@typerion/cli 0.1.0 → 0.1.1

package/index.cjs

@@ -5848,1794 +5848,6 @@ var require_checker = __commonJS({
   }
 });
 
-// ../typechecker/dist/error-codes.js
-var require_error_codes = __commonJS({
-  "../typechecker/dist/error-codes.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.ERROR_CODES = void 0;
-    exports2.getErrorCode = getErrorCode;
-    exports2.explainErrorCode = explainErrorCode;
-    exports2.listErrorCodes = listErrorCodes;
-    exports2.ERROR_CODES = {
-      // ─── E1xx: Structural Errors ──────────────────────────────────
-      E100: {
-        code: "E100",
-        severity: "error",
-        title: "Circular entity dependency",
-        description: "Two or more entities reference each other in a cycle via direct field types (not relations). This causes infinite recursion in ORM hydration and JSON serialization.",
-        howToFix: "Make one side of the relationship optional, use a reference ID instead, or convert to a RelationType.",
-        overridable: false
-      },
-      // ─── E2xx: Model Completeness Errors ──────────────────────────
-      E200: {
-        code: "E200",
-        severity: "error",
-        title: "PII field without encryption",
-        description: "A field marked @pii has no @encrypt decorator. GDPR Art.32 and most data protection regulations require encryption of personal data at rest.",
-        howToFix: 'Add @encrypt to the field, or explicitly override with @override(rule: "E200", justification: "...").',
-        overridable: true
-      },
-      E201: {
-        code: "E201",
-        severity: "error",
-        title: "Entity exposed via API without policy",
-        description: "An entity is referenced by one or more API declarations but has no corresponding policy declaration. Without access control, all fields are accessible to all callers.",
-        howToFix: "Add a policy declaration for this entity, e.g.: policy EntityName { read: admin | user }.",
-        overridable: true
-      },
-      E202: {
-        code: "E202",
-        severity: "error",
-        title: "Compliance decorator without policy",
-        description: "An entity has a compliance decorator (@gdpr, @hipaa, @soc2, @pci) but no policy declaration. Compliance frameworks require explicit access control definitions.",
-        howToFix: "Add a policy declaration for this entity.",
-        overridable: true
-      },
-      E203: {
-        code: "E203",
-        severity: "error",
-        title: "Sensitive field exposed in API response",
-        description: "A field marked @sensitive, @secret, or @private is part of an entity returned by an API that has no field-level policy restricting access to this field.",
-        howToFix: "Add a field-level policy to restrict access, or add @mask/@private to exclude from API responses.",
-        overridable: true
-      },
-      E204: {
-        code: "E204",
-        severity: "error",
-        title: "Expired override",
-        description: 'An @override decorator has an "until" date that has passed. The suppressed rule is now active again.',
-        howToFix: "Remove the @override decorator and fix the underlying issue, or extend the deadline.",
-        overridable: false
-      },
-      E205: {
-        code: "E205",
-        severity: "error",
-        title: "Entity with API lacks runtime enforcement binding",
-        description: "An entity is exposed via API and has a policy, but will not generate a runtime enforcement binding (EntityOps). Without EntityOps, policy checks and data protection can be bypassed at runtime.",
-        howToFix: "Ensure the entity has both a policy declaration and protected fields, or add @enforce decorator.",
-        overridable: true
-      },
-      E206: {
-        code: "E206",
-        severity: "error",
-        title: "Entity with PII/encrypted fields returns unsealed data",
-        description: "An entity has fields decorated with @pii or @encrypt but its EntityOps is configured with sealed: false. Without sealing, returned objects are plain JS \u2014 direct property access bypasses masking and encryption at runtime.",
-        howToFix: "Remove 'sealed: false' from the EntityOps config, or ensure all access goes through the enforcement API.",
-        overridable: true
-      },
-      E207: {
-        code: "E207",
-        severity: "error",
-        title: "Federated service has schema hash mismatch",
-        description: "A downstream service received an enforcement context token whose schema hash does not match the local schema. This means the services may have incompatible entity definitions, risking field-level enforcement bypass.",
-        howToFix: "Redeploy services with a consistent schema, or set onSchemaMismatch to 'warn' during rolling deployments.",
-        overridable: true
-      },
-      // ─── E3xx: Decorator Errors ───────────────────────────────────
-      E300: {
-        code: "E300",
-        severity: "error",
-        title: "Unknown decorator (strict mode)",
-        description: "A decorator was used that is not in the known decorator registry. In strict mode, all decorators must be recognized.",
-        howToFix: "Check the decorator name for typos, or register a custom decorator via the plugin system.",
-        overridable: true
-      },
-      E301: {
-        code: "E301",
-        severity: "error",
-        title: "Decorator type mismatch",
-        description: "A decorator was applied to a field type that it does not support. For example, @currency requires a Money type, @precision requires a numeric type.",
-        howToFix: "Change the field type to match the decorator's requirements.",
-        overridable: false
-      },
-      // ─── E4xx: Policy / Security Errors ───────────────────────────
-      E400: {
-        code: "E400",
-        severity: "error",
-        title: "Auth decorator without policy",
-        description: "An API has an @auth decorator but the entity it returns has no policy declaration. This creates a false sense of security \u2014 auth is checked but no field-level access control exists.",
-        howToFix: "Add a policy declaration for the returned entity.",
-        overridable: true
-      },
-      // ─── E7xx: Test Quality Errors ─────────────────────────────────
-      E700: {
-        code: "E700",
-        severity: "error",
-        title: "'any' type in test file",
-        description: "A test file (.test.typerion or .spec.typerion) uses the 'any' type. Tests should be at least as type-strict as production code \u2014 untyped test data silently drifts when entities evolve.",
-        howToFix: "Replace 'any' with the concrete entity type or use a typed test factory (e.g. buildUser()).",
-        overridable: true
-      },
-      // ─── E8xx: Connector Binding Errors ────────────────────────────
-      E800: {
-        code: "E800",
-        severity: "error",
-        title: "Unknown domain in @use",
-        description: "The @use decorator references a domain name that is not in the standard registry. Valid domains are: payments, identity, communication, storage, ai.",
-        howToFix: 'Use a known domain name: @use("payments"), @use("identity"), @use("communication"), @use("storage"), or @use("ai").',
-        overridable: false
-      },
-      E801: {
-        code: "E801",
-        severity: "error",
-        title: "@use without provider binding",
-        description: "An entity uses @use to declare a domain dependency, but no provider is configured for that domain in typerion.config.json. Without a provider binding, codegen cannot generate the adapter service.",
-        howToFix: 'Add a connector binding in typerion.config.json: { "connectors": { "payments": { "provider": "stripe" } } }, or run: typerion add stripe',
-        overridable: false
-      },
-      // ─── W2xx: Cross-target Compatibility Warnings ────────────────
-      W201: {
-        code: "W201",
-        severity: "warning",
-        title: "Nested arrays (SQL-unfriendly)",
-        description: "SQL databases have no native nested array support; this will be serialized as JSON. ORMs may not be able to query into nested array elements.",
-        howToFix: "Consider flattening to a separate entity with a foreign key.",
-        overridable: true
-      },
-      W202: {
-        code: "W202",
-        severity: "warning",
-        title: "Non-literal union type",
-        description: "SQL maps this to TEXT/JSON (no type safety). Go maps to interface{} (no type safety). Protobuf has no union support (maps to bytes).",
-        howToFix: "Consider using an enum or discriminated type.",
-        overridable: true
-      },
-      W203: {
-        code: "W203",
-        severity: "warning",
-        title: "Intersection type (cross-target risk)",
-        description: "Most target languages (Go, Rust, SQL, Protobuf) cannot represent intersections natively. This will fall back to a generic/opaque type.",
-        howToFix: "Consider merging into a single entity or type.",
-        overridable: true
-      },
-      W204: {
-        code: "W204",
-        severity: "warning",
-        title: "Tuple type (limited support)",
-        description: "SQL, Go, and Protobuf have no native tuple support. This will be serialized as JSON array in SQL, fixed-size array in Go.",
-        howToFix: "Consider using a named entity with explicit fields.",
-        overridable: true
-      },
-      W205: {
-        code: "W205",
-        severity: "warning",
-        title: "Dynamic type (safety bypass)",
-        description: "This bypasses type safety in all targets (any/interface{}/serde_json::Value). ORM validation and Protobuf schema generation will be ineffective.",
-        howToFix: "Consider using a more specific type or union.",
-        overridable: true
-      },
-      W206: {
-        code: "W206",
-        severity: "warning",
-        title: "'any' type usage",
-        description: "This disables type checking across all targets. SQL maps to JSON/JSONB, Protobuf to Any.",
-        howToFix: "Consider using a more specific type or union.",
-        overridable: true
-      },
-      // ─── E9xx: Connector Compliance Errors ──────────────────────────
-      E900: {
-        code: "E900",
-        severity: "error",
-        title: "Payment webhook missing replay protection",
-        description: 'An entity using @use("payments") has a webhook handler but no replay protection (idempotency key or event deduplication). Replayed webhooks can cause double charges.',
-        howToFix: "Add webhook signature verification and event ID deduplication to your payment webhook handler.",
-        overridable: true
-      },
-      E901: {
-        code: "E901",
-        severity: "error",
-        title: "Storage provider missing tenant isolation",
-        description: `An entity using @use("storage") does not scope object keys by tenant. Without tenant isolation, one tenant could access another's files.`,
-        howToFix: "Ensure all storage keys are prefixed with tenantId (e.g. `${tenantId}/${key}`).",
-        overridable: true
-      },
-      E902: {
-        code: "E902",
-        severity: "error",
-        title: "Identity provider missing session rotation",
-        description: 'An entity using @use("identity") does not implement session revocation. Without session rotation, compromised sessions remain valid indefinitely.',
-        howToFix: "Implement revokeSession() in your identity connector and expose a session management endpoint.",
-        overridable: true
-      },
-      // ─── W3xx: Model Completeness Warnings (default mode) ────────
-      W300: {
-        code: "W300",
-        severity: "warning",
-        title: "PII field without encryption",
-        description: "Same as E200 but in default (non-strict) mode.",
-        howToFix: "Add @encrypt to the field, or enable strict mode for full enforcement.",
-        overridable: true
-      },
-      W301: {
-        code: "W301",
-        severity: "warning",
-        title: "Entity exposed via API without policy",
-        description: "Same as E201 but in default (non-strict) mode.",
-        howToFix: "Add a policy declaration for this entity.",
-        overridable: true
-      },
-      W302: {
-        code: "W302",
-        severity: "warning",
-        title: "Compliance decorator without policy",
-        description: "Same as E202 but in default (non-strict) mode.",
-        howToFix: "Add a policy declaration for this entity.",
-        overridable: true
-      },
-      W303: {
-        code: "W303",
-        severity: "warning",
-        title: "Sensitive field exposed in API response",
-        description: "Same as E203 but in default (non-strict) mode.",
-        howToFix: "Add a field-level policy to restrict access.",
-        overridable: true
-      },
-      W304: {
-        code: "W304",
-        severity: "warning",
-        title: "Entity with API lacks runtime enforcement binding",
-        description: "Same as E205 but in default (non-strict) mode.",
-        howToFix: "Add a policy declaration for this entity to enable runtime enforcement.",
-        overridable: true
-      },
-      W305: {
-        code: "W305",
-        severity: "warning",
-        title: "Entity with PII/encrypted fields returns unsealed data",
-        description: "Same as E206 but in default (non-strict) mode.",
-        howToFix: "Remove 'sealed: false' from the EntityOps config to enable runtime property-level enforcement.",
-        overridable: true
-      },
-      W306: {
-        code: "W306",
-        severity: "warning",
-        title: "Federated service has schema hash mismatch",
-        description: "Same as E207 but in default (non-strict) mode. Schema hash mismatch detected during context verification.",
-        howToFix: "Redeploy services with a consistent schema, or set onSchemaMismatch to 'ignore' if intentional.",
-        overridable: true
-      },
-      // ─── E6xx: Behavior / Workflow Errors ─────────────────────────
-      E600: {
-        code: "E600",
-        severity: "error",
-        title: "Workflow unreachable state",
-        description: "A state has no incoming transition and is not marked as initial. It can never be entered.",
-        howToFix: "Add a transition leading to this state, mark it @initial, or remove it.",
-        overridable: true
-      },
-      E601: {
-        code: "E601",
-        severity: "error",
-        title: "Workflow dead-end state",
-        description: "A non-terminal state has no outgoing transition. The workflow will be stuck if it enters this state.",
-        howToFix: "Add an outgoing transition from this state or mark it @terminal.",
-        overridable: true
-      },
-      E602: {
-        code: "E602",
-        severity: "error",
-        title: "Workflow invalid transition reference",
-        description: "A transition references a state name that is not defined in the workflow.",
-        howToFix: "Define the missing state with 'state StateName' or correct the transition.",
-        overridable: false
-      },
-      E603: {
-        code: "E603",
-        severity: "error",
-        title: "Workflow missing initial state",
-        description: "No state in the workflow is marked as initial and could not be inferred.",
-        howToFix: "Mark one state with @initial or ensure at least one state is defined.",
-        overridable: false
-      },
-      E604: {
-        code: "E604",
-        severity: "error",
-        title: "Rule references undefined entity or field",
-        description: "A rule's 'when' or 'then' clause references an entity or field that doesn't exist in the model.",
-        howToFix: "Check the entity/field names in the rule expression and correct any typos.",
-        overridable: true
-      },
-      E605: {
-        code: "E605",
-        severity: "error",
-        title: "Invariant expression type error",
-        description: "An invariant expression references fields that don't exist on the entity.",
-        howToFix: "Check field names in the invariant expression.",
-        overridable: true
-      },
-      E606: {
-        code: "E606",
-        severity: "error",
-        title: "Lineage source references undefined entity or field",
-        description: "A lineage declaration's 'source' references an entity.field path that doesn't exist.",
-        howToFix: "Correct the source path to reference an existing entity and field.",
-        overridable: true
-      },
-      E607: {
-        code: "E607",
-        severity: "error",
-        title: "Workflow duplicate state name",
-        description: "Two or more states in the same workflow have the same name.",
-        howToFix: "Rename one of the duplicate states.",
-        overridable: false
-      },
-      // ─── W6xx: Behavior Warnings (warn mode) ─────────────────────
-      W600: {
-        code: "W600",
-        severity: "warning",
-        title: "Workflow unreachable state",
-        description: "Same as E600 but in default (non-strict) mode.",
-        howToFix: "Add a transition leading to this state, mark it @initial, or remove it.",
-        overridable: true
-      },
-      W601: {
-        code: "W601",
-        severity: "warning",
-        title: "Workflow dead-end state",
-        description: "Same as E601 but in default (non-strict) mode.",
-        howToFix: "Add an outgoing transition from this state or mark it @terminal.",
-        overridable: true
-      },
-      W604: {
-        code: "W604",
-        severity: "warning",
-        title: "Rule references undefined entity or field",
-        description: "Same as E604 but in default (non-strict) mode.",
-        howToFix: "Check the entity/field names in the rule expression and correct any typos.",
-        overridable: true
-      },
-      W605: {
-        code: "W605",
-        severity: "warning",
-        title: "Invariant expression type error",
-        description: "Same as E605 but in default (non-strict) mode.",
-        howToFix: "Check field names in the invariant expression.",
-        overridable: true
-      },
-      W606: {
-        code: "W606",
-        severity: "warning",
-        title: "Lineage source references undefined entity or field",
-        description: "Same as E606 but in default (non-strict) mode.",
-        howToFix: "Correct the source path to reference an existing entity and field.",
-        overridable: true
-      },
-      // ─── E10xx: System Execution Layer ─────────────────────────────
-      E1000: {
-        code: "E1000",
-        severity: "error",
-        title: "System tick exceeds maxLatency",
-        description: "The system timing tick interval is greater than the maxLatency constraint. This means the system cannot guarantee real-time deadlines.",
-        howToFix: "Set tick <= maxLatency in the timing block.",
-        overridable: false
-      },
-      E1001: {
-        code: "E1001",
-        severity: "error",
-        title: "Sensor emission references undefined event",
-        description: "A sensor emits an event type that is not declared as an event in the schema.",
-        howToFix: "Declare the event type or correct the sensor emission reference.",
-        overridable: true
-      },
-      E1002: {
-        code: "E1002",
-        severity: "error",
-        title: "Sensor emission interval below system tick",
-        description: "A sensor emits events faster than the system tick can process them. Events may be lost or delayed.",
-        howToFix: "Increase the sensor interval or decrease the system tick.",
-        overridable: true
-      },
-      E1003: {
-        code: "E1003",
-        severity: "error",
-        title: "Duplicate sensor or actuator name",
-        description: "Two sensors or actuators share the same name, creating an ambiguous reference.",
-        howToFix: "Rename one of the duplicate declarations.",
-        overridable: false
-      },
-      E1004: {
-        code: "E1004",
-        severity: "error",
-        title: "Actuator has duplicate command name",
-        description: "An actuator declares two commands with the same name.",
-        howToFix: "Rename one of the duplicate commands.",
-        overridable: false
-      },
-      // ─── W10xx: System Execution Layer (warnings, default mode) ───
-      W1000: {
-        code: "W1000",
-        severity: "warning",
-        title: "System tick exceeds maxLatency",
-        description: "Same as E1000 but in default (non-strict) mode.",
-        howToFix: "Set tick <= maxLatency in the timing block.",
-        overridable: true
-      },
-      W1001: {
-        code: "W1001",
-        severity: "warning",
-        title: "Sensor emission references undefined event",
-        description: "Same as E1001 but in default (non-strict) mode.",
-        howToFix: "Declare the event type or correct the sensor emission reference.",
-        overridable: true
-      },
-      W1002: {
-        code: "W1002",
-        severity: "warning",
-        title: "Sensor emission interval below system tick",
-        description: "Same as E1002 but in default (non-strict) mode.",
-        howToFix: "Increase the sensor interval or decrease the system tick.",
-        overridable: true
-      }
-    };
-    function getErrorCode(code) {
-      return exports2.ERROR_CODES[code];
-    }
-    function explainErrorCode(code) {
-      const entry = exports2.ERROR_CODES[code];
-      if (!entry)
-        return `Unknown error code: ${code}`;
-      return [
-        `${entry.code}: ${entry.title}`,
-        `  Severity: ${entry.severity}`,
-        `  ${entry.description}`,
-        `  How to fix: ${entry.howToFix}`,
-        entry.overridable ? '  This rule can be overridden with @override(rule: "' + entry.code + '", justification: "...").' : "  This rule cannot be overridden."
-      ].join("\n");
-    }
-    function listErrorCodes() {
-      return Object.values(exports2.ERROR_CODES).sort((a, b) => a.code.localeCompare(b.code));
-    }
-  }
-});
-
-// ../typechecker/dist/security-auditor.js
-var require_security_auditor = __commonJS({
-  "../typechecker/dist/security-auditor.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.SecurityAuditor = void 0;
-    var core_1 = require_dist();
-    var SECRET_FIELD_PATTERNS = Object.freeze([
-      /password/i,
-      /passwd/i,
-      /api[_-]?key/i,
-      /secret[_-]?key/i,
-      /access[_-]?token/i,
-      /refresh[_-]?token/i,
-      /private[_-]?key/i,
-      /session[_-]?token/i,
-      /client[_-]?secret/i,
-      /webhook[_-]?secret/i,
-      /signing[_-]?key/i,
-      /jwt[_-]?secret/i
-    ]);
-    var PII_FIELD_PATTERNS = Object.freeze([
-      /^email$/i,
-      /^phone(?:[_-]?number)?$/i,
-      /^ssn$/i,
-      /^(?:national[_-]?)?id[_-]?number$/i,
-      /^date[_-]?of[_-]?birth$/i,
-      /^(?:street[_-]?)?address$/i,
-      /^postal[_-]?code$/i,
-      /^credit[_-]?card/i,
-      /^iban$/i,
-      /^tax[_-]?id$/i,
-      /^passport/i
-    ]);
-    var FINANCIAL_FIELD_PATTERNS = Object.freeze([
-      /^balance$/i,
-      /^amount$/i,
-      /^credit$/i,
-      /^debit$/i,
-      /^total$/i,
-      /^net[_-]?worth$/i
-    ]);
-    var WRITE_API_PREFIXES = Object.freeze([
-      "create",
-      "update",
-      "delete",
-      "remove",
-      "set",
-      "reset",
-      "upsert",
-      "patch",
-      "cancel",
-      "refund",
-      "transfer",
-      "issue",
-      "revoke",
-      "grant"
-    ]);
-    var COMPLIANCE_DECORATORS = /* @__PURE__ */ new Set([
-      "gdpr",
-      "hipaa",
-      "soc2",
-      "pci",
-      "ccpa",
-      "pipeda"
-    ]);
-    var AUTH_DECORATORS = /* @__PURE__ */ new Set([
-      "auth",
-      "authenticated",
-      "authorize",
-      "requireAuth",
-      "protected"
-    ]);
-    var PROTECTION_DECORATORS = /* @__PURE__ */ new Set([
-      "secret",
-      "encrypt",
-      "pii",
-      "sensitive",
-      "mask"
-    ]);
-    var PII_DECORATORS = /* @__PURE__ */ new Set(["pii", "sensitive"]);
-    var RULES = Object.freeze({
-      S100: { errorCode: "S100", warnCode: "S100", title: "secret-named field without @secret/@encrypt" },
-      S101: { errorCode: "S101", warnCode: "S101", title: "PII-shaped field without @pii" },
-      S102: { errorCode: "S102", warnCode: "S102", title: "write API without @auth" },
-      S103: { errorCode: "S103", warnCode: "S103", title: "financial field mutable via API without @immutable or policy" },
-      S104: { errorCode: "S104", warnCode: "S104", title: "public read API returns sensitive entity without @auth" },
-      S105: { errorCode: "S105", warnCode: "S105", title: "entity references a stricter-tagged entity without reciprocal tag" },
-      S106: { errorCode: "S106", warnCode: "S106", title: "sensitive entity uses predictable numeric id" },
-      S107: { errorCode: "S107", warnCode: "S107", title: "public read API transitively exposes sensitive data through entity references" },
-      S108: { errorCode: "S108", warnCode: "S108", title: "write API transitively reaches a financial field without @immutable" },
-      S109: { errorCode: "S109", warnCode: "S109", title: "write API missing @rateLimit / @throttle" },
-      S110: { errorCode: "S110", warnCode: "S110", title: "@deprecated API missing @sunset" }
-    });
-    var RATE_LIMIT_DECORATORS = /* @__PURE__ */ new Set(["rateLimit", "rate_limit", "ratelimit", "throttle"]);
-    var SecurityAuditor = class {
-      level;
-      disabled;
-      constructor(level = "warn", options = {}) {
-        this.level = level;
-        this.disabled = new Set(options.disable ?? []);
-      }
-      /**
-       * Run every rule and return the combined diagnostics.
-       */
-      check(program) {
-        return this.audit(program).findings.slice();
-      }
-      /**
-       * Run every rule and return the full summary (diagnostics + counts).
-       * Useful for the CLI to render a per-rule table without re-grouping.
-       */
-      audit(program) {
-        const counts = {
-          S100: 0,
-          S101: 0,
-          S102: 0,
-          S103: 0,
-          S104: 0,
-          S105: 0,
-          S106: 0,
-          S107: 0,
-          S108: 0,
-          S109: 0,
-          S110: 0
-        };
-        if (this.level === "off") {
-          return { findings: [], ruleCounts: counts };
-        }
-        const entities = collectEntities(program);
-        const apis = collectAPIs(program);
-        const policies = collectPolicies(program);
-        const overrides = collectOverrides(program);
-        const diagnostics = [];
-        const sensitiveEntities = findSensitiveEntities(entities);
-        const complianceEntities = findComplianceEntities(entities);
-        const policiesByEntity = new Map(policies.map((p) => [p.entity, p]));
-        for (const entity of entities.values()) {
-          const entityOverrides = overrides.filter((o) => o.entityName === entity.name);
-          for (const field of entity.fields) {
-            this.runFieldRules(entity, field, entityOverrides, diagnostics, counts);
-          }
-          this.runPredictableIdRule(entity, entityOverrides, sensitiveEntities, diagnostics, counts);
-          this.runRelationComplianceRule(entity, entities, complianceEntities, entityOverrides, diagnostics, counts);
-        }
-        for (const api of apis) {
-          this.runWriteApiAuthRule(api, diagnostics, counts);
-          this.runPublicReadSensitiveRule(api, entities, sensitiveEntities, diagnostics, counts);
-          this.runFinancialMutationRule(api, entities, policiesByEntity, diagnostics, counts);
-          this.runRateLimitRule(api, diagnostics, counts);
-          this.runDeprecationSunsetRule(api, diagnostics, counts);
-        }
-        if (!this.disabled.has("S107") || !this.disabled.has("S108")) {
-          const graph = buildEntityGraph(entities);
-          for (const api of apis) {
-            this.runTaintFlowRules(api, entities, graph, policiesByEntity, diagnostics, counts);
-          }
-        }
-        return { findings: diagnostics, ruleCounts: counts };
-      }
-      // ─── Field-level rules ──────────────────────────────────────────
-      runFieldRules(entity, field, entityOverrides, diagnostics, counts) {
-        const fieldOverrides = entityOverrides.filter((o) => o.fieldName === field.name || !o.fieldName);
-        const decoratorNames = decoratorSet(field.decorators);
-        if (!this.disabled.has("S100") && matchesAny(field.name, SECRET_FIELD_PATTERNS)) {
-          const hasSecret = decoratorNames.has("secret") || decoratorNames.has("encrypt");
-          if (!hasSecret) {
-            this.emit("S100", fieldOverrides, diagnostics, counts, field.location, `Field '${entity.name}.${field.name}' looks like a secret but has no @secret or @encrypt decorator.`);
-          }
-        }
-        if (!this.disabled.has("S101") && matchesAny(field.name, PII_FIELD_PATTERNS)) {
-          const hasPII = hasAnyOf(decoratorNames, PII_DECORATORS);
-          if (!hasPII) {
-            this.emit("S101", fieldOverrides, diagnostics, counts, field.location, `Field '${entity.name}.${field.name}' looks like PII but has no @pii decorator.`);
-          }
-        }
-      }
-      runPredictableIdRule(entity, entityOverrides, sensitiveEntities, diagnostics, counts) {
-        if (this.disabled.has("S106"))
-          return;
-        if (!sensitiveEntities.has(entity.name))
-          return;
-        const idField = entity.fields.find((f) => /^id$/i.test(f.name));
-        if (!idField)
-          return;
-        const typeName = typeReferenceName(idField.typeExpr);
-        if (typeName === "number" || typeName === "int") {
-          this.emit("S106", entityOverrides, diagnostics, counts, idField.location, `Entity '${entity.name}' carries sensitive fields but uses a numeric id \u2014 prefer string/UUID to avoid enumeration attacks.`);
-        }
-      }
-      runRelationComplianceRule(entity, entities, complianceEntities, entityOverrides, diagnostics, counts) {
-        if (this.disabled.has("S105"))
-          return;
-        const selfCompliance = decoratorNameSet(entity.decorators);
-        const selfHasCompliance = hasAnyOf(selfCompliance, COMPLIANCE_DECORATORS);
-        if (selfHasCompliance)
-          return;
-        for (const field of entity.fields) {
-          const refName = typeReferenceName(field.typeExpr);
-          if (!refName)
-            continue;
-          if (!entities.has(refName))
-            continue;
-          if (!complianceEntities.has(refName))
-            continue;
-          this.emit("S105", entityOverrides, diagnostics, counts, field.location, `Entity '${entity.name}' references compliance-tagged '${refName}' via '${field.name}' but carries no reciprocal compliance decorator \u2014 data from '${refName}' may leak through '${entity.name}'.`);
-        }
-      }
-      // ─── API-level rules ────────────────────────────────────────────
-      runWriteApiAuthRule(api, diagnostics, counts) {
-        if (this.disabled.has("S102"))
-          return;
-        if (!isWriteApi(api.name))
-          return;
-        const decs = decoratorNameSet(api.decorators);
-        if (hasAnyOf(decs, AUTH_DECORATORS))
-          return;
-        this.emit("S102", [], diagnostics, counts, api.location, `Write API '${api.name}' has no @auth decorator \u2014 any caller can mutate state.`);
-      }
-      runPublicReadSensitiveRule(api, entities, sensitiveEntities, diagnostics, counts) {
-        if (this.disabled.has("S104"))
-          return;
-        const decs = decoratorNameSet(api.decorators);
-        if (hasAnyOf(decs, AUTH_DECORATORS))
-          return;
-        const entityNames = collectReferencedEntityNames(api.returnType);
-        for (const name of entityNames) {
-          if (!sensitiveEntities.has(name))
-            continue;
-          this.emit("S104", [], diagnostics, counts, api.location, `API '${api.name}' returns '${name}' which carries @pii/@secret fields, but has no @auth decorator \u2014 sensitive data is publicly reachable.`);
-          return;
-        }
-      }
-      runFinancialMutationRule(api, entities, policiesByEntity, diagnostics, counts) {
-        if (this.disabled.has("S103"))
-          return;
-        if (!isWriteApi(api.name))
-          return;
-        const entityNames = collectReferencedEntityNames(api.returnType);
-        for (const name of entityNames) {
-          const entity = entities.get(name);
-          if (!entity)
-            continue;
-          const financialFields = entity.fields.filter((f) => matchesAny(f.name, FINANCIAL_FIELD_PATTERNS));
-          if (financialFields.length === 0)
-            continue;
-          const policy = policiesByEntity.get(name);
-          const protectedFields = new Set(policy?.fieldPolicies.map((fp) => fp.fieldName) ?? []);
-          for (const field of financialFields) {
-            const decs = decoratorNameSet(field.decorators);
-            const immutable = decs.has("immutable") || decs.has("readonly");
-            if (immutable)
-              continue;
-            if (protectedFields.has(field.name))
-              continue;
-            this.emit("S103", [], diagnostics, counts, api.location, `Write API '${api.name}' can mutate '${name}.${field.name}' (financial) but the field has no @immutable decorator or field-level policy.`);
-          }
-        }
-      }
-      runRateLimitRule(api, diagnostics, counts) {
-        if (this.disabled.has("S109"))
-          return;
-        if (!isWriteApi(api.name))
-          return;
-        const decs = decoratorNameSet(api.decorators);
-        if (hasAnyOf(decs, RATE_LIMIT_DECORATORS))
-          return;
-        this.emit("S109", [], diagnostics, counts, api.location, `Write API '${api.name}' has no @rateLimit / @throttle \u2014 unbounded call rate exposes the endpoint to brute-force or DoS.`);
-      }
-      runDeprecationSunsetRule(api, diagnostics, counts) {
-        if (this.disabled.has("S110"))
-          return;
-        const decs = decoratorNameSet(api.decorators);
-        if (!decs.has("deprecated"))
-          return;
-        if (decs.has("sunset"))
-          return;
-        this.emit("S110", [], diagnostics, counts, api.location, `API '${api.name}' is @deprecated but has no @sunset \u2014 no scheduled removal date means the deprecation drifts indefinitely.`);
-      }
-      // ─── Taint-flow rules (S107 + S108) ─────────────────────────────
-      /**
-       * Walk the entity-reference graph starting from `api.returnType` and report
-       * transitive exposure of sensitive data or financial mutation paths.
-       *
-       * S107 (read path): an unauthenticated API whose return type transitively
-       * reaches a field carrying @pii / @secret / @sensitive.
-       *
-       * S108 (write path): a write API (create/update/delete/transfer prefixes)
-       * whose return type transitively reaches a financial field (`balance`,
-       * `amount`, …) that lacks @immutable / @readonly.
-       *
-       * Depth is capped at 6 hops — that covers the realistic contracts without
-       * exploring cycles. The walk uses a visited set to stop them cold.
-       */
-      runTaintFlowRules(api, entities, graph, policiesByEntity, diagnostics, counts) {
-        const decs = decoratorNameSet(api.decorators);
-        const isAuthenticated = hasAnyOf(decs, AUTH_DECORATORS);
-        const isWrite = isWriteApi(api.name);
-        const roots = collectReferencedEntityNames(api.returnType);
-        if (roots.size === 0)
-          return;
-        const MAX_DEPTH = 6;
-        for (const root of roots) {
-          if (!entities.has(root))
-            continue;
-          if (!this.disabled.has("S107") && !isAuthenticated) {
-            const hit = findFirstSensitiveField(root, entities, graph, MAX_DEPTH);
-            if (hit && hit.depth >= 1) {
-              const pathStr = renderPath(api.name, hit.path, hit.field.entity, hit.field.name, hit.field.decorator);
-              this.emit("S107", [], diagnostics, counts, api.location, `Public API '${api.name}' transitively exposes ${hit.field.decorator === "secret" ? "a secret" : "PII"} at '${hit.field.entity}.${hit.field.name}' \u2014 path: ${pathStr}.`);
-              break;
-            }
-          }
-          if (!this.disabled.has("S108") && isWrite) {
-            const hit = findFirstFinancialField(root, entities, graph, policiesByEntity, MAX_DEPTH);
-            if (hit && hit.depth >= 1) {
-              const pathStr = renderPath(api.name, hit.path, hit.field.entity, hit.field.name, "financial");
-              this.emit("S108", [], diagnostics, counts, api.location, `Write API '${api.name}' can transitively mutate financial field '${hit.field.entity}.${hit.field.name}' \u2014 path: ${pathStr}. Mark the field @immutable or gate it with a field-level policy.`);
-              break;
-            }
-          }
-        }
-      }
-      // ─── Emit ───────────────────────────────────────────────────────
-      emit(code, overrides, diagnostics, counts, location, message) {
-        const active = overrides.find((o) => {
-          if (o.rule !== code)
-            return false;
-          if (o.until) {
-            const expires = new Date(o.until);
-            if (!Number.isNaN(expires.getTime()) && expires < /* @__PURE__ */ new Date())
-              return false;
-          }
-          return true;
-        });
-        if (active)
-          return;
-        counts[code]++;
-        const severity = this.level === "strict" ? "error" : "warning";
-        diagnostics.push((0, core_1.createDiagnostic)(severity, message, location, code));
-      }
-    };
-    exports2.SecurityAuditor = SecurityAuditor;
-    function collectEntities(program) {
-      const entities = /* @__PURE__ */ new Map();
-      for (const decl of program.body) {
-        const unwrapped = decl.type === "ExportDeclaration" ? decl.declaration : decl;
-        if (unwrapped.type === "EntityDeclaration") {
-          entities.set(unwrapped.name, unwrapped);
-        }
-      }
-      return entities;
-    }
-    function collectAPIs(program) {
-      const apis = [];
-      for (const decl of program.body) {
-        const unwrapped = decl.type === "ExportDeclaration" ? decl.declaration : decl;
-        if (unwrapped.type === "APIDeclaration")
-          apis.push(unwrapped);
-      }
-      return apis;
-    }
-    function collectPolicies(program) {
-      const policies = [];
-      for (const decl of program.body) {
-        const unwrapped = decl.type === "ExportDeclaration" ? decl.declaration : decl;
-        if (unwrapped.type === "PolicyDeclaration")
-          policies.push(unwrapped);
-      }
-      return policies;
-    }
-    function collectOverrides(program) {
-      const overrides = [];
-      for (const decl of program.body) {
-        const unwrapped = decl.type === "ExportDeclaration" ? decl.declaration : decl;
-        if (unwrapped.type !== "EntityDeclaration")
-          continue;
-        collectOverridesFromDecorators(unwrapped.decorators, unwrapped.name, void 0, unwrapped.location, overrides);
-        for (const field of unwrapped.fields) {
-          collectOverridesFromDecorators(field.decorators, unwrapped.name, field.name, field.location, overrides);
-        }
-      }
-      return overrides;
-    }
-    function collectOverridesFromDecorators(decorators, entityName, fieldName, location, out) {
-      for (const dec of decorators ?? []) {
-        if (dec.name !== "override")
-          continue;
-        if (dec.args.length < 2)
-          continue;
-        const rule = literalString(dec.args[0]);
-        const justification = literalString(dec.args[1]);
-        const until = dec.args[2] ? literalString(dec.args[2]) : void 0;
-        if (!rule || !justification)
-          continue;
-        out.push({ rule, justification, until, entityName, fieldName, location });
-      }
-    }
-    function literalString(node) {
-      if (!node || typeof node !== "object")
-        return void 0;
-      const n = node;
-      if (n.type !== "LiteralExpression")
-        return void 0;
-      return typeof n.value === "string" ? n.value : void 0;
-    }
-    function findSensitiveEntities(entities) {
-      const result = /* @__PURE__ */ new Set();
-      for (const entity of entities.values()) {
-        const entityDecs = decoratorNameSet(entity.decorators);
-        if (hasAnyOf(entityDecs, COMPLIANCE_DECORATORS)) {
-          result.add(entity.name);
-          continue;
-        }
-        const hasSensitiveField = entity.fields.some((f) => {
-          const names = decoratorNameSet(f.decorators);
-          return hasAnyOf(names, PROTECTION_DECORATORS);
-        });
-        if (hasSensitiveField)
-          result.add(entity.name);
-      }
-      return result;
-    }
-    function findComplianceEntities(entities) {
-      const result = /* @__PURE__ */ new Set();
-      for (const entity of entities.values()) {
-        const decs = decoratorNameSet(entity.decorators);
-        if (hasAnyOf(decs, COMPLIANCE_DECORATORS))
-          result.add(entity.name);
-      }
-      return result;
-    }
-    function decoratorSet(decorators) {
-      return decoratorNameSet(decorators);
-    }
-    function decoratorNameSet(decorators) {
-      const out = /* @__PURE__ */ new Set();
-      for (const d of decorators ?? [])
-        out.add(d.name);
-      return out;
-    }
-    function hasAnyOf(names, required) {
-      for (const name of required) {
-        if (names.has(name))
-          return true;
-      }
-      return false;
-    }
-    function matchesAny(value, patterns) {
-      for (const p of patterns) {
-        if (p.test(value))
-          return true;
-      }
-      return false;
-    }
-    function isWriteApi(name) {
-      const lower = name.toLowerCase();
-      return WRITE_API_PREFIXES.some((p) => lower.startsWith(p));
-    }
-    function typeReferenceName(expr) {
-      if (expr.type === "TypeReference")
-        return expr.name;
-      if (expr.type === "ArrayType")
-        return typeReferenceName(expr.elementType);
-      return void 0;
-    }
-    function collectReferencedEntityNames(expr) {
-      const out = /* @__PURE__ */ new Set();
-      visitType(expr, (t) => {
-        if (t.type === "TypeReference")
-          out.add(t.name);
-      });
-      return out;
-    }
-    function visitType(expr, fn) {
-      fn(expr);
-      if (expr.type === "ArrayType")
-        visitType(expr.elementType, fn);
-      if (expr.type === "UnionType" && "types" in expr) {
-        for (const t of expr.types)
-          visitType(t, fn);
-      }
-    }
-    function buildEntityGraph(entities) {
-      const graph = /* @__PURE__ */ new Map();
-      for (const [name, entity] of entities) {
-        const edges = [];
-        for (const field of entity.fields) {
-          const refs = collectReferencedEntityNames(field.typeExpr);
-          for (const target of refs) {
-            if (!entities.has(target))
-              continue;
-            if (target === name)
-              continue;
-            edges.push({ to: target, via: field.name });
-          }
-        }
-        graph.set(name, edges);
-      }
-      return graph;
-    }
-    function findFirstSensitiveField(root, entities, graph, maxDepth) {
-      const queue = [{ entity: root, path: [], depth: 0 }];
-      const visited = /* @__PURE__ */ new Set([root]);
-      while (queue.length > 0) {
-        const { entity, path: path2, depth } = queue.shift();
-        const decl = entities.get(entity);
-        if (!decl)
-          continue;
-        if (depth >= 1) {
-          for (const field of decl.fields) {
-            const decs = decoratorNameSet(field.decorators);
-            for (const d of ["secret", "encrypt", "pii", "sensitive"]) {
-              if (decs.has(d)) {
-                return { depth, path: path2, field: { entity, name: field.name, decorator: d } };
-              }
-            }
-          }
-        }
-        if (depth >= maxDepth)
-          continue;
-        const edges = graph.get(entity) ?? [];
-        for (const edge of edges) {
-          if (visited.has(edge.to))
-            continue;
-          visited.add(edge.to);
-          queue.push({ entity: edge.to, path: [...path2, edge], depth: depth + 1 });
-        }
-      }
-      return null;
-    }
-    function findFirstFinancialField(root, entities, graph, policiesByEntity, maxDepth) {
-      const queue = [{ entity: root, path: [], depth: 0 }];
-      const visited = /* @__PURE__ */ new Set([root]);
-      while (queue.length > 0) {
-        const { entity, path: path2, depth } = queue.shift();
-        const decl = entities.get(entity);
-        if (!decl)
-          continue;
-        if (depth >= 1) {
-          const policy = policiesByEntity.get(entity);
-          const guarded = new Set(policy?.fieldPolicies.map((fp) => fp.fieldName) ?? []);
-          for (const field of decl.fields) {
-            if (!matchesAny(field.name, FINANCIAL_FIELD_PATTERNS))
-              continue;
-            const decs = decoratorNameSet(field.decorators);
-            if (decs.has("immutable") || decs.has("readonly"))
-              continue;
-            if (guarded.has(field.name))
-              continue;
-            return { depth, path: path2, field: { entity, name: field.name, decorator: "financial" } };
-          }
-        }
-        if (depth >= maxDepth)
-          continue;
-        const edges = graph.get(entity) ?? [];
-        for (const edge of edges) {
-          if (visited.has(edge.to))
-            continue;
-          visited.add(edge.to);
-          queue.push({ entity: edge.to, path: [...path2, edge], depth: depth + 1 });
-        }
-      }
-      return null;
-    }
-    function renderPath(apiName, path2, leakEntity, leakField, leakKind) {
-      const segments = [apiName];
-      for (const edge of path2) {
-        segments.push(`${edge.to} (via .${edge.via})`);
-      }
-      segments.push(`${leakEntity}.${leakField} [${leakKind}]`);
-      return segments.join(" \u2192 ");
-    }
-  }
-});
-
-// ../typechecker/dist/security-auditor-sarif.js
-var require_security_auditor_sarif = __commonJS({
-  "../typechecker/dist/security-auditor-sarif.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.RULE_CATALOGUE = exports2.TYPERION_AUDITOR_HELP_URI_BASE = exports2.TYPERION_AUDITOR_INFO_URI = exports2.TYPERION_AUDITOR_NAME = exports2.SARIF_VERSION = exports2.SARIF_SCHEMA_URI = void 0;
-    exports2.renderSarif = renderSarif;
-    exports2.SARIF_SCHEMA_URI = "https://json.schemastore.org/sarif-2.1.0.json";
-    exports2.SARIF_VERSION = "2.1.0";
-    exports2.TYPERION_AUDITOR_NAME = "Typerion Security Auditor";
-    exports2.TYPERION_AUDITOR_INFO_URI = "https://typerion.io";
-    exports2.TYPERION_AUDITOR_HELP_URI_BASE = "https://github.com/wiaahmarketplace/Typerion_V1/blob/main/docs/security";
-    exports2.RULE_CATALOGUE = Object.freeze({
-      S100: {
-        shortDescription: "Secret-shaped field is missing @secret or @encrypt.",
-        fullDescription: "Fields whose names strongly imply a secret (password, apiKey, refreshToken, etc.) must carry either @secret or @encrypt so the runtime masks and protects the value.",
-        defaultLevel: "error"
-      },
-      S101: {
-        shortDescription: "PII-shaped field is missing @pii.",
-        fullDescription: "Fields matching canonical PII names (email, ssn, dateOfBirth, iban, etc.) must carry @pii so downstream codegens register them in the data-protection catalogue.",
-        defaultLevel: "warning"
-      },
-      S102: {
-        shortDescription: "Write API has no @auth decorator.",
-        fullDescription: "Mutations (create/update/delete/transfer/refund/grant prefixes) must gate access with @auth; without it, any caller can change state.",
-        defaultLevel: "error"
-      },
-      S103: {
-        shortDescription: "Financial field is mutable via API without @immutable or a field-level policy.",
-        fullDescription: "Balance/amount/credit/debit fields on an entity reachable from a write API must be @immutable, @readonly, or covered by a field-level policy to avoid unauthorised balance changes.",
-        defaultLevel: "error"
-      },
-      S104: {
-        shortDescription: "Public read API returns a sensitive entity without @auth.",
-        fullDescription: "A read API whose return entity carries @pii or @secret fields must gate access with @auth to prevent unauthenticated disclosure.",
-        defaultLevel: "error"
-      },
-      S105: {
-        shortDescription: "Entity references a compliance-tagged entity without a reciprocal tag.",
-        fullDescription: "When entity A references an entity carrying @gdpr/@hipaa/@pci/@soc2, A should carry a compatible tag so compliance rules propagate consistently.",
-        defaultLevel: "warning"
-      },
-      S106: {
-        shortDescription: "Sensitive entity uses a predictable numeric id.",
-        fullDescription: "Entities carrying compliance decorators or @pii fields should use an opaque identifier (string/UUID) rather than an incrementing integer to resist enumeration.",
-        defaultLevel: "warning"
-      },
-      S107: {
-        shortDescription: "Public API transitively exposes sensitive data through entity references.",
-        fullDescription: "Data-flow walk found an unauthenticated API whose return type can reach a field carrying @pii or @secret via one or more reference hops. Gate the API with @auth or mask the leaking field.",
-        defaultLevel: "error"
-      },
-      S108: {
-        shortDescription: "Write API transitively reaches a financial field without @immutable.",
-        fullDescription: "Data-flow walk found a mutation API that can reach a financial field through one or more reference hops. Mark the field @immutable/@readonly or add a field-level policy to prevent unauthorised mutation.",
-        defaultLevel: "error"
-      },
-      S109: {
-        shortDescription: "Write API has no @rateLimit or @throttle decorator.",
-        fullDescription: "Mutations (create/update/delete/transfer/refund/grant prefixes) without an explicit rate limit expose the endpoint to brute-force, credential-stuffing, and DoS. Declare @rateLimit(requestsPerWindow) or @throttle(minIntervalMs) on the API, or install a gateway-level bound that you document via @override.",
-        defaultLevel: "warning"
-      },
-      S110: {
-        shortDescription: "API marked @deprecated has no @sunset date.",
-        fullDescription: 'A @deprecated API without a @sunset removal date drifts forever: consumers keep calling it, and the codebase accumulates obsolete surface area. Add @sunset("YYYY-MM-DD") so the removal date is tracked and auditable.',
-        defaultLevel: "warning"
-      }
-    });
-    function renderSarif(findings, options = {}) {
-      const version = options.version ?? "0.1.0";
-      const informationUri = options.informationUri ?? exports2.TYPERION_AUDITOR_INFO_URI;
-      const helpUriBase = options.helpUriBase ?? exports2.TYPERION_AUDITOR_HELP_URI_BASE;
-      const workspaceRoot = options.workspaceRoot ?? "";
-      const ruleIds = /* @__PURE__ */ new Set();
-      for (const d of findings) {
-        if (isSecurityRuleId(d.code))
-          ruleIds.add(d.code);
-      }
-      const rules = [];
-      for (const id of sortRuleIds([...ruleIds])) {
-        const doc = exports2.RULE_CATALOGUE[id];
-        rules.push({
-          id,
-          name: id,
-          shortDescription: { text: doc.shortDescription },
-          fullDescription: { text: doc.fullDescription },
-          helpUri: `${helpUriBase}/${id}.md`,
-          defaultConfiguration: { level: doc.defaultLevel }
-        });
-      }
-      const results = [];
-      for (const d of findings) {
-        if (!isSecurityRuleId(d.code))
-          continue;
-        const uri = relativiseUri(d.location?.file ?? "", workspaceRoot);
-        results.push({
-          ruleId: d.code,
-          level: d.severity === "error" ? "error" : d.severity === "warning" ? "warning" : "note",
-          message: { text: d.message },
-          locations: [
-            {
-              physicalLocation: {
-                artifactLocation: { uri },
-                region: {
-                  startLine: d.location?.startLine ?? 1,
-                  startColumn: d.location?.startColumn,
-                  endLine: d.location?.endLine,
-                  endColumn: d.location?.endColumn
-                }
-              }
-            }
-          ]
-        });
-      }
-      return {
-        $schema: exports2.SARIF_SCHEMA_URI,
-        version: exports2.SARIF_VERSION,
-        runs: [
-          {
-            tool: {
-              driver: {
-                name: exports2.TYPERION_AUDITOR_NAME,
-                version,
-                informationUri,
-                rules
-              }
-            },
-            results
-          }
-        ]
-      };
-    }
-    function isSecurityRuleId(code) {
-      return code !== void 0 && code.length === 4 && code.startsWith("S") && code in exports2.RULE_CATALOGUE;
-    }
-    function sortRuleIds(ids) {
-      return [...ids].sort();
-    }
-    function relativiseUri(absolutePath, root) {
-      if (!absolutePath)
-        return "";
-      if (!root)
-        return absolutePath;
-      const normalised = absolutePath.replace(/\\/g, "/");
-      const base = root.replace(/\\/g, "/").replace(/\/+$/, "");
-      if (normalised.startsWith(base + "/"))
-        return normalised.slice(base.length + 1);
-      return normalised;
-    }
-  }
-});
-
-// ../typechecker/dist/security-baseline.js
-var require_security_baseline = __commonJS({
-  "../typechecker/dist/security-baseline.js"(exports2) {
-    "use strict";
-    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      var desc = Object.getOwnPropertyDescriptor(m, k);
-      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-        desc = { enumerable: true, get: function() {
-          return m[k];
-        } };
-      }
-      Object.defineProperty(o, k2, desc);
-    }) : (function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      o[k2] = m[k];
-    }));
-    var __setModuleDefault = exports2 && exports2.__setModuleDefault || (Object.create ? (function(o, v) {
-      Object.defineProperty(o, "default", { enumerable: true, value: v });
-    }) : function(o, v) {
-      o["default"] = v;
-    });
-    var __importStar = exports2 && exports2.__importStar || /* @__PURE__ */ (function() {
-      var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function(o2) {
-          var ar = [];
-          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
-          return ar;
-        };
-        return ownKeys(o);
-      };
-      return function(mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) {
-          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        }
-        __setModuleDefault(result, mod);
-        return result;
-      };
-    })();
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.BASELINE_VERSION = void 0;
-    exports2.createBaseline = createBaseline;
-    exports2.applyBaseline = applyBaseline;
-    exports2.serializeBaseline = serializeBaseline;
-    exports2.parseBaseline = parseBaseline;
-    var path2 = __importStar(require("node:path"));
-    exports2.BASELINE_VERSION = 1;
-    function normalizeFile(file) {
-      if (!file)
-        return "";
-      const rel = path2.isAbsolute(file) ? path2.relative(process.cwd(), file) : file;
-      return rel.split(path2.sep).join("/");
-    }
-    function createBaseline(findings, clock = () => /* @__PURE__ */ new Date()) {
-      const entries = [];
-      for (const d of findings) {
-        if (!isSecurityCode(d.code))
-          continue;
-        entries.push({
-          ruleId: d.code,
-          file: normalizeFile(d.location?.file ?? ""),
-          message: d.message
-        });
-      }
-      entries.sort(compareEntries);
-      return {
-        version: exports2.BASELINE_VERSION,
-        createdAt: clock().toISOString(),
-        entries
-      };
-    }
-    function applyBaseline(findings, baseline) {
-      const keyCounts = /* @__PURE__ */ new Map();
-      for (const entry of baseline.entries) {
-        const key = entryKey(entry);
-        keyCounts.set(key, (keyCounts.get(key) ?? 0) + 1);
-      }
-      const remaining = [];
-      const suppressed = [];
-      for (const d of findings) {
-        if (!isSecurityCode(d.code)) {
-          remaining.push(d);
-          continue;
-        }
-        const key = findingKey(d);
-        const count = keyCounts.get(key) ?? 0;
-        if (count > 0) {
-          keyCounts.set(key, count - 1);
-          suppressed.push(d);
-        } else {
-          remaining.push(d);
-        }
-      }
-      const unmatched = [];
-      for (const entry of baseline.entries) {
-        const key = entryKey(entry);
-        const remainingQuota = keyCounts.get(key) ?? 0;
-        if (remainingQuota > 0) {
-          unmatched.push(entry);
-          keyCounts.set(key, remainingQuota - 1);
-        }
-      }
-      return { remaining, suppressed, unmatched };
-    }
-    function serializeBaseline(baseline) {
-      return JSON.stringify(baseline, null, 2) + "\n";
-    }
-    function parseBaseline(text) {
-      let parsed;
-      try {
-        parsed = JSON.parse(text);
-      } catch (err) {
-        throw new Error(`Baseline parse failed: ${err.message}. The file must be valid JSON.`);
-      }
-      if (!parsed || typeof parsed !== "object") {
-        throw new Error("Baseline parse failed: expected a JSON object.");
-      }
-      const obj = parsed;
-      if (obj.version !== exports2.BASELINE_VERSION) {
-        throw new Error(`Baseline version mismatch: expected ${exports2.BASELINE_VERSION}, got ${String(obj.version)}.`);
-      }
-      if (!Array.isArray(obj.entries)) {
-        throw new Error("Baseline parse failed: 'entries' must be an array.");
-      }
-      const entries = [];
-      for (const raw of obj.entries) {
-        if (!raw || typeof raw !== "object")
-          continue;
-        const e = raw;
-        if (typeof e.ruleId !== "string")
-          continue;
-        if (typeof e.file !== "string")
-          continue;
-        if (typeof e.message !== "string")
-          continue;
-        entries.push({ ruleId: e.ruleId, file: e.file, message: e.message });
-      }
-      const createdAt = typeof obj.createdAt === "string" ? obj.createdAt : "";
-      return { version: exports2.BASELINE_VERSION, createdAt, entries };
-    }
-    function isSecurityCode(code) {
-      return !!code && /^S\d{3}$/.test(code);
-    }
-    function findingKey(d) {
-      return `${d.code}\0${normalizeFile(d.location?.file ?? "")}\0${d.message}`;
-    }
-    function entryKey(e) {
-      return `${e.ruleId}\0${normalizeFile(e.file)}\0${e.message}`;
-    }
-    function compareEntries(a, b) {
-      if (a.ruleId !== b.ruleId)
-        return a.ruleId < b.ruleId ? -1 : 1;
-      if (a.file !== b.file)
-        return a.file < b.file ? -1 : 1;
-      return a.message < b.message ? -1 : a.message > b.message ? 1 : 0;
-    }
-  }
-});
-
-// ../typechecker/dist/security-fixer.js
-var require_security_fixer = __commonJS({
-  "../typechecker/dist/security-fixer.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.FIXABLE_CODES = void 0;
-    exports2.fixFindings = fixFindings;
-    exports2.FIXABLE_CODES = /* @__PURE__ */ new Set(["S102", "S109"]);
-    function fixFindings(source, findings) {
-      const lines = source.split("\n");
-      const edits = [];
-      const unfixable = [];
-      const candidates = [];
-      const seen = /* @__PURE__ */ new Set();
-      for (const d of findings) {
-        const code = d.code;
-        if (!code || !code.startsWith("S1"))
-          continue;
-        if (!exports2.FIXABLE_CODES.has(code)) {
-          unfixable.push(d);
-          continue;
-        }
-        const line = d.location?.startLine ?? 0;
-        if (line <= 0 || line > lines.length)
-          continue;
-        const key = `${code}:${line}`;
-        if (seen.has(key))
-          continue;
-        seen.add(key);
-        const decorator = decoratorFor(code);
-        if (decorator === null) {
-          unfixable.push(d);
-          continue;
-        }
-        candidates.push({ code, line, decorator });
-      }
-      const plannedByLine = /* @__PURE__ */ new Map();
-      for (const c of candidates) {
-        if (hasDecoratorAbove(lines, c.line, c.decorator))
-          continue;
-        const planned = plannedByLine.get(c.line) ?? [];
-        if (planned.includes(c.decorator))
-          continue;
-        planned.push(c.decorator);
-        plannedByLine.set(c.line, planned);
-      }
-      const targetLines = [...plannedByLine.keys()].sort((a, b) => b - a);
-      for (const line of targetLines) {
-        const decorators = plannedByLine.get(line);
-        const targetContent = lines[line - 1] ?? "";
-        const indent = targetContent.match(/^\s*/)?.[0] ?? "";
-        for (const dec of decorators) {
-          const inserted = `${indent}${dec}
-`;
-          lines.splice(line - 1, 0, `${indent}${dec}`);
-          edits.push({
-            code: codeForDecorator(dec),
-            line,
-            inserted
-          });
-        }
-      }
-      return {
-        source: lines.join("\n"),
-        edits,
-        unfixable
-      };
-    }
-    function decoratorFor(code) {
-      switch (code) {
-        case "S102":
-          return "@auth";
-        case "S109":
-          return "@rateLimit(60)";
-        default:
-          return null;
-      }
-    }
-    function codeForDecorator(decorator) {
-      if (decorator === "@auth")
-        return "S102";
-      if (decorator.startsWith("@rateLimit"))
-        return "S109";
-      return "";
-    }
-    function hasDecoratorAbove(lines, targetLine, decorator) {
-      const decoratorName = decorator.split("(")[0];
-      let cursor = targetLine - 2;
-      while (cursor >= 0) {
-        const line = lines[cursor]?.trim() ?? "";
-        if (line === "") {
-          cursor -= 1;
-          continue;
-        }
-        if (!line.startsWith("@"))
-          break;
-        const existingName = line.split(/[(\s]/)[0];
-        if (existingName === decoratorName)
-          return true;
-        cursor -= 1;
-      }
-      return false;
-    }
-  }
-});
-
-// ../typechecker/dist/security-coverage.js
-var require_security_coverage = __commonJS({
-  "../typechecker/dist/security-coverage.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.computeCoverage = computeCoverage;
-    exports2.renderCoverageTable = renderCoverageTable;
-    var COMPLIANCE_TAGS = /* @__PURE__ */ new Set([
-      "gdpr",
-      "hipaa",
-      "soc2",
-      "pci",
-      "ccpa",
-      "pipeda"
-    ]);
-    var AUTH_DECORATORS = /* @__PURE__ */ new Set([
-      "auth",
-      "authenticated",
-      "authorize",
-      "requireAuth",
-      "protected"
-    ]);
-    var RATE_LIMIT_DECORATORS = /* @__PURE__ */ new Set([
-      "rateLimit",
-      "rate_limit",
-      "ratelimit",
-      "throttle"
-    ]);
-    var PII_DECORATORS = /* @__PURE__ */ new Set(["pii", "sensitive"]);
-    var SECRET_DECORATORS = /* @__PURE__ */ new Set(["secret"]);
-    var ENCRYPT_DECORATORS = /* @__PURE__ */ new Set(["encrypt", "encrypted"]);
-    function computeCoverage(programs) {
-      const entities = /* @__PURE__ */ new Map();
-      const apis = [];
-      for (const program of programs) {
-        for (const decl of program.body) {
-          const unwrapped = decl.type === "ExportDeclaration" ? decl.declaration : decl;
-          if (unwrapped.type === "EntityDeclaration") {
-            if (!entities.has(unwrapped.name)) {
-              entities.set(unwrapped.name, unwrapped);
-            }
-          } else if (unwrapped.type === "APIDeclaration") {
-            apis.push(unwrapped);
-          }
-        }
-      }
-      const apisByEntity = /* @__PURE__ */ new Map();
-      let orphanApis = 0;
-      for (const api of apis) {
-        const names = collectEntityNames(api.returnType);
-        const matched = [...names].filter((n) => entities.has(n));
-        if (matched.length === 0) {
-          orphanApis += 1;
-          continue;
-        }
-        for (const name of matched) {
-          const arr = apisByEntity.get(name) ?? [];
-          arr.push(api);
-          apisByEntity.set(name, arr);
-        }
-      }
-      const perEntity = [];
-      let totalApis = 0;
-      let totalFields = 0;
-      let piiFields = 0;
-      let secretFields = 0;
-      let encryptedFields = 0;
-      let entitiesWithCompliance = 0;
-      let apisWithAuthTotal = 0;
-      let apisWithRateLimitTotal = 0;
-      let apisAuditedTotal = 0;
-      for (const [name, entity] of [...entities].sort((a, b) => a[0].localeCompare(b[0]))) {
-        const entityApis = apisByEntity.get(name) ?? [];
-        const entityDecs = decoratorNames(entity.decorators);
-        const complianceTags = [...entityDecs].filter((d) => COMPLIANCE_TAGS.has(d)).sort();
-        if (complianceTags.length > 0)
-          entitiesWithCompliance += 1;
-        let ePiiFields = 0;
-        let eSecretFields = 0;
-        let eEncryptedFields = 0;
-        for (const field of entity.fields) {
-          const fieldDecs = decoratorNames(field.decorators);
-          if (hasAnyOf(fieldDecs, PII_DECORATORS))
-            ePiiFields += 1;
-          if (hasAnyOf(fieldDecs, SECRET_DECORATORS))
-            eSecretFields += 1;
-          if (hasAnyOf(fieldDecs, ENCRYPT_DECORATORS))
-            eEncryptedFields += 1;
-        }
-        let apisWithAuth = 0;
-        let apisWithRateLimit = 0;
-        let auditedApis = 0;
-        for (const api of entityApis) {
-          const apiDecs = decoratorNames(api.decorators);
-          if (hasAnyOf(apiDecs, AUTH_DECORATORS))
-            apisWithAuth += 1;
-          if (hasAnyOf(apiDecs, RATE_LIMIT_DECORATORS))
-            apisWithRateLimit += 1;
-          if (apiDecs.has("audit"))
-            auditedApis += 1;
-        }
-        perEntity.push({
-          name,
-          complianceTags,
-          apiCount: entityApis.length,
-          apisWithAuth,
-          apisWithRateLimit,
-          fieldCount: entity.fields.length,
-          piiFields: ePiiFields,
-          secretFields: eSecretFields,
-          encryptedFields: eEncryptedFields,
-          auditedApis
-        });
-        totalApis += entityApis.length;
-        totalFields += entity.fields.length;
-        piiFields += ePiiFields;
-        secretFields += eSecretFields;
-        encryptedFields += eEncryptedFields;
-        apisWithAuthTotal += apisWithAuth;
-        apisWithRateLimitTotal += apisWithRateLimit;
-        apisAuditedTotal += auditedApis;
-      }
-      const summary = {
-        totalEntities: entities.size,
-        totalApis,
-        totalFields,
-        entitiesWithCompliance,
-        apisWithAuth: apisWithAuthTotal,
-        apisWithRateLimit: apisWithRateLimitTotal,
-        apisAudited: apisAuditedTotal,
-        fieldsProtected: piiFields + secretFields + encryptedFields,
-        piiFields,
-        secretFields,
-        encryptedFields
-      };
-      return { entities: perEntity, summary, orphanApis };
-    }
-    function renderCoverageTable(report) {
-      const rows = [];
-      rows.push([
-        "Entity",
-        "Tags",
-        "APIs",
-        "w/ @auth",
-        "w/ @rate",
-        "w/ @audit",
-        "Fields",
-        "@pii",
-        "@secret",
-        "@encrypt"
-      ]);
-      for (const e of report.entities) {
-        rows.push([
-          e.name,
-          e.complianceTags.length === 0 ? "-" : e.complianceTags.map((t) => `@${t}`).join(" "),
-          String(e.apiCount),
-          ratio(e.apisWithAuth, e.apiCount),
-          ratio(e.apisWithRateLimit, e.apiCount),
-          ratio(e.auditedApis, e.apiCount),
-          String(e.fieldCount),
-          String(e.piiFields),
-          String(e.secretFields),
-          String(e.encryptedFields)
-        ]);
-      }
-      const widths = computeWidths(rows);
-      const pad = (cells) => cells.map((c, i) => c.padEnd(widths[i])).join("  ");
-      const lines = [];
-      lines.push(`Security coverage \u2014 ${report.summary.totalEntities} entities, ${report.summary.totalApis} APIs, ${report.summary.totalFields} fields`);
-      lines.push("");
-      lines.push(pad(rows[0]));
-      lines.push(widths.map((w) => "-".repeat(w)).join("  "));
-      for (const row of rows.slice(1))
-        lines.push(pad(row));
-      lines.push("");
-      lines.push("Rollup:");
-      lines.push(`  entities with compliance tag: ${summaryRatio(report.summary.entitiesWithCompliance, report.summary.totalEntities)}`);
-      lines.push(`  APIs with @auth:              ${summaryRatio(report.summary.apisWithAuth, report.summary.totalApis)}`);
-      lines.push(`  APIs with @rateLimit:         ${summaryRatio(report.summary.apisWithRateLimit, report.summary.totalApis)}`);
-      lines.push(`  APIs with @audit:             ${summaryRatio(report.summary.apisAudited, report.summary.totalApis)}`);
-      lines.push(`  fields with any protection:   ${summaryRatio(report.summary.fieldsProtected, report.summary.totalFields)}`);
-      if (report.orphanApis > 0) {
-        lines.push(`  APIs returning a non-entity:  ${report.orphanApis} (not counted in entity rows)`);
-      }
-      return lines.join("\n") + "\n";
-    }
-    function decoratorNames(decorators) {
-      const out = /* @__PURE__ */ new Set();
-      for (const d of decorators ?? [])
-        out.add(d.name);
-      return out;
-    }
-    function hasAnyOf(names, required) {
-      for (const name of required) {
-        if (names.has(name))
-          return true;
-      }
-      return false;
-    }
-    function collectEntityNames(expr) {
-      const out = /* @__PURE__ */ new Set();
-      const walk = (t) => {
-        if (t.type === "TypeReference")
-          out.add(t.name);
-        if (t.type === "ArrayType")
-          walk(t.elementType);
-        if (t.type === "UnionType" && "types" in t) {
-          for (const sub of t.types)
-            walk(sub);
-        }
-      };
-      walk(expr);
-      return out;
-    }
-    function ratio(n, total) {
-      if (total === 0)
-        return "\u2014";
-      return `${n}/${total}`;
-    }
-    function summaryRatio(n, total) {
-      if (total === 0)
-        return "\u2014 (n/a)";
-      const pct = Math.round(n / total * 100);
-      return `${n}/${total} (${pct}%)`;
-    }
-    function computeWidths(rows) {
-      if (rows.length === 0)
-        return [];
-      const widths = new Array(rows[0].length).fill(0);
-      for (const row of rows) {
-        for (let i = 0; i < row.length; i += 1) {
-          widths[i] = Math.max(widths[i], row[i].length);
-        }
-      }
-      return widths;
-    }
-  }
-});
-
-// ../typechecker/dist/index.js
-var require_dist4 = __commonJS({
-  "../typechecker/dist/index.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.renderCoverageTable = exports2.computeCoverage = exports2.FIXABLE_CODES = exports2.fixFindings = exports2.BASELINE_VERSION = exports2.parseBaseline = exports2.serializeBaseline = exports2.applyBaseline = exports2.createBaseline = exports2.TYPERION_AUDITOR_NAME = exports2.SARIF_VERSION = exports2.SARIF_SCHEMA_URI = exports2.RULE_CATALOGUE = exports2.renderSarif = exports2.SecurityAuditor = exports2.listErrorCodes = exports2.explainErrorCode = exports2.getErrorCode = exports2.ERROR_CODES = exports2.SystemChecker = exports2.BehaviorChecker = exports2.CompletenessChecker = exports2.Scope = exports2.TypeChecker = void 0;
-    var checker_js_1 = require_checker();
-    Object.defineProperty(exports2, "TypeChecker", { enumerable: true, get: function() {
-      return checker_js_1.TypeChecker;
-    } });
-    var scope_js_1 = require_scope();
-    Object.defineProperty(exports2, "Scope", { enumerable: true, get: function() {
-      return scope_js_1.Scope;
-    } });
-    var completeness_checker_js_1 = require_completeness_checker();
-    Object.defineProperty(exports2, "CompletenessChecker", { enumerable: true, get: function() {
-      return completeness_checker_js_1.CompletenessChecker;
-    } });
-    var behavior_checker_js_1 = require_behavior_checker();
-    Object.defineProperty(exports2, "BehaviorChecker", { enumerable: true, get: function() {
-      return behavior_checker_js_1.BehaviorChecker;
-    } });
-    var system_checker_js_1 = require_system_checker();
-    Object.defineProperty(exports2, "SystemChecker", { enumerable: true, get: function() {
-      return system_checker_js_1.SystemChecker;
-    } });
-    var error_codes_js_1 = require_error_codes();
-    Object.defineProperty(exports2, "ERROR_CODES", { enumerable: true, get: function() {
-      return error_codes_js_1.ERROR_CODES;
-    } });
-    Object.defineProperty(exports2, "getErrorCode", { enumerable: true, get: function() {
-      return error_codes_js_1.getErrorCode;
-    } });
-    Object.defineProperty(exports2, "explainErrorCode", { enumerable: true, get: function() {
-      return error_codes_js_1.explainErrorCode;
-    } });
-    Object.defineProperty(exports2, "listErrorCodes", { enumerable: true, get: function() {
-      return error_codes_js_1.listErrorCodes;
-    } });
-    var security_auditor_js_1 = require_security_auditor();
-    Object.defineProperty(exports2, "SecurityAuditor", { enumerable: true, get: function() {
-      return security_auditor_js_1.SecurityAuditor;
-    } });
-    var security_auditor_sarif_js_1 = require_security_auditor_sarif();
-    Object.defineProperty(exports2, "renderSarif", { enumerable: true, get: function() {
-      return security_auditor_sarif_js_1.renderSarif;
-    } });
-    Object.defineProperty(exports2, "RULE_CATALOGUE", { enumerable: true, get: function() {
-      return security_auditor_sarif_js_1.RULE_CATALOGUE;
-    } });
-    Object.defineProperty(exports2, "SARIF_SCHEMA_URI", { enumerable: true, get: function() {
-      return security_auditor_sarif_js_1.SARIF_SCHEMA_URI;
-    } });
-    Object.defineProperty(exports2, "SARIF_VERSION", { enumerable: true, get: function() {
-      return security_auditor_sarif_js_1.SARIF_VERSION;
-    } });
-    Object.defineProperty(exports2, "TYPERION_AUDITOR_NAME", { enumerable: true, get: function() {
-      return security_auditor_sarif_js_1.TYPERION_AUDITOR_NAME;
-    } });
-    var security_baseline_js_1 = require_security_baseline();
-    Object.defineProperty(exports2, "createBaseline", { enumerable: true, get: function() {
-      return security_baseline_js_1.createBaseline;
-    } });
-    Object.defineProperty(exports2, "applyBaseline", { enumerable: true, get: function() {
-      return security_baseline_js_1.applyBaseline;
-    } });
-    Object.defineProperty(exports2, "serializeBaseline", { enumerable: true, get: function() {
-      return security_baseline_js_1.serializeBaseline;
-    } });
-    Object.defineProperty(exports2, "parseBaseline", { enumerable: true, get: function() {
-      return security_baseline_js_1.parseBaseline;
-    } });
-    Object.defineProperty(exports2, "BASELINE_VERSION", { enumerable: true, get: function() {
-      return security_baseline_js_1.BASELINE_VERSION;
-    } });
-    var security_fixer_js_1 = require_security_fixer();
-    Object.defineProperty(exports2, "fixFindings", { enumerable: true, get: function() {
-      return security_fixer_js_1.fixFindings;
-    } });
-    Object.defineProperty(exports2, "FIXABLE_CODES", { enumerable: true, get: function() {
-      return security_fixer_js_1.FIXABLE_CODES;
-    } });
-    var security_coverage_js_1 = require_security_coverage();
-    Object.defineProperty(exports2, "computeCoverage", { enumerable: true, get: function() {
-      return security_coverage_js_1.computeCoverage;
-    } });
-    Object.defineProperty(exports2, "renderCoverageTable", { enumerable: true, get: function() {
-      return security_coverage_js_1.renderCoverageTable;
-    } });
-  }
-});
-
 // ../codegen/dist/ir.js
 var require_ir = __commonJS({
   "../codegen/dist/ir.js"(exports2) {
@@ -11704,296 +9916,14 @@ var require_typescript_printer = __commonJS({
   }
 });
 
-// ../codegen/dist/language-ast/graphql-builder.js
-var require_graphql_builder = __commonJS({
-  "../codegen/dist/language-ast/graphql-builder.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.GraphQL = void 0;
-    exports2.gqlNamed = gqlNamed;
-    exports2.gqlList = gqlList;
-    exports2.gqlNonNull = gqlNonNull;
-    exports2.gqlArg = gqlArg;
-    exports2.gqlField = gqlField;
-    exports2.gqlObjectType = gqlObjectType;
-    exports2.gqlInputType = gqlInputType;
-    exports2.gqlEnumValue = gqlEnumValue;
-    exports2.gqlEnum = gqlEnum;
-    exports2.gqlQuery = gqlQuery;
-    exports2.gqlMutation = gqlMutation;
-    exports2.gqlComment = gqlComment;
-    var base_js_1 = require_base();
-    function gqlNamed(name) {
-      return { kind: "g-named-type", name: (0, base_js_1.ident)(name) };
-    }
-    function gqlList(inner) {
-      return { kind: "g-list-type", inner };
-    }
-    function gqlNonNull(inner) {
-      return { kind: "g-nonnull-type", inner };
-    }
-    function gqlArg(name, type) {
-      return { kind: "g-arg", name: (0, base_js_1.ident)(name), type };
-    }
-    function gqlField(args) {
-      return {
-        kind: "g-field",
-        name: (0, base_js_1.ident)(args.name),
-        type: args.type,
-        args: args.args ?? []
-      };
-    }
-    function gqlObjectType(args) {
-      return { kind: "g-object-type", name: (0, base_js_1.ident)(args.name), fields: args.fields };
-    }
-    function gqlInputType(args) {
-      return { kind: "g-input-type", name: (0, base_js_1.ident)(args.name), fields: args.fields };
-    }
-    function gqlEnumValue(name) {
-      return { kind: "g-enum-value", name: (0, base_js_1.ident)(name) };
-    }
-    function gqlEnum(args) {
-      return { kind: "g-enum", name: (0, base_js_1.ident)(args.name), values: args.values };
-    }
-    function gqlQuery(fields) {
-      return { kind: "g-query", fields };
-    }
-    function gqlMutation(fields) {
-      return { kind: "g-mutation", fields };
-    }
-    function gqlComment(text) {
-      return { kind: "g-comment", text };
-    }
-    exports2.GraphQL = {
-      named: gqlNamed,
-      list: gqlList,
-      nonNull: gqlNonNull,
-      arg: gqlArg,
-      field: gqlField,
-      objectType: gqlObjectType,
-      inputType: gqlInputType,
-      enumValue: gqlEnumValue,
-      enum: gqlEnum,
-      query: gqlQuery,
-      mutation: gqlMutation,
-      comment: gqlComment
-    };
-  }
-});
-
-// ../codegen/dist/language-ast/graphql-serializer.js
-var require_graphql_serializer = __commonJS({
-  "../codegen/dist/language-ast/graphql-serializer.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.graphqlSerializer = exports2.GraphQLSerializer = void 0;
-    var base_js_1 = require_base();
-    var KW_TYPE = "type";
-    var KW_INPUT = "input";
-    var KW_ENUM = "enum";
-    var KW_QUERY = "Query";
-    var KW_MUTATION = "Mutation";
-    var SPACE = " ";
-    var NL = "\n";
-    var COMMA = ", ";
-    var COLON = ": ";
-    var OPEN_BRACE = "{";
-    var CLOSE_BRACE = "}";
-    var OPEN_PAREN = "(";
-    var CLOSE_PAREN = ")";
-    var OPEN_BRACKET = "[";
-    var CLOSE_BRACKET = "]";
-    var BANG = "!";
-    var HASH = "# ";
-    var GraphQLSerializer = class {
-      language = "graphql";
-      serialize(node, ctx = (0, base_js_1.makeContext)()) {
-        switch (node.kind) {
-          case "g-named-type":
-            return node.name;
-          case "g-list-type":
-            return OPEN_BRACKET + this.serialize(node.inner) + CLOSE_BRACKET;
-          case "g-nonnull-type":
-            return this.serialize(node.inner) + BANG;
-          case "g-field":
-            return this.field(node);
-          case "g-arg":
-            return this.arg(node);
-          case "g-object-type":
-            return this.objectType(node, ctx);
-          case "g-input-type":
-            return this.inputType(node, ctx);
-          case "g-enum":
-            return this.enumDecl(node, ctx);
-          case "g-enum-value":
-            return node.name;
-          case "g-query":
-            return this.queryDecl(node, ctx);
-          case "g-mutation":
-            return this.mutationDecl(node, ctx);
-          case "g-comment":
-            return this.comment(node);
-          case "raw":
-            return node.text;
-          default:
-            throw new Error("GraphQLSerializer: unknown " + node.kind);
-        }
-      }
-      field(node) {
-        const args = node.args.length > 0 ? OPEN_PAREN + node.args.map((a) => this.arg(a)).join(COMMA) + CLOSE_PAREN : "";
-        return node.name + args + COLON + this.serialize(node.type);
-      }
-      arg(node) {
-        return node.name + COLON + this.serialize(node.type);
-      }
-      objectType(node, ctx) {
-        return this.blockDecl(KW_TYPE, node.name, node.fields, ctx);
-      }
-      inputType(node, ctx) {
-        return this.blockDecl(KW_INPUT, node.name, node.fields, ctx);
-      }
-      blockDecl(keyword, name, fields, ctx) {
-        const inner = ctx.indented();
-        const prefix = inner.indentString.repeat(inner.indent);
-        const lines = [];
-        for (const f of fields)
-          lines.push(prefix + this.field(f));
-        return keyword + SPACE + name + SPACE + OPEN_BRACE + NL + lines.join(NL) + NL + CLOSE_BRACE;
-      }
-      enumDecl(node, ctx) {
-        const inner = ctx.indented();
-        const prefix = inner.indentString.repeat(inner.indent);
-        const lines = [];
-        for (const v of node.values)
-          lines.push(prefix + v.name);
-        return KW_ENUM + SPACE + node.name + SPACE + OPEN_BRACE + NL + lines.join(NL) + NL + CLOSE_BRACE;
-      }
-      queryDecl(node, ctx) {
-        return this.blockDecl(KW_TYPE, KW_QUERY, node.fields, ctx);
-      }
-      mutationDecl(node, ctx) {
-        return this.blockDecl(KW_TYPE, KW_MUTATION, node.fields, ctx);
-      }
-      comment(node) {
-        const lines = node.text.split(NL);
-        const out = [];
-        for (const l of lines)
-          out.push(HASH + l);
-        return (0, base_js_1.joinLines)(out, NL);
-      }
-    };
-    exports2.GraphQLSerializer = GraphQLSerializer;
-    exports2.graphqlSerializer = new GraphQLSerializer();
-  }
-});
-
-// ../codegen/dist/printers/graphql-printer.js
-var require_graphql_printer = __commonJS({
-  "../codegen/dist/printers/graphql-printer.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.GraphQLPrinter = void 0;
-    var graphql_builder_js_1 = require_graphql_builder();
-    var graphql_serializer_js_1 = require_graphql_serializer();
-    var base_js_1 = require_base();
-    function toGQLType(typeStr) {
-      if (typeStr.endsWith("[]")) {
-        return graphql_builder_js_1.GraphQL.list(graphql_builder_js_1.GraphQL.nonNull(toGQLType(typeStr.slice(0, -2))));
-      }
-      return graphql_builder_js_1.GraphQL.named(typeStr);
-    }
-    function withNonNull(type, nonNull) {
-      return nonNull ? graphql_builder_js_1.GraphQL.nonNull(type) : type;
-    }
-    function transformField(f) {
-      const base = toGQLType(f.type);
-      const type = withNonNull(base, !f.optional);
-      return graphql_builder_js_1.GraphQL.field({ name: f.name, type });
-    }
-    function transformMethod(m) {
-      const args = [];
-      for (const p of m.params) {
-        const base = toGQLType(p.type);
-        args.push(graphql_builder_js_1.GraphQL.arg(p.name, withNonNull(base, !p.optional)));
-      }
-      const returnType = withNonNull(toGQLType(m.returnType), true);
-      return graphql_builder_js_1.GraphQL.field({ name: m.name, type: returnType, args });
-    }
-    function printNode(node) {
-      switch (node.nodeKind) {
-        case "interface": {
-          const fields = [];
-          for (const f of node.fields)
-            fields.push(transformField(f));
-          if (node.methods) {
-            for (const m of node.methods)
-              fields.push(transformMethod(m));
-          }
-          const keyword = node.keyword;
-          if (keyword === "input") {
-            return graphql_serializer_js_1.graphqlSerializer.serialize(graphql_builder_js_1.GraphQL.inputType({ name: node.name, fields }));
-          }
-          if (keyword === "Query") {
-            return graphql_serializer_js_1.graphqlSerializer.serialize(graphql_builder_js_1.GraphQL.query(fields));
-          }
-          if (keyword === "Mutation") {
-            return graphql_serializer_js_1.graphqlSerializer.serialize(graphql_builder_js_1.GraphQL.mutation(fields));
-          }
-          return graphql_serializer_js_1.graphqlSerializer.serialize(graphql_builder_js_1.GraphQL.objectType({ name: node.name, fields }));
-        }
-        case "enum": {
-          const values = node.variants.map((v) => graphql_builder_js_1.GraphQL.enumValue(v.name));
-          return graphql_serializer_js_1.graphqlSerializer.serialize(graphql_builder_js_1.GraphQL.enum({ name: node.name, values }));
-        }
-        case "field": {
-          return graphql_serializer_js_1.graphqlSerializer.serialize(transformField(node));
-        }
-        case "method": {
-          return graphql_serializer_js_1.graphqlSerializer.serialize(transformMethod(node));
-        }
-        case "comment": {
-          return graphql_serializer_js_1.graphqlSerializer.serialize(graphql_builder_js_1.GraphQL.comment(node.text));
-        }
-        case "raw": {
-          return node.code;
-        }
-        case "function":
-        case "file":
-        case "import":
-        case "param":
-        case "enum-variant":
-        case "type-alias":
-        case "class":
-        case "const":
-        default: {
-          return graphql_serializer_js_1.graphqlSerializer.serialize((0, base_js_1.raw)("# unknown: " + node.nodeKind, "unsupported-feature"));
-        }
-      }
-    }
-    exports2.GraphQLPrinter = {
-      target: "graphql",
-      print(node) {
-        return printNode(node);
-      },
-      printFile(file) {
-        const parts = [];
-        for (const n of file.nodes)
-          parts.push(printNode(n));
-        return parts.join("\n\n");
-      }
-    };
-  }
-});
-
 // ../codegen/dist/codegen-contract/ast-builders.js
 var require_ast_builders = __commonJS({
   "../codegen/dist/codegen-contract/ast-builders.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.GraphQLPrinter = exports2.TypeScriptPrinter = exports2.CodeBuilder = void 0;
+    exports2.TypeScriptPrinter = exports2.CodeBuilder = void 0;
     exports2.nodeToString = nodeToString;
     var typescript_printer_js_1 = require_typescript_printer();
-    var graphql_printer_js_1 = require_graphql_printer();
     exports2.CodeBuilder = {
       /** Create a file containing code nodes. */
       file(path2, nodes) {
@@ -12126,7 +10056,6 @@ var require_ast_builders = __commonJS({
       }
     };
     exports2.TypeScriptPrinter = typescript_printer_js_1.TypeScriptPrinter;
-    exports2.GraphQLPrinter = graphql_printer_js_1.GraphQLPrinter;
     function nodeToString(node) {
       if (node.nodeKind === "raw")
         return node.code;
@@ -13868,7 +11797,7 @@ var fs = __toESM(require("node:fs"));
 var path = __toESM(require("node:path"));
 var import_lexer = __toESM(require_dist2());
 var import_parser = __toESM(require_dist3());
-var import_typechecker = __toESM(require_dist4());
+var import_checker = __toESM(require_checker());
 var import_ir_compiler = __toESM(require_ir_compiler());
 var import_ts_codegen = __toESM(require_ts_codegen());
 var import_openapi_codegen = __toESM(require_openapi_codegen());
@@ -13888,7 +11817,7 @@ function parseToProgram(source, file) {
   return program;
 }
 function typecheckOrDie(program, file) {
-  const { diagnostics } = new import_typechecker.TypeChecker().check(program, file);
+  const { diagnostics } = new import_checker.TypeChecker().check(program, file);
   const errors = diagnostics.filter((d) => d.severity === "error");
   if (errors.length > 0) {
     console.error(`\u2717 ${file}:`);