heximon 0.4.0 → 0.6.0

package/dist/bin.mjs

@@ -3,18 +3,19 @@ import { c as RegistryAccess, d as ClackPrompter, f as PromptCancelledError, l a
 import { createRequire, register } from "node:module";
 import { cancel, confirm, intro, isCancel, log, outro, select, spinner } from "@clack/prompts";
 import process from "node:process";
-import { spawnSync } from "node:child_process";
+import { spawn } from "node:child_process";
 import { defineCommand, runMain } from "citty";
-import { basename, dirname, join, relative, resolve } from "pathe";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "pathe";
 import tab from "@bomb.sh/tab/citty";
-import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
-import { CompileMode, DiagnosticCode, DiagnosticRenderMode, DiagnosticRenderer, DiagnosticSeverity, RuntimeSingletons, TerminalStyle, UpgradeBaselineFile } from "@heximon/compiler";
-import { ConfigLoader, LibraryEmitter, ProjectCompiler, RuntimeConfigLoader } from "@heximon/compiler/project";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { AstNodeType, CompileEnvironment, CompileMode, DeployPlatform, DiagnosticCode, DiagnosticRenderMode, DiagnosticRenderer, DiagnosticSeverity, ImportKind, ReexportIndex, RuntimeConfigFile, RuntimeSingletons, TerminalStyle, UpgradeBaselineFile } from "@heximon/compiler";
+import { ConfigLoader, LibraryEmitter, LibraryFactoryPreflight, ProjectCompiler, RuntimeConfigLoader, SourceModuleResolution, SourceParser, WorkspaceTopologyReader } from "@heximon/compiler/project";
 import { NodeCompileSeam } from "@heximon/node/compiler";
 import { TransactionCensus, TransactionCensusPolicy } from "@heximon/cqrs/compiler";
 import { BoundaryProvenanceAuditor, BoundaryProvenanceStatus, CredentialSelection, DatabaseConfigDetector, DeployDiagnosticSeverity, DeployLedger, DeployManifestStore, DeployRunner, DeployStrategyUnavailableError, DeployTargetResolver, DeployableServiceReader, DotenvCascade, DrizzleKitRunner, EnvFileReader, EnvFileUnreadableError, HostManagedDeployUnsupportedError, ImportScanner, MigrationInspector, MigrationTargetComposer, PackageCopyAuditor, PeerClosureAuditor, PlatformTracingAuditor, PlatformTracingStatus, WorkspaceConsumerLocator } from "@heximon/deploy";
 import { RouteCensus, RouteScopeGap } from "@heximon/http/compiler";
 import { pathToFileURL } from "node:url";
+import { homedir } from "node:os";
 //#region src/compile-diagnostics.ts
 /**
 * Renders compile diagnostics to stderr with the same codeframe layout the dev server shows — a box-drawing
@@ -123,6 +124,8 @@ var ProjectCompileSession = class ProjectCompileSession {
 	/** The compiler plugins the sidecar declares, merged with the platform strategy's own. */
 	plugins;
 	strategy;
+	/** The `$env` name the sidecar was read for, which the member sidecars of the workspace scan share. */
+	environment;
 	/** The runtime config file the app compile checks and bakes in, or `undefined` when there is none. */
 	runtimeConfig;
 	constructor(options) {
@@ -133,6 +136,7 @@ var ProjectCompileSession = class ProjectCompileSession {
 		this.sourceDirectories = options.sourceDirectories;
 		this.plugins = options.plugins;
 		this.strategy = options.strategy;
+		this.environment = options.environment;
 		this.outputDirectory = join(options.rootDir, ProjectCompileSession.outputDirectoryName);
 	}
 	/**
@@ -151,7 +155,8 @@ var ProjectCompileSession = class ProjectCompileSession {
 			runtimeConfig: await RuntimeConfigLoader.load(options.rootDir, config, options.environment),
 			sourceDirectories: options.sourceDirectories,
 			plugins: NodeCompileSeam.mergePlugins(config?.plugins ?? [], strategy),
-			strategy
+			strategy,
+			environment: options.environment
 		});
 	}
 	/**
@@ -176,6 +181,42 @@ var ProjectCompileSession = class ProjectCompileSession {
 			...options.verifyBaseline === true ? { verifyBaseline: true } : {}
 		});
 	}
+	/** The platform the session compiles for, or `undefined` for the zero-config Node default. */
+	platformName() {
+		return this.strategy.platformName;
+	}
+	/**
+	* Run the compile `vp build` runs, into a chosen directory: the production graph with the sidecar's wiring
+	* mode, diagnostic dials and cross-service topology, which {@link compile} leaves out.
+	*
+	* @param outputDirectory - The directory the generated files will be written to. It must sit directly
+	*   under the project root, because the generated imports of the app source are relative to it.
+	* @param aliases - The module aliases of the project (prefix → absolute path), when it has some.
+	* @returns The compile output. Nothing is written.
+	*/
+	async compileProduction(outputDirectory, aliases = {
+		exact: {},
+		prefixes: {}
+	}) {
+		const workspaceSubscribers = await WorkspaceTopologyReader.resolveFromConfig(this.rootDir, this.plugins, this.config, this.environment);
+		return this.compiler.compile({
+			rootDir: this.rootDir,
+			outputDirectory,
+			plugins: this.plugins,
+			strategy: this.strategy,
+			environment: CompileEnvironment.Production,
+			aliases: aliases.prefixes,
+			exactAliases: aliases.exact,
+			...this.sourceDirectories === void 0 ? {} : { sourceDirectories: this.sourceDirectories },
+			...this.config === void 0 ? {} : { config: this.config },
+			...this.config?.wiringMode === void 0 ? {} : { wiringMode: this.config.wiringMode },
+			...this.config?.strictDiagnostics === void 0 ? {} : { strictDiagnostics: this.config.strictDiagnostics },
+			...this.config?.suppressDiagnostics === void 0 ? {} : { suppressDiagnostics: this.config.suppressDiagnostics },
+			...this.runtimeConfig === void 0 ? {} : { runtimeConfig: this.runtimeConfig },
+			...this.config?.root === void 0 ? {} : { apps: { main: this.config.root } },
+			...workspaceSubscribers === void 0 ? {} : { workspaceSubscribers }
+		});
+	}
 	/**
 	* Run the library-mode compile — a published module package goes through the same {@link LibraryEmitter}
 	* its own `vp pack` build uses, rather than being compiled as an app. Not a byte-for-byte replay of that
@@ -1337,7 +1378,7 @@ var DoctorReport = class DoctorReport {
 *    ({@link PackageCopyAuditor.installedBoundaryPackages}) — exits non-zero; a fork confined to build-time
 *    tooling (e.g. a devDependency-only bundler) is reported and does not gate.
 * 3. the staleness check ({@link BoundaryProvenanceAuditor.auditSelf}) — this package's own
-*    `dist/heximon.manifest.json` against its own `src/`. Stale exits non-zero.
+*    `dist/heximon.manifest.json` against its own source directory. Stale exits non-zero.
 *
 * Compile-free and filesystem-local (the `heximon.config.ts` sidecar is loaded only to read
 * `expectedOpenPeers`); exits non-zero when this package forks a runtime-reachable package against a
@@ -1378,7 +1419,7 @@ const doctorCommand = defineCommand({
 			let forked = false;
 			if (workspaceConsumers === null) log.info("Package copies — no pnpm workspace found from this directory; census not run.");
 			else forked = DoctorReport.logCopyAudit(PackageCopyAuditor.auditLibrary(rootDir, workspaceConsumers.consumers), DoctorReport.runtimeReachablePackageNames(rootDir, closureReport));
-			const selfReport = BoundaryProvenanceAuditor.auditSelf(rootDir);
+			const selfReport = await BoundaryProvenanceAuditor.auditSelf(rootDir);
 			const outroParts = [];
 			let exitFailure = forked || registryFailed;
 			if (forked) {
@@ -2137,66 +2178,150 @@ var RouteTableReport = class RouteTableReport {
 	}
 };
 //#endregion
-//#region src/routes-command.ts
+//#region src/transform-boot.ts
 /**
-* Boots an app in-process to read its live HTTP route table — the `--boot` fallback for a route surface the
-* compiler cannot describe statically. Booting imports the app's TypeScript source through `.js` specifiers,
-* and Heximon's parameter-property classes need a TypeScript TRANSFORM (not just type-stripping), so the boot
-* runs under a one-time re-exec with Node's transform-types enabled plus a resolve hook that maps those `.js`
-* specifiers to their `.ts` sources.
+* Runs a command that imports an app's TypeScript source in-process (`routes --boot`, `task run`).
+* The generated wiring imports the source through `.js` specifiers, and Heximon's parameter-property
+* classes need a TypeScript TRANSFORM (not just type-stripping), so such a command runs under a one-time
+* re-exec with Node's transform-types enabled plus a resolve hook that maps those `.js` specifiers to their
+* `.ts` sources.
 */
-var RoutesBoot = class RoutesBoot {
+var TransformBoot = class TransformBoot {
 	/** Set on the re-exec'd child so it boots rather than re-exec'ing again. */
 	static transformMarker = "HEXIMON_ROUTES_TRANSFORM";
+	/** The signals that reach only the parent, and so are passed on to the child. */
+	static forwardedSignals = ["SIGTERM", "SIGHUP"];
 	/** The `.js`/extensionless → `.ts` ESM resolve hook, inlined as a `data:` module so it ships in no file. */
-	static sourceResolverModule = RoutesBoot.buildSourceResolverModule();
+	static sourceResolverModule = TransformBoot.buildSourceResolverModule();
 	/** Whether this process is the transform-enabled child that performs the boot. */
 	static isBootProcess() {
-		return process.env[RoutesBoot.transformMarker] === "1";
+		return process.env[TransformBoot.transformMarker] === "1";
 	}
 	/**
 	* Re-run this exact CLI invocation under `node --experimental-transform-types`, inheriting stdio so the
 	* child's output and prompts reach the terminal directly.
 	*
+	* The child owns an interrupt: a terminal sends Ctrl-C to both processes, and the child cleans up. A
+	* `SIGTERM` or `SIGHUP` that reaches only this process is passed on, so the child never outlives it.
+	*
 	* A child that never started, or that a signal killed, reports no exit code. Both become `1` — but they
 	* are NAMED on stderr first, because the child printed nothing of its own and a bare `exit 1` after a
 	* silent run reads as "the command found a problem" rather than "the command never ran".
 	*
+	* @param commandLabel - The command name for the failure messages (`routes --boot`, `task run`).
 	* @returns The child process exit code (1 when it did not report one).
 	*/
-	static reexecUnderTransform() {
-		const result = spawnSync(process.execPath, [
-			"--experimental-transform-types",
-			"--disable-warning=ExperimentalWarning",
-			process.argv[1] ?? "",
-			...process.argv.slice(2)
-		], {
-			stdio: "inherit",
-			env: {
-				...process.env,
-				[RoutesBoot.transformMarker]: "1"
+	static reexecUnderTransform(commandLabel) {
+		return new Promise((resolve) => {
+			const child = spawn(process.execPath, [
+				"--experimental-transform-types",
+				"--disable-warning=ExperimentalWarning",
+				process.argv[1] ?? "",
+				...process.argv.slice(2)
+			], {
+				stdio: "inherit",
+				env: {
+					...process.env,
+					[TransformBoot.transformMarker]: "1"
+				}
+			});
+			const ignoreInterrupt = () => void 0;
+			const forwarded = TransformBoot.forwardedSignals.map((signal) => {
+				const forward = () => {
+					child.kill(signal);
+				};
+				process.on(signal, forward);
+				return [signal, forward];
+			});
+			process.on("SIGINT", ignoreInterrupt);
+			const finish = (code) => {
+				process.off("SIGINT", ignoreInterrupt);
+				for (const [signal, forward] of forwarded) process.off(signal, forward);
+				resolve(code);
+			};
+			child.once("error", (error) => {
+				process.stderr.write(`heximon ${commandLabel}: could not start the transform-enabled child (${process.execPath}): ${error.message}\n`);
+				finish(1);
+			});
+			child.once("close", (code, signal) => {
+				if (signal !== null) process.stderr.write(`heximon ${commandLabel}: the transform-enabled child was killed by ${signal}.\n`);
+				finish(code ?? 1);
+			});
+		});
+	}
+	/**
+	* Install the source hooks so the imminent boot can import the app's `.ts` source.
+	*
+	* @param rewrites - Source text to serve instead of what is on disk, by absolute file path. A production
+	*   build applies these rewrites, which drop the imports of dev-only modules, so a production run applies them too.
+	* @param aliases - The module aliases of the project. An exact alias (`@app` → one file) matches that specifier
+	*   only. A prefix alias (`@users` → a directory) matches `@users/<rest>` on whole path segments, the longest
+	*   prefix first. An exact alias wins over a prefix. This is the precedence of the compile and of TypeScript.
+	*/
+	static registerSourceResolver(rewrites = /* @__PURE__ */ new Map(), aliases = {
+		exact: {},
+		prefixes: {}
+	}) {
+		register(TransformBoot.sourceResolverModule, {
+			parentURL: import.meta.url,
+			data: {
+				rewrites: [...rewrites].map(([filePath, content]) => [pathToFileURL(TransformBoot.realPath(filePath)).href, content]),
+				exact: Object.entries(aliases.exact),
+				aliases: Object.entries(aliases.prefixes),
+				compilerUrl: import.meta.resolve("@heximon/compiler/project")
 			}
 		});
-		if (result.error !== void 0) process.stderr.write(`heximon routes --boot: could not start the transform-enabled child (${process.execPath}): ${result.error.message}\n`);
-		else if (result.signal !== null && result.signal !== void 0) process.stderr.write(`heximon routes --boot: the transform-enabled child was killed by ${result.signal}.\n`);
-		return result.status ?? 1;
 	}
-	/** Install the source resolve hook so the imminent boot can import the app's `.ts` source. */
-	static registerSourceResolver() {
-		register(RoutesBoot.sourceResolverModule);
+	/** The real path of `path`, or `path` itself when it does not exist. */
+	static realPath(path) {
+		try {
+			return realpathSync(path);
+		} catch {
+			return path;
+		}
 	}
 	/** Build the inline resolve-hook module — mirrors the compiler's own relative-import resolution. */
 	static buildSourceResolverModule() {
 		const source = [
-			"import { existsSync } from \"node:fs\";",
+			"import { existsSync, realpathSync } from \"node:fs\";",
 			"import { fileURLToPath, pathToFileURL } from \"node:url\";",
+			"let rewrites = new Map();",
+			"let resolver;",
+			"export async function initialize(data) {",
+			"  rewrites = new Map(data.rewrites);",
+			"  // The alias rule is the compiler's own, so the boot and the compile agree on every specifier.",
+			"  if (data.aliases.length > 0 || data.exact.length > 0) {",
+			"    const compiler = await import(data.compilerUrl);",
+			"    resolver = new compiler.AliasModuleResolver(Object.fromEntries(data.aliases), undefined, Object.fromEntries(data.exact));",
+			"  }",
+			"}",
+			"export async function load(url, context, nextLoad) {",
+			"  const result = await nextLoad(url, context);",
+			"  const content = rewrites.get(url);",
+			"  return content === undefined ? result : { ...result, source: content };",
+			"}",
 			"export async function resolve(specifier, context, nextResolve) {",
 			"  if ((specifier.startsWith(\"./\") || specifier.startsWith(\"../\")) && context.parentURL) {",
 			"    const base = fileURLToPath(new URL(specifier, context.parentURL));",
 			"    const withoutJs = base.endsWith(\".js\") ? base.slice(0, -3) : base;",
 			"    for (const candidate of [withoutJs + \".ts\", base + \".ts\", base + \"/index.ts\"]) {",
 			"      if (candidate.endsWith(\".ts\") && existsSync(candidate)) {",
-			"        return { url: pathToFileURL(candidate).href, shortCircuit: true };",
+			"        return { url: pathToFileURL(realpathSync(candidate)).href, shortCircuit: true };",
+			"      }",
+			"    }",
+			"  }",
+			"  if (resolver !== undefined) {",
+			"    const resolution = resolver.explain(specifier);",
+			"    if (resolution.kind === \"scanned\" || resolution.kind === \"outside-scan\") {",
+			"      return { url: pathToFileURL(realpathSync(resolution.filePath)).href, shortCircuit: true };",
+			"    }",
+			"    if (resolution.kind === \"no-source-file\") {",
+			"      // The compile finds no file here either and leaves the specifier to the normal resolution, so an",
+			"      // installed package of the same name still loads. The alias is named only when that fails too.",
+			"      try {",
+			"        return await nextResolve(specifier, context);",
+			"      } catch (error) {",
+			"        throw new Error('The alias \"' + resolution.prefix + '\" does not resolve \"' + specifier + '\": no file exists at ' + resolution.base + '.', { cause: error });",
 			"      }",
 			"    }",
 			"  }",
@@ -2206,6 +2331,8 @@ var RoutesBoot = class RoutesBoot {
 		return `data:text/javascript,${encodeURIComponent(source)}`;
 	}
 };
+//#endregion
+//#region src/routes-command.ts
 /**
 * `heximon routes` — print the app's unified HTTP route table (inline-mode AND contract-mode routes
 * together), each row carrying the authorization scopes the app enforces on it.
@@ -2263,8 +2390,8 @@ const routesCommand = defineCommand({
 	},
 	async run({ args }) {
 		const asBoot = args.boot;
-		if (asBoot && !RoutesBoot.isBootProcess()) {
-			process.exitCode = RoutesBoot.reexecUnderTransform();
+		if (asBoot && !TransformBoot.isBootProcess()) {
+			process.exitCode = await TransformBoot.reexecUnderTransform("routes --boot");
 			return;
 		}
 		const rootDir = resolve(process.cwd(), args.cwd);
@@ -2341,7 +2468,7 @@ var RoutesCommand = class RoutesCommand {
 		let app;
 		let inventory;
 		try {
-			RoutesBoot.registerSourceResolver();
+			TransformBoot.registerSourceResolver();
 			const sourceDirectories = SourceDirectories.resolve(rootDir, args.src);
 			DotenvCascade.loadInto(rootDir, args.env);
 			const config = await ConfigLoader.load(rootDir, args.env);
@@ -2455,6 +2582,1514 @@ var RoutesCommand = class RoutesCommand {
 	}
 };
 //#endregion
+//#region src/project-modules.ts
+/**
+* Imports packages the way the generated wiring imports them: through a small module written into the
+* compile output directory, which sits in the project. The specifiers inside it resolve from the project, so
+* the command gets the copy of a package that the wiring gets. A package the command imported from its own
+* install would be a second set of class objects, and `app.from(CoreModule)` would not know them.
+*/
+var ProjectModules = class ProjectModules {
+	/**
+	* Import `specifiers` of the project.
+	*
+	* @param directory - A directory inside the project, with write access (the compile output directory).
+	* @param fileName - The name of the module to write, unique among the calls for one directory.
+	* @param source - The module source: `export … from "<specifier>"` lines.
+	* @returns The namespace of the written module.
+	*/
+	static async import(directory, fileName, source) {
+		const file = join(directory, fileName);
+		writeFileSync(file, source);
+		return await import(pathToFileURL(file).href);
+	}
+	/** The runtime of the project: everything the command asks of `@heximon/runtime`. */
+	static runtime(directory) {
+		return ProjectModules.import(directory, "project-runtime.js", "export * from \"@heximon/runtime\";\n");
+	}
+};
+//#endregion
+//#region src/nitro-host.ts
+/**
+* The production inputs of a Nitro host project, for the preset that was read from its config files. The
+* preset picks the deploy platform, and the compile adds the Nitro host plugin, so a compile that reads the
+* sidecar alone would build another graph. `@heximon/nitro` of the project makes the inputs from the preset
+* name. Both packages load from the project, so the plugins, the strategy and the compiler are one copy. No
+* Nitro or Vite config runs.
+*/
+var NitroHost = class NitroHost {
+	context;
+	aliases;
+	constructor(context, aliases) {
+		this.context = context;
+		this.aliases = aliases;
+	}
+	/**
+	* Resolve the inputs of the Nitro host.
+	*
+	* @param rootDir - The project root.
+	* @param directory - A directory inside the project to write the import module into.
+	* @param request - The preset (or the choice to take the platform from the sidecar), the literal source
+	*   directories of the Nitro config, and the module aliases of the project (the tsconfig `paths`).
+	* @throws {Error} When `@heximon/nitro` is not installed in the project.
+	*/
+	static async open(rootDir, directory, request) {
+		const modules = await ProjectModules.import(directory, "project-nitro.js", "export { resolveNitroPresetInputs } from \"@heximon/nitro/module\";\n");
+		return new NitroHost(await modules.resolveNitroPresetInputs({
+			rootDirectory: rootDir,
+			preset: request.preset,
+			aliases: request.aliases.prefixes,
+			...request.serverDir === void 0 ? {} : { serverDir: request.serverDir },
+			...request.scanDirs === void 0 ? {} : { scanDirs: request.scanDirs },
+			...request.platformFromSidecar === true ? { platformFromSidecar: true } : {}
+		}), request.aliases);
+	}
+	/** Whether the sidecar declares the deploy platform. */
+	hasSidecarPlatform() {
+		return this.context.config?.platform !== void 0;
+	}
+	/**
+	* Run the compile the host's production build runs.
+	*
+	* @param rootDir - The project root.
+	* @param outputDirectory - Where the generated files will be written.
+	* @param sourceDirectories - The source directories to scan instead of the host's, when the caller has some.
+	*/
+	compile(rootDir, outputDirectory, sourceDirectories) {
+		const context = this.context;
+		const config = context.config;
+		const compiler = new ProjectCompiler();
+		return {
+			output: compiler.compile({
+				rootDir,
+				outputDirectory,
+				sourceDirectories: sourceDirectories ?? context.sourceDirectories,
+				aliases: this.aliases.prefixes,
+				exactAliases: this.aliases.exact,
+				plugins: context.plugins,
+				strategy: context.strategy,
+				...context.wiringMode === void 0 ? {} : { wiringMode: context.wiringMode },
+				...config === void 0 ? {} : { config },
+				...context.runtimeConfig === void 0 ? {} : { runtimeConfig: context.runtimeConfig },
+				...config?.root === void 0 ? {} : { apps: { main: config.root } },
+				...context.workspaceSubscribers === void 0 ? {} : { workspaceSubscribers: context.workspaceSubscribers }
+			}),
+			compiler,
+			platformName: context.strategy.platformName
+		};
+	}
+};
+//#endregion
+//#region src/nitro-static-config.ts
+/**
+* Reads the Nitro options that choose the graph of a build (`preset`, `serverDir`, `scanDirs`) from the source of
+* the config files, without running them. A config file is project code: it can read the environment, call a
+* service, or write a file. So the files are parsed with oxc, and the reader ACCEPTS only a shape that it can
+* prove. Everything else is "computed", and the command then refuses or asks for an explicit input.
+*
+* Accepted in `nitro.config.*`: `export default {…}`, or `export default defineNitroConfig({…})` with
+* `defineNitroConfig` imported from `nitro` or `nitro/config`, or either one through ONE top-level `const` that is
+* never assigned again. The object has no spread. A `$production` or `$env.production` overlay applies; the other
+* environments do not, because the command always compiles for production.
+*
+* Accepted in `vite.config.*`: ONE call of the Nitro plugin of `nitro/vite` (a named or a namespace import), as a
+* direct element of the `plugins` array literal of the exported config (`export default {…}`, or `defineConfig`
+* from `vite` over one, or either through one `const`). No ternary, no `&&`, no spread, no helper, no function.
+*
+* The precedence is Nitro's own: the options of the Vite config, then `NITRO_PRESET` / `SERVER_PRESET`, then the
+* Nitro config file.
+*/
+var NitroStaticConfig = class NitroStaticConfig {
+	static nitroConfigNames = [
+		"nitro.config.ts",
+		"nitro.config.mts",
+		"nitro.config.js",
+		"nitro.config.mjs"
+	];
+	static viteConfigNames = [
+		"vite.config.ts",
+		"vite.config.mts",
+		"vite.config.js",
+		"vite.config.mjs"
+	];
+	/** Nuxt creates its own Nitro, which a static read of these files cannot describe. */
+	static nuxtConfigNames = [
+		"nuxt.config.ts",
+		"nuxt.config.mts",
+		"nuxt.config.js",
+		"nuxt.config.mjs"
+	];
+	/** The extensions c12 tries for a config file, scripts and data formats. */
+	static configExtensions = [
+		".js",
+		".ts",
+		".mjs",
+		".cjs",
+		".mts",
+		".cts",
+		".json",
+		".jsonc",
+		".json5",
+		".yaml",
+		".yml",
+		".toml"
+	];
+	/** The exact name of the rc file c12 reads for Nitro. */
+	static resourceFileName = ".nitrorc";
+	/** The expression nodes that only wrap another expression. */
+	static wrapperTypes = [
+		"TSAsExpression",
+		"TSSatisfiesExpression",
+		"TSNonNullExpression",
+		"TSTypeAssertion",
+		"ParenthesizedExpression"
+	];
+	/** The module that exports the Nitro Vite plugin. */
+	static nitroVitePackage = "nitro/vite";
+	/** The helper that returns its Nitro config unchanged, and where it is imported from. */
+	static nitroConfigHelper = {
+		name: "defineNitroConfig",
+		packages: ["nitro", "nitro/config"]
+	};
+	/** The helper that returns its Vite config unchanged, and where it is imported from. */
+	static viteConfigHelper = {
+		name: "defineConfig",
+		packages: ["vite", "vite-plus"]
+	};
+	/**
+	* @param rootDir - The project root.
+	* @param environment - The environment to read `NITRO_PRESET` from; the process environment by default.
+	*/
+	static read(rootDir, environment = process.env) {
+		const find = (names) => names.map((name) => join(rootDir, name)).find((path) => existsSync(path));
+		const notAHost = {
+			isNitroHost: false,
+			preset: { kind: "none" },
+			serverDir: { kind: "none" },
+			scanDirs: { kind: "none" }
+		};
+		if (find(NitroStaticConfig.nuxtConfigNames) !== void 0) return notAHost;
+		const configFiles = NitroStaticConfig.configFilesOf(rootDir);
+		const nitroFile = configFiles.length === 1 && NitroStaticConfig.nitroConfigNames.some((name) => join(rootDir, name) === configFiles[0]) ? configFiles[0] : void 0;
+		const viteFile = find(NitroStaticConfig.viteConfigNames);
+		const vite = viteFile === void 0 ? void 0 : NitroStaticConfig.readVite(viteFile);
+		const hasNitroSource = configFiles.length > 0 || vite?.usesNitroPlugin === true;
+		if (!hasNitroSource && !NitroStaticConfig.dependsOnNitro(rootDir)) return notAHost;
+		const viteSources = vite?.sources ?? [];
+		const fileSources = nitroFile === void 0 ? [] : NitroStaticConfig.readNitroConfig(nitroFile);
+		const hiddenSources = NitroStaticConfig.hiddenSources(rootDir, hasNitroSource, nitroFile === void 0 ? configFiles : []);
+		const all = [
+			...viteSources,
+			...fileSources,
+			...hiddenSources
+		];
+		const fromVite = NitroStaticConfig.scalar("preset", viteSources, true);
+		const fromEnvironment = environment["NITRO_PRESET"] || environment["SERVER_PRESET"];
+		const found = fromVite.kind !== "none" ? fromVite : fromEnvironment ? {
+			kind: "literal",
+			value: fromEnvironment
+		} : NitroStaticConfig.scalar("preset", [...fileSources, ...hiddenSources], true);
+		const unreadable = all.find((source) => source.kind === "unproven");
+		return {
+			isNitroHost: true,
+			preset: unreadable !== void 0 && found.kind !== "computed" ? {
+				kind: "computed",
+				file: unreadable.file,
+				reason: unreadable.reason
+			} : NitroStaticConfig.withHidden(found, all, ["static", "extends"], ["defaultPreset"]),
+			serverDir: NitroStaticConfig.withHidden(NitroStaticConfig.scalar("serverDir", all), all, [], ["extends"]),
+			scanDirs: NitroStaticConfig.withHiddenList(NitroStaticConfig.list("scanDirs", all), all)
+		};
+	}
+	/**
+	* Sources of options that the project has but the reader cannot read: a `.nitrorc` file (in the project or the
+	* home directory), the `nitro` key of `package.json`, and a dependency on `nitro` when no config file or
+	* provable plugin call exists.
+	*/
+	static hiddenSources(rootDir, hasNitroSource, unreadFiles) {
+		const unproven = (reason) => ({
+			kind: "unproven",
+			file: join(rootDir, "package.json"),
+			reason
+		});
+		const sources = [];
+		const resourceFile = [rootDir, homedir()].map((directory) => join(directory, NitroStaticConfig.resourceFileName)).find((path) => existsSync(path));
+		if (resourceFile !== void 0) sources.push(unproven(`the file ${resourceFile} sets Nitro options`));
+		if (unreadFiles.length > 0) sources.push(unproven(`the file ${unreadFiles[0]} sets Nitro options in a form the command does not read`));
+		const manifest = NitroStaticConfig.manifestOf(rootDir);
+		if (manifest === "invalid") sources.push(unproven("package.json is not valid JSON"));
+		else if (manifest !== void 0) {
+			if (manifest.nitro !== void 0) sources.push(unproven("the `nitro` key of package.json sets Nitro options"));
+			if (!hasNitroSource && NitroStaticConfig.dependsOnNitro(rootDir)) sources.push(unproven("the project depends on nitro, but no Nitro config file or Nitro Vite plugin call was found"));
+		}
+		return sources;
+	}
+	/**
+	* Every file or directory that the config loader of Nitro (c12) would take as its main config: the name
+	* `nitro.config` in the project, in `.config/`, and `.config/nitro`, bare, with each supported extension, and as
+	* a directory with an `index` file. The project's own script forms are among them.
+	*/
+	static configFilesOf(rootDir) {
+		return [
+			join(rootDir, "nitro.config"),
+			join(rootDir, ".config", "nitro.config"),
+			join(rootDir, ".config", "nitro")
+		].flatMap((base) => ["", "/index"].flatMap((suffix) => ["", ...NitroStaticConfig.configExtensions].map((extension) => `${base}${suffix}${extension}`))).filter((path) => existsSync(path));
+	}
+	/** The parsed package.json of the project, `undefined` when it has none, `"invalid"` when it is not JSON. */
+	static manifestOf(rootDir) {
+		const file = join(rootDir, "package.json");
+		if (!existsSync(file)) return;
+		try {
+			return JSON.parse(readFileSync(file, "utf8"));
+		} catch {
+			return "invalid";
+		}
+	}
+	/** Whether package.json lists `nitro` as a dependency or a dev dependency. */
+	static dependsOnNitro(rootDir) {
+		const manifest = NitroStaticConfig.manifestOf(rootDir);
+		return manifest !== void 0 && manifest !== "invalid" && ("nitro" in (manifest.dependencies ?? {}) || "nitro" in (manifest.devDependencies ?? {}));
+	}
+	/**
+	* Apply the keys that change a value without showing in it. A key in `always` (for the preset: `static`, which
+	* turns a preset into its static variant) makes the value unknown. A key in `whenUnset` (`defaultPreset`,
+	* `extends`: the layers sit below every other source) matters only when no literal was found.
+	*/
+	static withHidden(value, sources, always, whenUnset) {
+		const hidden = (keys) => {
+			for (const source of sources) {
+				const key = source.kind === "object" ? keys.find((name) => source.entries.has(name)) : void 0;
+				if (source.kind === "object" && key !== void 0) return {
+					file: source.file,
+					key
+				};
+			}
+		};
+		const alwaysHidden = hidden(always);
+		const unsetHidden = value.kind === "none" ? hidden(whenUnset) : void 0;
+		const reason = alwaysHidden ?? unsetHidden;
+		return reason === void 0 ? value : {
+			kind: "computed",
+			file: reason.file,
+			reason: `\`${reason.key}\` can change the value`
+		};
+	}
+	/** A list gets every `extends` layer on top of it, so a layer makes it unknown. */
+	static withHiddenList(value, sources) {
+		const layered = sources.find((source) => source.kind === "object" && source.entries.has("extends"));
+		return layered === void 0 || layered.kind !== "object" ? value : {
+			kind: "computed",
+			file: layered.file,
+			reason: "`extends` can add values"
+		};
+	}
+	/**
+	* The option sources of a Nitro config file, highest priority first: the production overlays, then the
+	* object itself. An `extends` or `defaultPreset` key brings values that the source does not show, so it adds
+	* an unproven source below the object.
+	*/
+	static readNitroConfig(file) {
+		const { program, imports } = NitroStaticConfig.parse(file);
+		const resolved = NitroStaticConfig.exportedObject(program, imports, NitroStaticConfig.nitroConfigHelper);
+		if (resolved.kind === "unproven") return [{
+			kind: "unproven",
+			file,
+			reason: resolved.reason
+		}];
+		const base = NitroStaticConfig.prove(resolved.node, file);
+		if (base.kind === "unproven") return [base];
+		const overlay = /* @__PURE__ */ new Map();
+		const sources = [];
+		const overlays = [base.entries.get("$production")];
+		const environments = base.entries.get("$env");
+		if (environments !== void 0) {
+			const proven = NitroStaticConfig.prove(environments, file);
+			if (proven.kind === "unproven") sources.push(proven);
+			else overlays.push(proven.entries.get("production"));
+		}
+		for (const node of overlays) {
+			if (node === void 0) continue;
+			const proven = NitroStaticConfig.prove(node, file);
+			if (proven.kind === "unproven") sources.push(proven);
+			else for (const [key, value] of proven.entries) overlay.set(key, value);
+		}
+		if (overlay.size > 0) sources.push({
+			kind: "object",
+			file,
+			entries: overlay
+		});
+		sources.push(base);
+		return sources;
+	}
+	/**
+	* What the Vite config says: whether it imports the Nitro plugin, and the option sources it gives. Once the
+	* plugin is imported, anything the reader cannot prove makes the sources unproven; the project is still a
+	* Nitro host.
+	*/
+	static readVite(file) {
+		const { program, imports } = NitroStaticConfig.parse(file);
+		const named = /* @__PURE__ */ new Set();
+		const namespaces = /* @__PURE__ */ new Set();
+		for (const entry of imports) {
+			if (entry.request !== NitroStaticConfig.nitroVitePackage || entry.isTypeOnly) continue;
+			if (entry.importKind === ImportKind.Namespace) namespaces.add(entry.localName);
+			else if (entry.importKind === ImportKind.Named && entry.importedName === "nitro") named.add(entry.localName);
+		}
+		if (named.size === 0 && namespaces.size === 0) return {
+			usesNitroPlugin: false,
+			sources: []
+		};
+		const unproven = (reason) => ({
+			usesNitroPlugin: true,
+			sources: [{
+				kind: "unproven",
+				file,
+				reason
+			}]
+		});
+		const importStarts = new Set(program.descendants("ImportDeclaration").flatMap((declaration) => declaration.descendants(AstNodeType.Identifier)).map((identifier) => identifier.start));
+		const calls = program.descendants(AstNodeType.CallExpression).flatMap((call) => {
+			const callee = call.child("callee");
+			if (callee.is(AstNodeType.Identifier) && named.has(callee.name ?? "")) return [{
+				call,
+				referenceStart: callee.start
+			}];
+			if (callee.is(AstNodeType.MemberExpression) && !callee.flagAt("computed") && callee.child("property").name === "nitro" && callee.child("object").is(AstNodeType.Identifier) && namespaces.has(callee.child("object").name ?? "")) return [{
+				call,
+				referenceStart: callee.child("object").start
+			}];
+			return [];
+		});
+		const callStarts = new Set(calls.map((entry) => entry.referenceStart));
+		const nameStarts = NitroStaticConfig.nameStarts(program);
+		if (program.descendants(AstNodeType.Identifier).filter((identifier) => (named.has(identifier.name ?? "") || namespaces.has(identifier.name ?? "")) && !importStarts.has(identifier.start) && !nameStarts.has(identifier.start) && !callStarts.has(identifier.start)).length > 0) return unproven("the Nitro Vite plugin is used other than by a direct call");
+		if (calls.length !== 1) return unproven(`the Nitro Vite plugin is called ${calls.length} times, not once`);
+		const resolved = NitroStaticConfig.exportedObject(program, imports, NitroStaticConfig.viteConfigHelper);
+		if (resolved.kind === "unproven") return unproven(resolved.reason);
+		const config = NitroStaticConfig.prove(resolved.node, file);
+		if (config.kind === "unproven") return {
+			usesNitroPlugin: true,
+			sources: [config]
+		};
+		const plugins = NitroStaticConfig.unwrap(config.entries.get("plugins"));
+		const call = calls[0].call;
+		if (!(plugins?.is(AstNodeType.ArrayExpression) === true && plugins.children("elements").some((element) => NitroStaticConfig.unwrap(element)?.start === call.start))) return unproven("the Nitro Vite plugin is not a direct element of the `plugins` array");
+		const sources = [];
+		const argument = NitroStaticConfig.unwrap(call.children("arguments")[0]);
+		if (argument !== void 0) {
+			const options = NitroStaticConfig.prove(argument, file);
+			sources.push(options);
+			const nested = options.kind === "object" ? options.entries.get("config") : void 0;
+			if (nested !== void 0) sources.push(NitroStaticConfig.prove(nested, file));
+		}
+		const nitroKey = config.entries.get("nitro");
+		if (nitroKey !== void 0) sources.push(NitroStaticConfig.prove(nitroKey, file));
+		return {
+			usesNitroPlugin: true,
+			sources
+		};
+	}
+	/**
+	* The object that `export default` gives: a literal, a call of the verified identity helper over one, or a
+	* single top-level `const` that holds either and is never assigned again.
+	*/
+	static exportedObject(program, imports, helper) {
+		const helperNames = new Set(imports.filter((entry) => entry.importKind === ImportKind.Named && entry.importedName === helper.name && helper.packages.includes(entry.request) && !entry.isTypeOnly).map((entry) => entry.localName));
+		const declaration = program.children("body").find((statement) => statement.is(AstNodeType.ExportDefaultDeclaration))?.child("declaration");
+		const objectOf = (node, viaConstant) => {
+			const expression = NitroStaticConfig.unwrap(node);
+			if (expression === void 0) return {
+				kind: "unproven",
+				reason: "the config has no default export"
+			};
+			if (expression.is(AstNodeType.ObjectExpression)) return {
+				kind: "found",
+				node: expression
+			};
+			if (expression.is(AstNodeType.CallExpression)) {
+				const callee = expression.child("callee");
+				return callee.is(AstNodeType.Identifier) && helperNames.has(callee.name ?? "") && expression.children("arguments").length === 1 ? objectOf(expression.children("arguments")[0], viaConstant) : {
+					kind: "unproven",
+					reason: `the config is a call of something other than ${helper.name} from ${helper.packages.join(" or ")}`
+				};
+			}
+			if (expression.is(AstNodeType.Identifier) && !viaConstant) {
+				const initializer = NitroStaticConfig.constantOf(program, expression.name ?? "", expression.start);
+				return initializer === void 0 ? {
+					kind: "unproven",
+					reason: `\`${expression.name}\` is not a top-level const that nothing else uses`
+				} : objectOf(initializer, true);
+			}
+			return {
+				kind: "unproven",
+				reason: "the default export is not an object the reader can prove"
+			};
+		};
+		return objectOf(declaration, false);
+	}
+	/**
+	* The initializer of `const <name> = …` at the top level, when the name has no use except the one at
+	* `exportStart` (the default export, or the single wrapper call around it). A member assignment
+	* (`config.preset = …`), a call that gets the name (`Object.assign(config, …)`), or a spread of it is another
+	* use, and it makes the value unknown.
+	*/
+	static constantOf(program, name, exportStart) {
+		const initializers = [];
+		for (const statement of program.children("body")) {
+			const declaration = statement.is(AstNodeType.ExportNamedDeclaration) ? statement.child("declaration") : statement;
+			if (declaration.stringAt("kind") !== "const") continue;
+			for (const declarator of declaration.children("declarations")) if (declarator.child("id").name === name) initializers.push({
+				init: declarator.child("init"),
+				idStart: declarator.child("id").start
+			});
+		}
+		if (initializers.length !== 1) return;
+		const names = NitroStaticConfig.nameStarts(program);
+		return program.descendants(AstNodeType.Identifier).filter((identifier) => identifier.name === name && identifier.start !== initializers[0].idStart && identifier.start !== exportStart && !names.has(identifier.start)).length === 0 ? initializers[0].init : void 0;
+	}
+	/** The starts of identifiers that are names, not references: a property key and a member name. */
+	static nameStarts(program) {
+		return /* @__PURE__ */ new Set([...program.descendants(AstNodeType.Property).filter((property) => !property.flagAt("computed") && !property.flagAt("shorthand")).map((property) => property.child("key").start), ...program.descendants(AstNodeType.MemberExpression).filter((member) => !member.flagAt("computed")).map((member) => member.child("property").start)]);
+	}
+	/** The options of one object, or the reason that the reader cannot prove it. */
+	static prove(node, file) {
+		const object = NitroStaticConfig.unwrap(node);
+		if (object === void 0 || !object.is(AstNodeType.ObjectExpression)) return {
+			kind: "unproven",
+			file,
+			reason: "an options value is not an object literal"
+		};
+		const entries = /* @__PURE__ */ new Map();
+		for (const property of object.children("properties")) {
+			if (!property.is(AstNodeType.Property)) return {
+				kind: "unproven",
+				file,
+				reason: "an options object has a spread"
+			};
+			const key = property.child("key");
+			const name = key.name ?? key.stringAt("value");
+			if (property.flagAt("computed") || property.flagAt("method") || property.stringAt("kind") !== "init" || name === void 0) return {
+				kind: "unproven",
+				file,
+				reason: "an options object has a computed key, a getter or a method"
+			};
+			entries.set(name, property.child("value"));
+		}
+		return {
+			kind: "object",
+			file,
+			entries
+		};
+	}
+	/** A string option: the first source that sets it decides. */
+	static scalar(key, sources, emptyIsAbsent = false) {
+		for (const source of sources) {
+			if (source.kind === "unproven") return {
+				kind: "computed",
+				file: source.file,
+				reason: source.reason
+			};
+			const node = source.entries.get(key);
+			if (node === void 0) continue;
+			const value = NitroStaticConfig.stringOf(node);
+			if (emptyIsAbsent && value === "") continue;
+			return value === void 0 ? {
+				kind: "computed",
+				file: source.file,
+				reason: `\`${key}\` is not a string literal`
+			} : {
+				kind: "literal",
+				value
+			};
+		}
+		return { kind: "none" };
+	}
+	/** A list option: every source adds to it, so one unproven source makes it unknown. */
+	static list(key, sources) {
+		const values = [];
+		let found = false;
+		for (const source of sources) {
+			if (source.kind === "unproven") return {
+				kind: "computed",
+				file: source.file,
+				reason: source.reason
+			};
+			const node = NitroStaticConfig.unwrap(source.entries.get(key));
+			if (node === void 0) continue;
+			const strings = (node.is(AstNodeType.ArrayExpression) ? node.children("elements") : []).map((element) => NitroStaticConfig.stringOf(element));
+			if (!node.is(AstNodeType.ArrayExpression) || strings.some((value) => value === void 0)) return {
+				kind: "computed",
+				file: source.file,
+				reason: `\`${key}\` is not an array of string literals`
+			};
+			found = true;
+			values.push(...strings);
+		}
+		return found ? {
+			kind: "literal",
+			value: values
+		} : { kind: "none" };
+	}
+	/** The text of a string literal or of a template literal with no placeholder; else `undefined`. */
+	static stringOf(node) {
+		const value = NitroStaticConfig.unwrap(node);
+		if (value === void 0) return;
+		if (typeof value.literalValue === "string") return value.literalValue;
+		if (value.is(AstNodeType.TemplateLiteral) && !value.hasChildren("expressions")) return value.children("quasis")[0]?.child("value").stringAt("cooked");
+	}
+	/** The node without its wrappers (`as`, `satisfies`, `!`, parentheses); `undefined` when absent. */
+	static unwrap(node) {
+		let current = node;
+		while (current !== void 0 && current.exists() && NitroStaticConfig.wrapperTypes.includes(current.type ?? "")) current = current.child("expression");
+		return current === void 0 || !current.exists() ? void 0 : current;
+	}
+	static parse(file) {
+		const parsed = new SourceParser().parse(file, readFileSync(file, "utf8"));
+		return {
+			program: parsed.program,
+			imports: parsed.imports
+		};
+	}
+};
+//#endregion
+//#region src/runtime-export-resolver.ts
+/**
+* Tells whether a name that generated code imports is a given export of a package, through the barrel files
+* of the app. Generated code imports from app source (`../../src/runtime-barrel.js`), and a barrel can
+* re-export the package under the same name, another name, or through `export *`. The chain is followed with
+* the compiler's own {@link ReexportIndex}.
+*/
+var RuntimeExportResolver = class RuntimeExportResolver {
+	outputDirectory;
+	packageName;
+	exportName;
+	parser = new SourceParser();
+	/** The parsed barrel files reached so far, by absolute path. */
+	files = /* @__PURE__ */ new Map();
+	/** The index over {@link files}; dropped when a file joins. */
+	index;
+	/**
+	* @param outputDirectory - The compile output directory, the base of the relative requests of generated code.
+	* @param packageName - The package whose export is looked for (`@heximon/runtime`).
+	* @param exportName - The export looked for (`Platform`).
+	*/
+	constructor(outputDirectory, packageName, exportName) {
+		this.outputDirectory = outputDirectory;
+		this.packageName = packageName;
+		this.exportName = exportName;
+	}
+	/**
+	* Whether `name`, imported from `request` by the generated file `importer`, is the export looked for.
+	*
+	* @param importer - The generated file's path, relative to the output directory.
+	* @param request - The module request of the import.
+	* @param name - The imported name; `exportName` for a namespace member.
+	*/
+	isTarget(importer, request, name) {
+		if (request === this.packageName) return name === this.exportName;
+		if (!request.startsWith(".")) return false;
+		const barrel = RuntimeExportResolver.resolveFile(dirname(join(this.outputDirectory, importer)), request);
+		if (barrel === void 0) return false;
+		this.load(barrel);
+		const canonical = this.indexOfFiles().canonicalize({
+			sourceFile: barrel,
+			className: name
+		});
+		return canonical.sourceFile === this.packageName && canonical.className === this.exportName;
+	}
+	/** The source file a relative request names, or `undefined` when no file exists (a generated file, for one). */
+	static resolveFile(directory, request) {
+		return SourceModuleResolution.resolve(join(directory, request));
+	}
+	/** Parse `path` and the files its export statements lead to. */
+	load(path) {
+		if (this.files.has(path)) return;
+		let parsed;
+		try {
+			parsed = this.parser.parse(path, readFileSync(path, "utf8"));
+		} catch {
+			return;
+		}
+		this.files.set(path, parsed);
+		this.index = void 0;
+		const exportedLocals = new Set(parsed.exports.flatMap((entry) => entry.request === null ? [entry.localName ?? entry.exportedName] : []));
+		const requests = [...parsed.exports.map((entry) => entry.request), ...parsed.imports.filter((entry) => exportedLocals.has(entry.localName)).map((entry) => entry.request)];
+		for (const request of requests) if (request?.startsWith(".")) {
+			const next = RuntimeExportResolver.resolveFile(dirname(path), request);
+			if (next !== void 0) this.load(next);
+		}
+	}
+	indexOfFiles() {
+		this.index ??= new ReexportIndex([...this.files].map(([filePath, parsed]) => ({
+			filePath,
+			exports: parsed.exports,
+			imports: parsed.imports
+		})), (from, request) => RuntimeExportResolver.resolveFile(dirname(from), request) ?? null, false, (specifier, name) => specifier === this.packageName && name === this.exportName);
+		return this.index;
+	}
+};
+//#endregion
+//#region src/platform-binding-census.ts
+/**
+* Finds the platform bindings (Workers KV, Hyperdrive, Durable Objects, …) a compiled graph needs, before
+* anything boots. A binding exists only on its platform, so a run outside it must refuse instead of failing
+* on the first read.
+*
+* Two facts name a binding. The generated wiring holds the string literal of each `Platform.binding("NAME")`
+* call, with the module that owns the file. The deploy-config fragments of the compile list the bindings the
+* sidecar declares. A binding read through a variable name is in neither place, and the run then fails on
+* the read itself.
+*/
+var PlatformBindingCensus = class PlatformBindingCensus {
+	/** The package whose `Platform` the generated code reads bindings from. */
+	static runtimePackage = "@heximon/runtime";
+	/** The `Platform` class and the method of it that reads a binding. */
+	static platformExport = "Platform";
+	static bindingMethod = "binding";
+	/** The module wiring files: `modules/<name>.wiring.js` exports `init<ModuleClass>`. */
+	static moduleInitializerPattern = /export async function init(\w+)\(/;
+	static platformBindingKind = "platform binding";
+	/** The deploy-config sections that declare bindings, by section name. */
+	static declaringSections = {
+		"kv-namespaces": (payload) => PlatformBindingCensus.entriesOf(payload["kvNamespaces"], "binding").map((binding) => ({
+			binding,
+			neededBy: "`cloudflare.kvNamespaces` in heximon.config.ts"
+		})),
+		hyperdrive: (payload) => PlatformBindingCensus.entriesOf(payload["hyperdrive"], "binding").map((binding) => ({
+			binding,
+			neededBy: "`cloudflare.hyperdrive` in heximon.config.ts"
+		})),
+		"r2-buckets": (payload) => PlatformBindingCensus.entriesOf(payload["r2Buckets"], "binding").map((binding) => ({
+			binding,
+			neededBy: "`cloudflare.r2Buckets` in heximon.config.ts"
+		})),
+		browser: (payload) => PlatformBindingCensus.entriesOf([payload["browser"]], "binding").map((binding) => ({
+			binding,
+			neededBy: "`cloudflare.browser` in heximon.config.ts"
+		})),
+		"queue-bindings": (payload) => PlatformBindingCensus.entriesOf(payload["producers"], "binding").map((binding) => ({
+			binding,
+			neededBy: "`cloudflare.queues` in heximon.config.ts"
+		})),
+		"integration-event-subscriptions": (payload) => PlatformBindingCensus.entriesOf(payload["producers"], "binding").map((binding) => ({
+			binding,
+			neededBy: "the cross-service integration events"
+		})),
+		"workflow-bindings": (payload) => PlatformBindingCensus.entriesOf(payload["workflows"], "binding").map((binding) => ({
+			binding,
+			neededBy: "a Cloudflare workflow"
+		})),
+		"durable-objects": (payload) => PlatformBindingCensus.durableBindings(payload["bindings"])
+	};
+	/** The kind label of each deploy-config section. */
+	static sectionKinds = {
+		"kv-namespaces": "Workers KV",
+		hyperdrive: "Hyperdrive",
+		"r2-buckets": "R2 bucket",
+		browser: "Browser Rendering",
+		"queue-bindings": "Cloudflare Queue",
+		"integration-event-subscriptions": "Cloudflare Queue",
+		"workflow-bindings": "Cloudflare Workflow",
+		"durable-objects": "Durable Object"
+	};
+	/**
+	* The bindings the compile output needs, sorted by name.
+	*
+	* @param output - The production compile output.
+	* @param platformName - The platform the graph was compiled for. A deploy-config fragment for another
+	*   platform is inert and does not count: the Durable Objects of a Node graph run in-process.
+	* @param outputDirectory - The compile output directory, where the relative imports of generated code start.
+	* @returns One entry for each binding name, with every reason the compile found.
+	*/
+	static collect(output, platformName, outputDirectory) {
+		const needs = /* @__PURE__ */ new Map();
+		const record = (binding, kind, neededBy) => {
+			const known = needs.get(binding);
+			if (known === void 0) {
+				needs.set(binding, {
+					kind,
+					neededBy: /* @__PURE__ */ new Set([neededBy])
+				});
+				return;
+			}
+			known.neededBy.add(neededBy);
+			if (known.kind === PlatformBindingCensus.platformBindingKind) known.kind = kind;
+		};
+		const hostEntryPaths = new Set(output.hostEntries.map((entry) => entry.path));
+		const platform = new RuntimeExportResolver(outputDirectory, PlatformBindingCensus.runtimePackage, PlatformBindingCensus.platformExport);
+		for (const file of output.files) {
+			if (!file.path.endsWith(".js") || hostEntryPaths.has(file.path)) continue;
+			for (const binding of PlatformBindingCensus.calledBindings(file, platform)) record(binding, PlatformBindingCensus.platformBindingKind, PlatformBindingCensus.ownerOf(file));
+		}
+		for (const contribution of output.buildConfigContributions) for (const declared of PlatformBindingCensus.declaredBy(contribution, platformName)) record(declared.binding, PlatformBindingCensus.sectionKinds[contribution.section] ?? PlatformBindingCensus.platformBindingKind, declared.neededBy);
+		return [...needs.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([binding, need]) => ({
+			binding,
+			kind: need.kind,
+			neededBy: [...need.neededBy].sort()
+		}));
+	}
+	/**
+	* The refusal text: each binding with its kind and the places that need it.
+	*
+	* @param needs - The bindings from {@link collect}.
+	* @param platformName - The platform of the compiled graph, when the sidecar names one.
+	*/
+	static explain(needs, platformName) {
+		const lines = needs.map((need) => `  - ${need.binding} (${need.kind}): ${need.neededBy.join("; ")}`);
+		return [
+			`This graph needs platform bindings that exist only on ${platformName ?? "its deploy platform"}, so a run outside it would fail on the first read. Nothing was booted.`,
+			...lines,
+			"Run this task on the platform that has these bindings."
+		].join("\n");
+	}
+	/**
+	* The names in the literal `Platform.binding("NAME")` calls of one generated file. The callee must resolve
+	* to the `Platform` of `@heximon/runtime`, under any local name, through a namespace import, or through the
+	* barrel files of the app that re-export it; a call on another object is not a binding read.
+	*/
+	static calledBindings(file, platform) {
+		let parsed;
+		try {
+			parsed = new SourceParser().parse(file.path, file.content);
+		} catch {
+			return [];
+		}
+		if (parsed.errors.length > 0) return [];
+		const platformNames = /* @__PURE__ */ new Set();
+		const namespaces = /* @__PURE__ */ new Map();
+		for (const entry of parsed.imports) {
+			if (entry.isTypeOnly) continue;
+			if (entry.importKind === ImportKind.Namespace) namespaces.set(entry.localName, entry.request);
+			else if (entry.importKind === ImportKind.Named && platform.isTarget(file.path, entry.request, entry.importedName)) platformNames.add(entry.localName);
+		}
+		const bindings = [];
+		for (const call of parsed.program.descendants(AstNodeType.CallExpression)) {
+			const callee = call.child("callee");
+			if (callee.is(AstNodeType.MemberExpression) && PlatformBindingCensus.memberName(callee) === PlatformBindingCensus.bindingMethod && PlatformBindingCensus.isPlatform(callee.child("object"), file.path, platform, platformNames, namespaces)) {
+				const name = PlatformBindingCensus.literalText(call.children("arguments")[0]);
+				if (name !== void 0) bindings.push(name);
+			}
+		}
+		return bindings;
+	}
+	/** Whether `node` names the runtime `Platform`: an imported name, or `<namespace>.<name>` of a module that exports it. */
+	static isPlatform(node, importer, platform, platformNames, namespaces) {
+		if (node.is(AstNodeType.Identifier)) return platformNames.has(node.name ?? "");
+		const namespace = node.child("object");
+		const request = namespace.is(AstNodeType.Identifier) ? namespaces.get(namespace.name ?? "") : void 0;
+		const member = node.is(AstNodeType.MemberExpression) ? PlatformBindingCensus.memberName(node) : void 0;
+		return request !== void 0 && member !== void 0 && platform.isTarget(importer, request, member);
+	}
+	/** The property name of `object.name` or `object["name"]`, or `undefined` for a computed name. */
+	static memberName(node) {
+		const property = node.child("property");
+		if (!node.flagAt("computed")) return property.name;
+		return typeof property.literalValue === "string" ? property.literalValue : void 0;
+	}
+	/** The text of a string literal, or of a template literal with no placeholder; else `undefined`. */
+	static literalText(node) {
+		if (node === void 0 || !node.exists()) return;
+		if (typeof node.literalValue === "string") return node.literalValue;
+		const quasis = node.is(AstNodeType.TemplateLiteral) ? node.children("quasis") : [];
+		return quasis.length === 1 && !node.hasChildren("expressions") ? quasis[0].child("value").stringAt("cooked") ?? void 0 : void 0;
+	}
+	/** Who a generated file belongs to: its module, or the file itself. */
+	static ownerOf(file) {
+		const moduleClass = PlatformBindingCensus.moduleInitializerPattern.exec(file.content)?.[1];
+		return moduleClass === void 0 ? `generated file ${file.path}` : `module ${moduleClass}`;
+	}
+	/** The bindings a Cloudflare-targeted deploy-config fragment declares. */
+	static declaredBy(contribution, platformName) {
+		if (contribution.target !== DeployPlatform.Cloudflare || contribution.target !== platformName) return [];
+		const declare = PlatformBindingCensus.declaringSections[contribution.section];
+		const payload = contribution.payload;
+		if (declare === void 0 || typeof payload !== "object" || payload === null) return [];
+		return declare(payload);
+	}
+	/** The Durable Object bindings, each owned by its class. */
+	static durableBindings(value) {
+		if (!Array.isArray(value)) return [];
+		const declared = [];
+		for (const entry of value) {
+			const record = entry;
+			if (typeof record?.name === "string") declared.push({
+				binding: record.name,
+				neededBy: typeof record.class_name === "string" ? `Durable Object class ${record.class_name}` : "a Durable Object"
+			});
+		}
+		return declared;
+	}
+	/** The string `key` of each record in a payload list. */
+	static entriesOf(value, key) {
+		if (!Array.isArray(value)) return [];
+		return value.flatMap((entry) => {
+			const name = entry?.[key];
+			return typeof name === "string" && name.length > 0 ? [name] : [];
+		});
+	}
+};
+//#endregion
+//#region src/stdout-redirect.ts
+/**
+* Sends everything written to stdout to stderr for a while, so the log lines of an app that runs in this
+* process cannot mix with the JSON the command prints. The original writer stays reachable through
+* {@link write} for that JSON.
+*/
+var StdoutRedirect = class {
+	original;
+	/** Start the redirect. A second call does nothing. */
+	start() {
+		if (this.original !== void 0) return;
+		this.original = process.stdout.write.bind(process.stdout);
+		process.stdout.write = ((...parameters) => process.stderr.write(...parameters));
+	}
+	/** Write to the real stdout, redirected or not. */
+	write(text) {
+		(this.original ?? process.stdout.write.bind(process.stdout))(text);
+	}
+	/** Stop the redirect. */
+	stop() {
+		if (this.original !== void 0) {
+			process.stdout.write = this.original;
+			this.original = void 0;
+		}
+	}
+};
+//#endregion
+//#region src/task-target-resolver.ts
+/** Thrown when the names do not pick exactly one module and one task. The message is ready to print. */
+var TaskTargetError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "TaskTargetError";
+	}
+};
+/**
+* Picks the module class and the task class that `heximon task run <ModuleClass> <TaskClass>` names, by class
+* name, in the compiled graph. A name that matches nothing or more than one class fails with the names that
+* come close.
+*/
+var TaskTargetResolver = class TaskTargetResolver {
+	/** The most edits between a typed name and a suggestion. */
+	static maximumSuggestionDistance = 3;
+	/** The most names a message lists. */
+	static maximumListed = 8;
+	/**
+	* @param graph - The module graph of the production compile.
+	* @param moduleName - The module class name.
+	* @param taskName - The task class name; the module must provide it.
+	* @returns The module and the task.
+	* @throws {TaskTargetError} When a name matches no class, or more than one.
+	*/
+	static resolve(graph, moduleName, taskName) {
+		const modules = TaskTargetResolver.distinct(graph.modules.map((node) => node.reference), moduleName);
+		if (modules.length === 0) throw new TaskTargetError(`No module class named "${moduleName}" is in the compiled graph.` + TaskTargetResolver.suggestions(moduleName, graph.modules.map((node) => TaskTargetResolver.nameOf(node.reference)), "Modules in the graph"));
+		if (modules.length > 1) throw new TaskTargetError(`More than one module class is named "${moduleName}":\n` + modules.map((reference) => `  - ${reference.sourceFile}`).join("\n"));
+		const module = modules[0];
+		const nodes = graph.modules.filter((node) => TaskTargetResolver.isSame(node.reference, module));
+		const providerTokens = nodes.flatMap((node) => node.providers.map((provider) => provider.token));
+		const tasks = TaskTargetResolver.distinct(providerTokens, taskName);
+		if (tasks.length === 0) throw new TaskTargetError(`The module ${moduleName} does not provide a class named "${taskName}".` + TaskTargetResolver.otherOwner(graph, nodes, taskName) + TaskTargetResolver.suggestions(taskName, providerTokens.map((token) => TaskTargetResolver.nameOf(token)), `Providers of ${moduleName}`));
+		if (tasks.length > 1) throw new TaskTargetError(`The module ${moduleName} provides more than one class named "${taskName}":\n` + tasks.map((reference) => `  - ${reference.sourceFile}`).join("\n"));
+		return {
+			module,
+			task: tasks[0]
+		};
+	}
+	/** The class name a person typed: the declared name when the compiler aliased the export. */
+	static nameOf(reference) {
+		return reference.displayName ?? reference.className;
+	}
+	/** Whether two references name the same class. */
+	static isSame(left, right) {
+		return left.sourceFile === right.sourceFile && left.className === right.className;
+	}
+	/** The references that carry `name`, one for each class, in graph order. */
+	static distinct(references, name) {
+		const found = [];
+		for (const reference of references) if (TaskTargetResolver.nameOf(reference) === name && !found.some((known) => TaskTargetResolver.isSame(known, reference))) found.push(reference);
+		return found;
+	}
+	/** A hint when another module of the graph provides the class. */
+	static otherOwner(graph, own, taskName) {
+		const owners = graph.modules.filter((node) => !own.includes(node) && node.providers.some((provider) => TaskTargetResolver.nameOf(provider.token) === taskName));
+		if (owners.length === 0) return "";
+		return ` The class is provided by ${[...new Set(owners.map((node) => TaskTargetResolver.nameOf(node.reference)))].join(", ")}.`;
+	}
+	/** The "did you mean" line, or the start of the list when nothing is close. */
+	static suggestions(typed, candidates, listTitle) {
+		const unique = [...new Set(candidates)];
+		const close = unique.filter((candidate) => candidate.toLowerCase().includes(typed.toLowerCase()) || typed.toLowerCase().includes(candidate.toLowerCase()) || TaskTargetResolver.distance(candidate.toLowerCase(), typed.toLowerCase()) <= TaskTargetResolver.maximumSuggestionDistance);
+		if (close.length > 0) return ` Did you mean ${close.slice(0, TaskTargetResolver.maximumListed).map((name) => `"${name}"`).join(", ")}?`;
+		const listed = unique.slice(0, TaskTargetResolver.maximumListed);
+		return listed.length === 0 ? "" : ` ${listTitle}: ${listed.join(", ")}${unique.length > listed.length ? ", …" : ""}.`;
+	}
+	/** The Levenshtein distance between two names. */
+	static distance(left, right) {
+		let previous = Array.from({ length: right.length + 1 }, (_, index) => index);
+		for (let row = 1; row <= left.length; row += 1) {
+			const current = [row];
+			for (let column = 1; column <= right.length; column += 1) {
+				const substitution = left[row - 1] === right[column - 1] ? 0 : 1;
+				current[column] = Math.min((previous[column] ?? 0) + 1, (current[column - 1] ?? 0) + 1, (previous[column - 1] ?? 0) + substitution);
+			}
+			previous = current;
+		}
+		return previous[right.length] ?? 0;
+	}
+};
+//#endregion
+//#region src/tsconfig-aliases.ts
+/**
+* Reads the module aliases of a Nitro project from the `paths` of its tsconfig files. Nitro writes the aliases
+* of a project into a generated tsconfig, and the project's tsconfig extends it and adds its own. The
+* files are read as they are on disk: nothing is generated, and no config of the project runs.
+*
+* TypeScript's rules apply. A `paths` of a config replaces the `paths` of what it extends. `baseUrl` is the
+* nearest one in the chain, and a target is relative to it; without one, a target is relative to the directory
+* of the config that sets `paths`. An exact pattern wins over a wildcard one, and a longer wildcard prefix wins
+* over a shorter one.
+*/
+var TsconfigAliases = class TsconfigAliases {
+	/** Where Nitro writes its generated tsconfig, below the build directory. */
+	static generatedFiles = ["node_modules/.nitro/types/tsconfig.json", ".nitro/types/tsconfig.json"];
+	/** The longest `extends` chain followed. */
+	static maximumDepth = 8;
+	/**
+	* The aliases of the project. The project's tsconfig wins over the generated one that it does not extend.
+	*
+	* @param rootDir - The project root.
+	*/
+	static read(rootDir) {
+		const exact = {};
+		const prefixes = {};
+		for (const file of [...TsconfigAliases.generatedFiles.map((name) => join(rootDir, name)), join(rootDir, "tsconfig.json")]) {
+			const options = TsconfigAliases.optionsOf(file, 0);
+			if (options.paths === void 0) continue;
+			const base = options.baseUrl ?? options.paths.directory;
+			for (const [pattern, targets] of Object.entries(options.paths.entries)) {
+				const target = targets[0];
+				if (target === void 0) continue;
+				if (pattern.endsWith("/*") && target.endsWith("/*")) prefixes[pattern.slice(0, -2)] = resolve(base, target.slice(0, -2));
+				else if (!pattern.includes("*") && !target.includes("*")) exact[pattern] = resolve(base, target);
+			}
+		}
+		return {
+			exact,
+			prefixes
+		};
+	}
+	/** The effective options of one tsconfig, after the files it extends. */
+	static optionsOf(file, depth) {
+		if (!existsSync(file) || depth > TsconfigAliases.maximumDepth) return {};
+		let config;
+		try {
+			config = JSON.parse(TsconfigAliases.toJson(readFileSync(file, "utf8")));
+		} catch {
+			return {};
+		}
+		const options = {};
+		const parents = typeof config.extends === "string" ? [config.extends] : [...config.extends ?? []];
+		for (const parent of parents) if (parent.startsWith(".") || isAbsolute(parent)) {
+			const path = resolve(dirname(file), parent);
+			const inherited = TsconfigAliases.optionsOf(path.endsWith(".json") ? path : `${path}.json`, depth + 1);
+			Object.assign(options, inherited);
+		}
+		if (config.compilerOptions?.baseUrl !== void 0) options.baseUrl = resolve(dirname(file), config.compilerOptions.baseUrl);
+		if (config.compilerOptions?.paths !== void 0) options.paths = {
+			entries: config.compilerOptions.paths,
+			directory: dirname(file)
+		};
+		return options;
+	}
+	/**
+	* A tsconfig is JSON with comments and trailing commas. This removes both and leaves every string as it is,
+	* so `JSON.parse` can read the text.
+	*/
+	static toJson(text) {
+		let withoutComments = "";
+		let inString = false;
+		for (let index = 0; index < text.length; index += 1) {
+			const character = text[index];
+			if (inString) {
+				withoutComments += character;
+				if (character === "\\") withoutComments += text[++index] ?? "";
+				else if (character === "\"") inString = false;
+			} else if (character === "\"") {
+				inString = true;
+				withoutComments += character;
+			} else if (character === "/" && text[index + 1] === "/") {
+				while (index < text.length && text[index] !== "\n") index += 1;
+				withoutComments += "\n";
+			} else if (character === "/" && text[index + 1] === "*") {
+				index = text.indexOf("*/", index + 2);
+				index = index === -1 ? text.length : index + 1;
+			} else withoutComments += character;
+		}
+		let json = "";
+		inString = false;
+		for (let index = 0; index < withoutComments.length; index += 1) {
+			const character = withoutComments[index];
+			if (inString) {
+				json += character;
+				if (character === "\\") json += withoutComments[++index] ?? "";
+				else if (character === "\"") inString = false;
+			} else if (character === "\"") {
+				inString = true;
+				json += character;
+			} else if (character === "," && /^\s*[}\]]/.test(withoutComments.slice(index + 1))) continue;
+			else json += character;
+		}
+		return json;
+	}
+};
+//#endregion
+//#region src/task-runner.ts
+/** The in-process client of a run. A run serves no HTTP, so every call fails with the reason. */
+var RefusingInternalClient = class {
+	fetch(input) {
+		return Promise.reject(/* @__PURE__ */ new Error(`InternalClient.fetch(${JSON.stringify(input)}) is not available in \`heximon task run\`: the run boots no HTTP surface, so a task cannot call the app's own routes.`));
+	}
+};
+/** The failure a run reports to the caller; the message is ready to print. */
+var TaskRunFailure = class extends Error {};
+/**
+* `heximon task run`: compiles the production graph into a temporary directory, boots it in this process,
+* runs one {@link Task}, prints its result as JSON, and removes the compile output.
+*
+* The boot starts no HTTP listener and none of the standing work of the deployed app — no schedule timers,
+* queue consumers, pollers or sweeps, and no outbox relay unless the caller asked for it — so a run delivers
+* nothing of what the deployed app has pending. The result goes to stdout; everything else goes to stderr, the
+* log lines of the app included.
+*/
+var TaskRunner = class TaskRunner {
+	options;
+	/** The name prefix of the temporary compile output; the workspace ignore globs match it. */
+	static outputDirectoryPrefix = ".heximon-task-";
+	/** The most the run waits for in-flight background work before it shuts the app down. */
+	static drainTimeoutMilliseconds = 1e4;
+	/** The most the interrupt handler waits for the app to shut down. */
+	static interruptShutdownMilliseconds = 5e3;
+	static wiringFilePattern = /^apps\/.+\.wiring\.js$/;
+	outputDirectory;
+	app;
+	context;
+	platformName;
+	/** The Nitro alias table of the project; empty for any other project. */
+	aliases = {
+		exact: {},
+		prefixes: {}
+	};
+	runtime;
+	restoreStandingWork;
+	restoreHostBindings;
+	stdout = new StdoutRedirect();
+	/** The result of the task as one line of JSON, printed after the shutdown. */
+	serialized;
+	disposing;
+	constructor(options) {
+		this.options = options;
+	}
+	/**
+	* Run the task.
+	*
+	* @returns The process exit code: `0` when the task returned, `1` for every other outcome. The reason is
+	*   already on stderr.
+	*/
+	async run() {
+		let interrupts = 0;
+		const interrupt = (signal) => {
+			interrupts += 1;
+			this.interrupted(signal, interrupts > 1);
+		};
+		process.on("SIGINT", interrupt);
+		process.on("SIGTERM", interrupt);
+		let exitCode = 0;
+		this.stdout.start();
+		try {
+			this.outputDirectory = mkdtempSync(join(this.options.rootDir, TaskRunner.outputDirectoryPrefix));
+			this.runtime = await TaskRunner.projectRuntime(this.outputDirectory);
+			const output = await this.compile();
+			const target = this.pickTarget(output);
+			TaskRunner.refuseBindings(output, this.platformName, this.outputDirectory);
+			this.materialize(output);
+			await this.boot(output);
+			await this.execute(target);
+		} catch (error) {
+			TaskRunner.report(error);
+			exitCode = 1;
+		} finally {
+			if (!await this.dispose()) exitCode = 1;
+			this.stdout.stop();
+			if (this.serialized !== void 0) this.stdout.write(`${this.serialized}\n`);
+			process.off("SIGINT", interrupt);
+			process.off("SIGTERM", interrupt);
+		}
+		return exitCode;
+	}
+	/** The `@heximon/runtime` of the project, the copy the generated wiring imports. */
+	static async projectRuntime(directory) {
+		const runtime = await ProjectModules.runtime(directory);
+		if (typeof runtime.StandingWork?.suspend !== "function") throw new TaskRunFailure("The @heximon/runtime of this project is older than this command. Update @heximon/runtime and heximon to one version.");
+		return runtime;
+	}
+	/**
+	* Compile the production graph into the temporary directory. A Nitro host compiles with the inputs of its
+	* own build (the preset, the plugins, the source directories); any other project with its sidecar.
+	*/
+	async compile() {
+		const rootDir = this.options.rootDir;
+		const outputDirectory = this.outputDirectory;
+		let output;
+		let compiler;
+		const nitro = NitroStaticConfig.read(rootDir);
+		this.aliases = nitro.isNitroHost ? TsconfigAliases.read(rootDir) : {
+			exact: {},
+			prefixes: {}
+		};
+		if (nitro.isNitroHost) {
+			const sourceDirectories = TaskRunner.sourceDirectoriesOf(nitro, this.options.isSourceExplicit === true ? this.options.sourceDirectories ?? [] : void 0);
+			const preset = nitro.preset;
+			const host = await NitroHost.open(rootDir, outputDirectory, {
+				preset: preset.kind === "literal" ? preset.value : void 0,
+				platformFromSidecar: preset.kind === "computed",
+				aliases: this.aliases,
+				...sourceDirectories
+			});
+			if (preset.kind === "computed" && !host.hasSidecarPlatform()) throw new TaskRunFailure(`The Nitro preset is computed (${preset.reason}, in ${preset.file}), and the command does not run your config files, so it cannot read the platform: declare \`platform\` in heximon.config.ts (for example \`platform: new CloudflareWorkersStrategy()\`), or set NITRO_PRESET. Nothing was booted.`);
+			const compiled = host.compile(rootDir, outputDirectory, this.options.isSourceExplicit === true ? this.options.sourceDirectories : void 0);
+			({output, compiler} = compiled);
+			this.platformName = compiled.platformName;
+		} else {
+			const session = await ProjectCompileSession.open({
+				rootDir,
+				environment: "production",
+				...this.options.sourceDirectories === void 0 ? {} : { sourceDirectories: this.options.sourceDirectories }
+			});
+			this.platformName = session.platformName();
+			output = await session.compileProduction(outputDirectory, this.aliases);
+			compiler = session.compiler;
+		}
+		const errors = output.diagnostics.filter((diagnostic) => diagnostic.severity === DiagnosticSeverity.Error);
+		if (output.diagnostics.length > 0) CompileDiagnostics.renderToStderr(rootDir, output.diagnostics);
+		if (errors.length > 0) throw new TaskRunFailure(`The production graph has ${errors.length} compile error${errors.length === 1 ? "" : "s"}. Nothing was booted.`);
+		const findings = LibraryFactoryPreflight.inspect(compiler.consumedBoundaryPackages(), LibraryFactoryPreflight.productionBuildOptions);
+		if (findings.length > 0) throw new TaskRunFailure(LibraryFactoryPreflight.explain(findings));
+		return output;
+	}
+	/**
+	* The literal source directories of the Nitro config, for the host inputs. A value that is not a literal is
+	* refused, because dropping it would compile a smaller graph; `--src` names the directories instead.
+	*/
+	static sourceDirectoriesOf(nitro, explicit) {
+		if (explicit !== void 0) return { scanDirs: explicit };
+		for (const [name, value] of [["serverDir", nitro.serverDir], ["scanDirs", nitro.scanDirs]]) if (value.kind === "computed") throw new TaskRunFailure(`The Nitro \`${name}\` is computed (${value.reason}, in ${value.file}), and the command does not run your config files, so it cannot read the source directories. Name them with \`--src <dir>\` (repeat the option, or separate directories with commas). Nothing was booted.`);
+		return {
+			...nitro.serverDir.kind === "literal" ? { serverDir: nitro.serverDir.value } : {},
+			...nitro.scanDirs.kind === "literal" ? { scanDirs: nitro.scanDirs.value } : {}
+		};
+	}
+	/** Pick the module and the task from the compiled graph. */
+	pickTarget(output) {
+		if (output.moduleGraph === void 0) throw new TaskRunFailure("The compile produced no module graph, so the task cannot be found.");
+		return TaskTargetResolver.resolve(output.moduleGraph, this.options.moduleName, this.options.taskName);
+	}
+	/** Refuse a graph that needs bindings only its platform has, before anything boots. */
+	static refuseBindings(output, platformName, outputDirectory) {
+		const needs = PlatformBindingCensus.collect(output, platformName, outputDirectory);
+		if (needs.length > 0) throw new TaskRunFailure(PlatformBindingCensus.explain(needs, platformName));
+	}
+	/** Write the generated files into the temporary directory. */
+	materialize(output) {
+		for (const file of output.files) {
+			const target = join(this.outputDirectory, file.path);
+			mkdirSync(dirname(target), { recursive: true });
+			writeFileSync(target, file.content);
+		}
+	}
+	/** Boot the app with no HTTP surface and without the standing work of the deployed app. */
+	async boot(output) {
+		const wiring = output.files.find((file) => TaskRunner.wiringFilePattern.test(file.path));
+		if (wiring === void 0) throw new TaskRunFailure("No app wiring file was generated. Make sure the project has a root module (a module that no other module imports).");
+		const runtime = this.runtime;
+		if (TransformBoot.isBootProcess()) TransformBoot.registerSourceResolver(new Map(output.sourceRewrites.map((rewrite) => [rewrite.filePath, rewrite.content])), this.aliases);
+		runtime.StandingWork.suspend(runtime.StandingWork.kinds().filter((kind) => !(this.options.withOutboxRelay && kind === runtime.StandingWorkKind.OutboxRelay)));
+		this.restoreStandingWork = () => runtime.StandingWork.suspend([]);
+		runtime.Platform.capture(process.env);
+		const runtimeConfigFile = output.files.find((file) => file.path === RuntimeConfigFile.path);
+		const source = (runtimeConfigFile === void 0 ? void 0 : await import(pathToFileURL(join(this.outputDirectory, runtimeConfigFile.path)).href))?.[RuntimeConfigFile.sourceExport];
+		const coreConfig = source === void 0 ? new runtime.CoreConfig(process.env) : runtime.CoreConfig.resolve(process.env, source);
+		runtime.Logger.configure(coreConfig.logger);
+		const wiringModule = await import(pathToFileURL(join(this.outputDirectory, wiring.path)).href);
+		const bindings = {
+			InternalClient: new RefusingInternalClient(),
+			CoreConfig: coreConfig
+		};
+		runtime.HostBindings.capture(bindings);
+		this.restoreHostBindings = () => runtime.HostBindings.capture({});
+		this.app = await wiringModule.createApp(bindings);
+		this.context = await this.app.from(runtime.CoreModule).get(runtime.Context);
+	}
+	/** Run the task and print its result. */
+	async execute(target) {
+		const runtime = this.runtime;
+		const moduleClass = await this.importClass(target.module.sourceFile, target.module.className);
+		const taskClass = await this.importClass(target.task.sourceFile, target.task.className);
+		if (typeof taskClass.prototype.run !== "function") throw new TaskRunFailure(`${this.options.taskName} is not a task: the class has no run() method. A task extends Task.`);
+		const manager = new runtime.TaskManager(this.app, this.context, await this.seedsOf(runtime));
+		let outcome;
+		try {
+			outcome = await manager.from(moduleClass).run(taskClass, {
+				name: this.options.taskName,
+				...this.options.payload === void 0 ? {} : { payload: this.options.payload }
+			});
+		} catch (error) {
+			throw new TaskRunFailure(`The task ${this.options.taskName} failed:\n${error instanceof Error ? error.stack ?? error.message : String(error)}`, { cause: error });
+		}
+		try {
+			this.serialized = JSON.stringify(outcome);
+		} catch (error) {
+			throw new TaskRunFailure(`The task ran, but its result is not JSON: ${error instanceof Error ? error.message : String(error)}`);
+		}
+	}
+	/** The seeds the app declares for every background frame, or none. */
+	async seedsOf(runtime) {
+		const resolvable = this.app;
+		try {
+			return await resolvable.resolveUnscoped?.(runtime.ContextSeeds);
+		} catch (error) {
+			if (error instanceof Error && error.message.startsWith("No provider for")) return;
+			throw error;
+		}
+	}
+	/** Import a class by file (or package specifier) and export name. */
+	async importClass(sourceFile, className) {
+		const found = (await (isAbsolute(sourceFile) ? import(pathToFileURL(sourceFile).href) : import(sourceFile)))[className];
+		if (found === void 0) throw new TaskRunFailure(`${sourceFile} does not export a class named ${className}.`);
+		return found;
+	}
+	/**
+	* Shut the app down and remove the compile output. Safe to call twice.
+	*
+	* @returns `false` when the shutdown failed. The reason is already on stderr.
+	*/
+	dispose() {
+		this.disposing ??= this.disposeOnce();
+		return this.disposing;
+	}
+	async disposeOnce() {
+		let clean = true;
+		try {
+			await this.runtime?.StandingWork.settled({ timeoutMs: TaskRunner.drainTimeoutMilliseconds });
+			await this.context?.drain({ timeoutMs: TaskRunner.drainTimeoutMilliseconds });
+			await this.app?.shutdown();
+		} catch (error) {
+			clean = false;
+			process.stderr.write(`The task finished, but shutting the app down failed — a client may still be open: ${error instanceof Error ? error.message : String(error)}\n`);
+		}
+		this.restoreStandingWork?.();
+		this.restoreStandingWork = void 0;
+		this.restoreHostBindings?.();
+		this.restoreHostBindings = void 0;
+		if (this.outputDirectory !== void 0) {
+			rmSync(this.outputDirectory, {
+				recursive: true,
+				force: true
+			});
+			this.outputDirectory = void 0;
+		}
+		return clean;
+	}
+	/** An interrupt: shut down within a budget, remove the output, and leave with the signal's code. */
+	async interrupted(signal, immediately) {
+		process.stderr.write(`\nReceived ${signal}: shutting down and removing the compile output.\n`);
+		if (!immediately) {
+			const budget = new Promise((resolve) => {
+				setTimeout(resolve, TaskRunner.interruptShutdownMilliseconds).unref();
+			});
+			await Promise.race([this.dispose(), budget]);
+		}
+		if (this.outputDirectory !== void 0) rmSync(this.outputDirectory, {
+			recursive: true,
+			force: true
+		});
+		process.exit(signal === "SIGINT" ? 130 : 143);
+	}
+	/** Print a failure on stderr. */
+	static report(error) {
+		if (error instanceof TaskRunFailure || error instanceof TaskTargetError) {
+			process.stderr.write(`${error.message}\n`);
+			return;
+		}
+		const text = error instanceof Error ? error.stack ?? error.message : String(error);
+		process.stderr.write(`${text}\n`);
+	}
+};
+//#endregion
+//#region src/task-command.ts
+/** Helpers of {@link taskCommand}: the argument checks, the environment file and the exit. */
+var TaskCommand = class TaskCommand {
+	/**
+	* The longest a finished run may keep the process alive. A task can leave a handle open (a socket, a
+	* timer) that its app did not close, and a one-off run must end.
+	*/
+	static exitGraceMilliseconds = 1e4;
+	/**
+	* Read `--payload`. It must be a JSON object, because it becomes the payload of the task's event.
+	*
+	* @param raw - The raw `--payload` text, when the caller passed one.
+	*/
+	static parsePayload(raw) {
+		if (raw === void 0) return {
+			ok: true,
+			payload: void 0
+		};
+		let parsed;
+		try {
+			parsed = JSON.parse(raw);
+		} catch (error) {
+			return {
+				ok: false,
+				reason: `--payload is not valid JSON: ${error instanceof Error ? error.message : String(error)}`
+			};
+		}
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return {
+			ok: false,
+			reason: "--payload must be a JSON object, such as '{\"year\": 2026}'."
+		};
+		return {
+			ok: true,
+			payload: parsed
+		};
+	}
+	/**
+	* Put the variables of an env file into `process.env`. A variable that the shell already sets keeps the
+	* shell's value.
+	*
+	* @param filePath - The absolute path of a dotenv-format file.
+	* @throws {EnvFileUnreadableError} When the file cannot be read.
+	*/
+	static async loadEnvironmentFile(filePath) {
+		for (const [name, value] of await EnvFileReader.read(filePath)) if (process.env[name] === void 0) process.env[name] = value;
+	}
+	/**
+	* Every `--src` of the raw arguments, as one comma-separated text. The argument parser keeps only the last
+	* value of a repeated option, so the values are collected here, before it parses: `--src server --src extra`,
+	* `--src=server`, and `--src server,extra` all count.
+	*
+	* @param rawArgs - The arguments after `task run`.
+	* @returns The text, or `undefined` when the option is absent.
+	*/
+	static sourceOption(rawArgs) {
+		const values = [];
+		for (let index = 0; index < rawArgs.length; index += 1) {
+			const argument = rawArgs[index];
+			if (argument === "--") break;
+			if (argument === "--src") {
+				const value = rawArgs[index + 1];
+				if (value !== void 0 && !value.startsWith("--")) {
+					values.push(value);
+					index += 1;
+				}
+			} else if (argument.startsWith("--src=")) values.push(argument.slice(6));
+		}
+		return values.length === 0 ? void 0 : values.join(",");
+	}
+	/**
+	* Set the exit code and make sure the process ends soon after, even when the task left a handle open.
+	* The timer does not keep the process alive by itself.
+	*/
+	static finish(exitCode) {
+		process.exitCode = exitCode;
+		setTimeout(() => process.exit(exitCode), TaskCommand.exitGraceMilliseconds).unref();
+	}
+	/** Print a usage failure and set the exit code. */
+	static refuse(reason) {
+		process.stderr.write(`heximon task run: ${reason}\n`);
+		process.exitCode = 1;
+	}
+};
+const taskRunCommand = defineCommand({
+	meta: {
+		name: "run",
+		description: "Run one Task against the production graph of the app, then exit. Prints the result as JSON on stdout."
+	},
+	args: {
+		module: {
+			type: "positional",
+			description: "The class name of the module that declares the task.",
+			required: true
+		},
+		task: {
+			type: "positional",
+			description: "The class name of the task.",
+			required: true
+		},
+		cwd: {
+			type: "string",
+			description: "Project root directory.",
+			default: "."
+		},
+		payload: {
+			type: "string",
+			description: "A JSON object handed to the task as the payload of its event."
+		},
+		"env-file": {
+			type: "string",
+			description: "A dotenv-format file loaded before the compile. A variable the shell already sets keeps its value."
+		},
+		"with-outbox-relay": {
+			type: "boolean",
+			description: "Start the outbox relay. It delivers every pending row of the database, the rows of the deployed app included.",
+			default: false
+		},
+		src: {
+			type: "string",
+			description: "Source directories to scan: repeat the option, or separate directories with commas. Defaults to `src/`, or the directories of the Nitro config for a Nitro host."
+		}
+	},
+	async run({ args, rawArgs }) {
+		if (!TransformBoot.isBootProcess()) {
+			process.exitCode = await TransformBoot.reexecUnderTransform("task run");
+			return;
+		}
+		const rootDir = resolve(process.cwd(), args.cwd);
+		const parsed = TaskCommand.parsePayload(args.payload);
+		if (!parsed.ok) {
+			TaskCommand.refuse(parsed.reason);
+			return;
+		}
+		const envFile = args["env-file"];
+		if (envFile !== void 0) try {
+			await TaskCommand.loadEnvironmentFile(resolve(process.cwd(), envFile));
+		} catch (error) {
+			TaskCommand.refuse(error instanceof Error ? error.message : String(error));
+			return;
+		}
+		const sourceOption = TaskCommand.sourceOption(rawArgs);
+		const sourceDirectories = SourceDirectories.resolve(rootDir, sourceOption);
+		const exitCode = await new TaskRunner({
+			rootDir,
+			moduleName: args.module,
+			taskName: args.task,
+			withOutboxRelay: args["with-outbox-relay"],
+			isSourceExplicit: sourceOption !== void 0 && sourceOption.trim() !== "",
+			...parsed.payload === void 0 ? {} : { payload: parsed.payload },
+			...sourceDirectories === void 0 ? {} : { sourceDirectories }
+		}).run();
+		TaskCommand.finish(exitCode);
+	}
+});
+/** `heximon task` — run one-off work of the app. */
+const taskCommand = defineCommand({
+	meta: {
+		name: "task",
+		description: "Run one-off work of the app."
+	},
+	subCommands: { run: taskRunCommand }
+});
+//#endregion
 //#region src/workflow-status-report.ts
 /** How one workflow's current step graph relates to the committed baseline gate. */
 const WorkflowBaselineState = {
@@ -2915,7 +4550,8 @@ const main = defineCommand({
 		provision: provisionCommand,
 		migrations: migrationsCommand,
 		workflows: workflowsCommand,
-		skills: skillsCommand
+		skills: skillsCommand,
+		task: taskCommand
 	}
 });
 await tab(main);