@lunora/config 1.0.0-alpha.9 → 1.0.0-alpha.91

package/dist/packem_shared/SEED_ENDPOINT-DVCjaGO-.mjs

@@ -1,61 +0,0 @@
-import { existsSync } from 'node:fs';
-import { discoverSchema, schemaFromIr } from '@lunora/codegen';
-import { seedPlan } from '@lunora/seed';
-import { Project } from 'ts-morph';
-import { join } from 'node:path';
-
-const SEED_ENDPOINT = "/__lunora/seed";
-const MAX_SEED_ROWS = 1e3;
-const jsonReplacer = (_key, value) => {
-  if (typeof value === "bigint") {
-    return Number(value);
-  }
-  if (value instanceof ArrayBuffer) {
-    return [...new Uint8Array(value)];
-  }
-  return value;
-};
-const clampCount = (count) => {
-  if (typeof count !== "number" || !Number.isFinite(count)) {
-    return 10;
-  }
-  return Math.min(Math.max(1, Math.floor(count)), MAX_SEED_ROWS);
-};
-const handleSeedRequest = (request) => {
-  if (request.method !== "POST") {
-    return { body: { error: "method-not-allowed", ok: false }, status: 405 };
-  }
-  const { body } = request;
-  if (body === void 0 || typeof body !== "object") {
-    return { body: { error: "invalid-request", ok: false }, status: 400 };
-  }
-  const { count, existingIds, seed, table } = body;
-  if (typeof table !== "string" || table.length === 0) {
-    return { body: { error: "missing-table", ok: false }, status: 400 };
-  }
-  const lunoraDirectory = request.schemaDirectory ?? "lunora";
-  const schemaPath = join(request.projectRoot, lunoraDirectory, "schema.ts");
-  if (!existsSync(schemaPath)) {
-    return { body: { error: "schema-not-found", ok: false }, status: 404 };
-  }
-  const project = new Project({ skipAddingFilesFromTsConfig: true });
-  const ir = discoverSchema(project, schemaPath);
-  if (!ir.tables.some((candidate) => candidate.name === table)) {
-    return { body: { error: "unknown-table", ok: false, table }, status: 404 };
-  }
-  const schema = schemaFromIr(ir);
-  const plan = seedPlan(schema, {
-    // Pass every sampled parent table as `existingIds` so the generator links
-    // to live rows and never fabricates parents — matching the studio's
-    // "existing rows are not affected, FKs point at what's there" semantics.
-    existingIds: existingIds ?? {},
-    defaultCount: clampCount(count),
-    only: [table],
-    seed: seed ?? 0
-  });
-  const rows = plan.find((entry) => entry.table === table)?.rows ?? [];
-  const jsonSafeRows = JSON.parse(JSON.stringify(rows, jsonReplacer));
-  return { body: { ok: true, rows: jsonSafeRows }, status: 200 };
-};
-
-export { SEED_ENDPOINT, handleSeedRequest };

package/dist/packem_shared/WRANGLER_FILES-DwSuC-Kn.mjs

@@ -1,25 +0,0 @@
-import { existsSync, readFileSync } from 'node:fs';
-import { parse } from 'jsonc-parser';
-import { join } from 'node:path';
-
-const WRANGLER_FILES = ["wrangler.jsonc", "wrangler.json"];
-const findWranglerFile = (projectRoot) => {
-  for (const candidate of WRANGLER_FILES) {
-    const fullPath = join(projectRoot, candidate);
-    if (existsSync(fullPath)) {
-      return fullPath;
-    }
-  }
-  return void 0;
-};
-const readWranglerJsonc = (wranglerPath) => {
-  const text = readFileSync(wranglerPath, "utf8");
-  const parseErrors = [];
-  const value = parse(text, parseErrors, { allowTrailingComma: true });
-  if (parseErrors.length > 0 || value === null || typeof value !== "object") {
-    return { parsed: void 0, text };
-  }
-  return { parsed: value, text };
-};
-
-export { WRANGLER_FILES, findWranglerFile, readWranglerJsonc };

package/dist/packem_shared/applyAdditiveEdit-C-snTFEV.mjs

@@ -1,228 +0,0 @@
-import { Project, SyntaxKind } from 'ts-morph';
-import { collectCalls } from './parseSchema-DSeyktvG.mjs';
-
-const IDENTIFIER_PATTERN = /^[A-Za-z_$][\w$]*$/u;
-const VALIDATOR_METHODS = /* @__PURE__ */ new Set([
-  "any",
-  "array",
-  "bigint",
-  "boolean",
-  "bytes",
-  "date",
-  "id",
-  "literal",
-  "null",
-  "number",
-  "object",
-  "optional",
-  "record",
-  "storage",
-  "string",
-  "timestamp",
-  "union"
-]);
-const isValidatorExpression = (node) => {
-  if (node.getKind() === SyntaxKind.ParenthesizedExpression) {
-    return isValidatorExpression(node.asKindOrThrow(SyntaxKind.ParenthesizedExpression).getExpression());
-  }
-  if (node.getKind() !== SyntaxKind.CallExpression) {
-    return false;
-  }
-  const call = node.asKindOrThrow(SyntaxKind.CallExpression);
-  const callee = call.getExpression();
-  if (callee.getKind() !== SyntaxKind.PropertyAccessExpression) {
-    return false;
-  }
-  const access = callee.asKindOrThrow(SyntaxKind.PropertyAccessExpression);
-  if (access.getExpression().getKind() !== SyntaxKind.Identifier || access.getExpression().getText() !== "v" || !VALIDATOR_METHODS.has(access.getName())) {
-    return false;
-  }
-  return call.getArguments().every((argument) => isValidatorArgument(argument));
-};
-const isValidatorArgument = (node) => {
-  const kind = node.getKind();
-  if (kind === SyntaxKind.ParenthesizedExpression) {
-    return isValidatorArgument(node.asKindOrThrow(SyntaxKind.ParenthesizedExpression).getExpression());
-  }
-  if (kind === SyntaxKind.StringLiteral || kind === SyntaxKind.NumericLiteral || kind === SyntaxKind.TrueKeyword || kind === SyntaxKind.FalseKeyword || kind === SyntaxKind.NullKeyword) {
-    return true;
-  }
-  if (kind === SyntaxKind.PrefixUnaryExpression) {
-    const unary = node.asKindOrThrow(SyntaxKind.PrefixUnaryExpression);
-    return unary.getOperand().getKind() === SyntaxKind.NumericLiteral;
-  }
-  if (kind === SyntaxKind.ObjectLiteralExpression) {
-    return node.asKindOrThrow(SyntaxKind.ObjectLiteralExpression).getProperties().every((property) => {
-      if (property.getKind() !== SyntaxKind.PropertyAssignment) {
-        return false;
-      }
-      const initializer = property.getInitializer();
-      return initializer !== void 0 && isValidatorArgument(initializer);
-    });
-  }
-  if (kind === SyntaxKind.ArrayLiteralExpression) {
-    return node.asKindOrThrow(SyntaxKind.ArrayLiteralExpression).getElements().every((element) => isValidatorArgument(element));
-  }
-  return isValidatorExpression(node);
-};
-const isAllowedValidatorText = (validator) => {
-  if (typeof validator !== "string" || validator.trim().length === 0) {
-    return false;
-  }
-  const project = new Project({ compilerOptions: { allowJs: true }, useInMemoryFileSystem: true });
-  const sourceFile = project.createSourceFile("validator.ts", `const __v = (${validator});`, { overwrite: true });
-  if (project.getProgram().getSyntacticDiagnostics(sourceFile).length > 0) {
-    return false;
-  }
-  if (sourceFile.getStatements().length !== 1) {
-    return false;
-  }
-  const declaration = sourceFile.getVariableDeclaration("__v");
-  const initializer = declaration?.getInitializer();
-  return initializer !== void 0 && isValidatorExpression(initializer);
-};
-const ADDITIVE_KINDS = /* @__PURE__ */ new Set(["addIndex", "addOptionalColumn", "addTable"]);
-const classifyEdit = (edit) => ADDITIVE_KINDS.has(edit.kind) ? "additive" : "destructive";
-const isIdentifier = (value) => typeof value === "string" && IDENTIFIER_PATTERN.test(value);
-const validateAdditiveEdit = (edit) => {
-  if (!isIdentifier(edit.table)) {
-    return "invalid-identifier";
-  }
-  if (edit.kind === "addOptionalColumn") {
-    if (!isIdentifier(edit.column)) {
-      return "invalid-identifier";
-    }
-    if (!isAllowedValidatorText(edit.validator)) {
-      return "invalid-validator";
-    }
-  }
-  if (edit.kind === "addIndex") {
-    if (!isIdentifier(edit.name)) {
-      return "invalid-identifier";
-    }
-    if (!Array.isArray(edit.fields) || !edit.fields.every((field) => isIdentifier(field))) {
-      return "invalid-identifier";
-    }
-  }
-  return void 0;
-};
-const findTablesObject = (source) => {
-  const project = new Project({ compilerOptions: { allowJs: true }, useInMemoryFileSystem: true });
-  const sourceFile = project.createSourceFile("schema.ts", source, { overwrite: true });
-  let defineSchemaCall;
-  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
-    if (call.getExpression().getText() === "defineSchema") {
-      defineSchemaCall = call;
-      break;
-    }
-  }
-  if (defineSchemaCall === void 0) {
-    const aliased = sourceFile.getImportDeclarations().some((declaration) => declaration.getNamedImports().some((named) => named.getName() === "defineSchema" && named.getAliasNode() !== void 0));
-    return { reason: aliased ? "aliased-define-schema" : "no-define-schema" };
-  }
-  const tablesArgument = defineSchemaCall.getArguments()[0];
-  if (tablesArgument?.getKind() !== SyntaxKind.ObjectLiteralExpression) {
-    return { reason: "non-object-argument" };
-  }
-  return { object: tablesArgument.asKindOrThrow(SyntaxKind.ObjectLiteralExpression), sourceFile };
-};
-const findTableProperty = (tablesObject, table) => {
-  for (const property of tablesObject.getProperties()) {
-    if (property.getKind() === SyntaxKind.PropertyAssignment && property.getNameNode().getText().replaceAll(/["']/gu, "") === table) {
-      return property;
-    }
-  }
-  return void 0;
-};
-const findDefineTableShape = (tableProperty) => {
-  const defineTableCall = tableProperty.getInitializer()?.getDescendantsOfKind(SyntaxKind.CallExpression).find((call) => call.getExpression().getText() === "defineTable");
-  const shape = defineTableCall?.getArguments()[0];
-  return shape?.getKind() === SyntaxKind.ObjectLiteralExpression ? shape.asKindOrThrow(SyntaxKind.ObjectLiteralExpression) : void 0;
-};
-const applyAddTable = (tablesObject, edit) => {
-  if (findTableProperty(tablesObject, edit.table) !== void 0) {
-    return "duplicate-table";
-  }
-  tablesObject.addPropertyAssignment({
-    initializer: `defineTable({
-        // Add your column validators here.
-        // Example:
-        // text: v.string(),
-        // createdAt: v.number(),
-    })`,
-    name: edit.table
-  });
-  return void 0;
-};
-const applyAddOptionalColumn = (tablesObject, edit) => {
-  const tableProperty = findTableProperty(tablesObject, edit.table);
-  if (tableProperty === void 0) {
-    return "unknown-table";
-  }
-  const shape = findDefineTableShape(tableProperty);
-  if (shape === void 0) {
-    return "unknown-table";
-  }
-  const exists = shape.getProperties().some(
-    (property) => property.getKind() === SyntaxKind.PropertyAssignment && property.getNameNode().getText().replaceAll(/["']/gu, "") === edit.column
-  );
-  if (exists) {
-    return "duplicate-column";
-  }
-  shape.addPropertyAssignment({ initializer: `v.optional(${edit.validator})`, name: edit.column });
-  return void 0;
-};
-const applyAddIndex = (tableProperty, edit) => {
-  if (tableProperty === void 0) {
-    return "unknown-table";
-  }
-  const initializer = tableProperty.getInitializer();
-  if (initializer === void 0) {
-    return "unknown-table";
-  }
-  const duplicate = collectCalls(initializer).some((call) => {
-    const expression = call.getExpression();
-    if (expression.getKind() !== SyntaxKind.PropertyAccessExpression) {
-      return false;
-    }
-    const access = expression.asKindOrThrow(SyntaxKind.PropertyAccessExpression);
-    const [nameArgument] = call.getArguments();
-    return access.getName() === "index" && nameArgument?.getKind() === SyntaxKind.StringLiteral && nameArgument.asKindOrThrow(SyntaxKind.StringLiteral).getLiteralText() === edit.name;
-  });
-  if (duplicate) {
-    return "duplicate-index";
-  }
-  const fields = edit.fields.map((field) => JSON.stringify(field)).join(", ");
-  const options = edit.unique === true ? ", { unique: true }" : "";
-  tableProperty.setInitializer(`${initializer.getText()}.index(${JSON.stringify(edit.name)}, [${fields}]${options})`);
-  return void 0;
-};
-const applyAdditiveEdit = (source, edit) => {
-  if (classifyEdit(edit) === "destructive") {
-    return { ok: false, reason: "destructive" };
-  }
-  const additive = edit;
-  const invalid = validateAdditiveEdit(additive);
-  if (invalid !== void 0) {
-    return { ok: false, reason: invalid };
-  }
-  const located = findTablesObject(source);
-  if ("reason" in located) {
-    return { ok: false, reason: located.reason };
-  }
-  const { object: tablesObject, sourceFile } = located;
-  let failure;
-  if (additive.kind === "addTable") {
-    failure = applyAddTable(tablesObject, additive);
-  } else if (additive.kind === "addOptionalColumn") {
-    failure = applyAddOptionalColumn(tablesObject, additive);
-  } else {
-    failure = applyAddIndex(findTableProperty(tablesObject, additive.table), additive);
-  }
-  if (failure !== void 0) {
-    return { ok: false, reason: failure };
-  }
-  return { ok: true, text: sourceFile.getFullText() };
-};
-
-export { applyAdditiveEdit, classifyEdit };

package/dist/packem_shared/buildPackageSecretsBlock-S74dgmwy.mjs

@@ -1,187 +0,0 @@
-import { randomBytes } from 'node:crypto';
-import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'node:fs';
-import { join } from 'node:path';
-import { DEV_VARS_FILE, DEV_VARS_EXAMPLE_FILE, parseDevVariableEntries, DEV_VARS_NEWLINE, splitDevVariableLine, unquoteDevVariable } from './DEV_VARS_EXAMPLE_FILE-dJPNTEnK.mjs';
-import { secretsForPackages } from './PACKAGE_SECRETS_REGISTRY-CySy5vR_.mjs';
-
-const SECRET_BYTES = 32;
-const SECRET_KEY = /(?:KEY|PASSWORD|SECRET|TOKEN)$/u;
-const PLACEHOLDER_MARKERS = [
-  "replace",
-  "openssl",
-  "changeme",
-  "change-me",
-  "change_me",
-  "change-this",
-  "change_this",
-  "your-",
-  "your_",
-  "example",
-  "placeholder",
-  "todo",
-  "fill-me",
-  "fill_me",
-  "fill-in",
-  "fill_in",
-  "xxx"
-];
-const REGEXP_SPECIAL_CHARS = /[.*+?^${}()|[\]\\]/gu;
-const MARKER_ENDS_ALPHANUMERIC = /[a-z0-9]$/u;
-const isPlaceholderValue = (value) => {
-  const normalised = value.trim().toLowerCase();
-  if (normalised === "") {
-    return true;
-  }
-  if (normalised.startsWith("<") && normalised.endsWith(">")) {
-    return true;
-  }
-  return PLACEHOLDER_MARKERS.some((marker) => {
-    const escaped = marker.replaceAll(REGEXP_SPECIAL_CHARS, String.raw`\$&`);
-    const needsTrailingBoundary = MARKER_ENDS_ALPHANUMERIC.test(marker);
-    const pattern = needsTrailingBoundary ? `(^|[^a-z0-9])${escaped}([^a-z0-9]|$)` : `(^|[^a-z0-9])${escaped}`;
-    return new RegExp(pattern, "u").test(normalised);
-  });
-};
-const isPlaceholder = (rawValue) => isPlaceholderValue(unquoteDevVariable(rawValue.trim()));
-const defaultRandomHex = (bytes) => randomBytes(bytes).toString("hex");
-const generatedSecretFor = (key, rawValue, randomHex) => SECRET_KEY.test(key) && isPlaceholder(rawValue) ? randomHex(SECRET_BYTES) : void 0;
-const planDevVariablesScaffold = (input) => {
-  if (input.devVarsExists) {
-    return { status: "exists" };
-  }
-  if (input.exampleContent === void 0) {
-    return { status: "no-example" };
-  }
-  const randomHex = input.randomHex ?? defaultRandomHex;
-  const generatedKeys = [];
-  const lines = input.exampleContent.split(DEV_VARS_NEWLINE).map((line) => {
-    const parsed = splitDevVariableLine(line);
-    const secret = parsed ? generatedSecretFor(parsed.key, parsed.value, randomHex) : void 0;
-    if (!parsed || secret === void 0) {
-      return line;
-    }
-    generatedKeys.push(parsed.key);
-    return `${parsed.key}="${secret}"`;
-  });
-  return { content: lines.join("\n"), generatedKeys, status: "generate" };
-};
-const planDevVariablesAugment = (input) => {
-  const randomHex = input.randomHex ?? defaultRandomHex;
-  const present = new Set(parseDevVariableEntries(input.existingContent).map((entry) => entry.key));
-  const additions = [];
-  const generatedKeys = [];
-  const missingKeys = [];
-  for (const line of input.exampleContent.split(DEV_VARS_NEWLINE)) {
-    const parsed = splitDevVariableLine(line);
-    if (!parsed || present.has(parsed.key)) {
-      continue;
-    }
-    const secret = generatedSecretFor(parsed.key, parsed.value, randomHex);
-    missingKeys.push(parsed.key);
-    if (secret === void 0) {
-      additions.push(`${parsed.key}="${unquoteDevVariable(parsed.value)}"`);
-    } else {
-      generatedKeys.push(parsed.key);
-      additions.push(`${parsed.key}="${secret}"`);
-    }
-  }
-  return { additions, generatedKeys, missingKeys };
-};
-const generatedSuffix = (keys) => keys.length > 0 ? ` (generated ${keys.join(", ")})` : "";
-const atomicCreateDevVariables = (path, content) => {
-  const temporaryPath = `${path}.tmp-${String(process.pid)}`;
-  try {
-    writeFileSync(temporaryPath, content, { encoding: "utf8", flag: "wx", mode: 384 });
-    renameSync(temporaryPath, path);
-  } catch (error) {
-    rmSync(temporaryPath, { force: true });
-    throw error;
-  }
-};
-const appendDevVariables = (path, additions) => {
-  const existing = readFileSync(path, "utf8");
-  const separator = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
-  const content = `${existing}${separator}${additions.join("\n")}
-`;
-  const temporaryPath = `${path}.tmp-${String(process.pid)}`;
-  try {
-    writeFileSync(temporaryPath, content, { encoding: "utf8", mode: 384 });
-    renameSync(temporaryPath, path);
-  } catch (error) {
-    rmSync(temporaryPath, { force: true });
-    throw error;
-  }
-};
-const ensureDevVariables = async (deps) => {
-  const devVariablesPath = join(deps.cwd, DEV_VARS_FILE);
-  const examplePath = join(deps.cwd, DEV_VARS_EXAMPLE_FILE);
-  if (!existsSync(examplePath)) {
-    return { addedKeys: [], generatedKeys: [], status: "no-example" };
-  }
-  const exampleContent = readFileSync(examplePath, "utf8");
-  if (!existsSync(devVariablesPath)) {
-    const plan = planDevVariablesScaffold({ devVarsExists: false, exampleContent, randomHex: deps.randomHex });
-    if (plan.status !== "generate") {
-      return { addedKeys: [], generatedKeys: [], status: "no-example" };
-    }
-    const proceed2 = deps.yes === true || await deps.confirm(`No ${DEV_VARS_FILE} found. Generate it from ${DEV_VARS_EXAMPLE_FILE} (secrets auto-filled)?`);
-    if (!proceed2) {
-      deps.info(`Skipped — copy ${DEV_VARS_EXAMPLE_FILE} to ${DEV_VARS_FILE} and fill it in when you're ready.`);
-      return { addedKeys: [], generatedKeys: [], status: "declined" };
-    }
-    if (existsSync(devVariablesPath)) {
-      return { addedKeys: [], generatedKeys: [], status: "skipped-exists" };
-    }
-    atomicCreateDevVariables(devVariablesPath, plan.content);
-    deps.info(`Created ${DEV_VARS_FILE}${generatedSuffix(plan.generatedKeys)}.`);
-    return { addedKeys: [], generatedKeys: plan.generatedKeys, status: "generated" };
-  }
-  const augment = planDevVariablesAugment({ existingContent: readFileSync(devVariablesPath, "utf8"), exampleContent, randomHex: deps.randomHex });
-  if (augment.missingKeys.length === 0) {
-    return { addedKeys: [], generatedKeys: [], status: "exists" };
-  }
-  const list = augment.missingKeys.join(", ");
-  const proceed = deps.yes === true || await deps.confirm(`${DEV_VARS_FILE} is missing ${String(augment.missingKeys.length)} key(s) from ${DEV_VARS_EXAMPLE_FILE} (${list}). Add them?`);
-  if (!proceed) {
-    deps.info(`Skipped — add ${list} to ${DEV_VARS_FILE} when you're ready.`);
-    return { addedKeys: [], generatedKeys: [], status: "declined" };
-  }
-  appendDevVariables(devVariablesPath, augment.additions);
-  deps.info(`Updated ${DEV_VARS_FILE} — added ${list}${generatedSuffix(augment.generatedKeys)}.`);
-  return { addedKeys: augment.missingKeys, generatedKeys: augment.generatedKeys, status: "augmented" };
-};
-const secretEntryBlock = (entry) => {
-  const lines = [`# ${entry.description}`, `# Docs: ${entry.docsUrl}`, `${entry.key}="${entry.placeholderValue}"`];
-  return lines.join("\n");
-};
-const buildPackageSecretsBlock = (packageNames, existingKeys) => {
-  const entries = secretsForPackages(packageNames).filter((entry) => !existingKeys.has(entry.key));
-  if (entries.length === 0) {
-    return "";
-  }
-  return entries.map((entry) => secretEntryBlock(entry)).join("\n\n");
-};
-const ensureDevVariablesExample = (cwd, packageNames) => {
-  const examplePath = join(cwd, DEV_VARS_EXAMPLE_FILE);
-  const existing = existsSync(examplePath) ? readFileSync(examplePath, "utf8") : "";
-  const existingKeys = new Set(parseDevVariableEntries(existing).map((entry) => entry.key));
-  const block = buildPackageSecretsBlock(packageNames, existingKeys);
-  if (block === "") {
-    return [];
-  }
-  const separator = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
-  const newContent = `${existing}${separator}
-${block}
-`;
-  const temporaryPath = `${examplePath}.tmp-${String(process.pid)}`;
-  try {
-    writeFileSync(temporaryPath, newContent, { encoding: "utf8" });
-    renameSync(temporaryPath, examplePath);
-  } catch (error) {
-    rmSync(temporaryPath, { force: true });
-    throw error;
-  }
-  return secretsForPackages(packageNames).filter((entry) => !existingKeys.has(entry.key)).map((entry) => entry.key);
-};
-
-export { buildPackageSecretsBlock, ensureDevVariables, ensureDevVariablesExample as ensureDevVarsExample, isPlaceholderValue, planDevVariablesAugment, planDevVariablesScaffold };

package/dist/packem_shared/classifyPolicyEdit-BHeAqF8P.mjs

@@ -1,99 +0,0 @@
-import { Project, SyntaxKind } from 'ts-morph';
-
-const TERMINAL_METHODS = /* @__PURE__ */ new Set(["action", "mutation", "query", "stream"]);
-const IDENTIFIER_PATTERN = /^[A-Za-z_$][\w$]*$/u;
-const ADDITIVE_KINDS = /* @__PURE__ */ new Set(["scaffoldPolicy", "wireRls"]);
-const classifyPolicyEdit = (edit) => ADDITIVE_KINDS.has(edit.kind) ? "additive" : "destructive";
-const scaffoldPolicyFile = (edit) => {
-  if (typeof edit.name !== "string" || typeof edit.table !== "string" || !IDENTIFIER_PATTERN.test(edit.name) || !IDENTIFIER_PATTERN.test(edit.table)) {
-    return { ok: false, reason: "invalid-identifier" };
-  }
-  const policiesIdentifier = `${edit.name}Policies`;
-  const rolesIdentifier = `${edit.name}Roles`;
-  const table = JSON.stringify(edit.table);
-  const source = `import { definePermission, definePolicies, definePolicy, defineRole } from "@lunora/server";
-
-/**
- * Access rules for the ${edit.table} table — scaffolded by the Lunora studio
- * (plan 025). The \`when\` predicates below DENY by default (\`() => false\`);
- * replace each TODO with the real condition, then wire \`${policiesIdentifier}\`
- * into the procedures that read/write ${edit.table} via
- * \`.use(rls(${policiesIdentifier}, { roles: ${rolesIdentifier} }))\`.
- */
-export const ${policiesIdentifier} = definePolicies([
-    definePolicy({
-        on: "read",
-        table: ${table},
-        // TODO: return \`true\` to allow, a \`WhereInput\` to filter, or \`false\` to deny.
-        when: () => false,
-    }),
-]);
-
-/** Named permissions \`${policiesIdentifier}\` can check with \`ctx.auth.can(...)\`. */
-export const ${edit.name}View = definePermission("${edit.name}:view");
-
-/** Roles that grant the permissions above; register via \`rls(policies, { roles })\`. */
-export const ${rolesIdentifier} = [defineRole("${edit.name}-admin", { permissions: [${edit.name}View] })];
-`;
-  return { fileName: `${edit.name}.policies.ts`, ok: true, source };
-};
-const builderReceiver = (initializer) => {
-  const callee = initializer.getExpression();
-  if (callee.getKind() !== SyntaxKind.PropertyAccessExpression) {
-    return void 0;
-  }
-  const access = callee.asKindOrThrow(SyntaxKind.PropertyAccessExpression);
-  return TERMINAL_METHODS.has(access.getName()) ? access.getExpression() : void 0;
-};
-const ensureRlsImport = (sourceFile) => {
-  const serverImport = sourceFile.getImportDeclaration((declaration) => declaration.getModuleSpecifierValue() === "@lunora/server");
-  if (serverImport === void 0) {
-    sourceFile.addImportDeclaration({ moduleSpecifier: "@lunora/server", namedImports: ["rls"] });
-    return;
-  }
-  if (!serverImport.getNamedImports().some((named) => named.getName() === "rls")) {
-    serverImport.addNamedImport("rls");
-  }
-};
-const chainHasRls = (receiver) => {
-  const calls = receiver.getDescendantsOfKind(SyntaxKind.CallExpression);
-  if (receiver.getKind() === SyntaxKind.CallExpression) {
-    calls.push(receiver.asKindOrThrow(SyntaxKind.CallExpression));
-  }
-  for (const call of calls) {
-    const callee = call.getExpression();
-    if (callee.getKind() !== SyntaxKind.PropertyAccessExpression) {
-      continue;
-    }
-    const access = callee.asKindOrThrow(SyntaxKind.PropertyAccessExpression);
-    const [argument] = call.getArguments();
-    if (access.getName() === "use" && argument?.getKind() === SyntaxKind.CallExpression && argument.asKindOrThrow(SyntaxKind.CallExpression).getExpression().getText() === "rls") {
-      return true;
-    }
-  }
-  return false;
-};
-const wireRlsIntoProcedure = (source, edit) => {
-  if (typeof edit.policies !== "string" || !IDENTIFIER_PATTERN.test(edit.policies)) {
-    return { ok: false, reason: "invalid-identifier" };
-  }
-  const project = new Project({ compilerOptions: { allowJs: true }, useInMemoryFileSystem: true });
-  const sourceFile = project.createSourceFile("procedure.ts", source, { overwrite: true });
-  const declaration = sourceFile.getVariableDeclaration(edit.exportName);
-  const initializer = declaration?.getInitializer();
-  if (declaration === void 0 || initializer?.getKind() !== SyntaxKind.CallExpression) {
-    return { ok: false, reason: "unknown-procedure" };
-  }
-  const receiver = builderReceiver(initializer.asKindOrThrow(SyntaxKind.CallExpression));
-  if (receiver === void 0) {
-    return { ok: false, reason: "unsupported-procedure-shape" };
-  }
-  if (chainHasRls(receiver)) {
-    return { ok: false, reason: "already-wired" };
-  }
-  receiver.replaceWithText(`${receiver.getText()}.use(rls(${edit.policies}))`);
-  ensureRlsImport(sourceFile);
-  return { ok: true, text: sourceFile.getFullText() };
-};
-
-export { classifyPolicyEdit, scaffoldPolicyFile, wireRlsIntoProcedure };