf8"), "LUNORA_ADMIN_TOKEN");
+  } catch {
+    return void 0;
+  }
+};
+
+export { parseDevVariable, resolveAdminToken };

package/dist/packem_shared/parseSchema-DSeyktvG.mjs

@@ -0,0 +1,107 @@
+import { Project, SyntaxKind } from 'ts-morph';
+
+const OPTIONAL_VALIDATOR_PATTERN = /^v\s*\.\s*optional\s*\(/u;
+const SHARD_BY_PATTERN = /\.shardBy\(\s*["']([^"']+)["']\s*\)/u;
+const GLOBAL_PATTERN = /\.global\(\s*\)/u;
+const QUOTE_PATTERN = /["']/gu;
+const collectCalls = (node) => {
+  const calls = node.getDescendantsOfKind(SyntaxKind.CallExpression);
+  if (node.getKind() === SyntaxKind.CallExpression) {
+    calls.push(node.asKindOrThrow(SyntaxKind.CallExpression));
+  }
+  return calls;
+};
+const isOptionalValidator = (validatorText) => OPTIONAL_VALIDATOR_PATTERN.test(validatorText.trim());
+const readStringArray = (node) => {
+  if (node?.getKind() !== SyntaxKind.ArrayLiteralExpression) {
+    return [];
+  }
+  return node.asKindOrThrow(SyntaxKind.ArrayLiteralExpression).getElements().filter((element) => element.getKind() === SyntaxKind.StringLiteral).map((element) => element.asKindOrThrow(SyntaxKind.StringLiteral).getLiteralText());
+};
+const readUnique = (node) => {
+  if (node?.getKind() !== SyntaxKind.ObjectLiteralExpression) {
+    return false;
+  }
+  const property = node.asKindOrThrow(SyntaxKind.ObjectLiteralExpression).getProperty("unique");
+  return property?.getKind() === SyntaxKind.PropertyAssignment && property.getInitializer()?.getText() === "true";
+};
+const parseIndexCall = (call) => {
+  const expression = call.getExpression();
+  if (expression.getKind() !== SyntaxKind.PropertyAccessExpression || expression.asKindOrThrow(SyntaxKind.PropertyAccessExpression).getName() !== "index") {
+    return void 0;
+  }
+  const [nameArgument, fieldsArgument, optionsArgument] = call.getArguments();
+  if (nameArgument?.getKind() !== SyntaxKind.StringLiteral) {
+    return void 0;
+  }
+  return {
+    fields: readStringArray(fieldsArgument),
+    name: nameArgument.asKindOrThrow(SyntaxKind.StringLiteral).getLiteralText(),
+    unique: readUnique(optionsArgument)
+  };
+};
+const parseIndexes = (initializer) => {
+  const initializerNode = initializer.getInitializer();
+  if (initializerNode === void 0) {
+    return [];
+  }
+  const indexes = [];
+  for (const call of collectCalls(initializerNode)) {
+    const index = parseIndexCall(call);
+    if (index !== void 0) {
+      indexes.push(index);
+    }
+  }
+  return indexes;
+};
+const parseColumns = (initializer) => {
+  const columns = [];
+  const defineTableCall = initializer.getInitializer()?.getDescendantsOfKind(SyntaxKind.CallExpression).find((call) => call.getExpression().getText() === "defineTable");
+  const tableShape = defineTableCall?.getArguments()[0];
+  if (tableShape?.getKind() !== SyntaxKind.ObjectLiteralExpression) {
+    return columns;
+  }
+  for (const property of tableShape.getProperties()) {
+    if (property.getKind() !== SyntaxKind.PropertyAssignment) {
+      continue;
+    }
+    const assignment = property;
+    const name = assignment.getName().replaceAll(QUOTE_PATTERN, "");
+    const validator = assignment.getInitializer()?.getText() ?? "";
+    columns.push({ name, optional: isOptionalValidator(validator), validator });
+  }
+  return columns;
+};
+const parseSchema = (source) => {
+  const project = new Project({ compilerOptions: { allowJs: true }, useInMemoryFileSystem: true });
+  const sourceFile = project.createSourceFile("schema.ts", source, { overwrite: true });
+  const defineSchemaCall = sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression).find((call) => call.getExpression().getText() === "defineSchema");
+  if (defineSchemaCall === void 0) {
+    const aliased = sourceFile.getImportDeclarations().some((declaration) => declaration.getNamedImports().some((named) => named.getName() === "defineSchema" && named.getAliasNode() !== void 0));
+    return { ok: false, reason: aliased ? "aliased-define-schema" : "no-define-schema" };
+  }
+  const tablesArgument = defineSchemaCall.getArguments()[0];
+  if (tablesArgument?.getKind() !== SyntaxKind.ObjectLiteralExpression) {
+    return { ok: false, reason: "non-object-argument" };
+  }
+  const tables = [];
+  for (const property of tablesArgument.getProperties()) {
+    if (property.getKind() !== SyntaxKind.PropertyAssignment) {
+      continue;
+    }
+    const assignment = property;
+    const name = assignment.getName().replaceAll(QUOTE_PATTERN, "");
+    const initializerText = assignment.getInitializer()?.getText() ?? "";
+    const shardMatch = SHARD_BY_PATTERN.exec(initializerText);
+    tables.push({
+      columns: parseColumns(assignment),
+      global: GLOBAL_PATTERN.test(initializerText),
+      indexes: parseIndexes(assignment),
+      name,
+      ...shardMatch?.[1] === void 0 ? {} : { shardBy: shardMatch[1] }
+    });
+  }
+  return { ok: true, tables };
+};
+
+export { collectCalls, parseSchema };

package/dist/packem_shared/policy-scaffold.d-DCmwn7zQ.d.mts

@@ -0,0 +1,74 @@
+/** Scaffold a new policy/role/permission stub file under `lunora/`. */
+interface ScaffoldPolicyEdit {
+  readonly kind: "scaffoldPolicy";
+  /**
+  * Base name for the generated file and its exported policy-set identifier,
+  * e.g. `invoices` → `lunora/invoices.policies.ts` exporting `invoicesPolicies`.
+  */
+  readonly name: string;
+  /** Logical table the scaffolded policy guards (used in the stub body). */
+  readonly table: string;
+}
+/** Append `.use(rls(<policies>))` to an existing procedure's builder chain. */
+interface WireRlsEdit {
+  /** Exported procedure name to wire, e.g. `listInvoices`. */
+  readonly exportName: string;
+  readonly kind: "wireRls";
+  /** Identifier of the policy set passed to `rls(...)`, e.g. `invoicesPolicies`. */
+  readonly policies: string;
+}
+/** Additive scaffolder edits — the only requests the scaffolder applies. */
+type AdditivePolicyEdit = ScaffoldPolicyEdit | WireRlsEdit;
+/**
+* Destructive scaffolder requests — never applied. Rewriting an existing `when`
+* body changes evaluation semantics silently, so it is refused (STOP condition
+* in plan 025); carried as data so the editor can describe the request.
+*/
+interface DestructivePolicyEdit {
+  readonly exportName?: string;
+  readonly kind: "rewritePolicyWhen";
+  readonly table?: string;
+}
+/** Any request the scaffolder can receive. */
+type PolicyEdit = AdditivePolicyEdit | DestructivePolicyEdit;
+/**
+* Classify a scaffolder request. Additive requests ({@link AdditivePolicyEdit})
+* apply directly; everything else (rewriting an existing predicate) changes
+* evaluation semantics and is destructive.
+*/
+declare const classifyPolicyEdit: (edit: PolicyEdit) => "additive" | "destructive";
+/** Failure reasons a scaffolder request can report. */
+type PolicyScaffoldFailureReason = "already-wired" | "destructive" | "invalid-identifier" | "unknown-procedure" | "unsupported-procedure-shape";
+/** Tagged result of generating a stub file. */
+type ScaffoldFileResult = {
+  fileName: string;
+  ok: true;
+  source: string;
+} | {
+  ok: false;
+  reason: PolicyScaffoldFailureReason;
+};
+/** Tagged result of wiring a procedure. */
+type WireResult = {
+  ok: false;
+  reason: PolicyScaffoldFailureReason;
+} | {
+  ok: true;
+  text: string;
+};
+/**
+* Generate the source of a new policy/role/permission stub file. The `when`
+* predicate is a `() => false` skeleton with a TODO — the scaffolder never
+* authors real logic, the developer fills it in. Pure (no I/O); the handler
+* writes the returned source and refuses to overwrite an existing file.
+*/
+declare const scaffoldPolicyFile: (edit: ScaffoldPolicyEdit) => ScaffoldFileResult;
+/**
+* Append `.use(rls(<policies>))` to a procedure's builder chain, preserving the
+* terminal `.query(handler)` (and its handler body) byte-for-byte. Only the
+* **builder** form can be wired; the bare-factory form (`query({ handler })`)
+* has no chain and is reported `unsupported-procedure-shape` so the editor can
+* tell the developer to convert it rather than silently rewriting their code.
+*/
+declare const wireRlsIntoProcedure: (source: string, edit: WireRlsEdit) => WireResult;
+export { AdditivePolicyEdit as A, DestructivePolicyEdit as D, PolicyEdit as P, ScaffoldPolicyEdit as S, WireRlsEdit as W, PolicyScaffoldFailureReason as a, ScaffoldFileResult as b, WireResult as c, classifyPolicyEdit as d, scaffoldPolicyFile as s, wireRlsIntoProcedure as w };