Audit: full inventory of impure functions across the monorepo (goal: completely pure functions)

[2witstudios]

Goal

We want completely pure functions wherever possible. This issue is the full inventory of impure functions across the monorepo, produced by a systematic audit of all ~2,700 non-test TypeScript source files in apps/* and packages/* (excluding apps/e2e, apps/ios, apps/android, tests, and generated migrations).

Definition used. A function is impure if it: (a) performs I/O (database, network, filesystem, process spawning, browser storage, sockets/IPC); (b) is nondeterministic (Date.now(), new Date() with no argument, Math.random(), crypto.randomUUID/randomBytes, nanoid/createId); (c) reads mutable external state (process.env at call time, window/document/navigator, module-level mutable variables); (d) mutates external state (module-level caches/maps, singletons, its arguments); or (e) has observable side effects (console.*, event emission, timers). Deterministic helpers that only transform their inputs (including new Date(value) parsing a supplied value, and functions that take now/env/fetch as parameters) are counted as pure and excluded.

Headline counts (named functions; boundary layers like API routes and repositories grouped per file):

Area	Approx. impure functions	Dominant impurity
packages/lib	~420	Database I/O (~300 across ~70 files)
packages/db	~35 + ~55 schema files with createId/new Date default closures	DB singletons, schema defaults
packages/sdk	~9	Network (impurity is constructor-injected — closest to pure)
packages/cli	~125	Network + filesystem (command handlers)
apps/web	~250 named in src/lib/stores/hooks + 356 API route files + component-layer markers (227 nondeterminism / 230 browser-global / 157 console occurrences)	DB/network I/O, wall-clock reads
apps/processor	~95	S3/DB I/O, module state
apps/realtime	~55	Socket emission, module registries
apps/control-plane	~40	Shell/docker exec, Stripe
apps/desktop (main)	~45	IPC, fs, module singletons
apps/admin	~55 named + 26 route files	DB analytics queries
apps/marketing	~8 named + 1 route	Env reads
apps/atlas	3	Browser globals

Total: roughly 1,100+ impure functions (plus per-file-grouped boundary handlers).

Highest-value purification targets

These are pure computations contaminated by avoidable impurity — fix by injecting now/rng/env/ports as parameters:

1. evaluateFunction — packages/lib/src/sheets/functions.ts:96 — the spreadsheet formula evaluator calls new Date() (NOW/TODAY) and Math.random() (RAND/RANDBETWEEN) inline; inject a clock/rng.
2. getTodayUTC/getTomorrowMidnightUTC/getSecondsUntilMidnightUTC — packages/lib/src/services/date-utils.ts:13,28,44 — pure date math reading the wall clock; take now as a parameter.
3. isOnPrem/isTenantMode/isCloud/isBillingEnabled — packages/lib/src/deployment-mode.ts:34-46 — read process.env at call time (areCloudIntegrationsAllowed already shows the pure pattern).
4. csrf-utils / broadcast-auth — packages/lib/src/auth/csrf-utils.ts:24, packages/lib/src/auth/broadcast-auth.ts:28,88 — token generation/validation mixes randomBytes, Date.now(), env reads, and console.error.
5. currentWindowStart — packages/lib/src/security/distributed-rate-limit.ts:218 — now = Date.now() default parameter bakes the clock into the signature (same anti-pattern in calculateVersionExpiresAt — packages/db/src/schema/versioning.ts:80, isDormant — apps/admin/src/lib/dormancy.ts:9, and the sdk/cli default-deps constructors).
6. components/calendar/calendar-types.ts:219 (apps/web) — exported date-bucketing helpers read new Date() for "today" instead of accepting it.
7. Workflow/trigger executors — apps/web/src/lib/workflows/workflow-executor.ts, calendar-trigger-executor.ts, zoom/webhook-trigger-executor.ts — Date.now() embedded in computation and console.* in logic paths.
8. In-memory rate limiters & module caches — packages/lib/src/auth/rate-limit-utils.ts:22, packages/lib/src/security/distributed-rate-limit.ts:66, apps/web/src/lib/auth/cron-auth.ts:18-34 (usedNonces), apps/web/src/lib/ai/core/model-capabilities.ts:29-118, apps/web/src/lib/ai/core/stream-abort-registry.ts:30-117 — module-level mutable Maps + setInterval at import time.
9. credit-pricing module-init env reads — packages/lib/src/billing/credit-pricing.ts:12-39 — pricing constants frozen from process.env at import.
10. Sandbox env gates — packages/lib/src/services/sandbox/{can-run-code,checkpoint-policy,containment,egress-ip,quota}.ts — call-time process.env reads inside decision logic.

Good existing patterns to replicate: packages/sdk (all impurity constructor-injected; operations layer fully pure), packages/cli's pure modules (argv/parse.ts, config/resolve.ts, auth/resolve.ts, keys/logic.ts), packages/lib pure decision modules (step-up-decisions.ts, credit-core.ts, compute-reorder-plan.ts, breach-assessment.ts), and apps/web's machine-workspace/workspace-reducer.ts + sheet/core/touch.ts (injected clock).

Note: boundary layers (API route handlers, DB repositories, socket handlers, CLI entrypoints) are inherently effectful — the goal there is not to make them pure but to keep them thin, pushing decisions into pure functions. They are inventoried below for completeness.

---

Full inventory

packages/lib — Impure Function Audit

Scope: packages/lib/src (non-test .ts). For inherently-effectful boundary modules (DB repositories, network/sandbox clients) exported functions are grouped per file; pure-computation-contaminated-by-avoidable-impurity cases are called out individually. A function with several impurities is listed once under its most severe category with all reasons.

Nondeterminism (time/randomness)

Otherwise-pure computations that read the clock / RNG inline instead of taking now/entropy as a parameter:

• evaluateFunction — packages/lib/src/sheets/functions.ts:96 — a pure spreadsheet-formula evaluator, but the NOW/TODAY cases call new Date() (337, 333) and RAND/RANDBETWEEN call Math.random() (451, 462); no clock/rng injected.
• getTodayUTC / getTomorrowMidnightUTC / getSecondsUntilMidnightUTC — packages/lib/src/services/date-utils.ts:13,28,44 — pure date math contaminated by new Date() / Date.now() read at call time (parseDateUTC:56 is pure).
• generateCsrfToken — packages/lib/src/auth/csrf-utils.ts:24 — randomBytes(32) (25) + Date.now() (26); also reads process.env.CSRF_SECRET.
• validateCsrfToken — packages/lib/src/auth/csrf-utils.ts — Date.now() (60) for expiry, console.error (74), reads CSRF_SECRET (5).
• generateBroadcastSignature / verifyBroadcastSignature — packages/lib/src/auth/broadcast-auth.ts:28,88 — Date.now() timestamps; verify also console.error (98) and reads REALTIME_BROADCAST_SECRET (9).
• currentWindowStart — packages/lib/src/security/distributed-rate-limit.ts:218 — default param now = Date.now() bakes the clock into the signature.
• getMonitoringCutoff — packages/lib/src/compliance/retention/monitoring-retention.ts:47 — new Date(Date.now() - ...).
• generateVerificationToken — packages/lib/src/auth/verification-utils.ts:28 — randomBytes(32) + new Date(Date.now()+...) (29).
• generateOpaqueToken — packages/lib/src/auth/opaque-tokens.ts:18 — randomBytes(32).
• token minter — packages/lib/src/auth/token-utils.ts:17 — cuid2 seeded from randomBytes.
• generateUnsubToken — packages/lib/src/services/notification-email-service.ts:57 — randomBytes + new Date expiry (67).
• generateSessionRowId — packages/lib/src/monitoring/activity-logger.ts:118 — randomBytes(32).

Note: incidents/breach-assessment.ts, compliance/dsr/sla.ts, services/machines/branch-session.ts, auth/invite-token.ts, auth/oauth/issue-tokens.ts, compliance/retention/chat-retention.ts correctly take now/detectedAt as a parameter and are PURE.

Environment reads

• isOnPrem / isTenantMode / isCloud / isBillingEnabled — packages/lib/src/deployment-mode.ts:34,38,42,46 — read process.env.DEPLOYMENT_MODE at call time (areCloudIntegrationsAllowed:30 takes mode and is pure).
• isFlyEnvironment — packages/lib/src/security/client-ip.ts:72 — reads process.env.FLY_APP_NAME.
• envInt/envBool/envFloat + module-level constants — packages/lib/src/billing/credit-pricing.ts:12,22,31,39… — read process.env at module-init; openRouterBaseUrl — :343 — call time.
• resolveMonitoringRetentionConfig / resolveAiUsageRetentionDays — packages/lib/src/compliance/retention/monitoring-retention.ts:29-32,43.
• resolveArchivalConfig — packages/lib/src/compliance/retention/activity-log-archival.ts:63-65.
• retention-engine env read — packages/lib/src/compliance/retention/retention-engine.ts:144.
• validateEnv / getEnvErrors / isEnvValid / getValidatedEnv — packages/lib/src/config/env-validation.ts:190,210,226,238 (getValidatedEnv also caches).
• getResendConfig / resolveAppUrl — packages/lib/src/services/email-service.ts:6,27.
• resolveBaseUrl / resolveMarketingBase — packages/lib/src/services/broadcast/core.ts:152,169 — default param env = process.env.
• getUserIndexKey / isPiiEncryptionEnabled — packages/lib/src/auth/user-repository.ts:41,52.
• master-key readers — packages/lib/src/encryption/encryption-utils.ts:20, packages/lib/src/encryption/user-crypto.ts:49, packages/lib/src/audit/audit-query.ts:58, packages/lib/src/audit/audit-ingest-writer.ts:46, packages/lib/src/audit/security-audit-repository.ts:32 — read ENCRYPTION_KEY at call time.
• anchor-gate env — packages/lib/src/audit/full-audit-verification.ts:241-242.
• getSessionIdleTimeout — packages/lib/src/auth/constants.ts:28 — env + console.warn (32).
• verifyGoogleToken / verifyAppleToken — packages/lib/src/auth/oauth-utils.ts:37-101 — env (also network).
• passkey PASSKEY_CONFIG module constants — packages/lib/src/auth/passkey-service.ts:30-32.
• onprem link base — packages/lib/src/auth/onprem-setup-link.ts:44-46.
• NODE_ENV gating — packages/lib/src/security/auth-handoff-sweep.ts:28, security/jti-revocation.ts:42,80,116,139, security/distributed-rate-limit.ts:338,424,485,698, auth/exchange-codes.ts:69,116, auth/passkey-register-handoff.ts:80.
• ClickHouse config — packages/lib/src/observability/clickhouse-client.ts:107-152.
• Logger config — packages/lib/src/logging/logger.ts:82-100,287,301,305,309,330; logging/logger-config.ts:306; logging/logger-database.ts:265.
• sanitizeCss — packages/lib/src/canvas/sanitize-css.ts:62,83 — NODE_ENV gate + console.warn.
• Sandbox env gates: isCodeExecutionEnabled — services/sandbox/can-run-code.ts:85; isCheckpointBeforeAgentBatchEnabled — checkpoint-policy.ts:51; isContainmentVerified — containment.ts:167; getConfiguredEgressIpTag — egress-ip.ts:34; getMachineMaxActiveSeconds — quota.ts:140; resolveSpritesToken — sandbox-client/sprites.ts:354; getSandboxSessionSecret — machine-session-manager.ts:88; machine-storage-measure.ts:30.
• credit-emit — packages/lib/src/billing/credit-emit.ts:40; notifications — notifications/notifications.ts:40; APNs config notifications/push-notifications.ts:40-42,226-227; cost-reconcile — billing/cost-reconcile.ts:68; Resend suppression — compliance/erasure/resend-suppression-client.ts:50-51,108-109.
• page-content-store — packages/lib/src/services/page-content-store.ts:42-56,154-155.
• voice-pricing — packages/lib/src/monitoring/voice-pricing.ts:30.
• UploadSemaphore ctor — packages/lib/src/services/upload-semaphore.ts:54.
• quota readers — packages/lib/src/services/sandbox/quota.ts:24,141.

Module-level mutable state

• attempts Map + module-load setInterval — packages/lib/src/auth/rate-limit-utils.ts:22,25; mutated by checkRateLimit:39, resetRateLimit:132, getRateLimitStatus:140.
• inMemoryAttempts Map / cleanupIntervalId / postgresAvailableLogged — packages/lib/src/security/distributed-rate-limit.ts:66,67,206; startCleanupInterval:73 (module-load setInterval, 102), shutdownRateLimiting:93, inMemoryCheckRateLimit:106.
• UploadSemaphore singleton — packages/lib/src/services/upload-semaphore.ts:43-60; acquireUploadSlot:75, releaseUploadSlot:112, cleanupStaleSlots (acquire also Date.now+Math.random, 98).
• cachedEnv memo — packages/lib/src/config/env-validation.ts:232.
• cached binding — packages/lib/src/audit/audit-db-binding.ts:39; resolveAuditDbBinding:45, resetAuditDbBindingForTests:65.
• defaultAppendPath / defaultService singletons — packages/lib/src/audit/security-audit.ts:427,445,161.
• alertHandler / periodicTimer / verificationInProgress — packages/lib/src/audit/security-audit-alerting.ts:72,545,546 (periodic setInterval 562).
• incidentNotifier — packages/lib/src/incidents/incident-service.ts:51; setIncidentNotifier:54.
• hookFn — packages/lib/src/logging/siem-error-hook.ts:16; setSiemErrorHook:18, fireSiemErrorHook:26.
• activityBroadcastHook / workflowTriggerHook — packages/lib/src/monitoring/activity-logger.ts:374,400.
• APNs JWT cache — packages/lib/src/notifications/push-notifications.ts:29,30; getApnsJwtToken:32.
• resendInstance memo — packages/lib/src/services/email-service.ts:17.
• _s3 singleton — packages/lib/src/services/page-content-store.ts:37.
• concurrency/activity maps — packages/lib/src/services/sandbox/quota.ts; acquireCodeExecutionSlot:58, releaseCodeExecutionSlot:70, recordMachineActivity:206, resets :80,220,225.
• checkpoint state map — packages/lib/src/services/sandbox/checkpoint-policy.ts:143-185.
• sprite handle cache — packages/lib/src/services/sandbox/sandbox-client/sprites.ts:1375.
• Logger buffers + flushTimer — packages/lib/src/logging/logger.ts:79,359, logging/logger-browser.ts:84,208.
• ClickHouse buffer — packages/lib/src/observability/clickhouse-buffer.ts:102.

Database I/O (grouped per file; most also stamp new Date() and/or console.error)

• Repositories: repositories/account-repository.ts:32, activity-log-repository.ts:17, agent-repository.ts:47, broadcast-repository.ts:64, data-subject-request-repository.ts:41, drive-repository.ts:28, page-repository.ts:79 — all exported CRUD.
• Permissions: permissions/permissions.ts — getDriveIdsForUser, getUserAccessLevel, canUserViewPage/EditPage/SharePage/DeletePage, isDriveOwnerOrAdmin, isUserDriveMember, getUserAccessiblePagesInDrive(+WithDetails), getUserDriveAccess, getUserDrivePermissions, usersShareDrive, getBatchPagePermissions; permission-mutations.ts:224,359; share-link-service.ts:94-453 (9 fns); accessible-page-ids.ts:12; agent-permissions.ts:30,64,73; app-permissions.ts:60-463 (10 fns; resolveExplicitAppRoleAccess:89, getScopedDriveMembership:428 pure); membership-queries.ts:23,36,53,63 (resolveCustomRolePermissions:14 pure); file-access.ts:18; rollback-permissions.ts:53.
• pages/circular-reference-guard.ts — DB reads.
• Integrations: integrations/repositories/{audit,connection,provider,config,grant}-repository.ts — all exported fns; integrations/saga/execute-tool.ts:77 (Date.now timing); integrations/resolution/resolve-agent-integrations.ts.
• Auth: auth/account-lockout.ts:62-148, device-auth-utils.ts (console 122-384), exchange-codes.ts:53 (randomBytes+env), magic-link-service.ts:107,126, oauth-utils.ts (network+env, new Date 233,276), passkey-service.ts, passkey-register-handoff.ts:59, pkce.ts:41,47, session-repository.ts (new Date 55-139), session-service.ts:68, step-up-service.ts (pure decisions in step-up-decisions.ts), token-lookup.ts, user-repository.ts, verification-utils.ts:28, onprem-setup-link.ts:32.
• Security: security/jti-revocation.ts:36,75, distributed-rate-limit.ts (checkDistributedRateLimit), auth-handoff-sweep.ts.
• Audit: audit/audit-ingest-writer.ts:82, security-audit-repository.ts:83, security-audit-chain-verifier.ts:178,207,318, security-audit.ts:160, security-audit-alerting.ts:97, audit-log.ts, audit-query.ts, co-stream-reconciliation.ts, full-audit-verification.ts, admin-read-audit.ts, co-stream.ts.
• Billing: billing/cost-reconcile.ts, credit-backfill.ts:68, credit-balance.ts:108, credit-consume.ts, credit-funding.ts, credit-gate.ts:144, live-concurrency-query.ts:26, machine-payer.ts (credit-core.ts is pure).
• Compliance: compliance/retention/{retention-engine.ts:25-143,activity-log-archival.ts:96,monitoring-retention.ts,chat-retention.ts}, compliance/erasure/{pseudonymize-repository,pseudonymize-targets,run-erasure,revoke-integration-tokens.ts:37,drive-disposition,email-suppression,ai-provider-erasure}.ts, compliance/export/gdpr-export.ts, compliance/file-cleanup/orphan-detector.ts.
• Monitoring/observability: monitoring/activity-logger.ts (logActivity + helpers; randomBytes, console 48-587, module hooks), ai-monitoring.ts, hash-chain-verifier.ts:146 (console 329-573), observability/analytics-inserts.ts:76, analytics-reads.ts, analytics-read-core.ts, analytics-gdpr.ts, error-resolutions.ts:100, logging/logger-database.ts (write* fns), logging/monitoring-purge.ts:42, logging/ai-usage-purge.ts.
• incidents/incident-service.ts:71 — createIncident.
• Notifications: notifications/notifications.ts (DB+fetch+env+console), notifications/push-notifications.ts (DB+APNs network+env+cache).
• content/version-resolver.ts.
• Services: services/storage-limits.ts:34-382 (11 fns; pure helpers excluded), storage-repository.ts, drive-service.ts, drive-member-service.ts, drive-role-service.ts:83-393 (7 fns; validators pure), drive-agent-service.ts:99-496 (7 fns), drive-search-service.ts:117,162,350, calendar-event-drive-service.ts:130-356 (6 fns), channel-message-repository.ts, dm-message-repository.ts, app-shell-service.ts:264, page-payload-service.ts:250, page-version-service.ts, quote-enrichment.ts, notification-email-service.ts, attachment-upload.ts:51, attachment-upload-repository.ts, validated-service-token.ts:178-669 (7 fns), subdomain-allocation.ts, reorder/locked-batch-reorder.ts:47 (compute-reorder-plan.ts:19 pure), broadcast/{audience.ts:70,record-adapter.ts,engine.ts,transactional-engine.ts}.
• Machines: services/machines/{machine-branches-store.ts:102,machine-projects-store.ts:63,machine-workspaces-store.ts:99,agent-terminals-store.ts:90,machine-settings.ts:88-136,machine-projects.ts:187-291,machine-access.ts:29,39,machine-list.ts:57,87,machine-workspaces.ts:104-229,agent-terminals.ts:265-536,machine-branches.ts:314-717,machine-orphan-reconcile.ts:184} — DB (+ sandbox process I/O for spawn/kill).
• Sandbox: services/sandbox/{machine-session-manager.ts:392,555,575,machine-session.ts:93,machine-billing.ts,machine-storage-billing.ts:110,212,machine-storage-reconcile.ts:159,github-token.ts:6,tool-gate.ts:100,audit.ts:230,quota.ts:107}.

Network I/O

• assertSafeUrl/safe-fetch — packages/lib/src/security/url-validator.ts:482 — SSRF-guarded fetch.
• fetchWithTimeout — packages/lib/src/utils/fetch-with-timeout.ts:38.
• buildWebhookSiemErrorHook — packages/lib/src/logging/siem-error-hook.ts:35 — POST (44), console (56), new Date (49).
• exchangeCodeForTokens / refreshTokens — packages/lib/src/integrations/oauth/oauth-handler.ts:125,178 — fetch + PKCE randomBytes (217).
• executeHttpRequest — packages/lib/src/integrations/execution/http-executor.ts — fetch (91), Date.now timing.
• billing/cost-reconcile.ts:71, billing/credit-emit.ts:47, notifications/notifications.ts:47, notifications/push-notifications.ts (HTTP/2 APNs), compliance/erasure/revoke-integration-tokens.ts:37, compliance/erasure/resend-suppression-client.ts:50-109, services/email-service.ts:71 (Resend SDK).

Note: fetch(...) at packages/lib/src/forms/form-html.ts:55 is inside a generated client-side HTML string — not a runtime call in this package.

Filesystem/process I/O

• writePageContent / readPageContent / readPageContentFromFilesystem / isContentCompressed / getContentMetadata — packages/lib/src/services/page-content-store.ts:80,132,153,166,178.
• validatePath — packages/lib/src/security/path-validator.ts:17 — realpath/stat.
• Sprite sandbox client — packages/lib/src/services/sandbox/sandbox-client/sprites.ts — runSpawned:379, killSpriteSession:873, createSpritesSandboxClient:1406 (+ internal spawn/fs at 282,700,940-956,1329); sprite-tasks.ts:330,453; sprite-machine-host.ts:244.
• Sandbox tool runners — packages/lib/src/services/sandbox/tool-runners.ts:605,744,801,878 — runBashInSandbox, writeSandboxFile, readSandboxFile, editSandboxFile.
• Machine remote FS — packages/lib/src/services/sandbox/machine-fs.ts:68-343 — 8 fns.
• runGitInSandbox — packages/lib/src/services/sandbox/git-tool-runners.ts:90.
• resolveMachineMergeBase / listMachineDiffFiles / readMachineDiffPair — packages/lib/src/services/sandbox/machine-diff.ts:68,113,214; readMachineGitBlob — machine-git-blob.ts:78.
• refreshStorageMeasurement — packages/lib/src/services/sandbox/machine-storage-measure.ts:144 — du spawn.
• setupMemoryProtection — packages/lib/src/services/memory-monitor.ts:50 — setInterval; getProcessMemory:34 — process.memoryUsage().

Console/logging side effects (only impurity)

• generateDocx / generateExcel — packages/lib/src/content/export-utils.ts:30,135 — console.error; new Date() (100) in workbook metadata.
• sanitizeCss — packages/lib/src/canvas/sanitize-css.ts:63,84.
• getSessionIdleTimeout — packages/lib/src/auth/constants.ts:32.
• Logger console writers — packages/lib/src/logging/logger.ts:316-417, logger-browser.ts:251-257.
• graceful-shutdown default logError — packages/lib/src/logging/graceful-shutdown.ts:23.
• clickhouse-buffer / analytics-inserts default logError — observability/clickhouse-buffer.ts:52, analytics-inserts.ts:77.

Count

Approximately 420 impure exported/significant functions in packages/lib/src: Nondeterminism ~14 highlighted; Environment reads ~55; Module-level mutable state ~24; Database I/O ~300+ (across ~70 files); Network I/O ~13; Filesystem/process I/O ~30; Console/logging ~12. Most notable avoidable contaminations: evaluateFunction (sheets), date-utils helpers, csrf-utils/broadcast-auth, currentWindowStart default param, call-time process.env readers in deployment-mode/credit-pricing/sandbox gates.

---

packages/db, packages/sdk, packages/cli — Impure Function Audit

packages/db

Nondeterminism (time/randomness)

Schema default closures — anonymous callbacks on exported Drizzle table objects. Two markers recur: $defaultFn(() => createId()) (cuid2, random) on primary keys, and $onUpdate(() => new Date()) (wall clock) on updatedAt. Present across ~55 schema files:

auth.ts:11,53,61,106,129,157,210,236, automation-preferences.ts:16, calendar-triggers.ts:22,44, calendar.ts:31,90,116,149,186,203, chat.ts:30,93, commands.ts:27,57, contact.ts:5, conversations.ts:11,18,32, core.ts:12,20,38,86,103,105,132,147,165,182,196, credits.ts:34,63,111, custom-domains.ts:9, dashboard.ts:8,12,32, data-subject-requests.ts:69, display-preferences.ts:13, drafts.ts:7, email-broadcasts.ts:102,119,191, email-notifications.ts:9,22, feedback.ts:14, form-targets.ts:27,59, hotkeys.ts:7, incidents.ts:38, integrations.ts:59,86,102,149,178,218,250,261, machine-agent-terminals.ts:57,77, machine-branches.ts:30,97, machine-projects.ts:30,45, machine-sessions.ts:25,122, machine-workspaces.ts:92, members.ts:12,26,44,53,74,90,181, monitoring.ts:31,78,116,147,233,325,469, notifications.ts:42, oauth.ts:13,29,56,82,108, pending-connection-invites.ts:7, pending-invites.ts:9, pending-page-invites.ts:14, permissions.ts:9, personalization.ts:11, published-pages.ts:8,21, push-notifications.ts:9,31, security-audit-anchors.ts:28, security-audit-ingest.ts:29, security-audit.ts:90, sessions.ts:7, share-links.ts:11,38, social.ts:12,37,45,61,116, storage.ts:22, subscriptions.ts:7,21, task-triggers.ts:19,32, tasks.ts:12,21,44,52,73,85,105, toast-notification-preferences.ts:16, versioning.ts:147,174,307, webhook-triggers.ts:18,31, workflow-runs.ts:38, workflows.ts:15,34, zoom.ts:19,48, ai-compaction.ts:21 (all under packages/db/src/schema/)

• calculateVersionExpiresAt — packages/db/src/schema/versioning.ts:80 — default param createdAt: Date = new Date(); reads wall clock when called without an argument

Database I/O

• pool (module singleton) — packages/db/src/db.ts:37 — constructs new Pool() at import time
• db (module singleton) — packages/db/src/db.ts:49 — drizzle(pool) bound at import
• getAdvisoryLockPool — packages/db/src/db.ts:76 — lazily constructs a second pg.Pool, mutates module-level advisoryLockPool
• withAdvisoryLock — packages/db/src/advisory-lock.ts:113 — pool.connect() + pg_try_advisory_lock/pg_advisory_unlock queries
• getAdminDb — packages/db/src/admin-db.ts:131 — lazy connect via memoized registry singleton
• createAdminDbRegistry — packages/db/src/admin-db.ts:69 — closure holds mutable instance, calls createPool/drizzle/alert
• getAdminEraserDb — packages/db/src/admin-eraser-db.ts:126 — lazy connect, throws when unconfigured
• createAdminEraserDbRegistry — packages/db/src/admin-eraser-db.ts:81 — closure instance, createPool/drizzle
• createAdminAuditDbClient — packages/db/src/admin-eraser-db.ts:142 — new Pool() + drizzle on arbitrary creds
• runMigrations — packages/db/src/migration-runner.ts:34 — executes CREATE SCHEMA/TABLE, per-migration transactions
• migrateAdminDb — packages/db/src/migrate-admin.ts:23 — new Pool(), reads migration files, runs migrations
• provisionAdminLoginUsers — packages/db/src/provision-admin-users.ts:25 — new Pool(), pool.query for each login user
• atomicDeviceTokenRotation — packages/db/src/transactions/auth-transactions.ts:71 — db.transaction SELECT FOR UPDATE / INSERT / UPDATE; also Date.now() (145), new Date() (188,198), createId() (203)
• atomicValidateOrCreateDeviceToken — packages/db/src/transactions/auth-transactions.ts:281 — db.transaction locking + writes; also new Date() (340,383,413), createId() (416)
• calculateInitialStorage — packages/db/scripts/calculate-initial-storage.ts:20 — SELECT/UPDATE/INSERT over all users; new Date() (48,92)

Environment reads

• basePoolConfig — packages/db/src/db.ts:10 — reads process.env.DATABASE_URL/DATABASE_SSL at call time
• pool init — packages/db/src/db.ts:39 — reads process.env.DB_POOL_MAX
• getEnv closure (adminDb registry) — packages/db/src/admin-db.ts:112 — reads 5 ADMIN_*/AUDIT_* env vars each call
• getAdminDbMode — packages/db/src/admin-db.ts:137 — re-reads env via getEnv
• getEnv closure (eraser registry) — packages/db/src/admin-eraser-db.ts:117 — reads ADMIN_ERASER_DATABASE_URL/ADMIN_DATABASE_SSL
• module-scope dryRun — packages/db/src/migrate-pending-invites.ts:29 — reads process.argv at import

Module-level mutable state

• advisoryLockPool (module let) — packages/db/src/db.ts:74 — mutated by getAdvisoryLockPool
• pools (module new Map) — packages/db/src/pool-stats.ts:5
• registerPool — packages/db/src/pool-stats.ts:13 — mutates the module pools map
• getPoolStats — packages/db/src/pool-stats.ts:17 — reads the module pools map
• registry singletons — packages/db/src/admin-db.ts:110, packages/db/src/admin-eraser-db.ts:115 — module-level instances holding memoized connection state

Console/logging side effects

• releaseQuietly — packages/db/src/advisory-lock.ts:76 — console.error on release failure
• unlockAndRelease — packages/db/src/advisory-lock.ts:95 — console.error on unlock failure
• alert closure (adminDb) — packages/db/src/admin-db.ts:124 — console.error break-glass banner

Filesystem/process I/O

• main — packages/db/src/migrate.ts:11 — readMigrationFiles, console.log, process.exit(0/1)
• main — packages/db/src/migrate-admin.ts:47 — console.log, process.exit
• main — packages/db/src/provision-admin-users.ts:62 — console.log, process.exit
• main — packages/db/src/migrate-pending-invites.ts:31 — DB deletes, console.log/error, process.exit
• calculateInitialStorage / bottom runner — packages/db/scripts/calculate-initial-storage.ts:20,164 — config() env load, console.*, process.exit

Count (db): ~15 DB-I/O functions, ~6 env-read functions, 5 module-mutable-state functions, 3 console-side-effect functions, 5 filesystem/process entrypoints, 1 nondeterministic helper, plus ~55 schema files carrying createId/new Date default closures.

packages/sdk

Network I/O

• executeRequest — packages/sdk/src/transport/execute.ts:22 — calls injected fetch; setTimeout timeout timer/AbortController
• PageSpaceClient.#invoke / invoke — packages/sdk/src/client.ts:344 — drives the fetch pipeline (network), retry backoff via delay
• delay — packages/sdk/src/client.ts:265 — setTimeout-based sleep
• OAuthTokenProvider.getAccessToken / #performRefresh — packages/sdk/src/auth/oauth.ts:83,138 — awaits injected refresh HTTP call, persists via onTokensUpdated

Nondeterminism (time/randomness)

• PageSpaceClient constructor — packages/sdk/src/client.ts:324 — defaults #fetch = fetch.bind(globalThis) (331) and #jitter = Math.random (331) when not injected
• OAuthTokenProvider constructor — packages/sdk/src/auth/oauth.ts:75 — defaults #now = Date.now (78) when now not injected

Module-level mutable state

• PageSpaceClient instance field #compatibilityVerified — packages/sdk/src/client.ts:322 — memoized flag mutated during #invoke
• OAuthTokenProvider fields #tokens/#status/#inFlightRefresh — packages/sdk/src/auth/oauth.ts:67-73 — mutated across refresh calls
• StaticTokenProvider field #invalidated — packages/sdk/src/auth/static.ts:23 — toggled by invalidate/getAccessToken

Note: pkce.generateCodeVerifier (pkce.ts:54), retry.ts, registry.ts, version.ts, build-request.ts, parse-response.ts, decide.ts, and all operations/* (the new Date(value) in calendar.ts/activity.ts are deterministic parses of given input) are pure — impurity is constructor-injected.

Count (sdk): 4 network-I/O functions, 2 nondeterministic-default constructors, 3 stateful classes. No filesystem/process, env-read, or standalone console impurities.

packages/cli

Nondeterminism (time/randomness)

• FileCredentialStore.writeFile — packages/cli/src/credentials/file-store.ts:104 — Math.random() temp-file suffix (110); also process.pid
• FileActiveKeyStore.writeFile — packages/cli/src/credentials/active-key.ts:88 — Math.random() temp-file suffix (91); also process.pid
• createRefreshAccessToken — packages/cli/src/auth/silent-refresh.ts:35 — defaults now = Date.now (39); computes token expiries from clock
• default-deps wiring: loginHandler — packages/cli/src/commands/login.ts:151 — deps default randomBytes: nodeRandomBytes (148/153) + now: Date.now (160)
• tokensCreateHandler — packages/cli/src/commands/keys/create.ts:409 — deps default randomBytes (406/411) + now: Date.now (418)
• keysUseHandler — packages/cli/src/commands/keys/use.ts:278 — deps default randomBytes (275/280) + now: Date.now (287)
• keysHandler — packages/cli/src/commands/keys/wizard.ts:645 — deps default randomBytes (642/647) + now: Date.now (654)
• loginDeviceHandler — packages/cli/src/commands/login-device.ts:137 — deps default now: Date.now (147)
• whoamiHandler — packages/cli/src/commands/whoami.ts:136 — deps default now: Date.now (141); new Date(deps.now()) (102)

Environment reads

• module-scope process wiring in bin.ts — packages/cli/src/bin.ts:46,50,55 — reads process.argv/process.env/process.stdin.isTTY
• module-scope process wiring in bin-pagespace-mcp.ts — packages/cli/src/bin-pagespace-mcp.ts:17-24 — reads process.argv/process.env

(resolveConfig, resolveEnvToken, resolveEnvKeyName, resolveAuth, resolveKeyName, hasExplicitCredential all take env as a parameter and are pure.)

Network I/O

Auth flow factories/functions:

• confirmIdentity — packages/cli/src/auth/confirm-identity.ts:36 — constructs a client and performs GET /api/auth/me
• createDiscoverMetadata — packages/cli/src/auth/discover.ts:29 — returned fn defaults to real fetch, hits .well-known
• createExchangeCode — packages/cli/src/auth/exchange-code.ts:70 — default fetch, token exchange
• createPollDeviceToken — packages/cli/src/auth/poll-device-token.ts:30 — default fetch, device-token poll
• createRequestDeviceAuthorization — packages/cli/src/auth/request-device-authorization.ts:35 — default fetch
• createRevokeToken — packages/cli/src/auth/revoke-token.ts:29 — default fetch
• runDeviceLogin — packages/cli/src/auth/device-flow.ts:150 — polling network loop; new Date(deps.now()) (222)
• runLoopbackLogin — packages/cli/src/auth/loopback-flow.ts:299 — discovery/exchange network + browser + loopback server; deps.randomBytes (313,315), new Date(deps.now()) (405)
• buildAuthProvider — packages/cli/src/auth/auth-context.ts:53 — wires OAuth refresher (network) + credential-store writes; new Date(deps.now()) (103)
• enforceAuth — packages/cli/src/auth/auth-context.ts:130 — auth.getAccessToken() (network refresh), credentialStore.delete, stderr writes
• run — packages/cli/src/run.ts:128 — composition root: constructs PageSpaceClient, network auth, now: Date.now (200), reads active-key/credential stores, writes stderr
• runPagespaceMcpBin — packages/cli/src/pagespace-mcp-bin.ts:19 — delegates to run
• createMcpServer — packages/cli/src/mcp/serve.ts:217 — wires tools/call handler that performs sdk.invoke (network)

Command handlers — each writes to ctx.stdout/ctx.stderr and calls ctx.sdk.* (network): ~70 handlers across commands/activity.ts:22, agents.ts:68,142,223,271, channels.ts:13, content.ts:101,140,197, drives.ts:42,54,72,90,108,129,170, export.ts:53,124, pages.ts:53,76,105,125,161,182,207,235, roles.ts:155,177,202,276,351,386,438,486, search.ts:98,145,193, sheets.ts:44,104, tasks.ts:50,74,195,242,284,312,336,390, trash.ts:25, keys/list.ts:19,51, keys/revoke.ts:23,56, keys/create.ts:254,409, keys/use.ts:136,197,278, keys/wizard.ts:580,645, login.ts:58,151, login-device.ts:44,137, logout.ts:102,139, whoami.ts:40,136, mcp.ts:41,68

Filesystem/process I/O

• bin.ts top-level + prompt/flushAndExit — packages/cli/src/bin.ts:14-75 — process.stdout/stderr/stdin, readline, process.exit
• bin-pagespace-mcp.ts top-level — packages/cli/src/bin-pagespace-mcp.ts:14-36 — process.stdout/stderr, process.exitCode
• openBrowser — packages/cli/src/auth/open-browser.ts:45 — spawn detached child (reads process.platform)
• createLoopbackServer — packages/cli/src/auth/create-loopback-server.ts:22 — node:http createServer/listen
• waitMs/unrefWaitMs — packages/cli/src/auth/wait.ts:15,28 — setTimeout
• FileCredentialStore get/set/delete/list/readFile/writeFile — packages/cli/src/credentials/file-store.ts:52-120 — node:fs open/read/write/chmod/rename; defaultCredentialsPath reads homedir() (33)
• FileActiveKeyStore getActiveKey/setActiveKey/clearActiveKey/readFile/writeFile — packages/cli/src/credentials/active-key.ts:60-99 — node:fs; defaultActiveKeysPath reads homedir() (28)
• createNativeKeychainAdapter (getSecret/setSecret/deleteSecret/listSecrets) — packages/cli/src/credentials/keychain.ts:91 — lazy native @napi-rs/keyring binding, OS keychain I/O
• readStdinToString / createPagesReplaceLinesHandler deps — packages/cli/src/commands/content.ts:191,199 — process.stdin async iteration, readFile
• pagesExportHandler default deps — packages/cli/src/commands/export.ts:100,126 — writeFile/access to disk
• sheetsEditCellsHandler stdin reader — packages/cli/src/commands/sheets.ts:98 — process.stdin async iteration

Console/logging side effects

• versionHandler — packages/cli/src/commands/version.ts:12 — writes to ctx.stdout only (no network)
• helpHandler/createHelpHandler — packages/cli/src/router/routes.ts:162, packages/cli/src/commands/help.ts:104 — prints help text to ctx.stdout

Module-level mutable state

• CompositeCredentialStore fields degraded/noticeShown — packages/cli/src/credentials/store.ts:42,43 — mutated on first keychain failure (degrade)
• createNativeKeychainAdapter closure modulePromise — packages/cli/src/credentials/keychain.ts:92 — memoized lazy import
• createCredentialStore — packages/cli/src/credentials/store.ts:204 — defaults stderr to a sink writing process.stderr (209)

Count (cli): ~90 network-I/O functions, ~20 filesystem/process-I/O functions, ~9 nondeterminism sites, 2 env-reading module entrypoints, 2 console-only handlers, 3 module-mutable-state sites. Pure modules: argv/parse.ts, router/router.ts, config/resolve.ts, auth/resolve.ts, auth/legacy-token-env.ts, credentials/serialize.ts, mcp/tool-convert.ts, commands/keys/args.ts, commands/keys/logic.ts, commands/keys/guidance.ts, exit-codes.ts, and pure helpers in keys/create.ts (buildTokenScope, buildKeyUpdateScope, buildKeyActivateScope, resolveNewKeyName).

---

The apps/web and remaining apps inventories continue in the comments below (GitHub body size limit).

[2witstudios]

apps/web — Impure Function Audit (inventory continued, 2/3)

Scope: apps/web/src (~1,670 files). Tests excluded. src/lib is enumerated in detail; src/app/api and src/components are summarized.

src/lib

Nondeterminism (time / randomness)

ID generation (createId/crypto.randomUUID/Math.random) — nondeterministic output:

• generateId — lib/tabs/tab-navigation.ts:32 — `tab-${Date.now()}-${Math.random()...}` module-level arrow
• getRequestId / createRequestId — lib/request-id/request-id.ts:26,29 — createId()
• getBrowserSessionId — lib/ai/core/browser-session-id.ts:7 — crypto.randomUUID()
• resolveMessageId — lib/ai/streams/resolveMessageId.ts:34 — createId() fallback
• validateInferenceRequest message mapper — lib/ai/openai-api/validate-inference-request.ts:45,154 — createId()
• MCPBridge request id — lib/mcp/mcp-bridge.ts:79 — crypto.randomUUID()
• FetchBridge request id — lib/fetch-bridge/fetch-bridge.ts:69 — crypto.randomUUID()
• sandbox runtime context.turnId — lib/ai/tools/sandbox-tools-runtime.ts:228 — crypto.randomUUID()
• iOS/web device id — lib/auth/platform-storage/ios-storage.ts:43, web-storage.ts:35, lib/ios-google-auth.ts:95, lib/ios-apple-auth.ts:82, lib/repositories/oauth-repository.ts:560 — createId()

Wall-clock reads (Date.now() / new Date() without injected clock):

• lib/workflows/workflow-executor.ts — runWorkflow uses Date.now() (79,100,115,166…) and `workflow-${...}-${Date.now()}` (297), createId() (359,360), new Date() (140)
• lib/workflows/calendar-trigger-executor.ts:33-129 — executeCalendarTrigger duration via Date.now()
• lib/integrations/zoom/webhook-trigger-executor.ts:36-125 — same pattern, plus triggerAt: new Date() (102)
• lib/workflows/calendar-trigger-helpers.ts:207,343 — new Date() "now" horizon computation
• lib/workflows/task-trigger-helpers.ts:238 — lastFiredAt: new Date()
• lib/workflows/cron-utils.ts:25 — after ?? new Date() default
• lib/memory/discovery-service.ts:80,167 / integration-service.ts:102 — new Date() lookback / updatedAt
• lib/ai/core/model-capabilities.ts:56,136 — cache-expiry Date.now() (with module caches)
• lib/ai/core/timestamp-utils.ts — getCurrentBucketedTimestamp/others default now = Date.now() (136,253) and new Date() (166,214)
• lib/ai/core/stream-abort-registry.ts:72,123,171,323 — Date.now() + createId() (155)
• lib/ai/core/stream-lifecycle.ts:135,216,305,327,333,359,421 — new Date() heartbeat/Date.now() deadlines
• lib/ai/core/stream-takeover.ts:65,179 — now = Date.now() default, completedAt: new Date()
• lib/ai/core/stream-abort-mark.ts:80,168 — now = new Date() default
• lib/ai/core/pending-abort-intents.ts:54,90,167 — now defaults + new Date(Date.now() - TTL)
• lib/ai/core/run-agent-with-retry.ts:249,266 — Date.now() budget, setTimeout
• lib/ai/core/compaction/compaction-service.ts:83,190 / compaction-repository.ts:108,178 — Date.now() gap, new Date()
• lib/ai/core/materialize-interrupted-stream.ts:130 / message-utils.ts:595,744 / conversation-state.ts:65,72 — new Date() / createId()
• lib/ai/openai-api/v1-conversations.ts:96 — updatedAt: new Date()
• lib/ai/tools/* — DB-write timestamps new Date() and createId(): trigger-tools.ts:153,176,180, calendar-write-tools.ts:297,306,512,757,769,868, drive-tools.ts:186,294,406, channel-tools.ts:130,230, page-write-tools.ts:248,273,623, task-management-tools.ts:168-190,322, task-helpers.ts:393,465,479,514,612, activity-tools.ts:43-58 (relative windows off new Date()), agent-communication-tools.ts:439,478,515,805,839 (Date.now()+createId()), calendar-read-tools.ts (naive-tz new Date() math)
• lib/auth/cron-auth.ts:34,58,83,143 — Date.now() (+ module state), login-csrf-utils.ts:26,53 — Date.now() timestamp, oauth-state.ts:78 — Date.now() age check, auth/index.ts:213 — expiresAt <= Date.now(), native-invite-acceptance.ts:110 — now: new Date()
• lib/auth/auth-fetch.ts:182,185,457,791-815 — Date.now() refresh cooldown (AuthFetch class methods)
• lib/auth/google-avatar.ts:231 — ?t=${Date.now()} cache-bust URL
• lib/canvas/file-view-token.ts:46,62 — nowMs = Date.now() default (signToken/verifyToken), publish-page.ts:405,452 — updatedAt: new Date()
• lib/upload/create-file-page.ts:120,248 — now ?? new Date(), createId(); attachment-direct.ts:100 — new Date(Date.now()+TTL)
• lib/stripe-customer.ts:61 — updatedAt: new Date()
• lib/subscription/usage-breakdown.ts:69 / usage-breakdown-query.ts:43 — new Date() fallback/now
• lib/monitoring/monitoring-queries.ts:68,122,1036-1047 — new Date(Date.now() - window)
• lib/integrations/google-calendar/{sync-service,push-service,token-refresh,event-transform}.ts — pervasive new Date() for sync timestamps/createId() (sync-service 138-140,196,706,814; token-refresh 31,77; event-transform 57,255,304,310)
• lib/integrations/zoom/{token-refresh,process-webhook,verify-webhook,webhook-trigger-queries}.ts — Date.now() expiry/replay window (token-refresh 15,55; verify-webhook 21), new Date() (webhook-trigger-queries 64)
• lib/machines/*-runtime.ts — injected now: () => new Date() defaults + Date.now() (machine-projects 165, agent-terminals 144, machine-settings 165,360,403, machine-orphan-reconcile 230,241, machine-branches 177, machine-workspaces 108)
• lib/onboarding/drive-setup.ts / home-drive.ts — new Date() + many createId() (drive-setup 29,42-387; home-drive 60,75,82)
• lib/erasure/request-erasure.ts:37,59-75 — new Date() / .toISOString()
• lib/draft/draft.ts:23 — new Date(now + TTL); lib/editor/pagination/PaginationExtension.ts:208 — setMeta(..., Date.now())
• lib/analytics/device-fingerprint.ts:20 — new Date().getTimezoneOffset(); client-tracker.ts:68 — new Date().toISOString()
• lib/logging/client-logger.ts:97 / edge-logger.ts:140 — timestamp: new Date().toISOString()
• lib/repositories/* — timestamp writes: auth-repository.ts:53, session-repository.ts:189, chat-message-repository.ts:136, conversation-repository.ts:174,379,401,407, global-conversation-repository.ts:289,290,361,380,423, drive-invite-repository.ts:221, page-invite-repository.ts:330 (createId)

Note: lib/workflows/recurrence-utils.ts, lib/utils/timestamp.ts (toISOTimestamp), lib/messages/grouping.ts, lib/ai/shared/chat-types.ts construct new Date() only from given inputs (deterministic) — excluded.

Count (nondeterminism): ~70 files with time/randomness impurity.

Environment reads (process.env at call time)

• lib/deployment-mode.ts:16,20; lib/share-url.ts:2 (buildShareUrl); lib/theme-cookie.ts:5
• lib/websocket/socket-utils.ts:174, calendar-events.ts:28, ws-security.ts:121
• lib/auth/cookie-config.ts:44-72, oauth-state.ts:44, origin-validation.ts:56,62,197, login-csrf-utils.ts:13, cron-auth.ts:109,113
• lib/logging/client-logger.ts:17-30, edge-logger.ts:78
• lib/security/edge-client-ip.ts:37
• lib/canvas/file-view-token.ts:27, published-storage.ts:41-335 (client + isPublishConfigured/asset origin), reconcile-cert.ts:13,84, publish-page.ts:365,698
• lib/presigned-url.ts:9-23 (getS3Client/getBucketName), lib/stripe/client.ts:13, lib/stripe-config.ts:46,52
• lib/fly/certs.ts:53, lib/storage/reap-orphaned-files.ts:7, lib/erasure/enqueue.ts:12, lib/upload/processor-effects.ts:3, lib/upload/attachment-verify-effect.ts:12
• lib/channels/agent-mention-responder.ts:399,406
• lib/integrations/google-calendar/{sync-service.ts:663,token-refresh.ts:56,57,webhook-auth.ts:42,46,webhook-token.ts:25,27,48}, lib/integrations/zoom/token-refresh.ts:21,22
• lib/ai/core/provider-factory.ts:193, ai-providers-config.ts:392,393, image-generation.ts:106, message-utils.ts:54 (module-level isAIDebugEnabled), ai-utils.ts:24-50, pending-abort-intents.ts:173
• lib/ios-google-auth.ts:45 (module const), lib/auth/google-avatar.ts:4 (PROCESSOR_URL module const)

Count (env): ~35 files.

Browser / global state (window / document / navigator / DOM)

• lib/analytics/client-tracker.ts:35-281 — startTracking/trackPageView read window/document/navigator, register listeners, navigator.sendBeacon
• lib/analytics/device-fingerprint.ts:14-87 — generateFingerprint/getDeviceId read navigator.*
• lib/pointer-capability.ts:33,37,48 — detectCoarsePointer reads window.matchMedia/navigator.maxTouchPoints
• lib/utils/utils.ts:34 — isElectron() reads navigator.userAgent
• lib/desktop-auth.ts:15,23,47,70 — window.electron, sets window.location.href
• lib/haptics.ts:22-77 — navigator.vibrate
• lib/consent/cookie-utils.ts / lib/utils/get-cookie-value.ts:19 — read document.cookie
• lib/theme/css-color-resolution.ts:26,127,140,144,173,182 — getComputedStyle/document.createElement/window.CSS
• lib/navigation/app-navigation.ts:21-101 — window.open, window.location, document.addEventListener; app-navigator.ts:36 — window.location.assign
• lib/url-state.ts:10-43 — reads/writes window.location/window.history
• lib/auth/browser-detection.ts:12 — navigator.userAgent
• lib/auth/auth-fetch.ts — pervasive window.electron, window.location, window.dispatchEvent, localStorage (71-988)
• lib/auth/platform-storage/{desktop-storage,ios-storage,index,web-storage}.ts — window.electron, navigator.userAgent, window.dispatchEvent
• lib/utils/persist-csrf-token.ts:10 — localStorage
• lib/ai/core/conversation-state.ts:43-105 — writes document.cookie, reads window.location.protocol
• lib/editor/tiptap-mention-config.tsx:147-361 — document.*, tippy(document.body)
• lib/editor/pagination/PaginationExtension.ts:91-556 — heavy document.createElement
• lib/editor/code-block/CodeBlockShikiExtension.ts:17 — document.documentElement.classList
• lib/ai/shared/utils/image-resize.ts:89 — document.createElement('canvas')
• lib/ai/shared/hooks/useMCPTools.ts:113,115 — window.electron

Count (browser/global): ~22 files.

Storage I/O (localStorage / sessionStorage)

• lib/analytics/device-fingerprint.ts:57,71 — getDeviceId read/write localStorage
• lib/draft/draft.io.ts:6,10,15 — readDraft/writeDraft/removeDraft localStorage
• lib/auth/platform-storage/web-storage.ts:12-42, lib/auth/clear-user-stores.ts:17-25, lib/auth/auth-fetch.ts:602,633,635, lib/utils/persist-csrf-token.ts:10
• lib/ai/core/browser-session-id.ts:4,5,8 — sessionStorage read/write

Count (storage): 6 files.

Module-level mutable state (caches / singletons / counters)

• lib/websocket/ws-connections.ts:13,28,39 — connections Map, connectionMetadata Map, cleanupInterval let (mutated across module fns)
• lib/websocket/socket-utils.ts:1236 — pendingActivityBroadcasts Map
• lib/mcp/mcp-bridge.ts:215 — mcpBridge singleton let
• lib/fetch-bridge/fetch-bridge.ts:317 — fetchBridge singleton let
• lib/machines/machine-branches-runtime.ts:56,69,75, machine-workspaces-runtime.ts:91, machine-projects-runtime.ts:70,83,89, agent-terminals-runtime.ts:71,84,90,96,102, ai/tools/sandbox-tools-runtime.ts:69,70 — lazy store/client promise singletons
• lib/canvas/published-storage.ts:35, lib/presigned-url.ts:4, lib/stripe/client.ts:9, lib/sandbox/sprites-client.ts:26 — cached SDK client let
• lib/mentions/mentionConfig.ts:114 — globalConfig mutable object (setGlobalConfig mutates)
• lib/navigation/app-navigator.ts:4 — routerNavigate mutable (setNavigate mutates)
• lib/auth/cookie-config.ts:56 — policyLogged flag; lib/auth/cron-auth.ts:18,33,34 — cronSecretWarningLogged, usedNonces Map, lastNonceCleanup
• lib/auth/platform-storage/index.ts:6 — instance singleton
• lib/integrations/google-calendar/webhook-auth.ts:18 — secretWarningLogged
• lib/theme/css-color-resolution.ts:23 — colorResolveContext canvas cache
• lib/editor/code-block/shiki-highlighter.ts:13,33 — highlighterPromise, loadedLanguages Set; lib/editor/monaco/loader-config.ts:11 — isMonacoLoaderConfigured
• lib/ai/core/model-capabilities.ts:29-118 — 4 capability Map caches + expiry lets
• lib/ai/core/stream-abort-registry.ts:30-117 — registry/messageIdToStreamId/streamIdToMessageId/recentlyFinished Maps + cleanupInterval
• lib/ai/streams/bootstrapConsumerGuard.ts:2 — activeConsumers Set; consumingChannels.ts:55 — consumerCounts Map

Count (module state): ~30 files.

Database I/O (drizzle)

97 files import @pagespace/db and run queries. All exported functions in the repositories/ layer are DB effects. Representative:

• lib/repositories/ (13 files) — auth-repository, session-repository, oauth-repository, conversation-repository, global-conversation-repository, chat-message-repository, page-agent-repository, page-invite-repository, connection-invite-repository, drive-invite-repository, ai-settings-repository, global-machine-config-repository — every exported CRUD function
• Services: lib/memory/{discovery,integration,compaction}-service.ts, lib/integrations/google-calendar/{sync,push}-service.ts, lib/subscription/{credit-balance,credits,usage-breakdown-query}.ts, lib/monitoring/monitoring-queries.ts, lib/stripe-customer.ts, lib/erasure/request-erasure.ts, lib/pages/get-page-breadcrumb-trail.ts, lib/onboarding/{drive-setup,home-drive}.ts
• All lib/ai/tools/* write/read tools (page-write-tools, calendar-write-tools, drive-tools, channel-tools, task-*, agent-communication-tools, trigger-tools, member-tools, role-management-tools, activity-tools, search-tools, page-read-tools)
• lib/ai/core/{stream-lifecycle,stream-takeover,stream-abort-mark,materialize-interrupted-stream,resolve-request-context,start-generation-exclusive,command-resolver,agent-awareness,agent-memory,ask-user-resume,integration-tool-resolver,page-tree-context,abort-conversation-streams,personalization-utils}.ts, compaction/compaction-repository.ts
• lib/machines/*-runtime.ts (7 files), lib/workflows/{workflow-executor,calendar-trigger-*,task-trigger-helpers,agent-trigger-shared}.ts, lib/integrations/zoom/{process-webhook,webhook-trigger-*,fire-webhook-triggers}.ts, lib/auth/{index,admin-role,invite-resolver,magic-link-adapters,revoke-adapters}.ts, lib/canvas/{publish-page,custom-domain-mirror,asset-pipeline}.ts, lib/users/visibility.ts, lib/tasks/completion-guard.ts, lib/websocket/broadcast-triggered-by.ts, lib/upload/{create-file-page,attachment-route-helpers}.ts

Count (DB I/O): 97 files.

Network I/O (fetch / external SDK)

• fetch() callers: lib/auth/google-avatar.ts (fetch + setTimeout abort), lib/auth/auth-fetch.ts (AuthFetch class), lib/channels/agent-mention-responder.ts:406, lib/storage/reap-orphaned-files.ts, lib/upload/{processor-effects,attachment-verify-effect}.ts, lib/erasure/enqueue.ts, lib/fly/certs.ts, lib/integrations/google-calendar/api-client.ts, lib/integrations/zoom/{token-refresh,zoom-api-client}.ts, lib/ios-apple-auth.ts, lib/ios-google-auth.ts, lib/ai/tools/{web-search-tools,form-tools,channel-tools}.ts, lib/ai/core/{stream-join-client,model-capabilities}.ts, lib/websocket/{calendar-events,socket-utils}.ts
• SDK/socket clients: lib/presigned-url.ts + lib/canvas/published-storage.ts (S3), lib/stripe/client.ts (Stripe), lib/sandbox/sprites-client.ts, lib/mcp/mcp-bridge.ts, lib/fetch-bridge/fetch-bridge.ts, lib/publish/dns-resolver.ts, lib/canvas/reconcile-cert.ts, lib/canvas/custom-domain-mirror.ts

Count (network): ~28 files.

Console / logging side effects

39 files call console.* directly. Notables in non-logger logic: lib/analytics/device-fingerprint.ts:63,73, lib/auth/auth-fetch.ts, lib/auth/cron-auth.ts, lib/auth/index.ts, lib/ai/tools/{search-tools,task-management-tools,page-read-tools,role-management-tools,calendar-read-tools,drive-tools,activity-tools}.ts, lib/ai/core/{provider-factory,stream-join-poll-fallback,compaction-service,conversation-state,mcp-tool-converter,personalization-utils}.ts, lib/ai/shared/hooks/*, lib/capacitor-bridge.ts, lib/ios-{apple,google}-auth.ts, lib/storage/reap-orphaned-files.ts, lib/integrations/google-calendar/webhook-auth.ts, lib/utils/persist-csrf-token.ts. Dedicated loggers (lib/logging/{client-logger,edge-logger}.ts) are intentionally effectful.

Timers (setTimeout / setInterval)

lib/analytics/client-tracker.ts, lib/mcp/mcp-bridge.ts, lib/websocket/{ws-connections.ts:373,socket-utils.ts:1275}, lib/auth/google-avatar.ts:171,271, lib/fetch-bridge/fetch-bridge.ts, lib/auth/auth-fetch.ts, lib/ai/core/{run-agent-with-retry,stream-abort-mark,stream-multicast-registry,stream-abort-registry:122,stream-abort-watcher:130,stream-join-poll-fallback:76,start-generation-exclusive,stream-lifecycle:326,386}.ts, lib/editor/code-block/CodeBlockShikiExtension.ts.

src/stores (103 files)

Zustand stores; actions mutate store state via set() (external-state mutation) and are additionally impure as noted:

Nondeterminism (time/randomness)

• useDocumentManagerStore.ts:38,101 — markSaved/update uses Date.now()
• useAuthStore.ts — setUser/loadSession/status helpers stamp Date.now() throughout (107-546, 617,625,643)
• useEditingStore.ts:97,118,175,218 — startEditing/endEditing/cleanupStale use Date.now()
• useConsentStore.ts:73,79,85,95 — acceptAll/rejectNonEssential/setCustom stamp new Date().toISOString()
• useNotificationStore.ts:80,102,109 — sort/markRead use new Date()
• machine-workspace/useMachineWorkspaceStore.ts:199-332 — crypto.randomUUID() for workspace/pane/column ids

Browser / global state + Storage I/O

• useAuthStore.ts — window.electron, window.location, window.addEventListener, createJSONStorage(() => localStorage) (287-838, 567)
• useAssistantSettingsStore.ts:76-198 — toggles write localStorage, window.dispatchEvent
• useVoiceModeStore.ts:111-215 — settings read/write localStorage
• useSocketStore.ts:59-239 — process.env, window.electron, window.addEventListener, setTimeout
• useConsentStore.ts:29-50 — reads/writes document.cookie, process.env, window.dispatchEvent
• useMCPStore.ts:108 / useDocumentStore.ts:38 — localStorage persistence / setTimeout
• page-agents/usePageAgentDashboardStore.ts:153 — window.location.search

Console side effects

Heavy in useAuthStore.ts, useSocketStore.ts, useNotificationStore.ts, useEditingStore.ts (dev-gated), page-agents/usePageAgentDashboardStore.ts, useDocumentStore.ts.

Module-level mutable state

• machine-workspace/useMachineWorkspaceStore.ts:437 — childSessionCache module WeakMap

Note: machine-workspace/workspace-reducer.ts is a pure reducer (id generation delegated to the store). Count (stores): ~11 files with function-level impurity beyond ordinary set().

src/hooks (150 files)

React hooks are effect boundaries by design (useEffect/useSWR). Function-level impurities:

Nondeterminism (time/randomness)

• useSuggestionCore.ts:67 — `${Date.now()}-${Math.random()}` requestId
• useDocument.ts:63,100,101,198,209 — Date.now() save timestamps
• useNewStoreNotification.ts:30,41 — Date.now() mount ref, new Date()
• useOwnStreamMirror.ts:151,170 — new Date().toISOString(), Math.max(Date.now(), …) sequence
• useDrive.ts:31,54-62, useFavorites.ts:281, useTokenRefresh.ts:30,100,225,313, useAppStateRecovery.ts:102,154,190, useVoiceMode.ts:315,316, usePerformanceMonitor.ts:41 — Date.now()
• conversationCacheSocketHandlers.ts:55 / useInboxSocket.ts:82 — new Date() (from payload — deterministic on input)

Browser / global state

Widespread window.*/document.*/navigator.*: useIOSKeyboardInit, useAuth (window.electron, document.cookie, window.history), useOAuthSignIn, useDesktopExchangeHandler, useMobileKeyboard, useMCP, useBreakpoint, useTouchDevice, useEnterToSend (navigator.userAgent — non-effect helpers isMac/isEnterToSend), useCapacitor/useDeviceTier (window.screen), useSpeechRecognition, useVoiceMode (navigator.mediaDevices), usePageShareLink/useDriveShareLink (navigator.clipboard), useDesktopNotifications (document.hasFocus/window.focus), useTokenRefresh (navigator.onLine, power events), useUnsavedChanges, useFavorites, useCreditBalance, usePushNotifications (window.dispatchEvent), useTabSync, useMachineWorkspaceSync.

Storage I/O

• useAuth.ts:115-229 — localStorage deviceToken
• page-agents/usePageAgentSidebarState.ts:150-169 — localStorage persistence adapter
• usePerformanceMonitor.ts:56-98 — localStorage metrics
• useFavorites.ts:217, useDraft.ts — localStorage-backed
• useFileDrop.ts:91 — process.env; usePerformanceMonitor.ts:14,45 — process.env

Module-level mutable state

• useAuth.ts:12 — deviceRegistrationInFlight flag
• useTokenRefresh.ts:15,18,19 — globalRefreshPromise/globalRefreshTimeout/isRefreshScheduled
• useMachineWorkspaceSync.ts:69 — declinedBootstraps Set

Console side effects

Pervasive across useAuth, useMCP, usePageTreeSocket, useGlobalDriveSocket, useSuggestionCore, usePushNotifications, useTokenRefresh, conversationMessagesLoaders, useFileDrop, useDocument, and most socket hooks.

Note: extractDesktopExchangeCode (useDesktopExchangeHandler.ts:21) is a non-hook helper reading window.location.search by default arg (impure default).

src/app/api (boundary layer — summarized)

• 356 route.ts handler files + 21 non-route helper .ts files. Route handlers are effect boundaries (auth, DB, network, NextResponse) and are expected to be impure; not enumerated individually.

Representative handlers (illustrating the impurity classes present throughout): app/api/auth/session/route.ts, app/api/auth/refresh/route.ts (cookies, DB, env); app/api/pages/[pageId]/route.ts (DB CRUD + timestamps); app/api/ai/chat/route.ts / app/api/ai/global/chat/route.ts (streaming, DB, provider network); app/api/track/route.ts; app/api/upload/route.ts (S3 + fs); app/api/webhooks/stripe/route.ts; app/api/integrations/google-calendar/webhook/route.ts; app/api/cron/*/route.ts; app/api/notifications/route.ts (DB + realtime broadcast).

Pure-looking helpers contaminated by avoidable impurity: the workflow/trigger/webhook executors these routes delegate to carry the avoidable impurities flagged in src/lib — Date.now() embedded in computation and console.* in logic paths (lib/workflows/workflow-executor.ts, lib/workflows/calendar-trigger-executor.ts, lib/integrations/zoom/webhook-trigger-executor.ts), and lib/auth/cron-auth.ts (module-level usedNonces Map + lastNonceCleanup used by cron route auth).

src/components (summarized + helper inventory)

Marker counts (non-test .ts/.tsx, occurrences / files):

• Nondeterminism (Date.now/new Date/Math.random/randomUUID/nanoid): 227 / 88
• Console (console.*): 157 / 72
• Browser globals (window./document./navigator.): 230 / 72
• Storage (localStorage/sessionStorage): 27 / 10
• Environment (process.env): 7 / 5 (DebugPanel, LayoutErrorBoundary, NavigationProvider, auth/GoogleOneTap, shared/FeedbackDialog)

The overwhelming majority sit inside React components/effects and formatter JSX — expected component-layer impurity, not enumerated individually.

Non-component helpers inside component files that are impure:

• components/calendar/calendar-types.ts:219 — new Date() "today" used inside exported date-bucketing helpers (getEventsForDay etc., 219,239-254) — the one clearly avoidable helper impurity in components
• components/activity/utils.ts:23-27 — groupActivitiesByDate parses new Date(activity.timestamp) (deterministic on input)
• Injected-clock helpers (correctly parameterized, pure): .../sheet/hooks/useSheetTouch.ts:50 (now = Date.now injected), sheet/core/touch.ts.

---

Generated by Claude Code

[2witstudios]

apps/{processor,realtime,control-plane,admin,desktop,atlas,marketing} — Impure Function Audit (inventory continued, 3/3)

Scope excludes apps/e2e, apps/ios, apps/android, and test files. Backend services (processor, realtime, control-plane), desktop main-process, and atlas are named exhaustively; admin/marketing give exhaustive lib/util coverage plus per-directory summaries for API routes and React components.

apps/processor

Nondeterminism (time/randomness)

• write / processorLogger.{info,warn,debug,error} — apps/processor/src/logger.ts:5,7 — stamps new Date().toISOString() on every log line
• encryptBuffer / maybeEncryptBuffer — apps/processor/src/cache/envelope-crypto.ts:33,69 — randomBytes(SALT_LEN) + randomBytes(IV_LEN) (34,35)
• calculateBackoffDelay — apps/processor/src/services/siem-adapter.ts:826 — Math.random() * 1000 jitter (829)
• sleep — apps/processor/src/api/s3-pull-adapter.ts:36 — setTimeout-based delay
• withTimeout — apps/processor/src/services/content-detector.ts:92 — setTimeout timeout race (95)

Environment reads

• getAllowedOrigins — apps/processor/src/utils/cors-validation.ts:18 — CORS_ORIGIN/WEB_APP_URL/ADDITIONAL_ALLOWED_ORIGINS (21,22,32)
• validateCorsOrigin — apps/processor/src/utils/cors-validation.ts:54 — NODE_ENV (64)
• createS3Client — apps/processor/src/s3-client.ts:3 — AWS_* env (5-10); getS3Bucket — :17 — BUCKET_NAME/TIGRIS_BUCKET/S3_BUCKET (18)
• AUTH_REQUIRED (module IIFE) — apps/processor/src/middleware/auth.ts:10 — PROCESSOR_AUTH_REQUIRED/NODE_ENV (11,12)
• resolveEncryptionConfigFromEnv — apps/processor/src/cache/content-store.ts:38 — FILE_ENCRYPTION_ENABLED/ENCRYPTION_KEY (40,41)
• getClientIP — apps/processor/src/middleware/rate-limit.ts:18 — FLY_APP_NAME (19)
• loadAnchorConfig — apps/processor/src/services/anchor-publishers.ts:61 — ANCHOR_S3_*/AUDIT_ANCHOR_* (62-73)
• loadSiemConfig — apps/processor/src/services/siem-adapter.ts:163 — AUDIT_SIEM_*/AUDIT_WEBHOOK_*/SYSLOG_* (164-184)
• resolveBatchSize — apps/processor/src/workers/audit-chainer-worker.ts:159 — AUDIT_CHAINER_BATCH_SIZE (161)
• TEMP_ROOT module const — apps/processor/src/workers/video-processor.ts:11 — TEMP_UPLOADS_PATH
• Module-level env: rate-limit limits (rate-limit.ts:9,10,122,123); server.ts:56 PORT

Module-level mutable state

• rateLimitUpload + createRateLimiter — apps/processor/src/middleware/rate-limit.ts:92,43 — mutate module buckets Map (8) / closure limitBuckets Map (49); setInterval cleanup (52,132)
• getInstance / __resetContentDetectorForTests — apps/processor/src/services/content-detector.ts:65,167 — module instancePromise + lastInitFailureAt (62,63)
• getPool / getPoolForWorker / getAdminPoolForWorker — apps/processor/src/db.ts:21,32,45 — memoized module pool singletons
• s3 — apps/processor/src/api/avatar.ts:42 — memoizes module _s3 (41)
• refreshSiemCursorCache / doRefreshSiemCursorCache — apps/processor/src/server.ts:83,91 — module siemHealthCache/siemCacheLastRefresh/siemRefreshInFlight (76-81)
• maybePublishAnchor / resetAnchorPublishStateForTests — apps/processor/src/workers/audit-chainer-worker.ts:194,153 — module anchorState incl. failureStreaks Map (147)
• logModeBannerOnce — apps/processor/src/workers/siem-delivery-worker.ts:109 — module modeBannerLogged (104)
• rateLimiter.wait — apps/processor/src/workers/ocr-processor.ts:11 — mutates module rateLimiter.lastCall (20) using Date.now (12)
• contentStore / queueManager singletons — apps/processor/src/server.ts:58,59

Database I/O

• setPageProcessing,setPageCompleted,setPageVisual,setPageVideoProcessed,setPageFailed,getPageForIngestion — apps/processor/src/db.ts:56,68,85,97,112,124 — pg queries
• ensureFileLinked,getLinksForFile,getConversationLinksForFile,getFileDriveId,getLinkForPage — apps/processor/src/services/file-links.ts:20,58,72,87,95 — drizzle (also new Date() 52)
• validateServiceUser — apps/processor/src/services/user-validator.ts:66 — db.query + console.error (100)
• assertDeleteFileAccess — apps/processor/src/services/rbac.ts:106; authorizeFileAccess,assertFileAccess — services/authorization.ts:237,416
• processAuditChainer,readChainHead,maybePublishAnchor,buildDefaultAnchorPublishers — apps/processor/src/workers/audit-chainer-worker.ts:336,172,194,180 — advisory-lock drain/insert/delete; Date.now(222)/new Date(235); pervasive console
• runAccountErasureJob — apps/processor/src/workers/account-erasure-worker.ts:49 — repositories, new Date() (71,74,209), console
• runEmailBroadcastJob,refuse,nowIso — apps/processor/src/workers/email-broadcast-worker.ts:94,78,67 — repositories, new Date(), FROM_EMAIL/COMPANY_POSTAL_ADDRESS env (168,169), setTimeout (327), console
• processSiemDelivery + cursor/query/record helpers (loadCursor,initCursor,seedCursorFromLegacy,queryActivityLogs,querySecurityAuditLog,queryRowsForSource,recordError,advanceCursor) — apps/processor/src/workers/siem-delivery-worker.ts:329,127,135,191,216,239,256,274,290 — DB reads/writes, createId (615), new Date() (676), ADMIN_DATABASE_URL/ADMIN_DB_BREAK_GLASS env (343,344), console
• runChainPreflight — workers/siem-delivery-preflight.ts:142; loadAnchorHash,loadActivityLogHashableFields,loadSecurityAuditHashableFields — workers/siem-anchor-loader.ts:53,90,154; readCursorSnapshots — workers/siem-cursor-reader.ts:12; readRecentReceipts — workers/siem-receipt-reader.ts:19; writeReceipts — workers/siem-receipt-writer.ts:20 (createId 39)
• createAnchorReceiptPublisher().publish — services/anchor-publishers.ts:160 — DB insert + createId/new Date (171,175)
• QueueManager initialize,setupQueues,startWorkers,addJob,getJob,getQueueStatus,shutdown — apps/processor/src/workers/queue-manager.ts:55,79,99,289,344,366,386 — pg-boss; DATABASE_URL (48), ENABLE_OCR (140,167); console
• fetchEntryTimestamp + /siem/receipts + /health — apps/processor/src/server.ts:227,240,164 — DB reads, new Date() (182,289), console; start (373) + setInterval (397)

Network I/O (S3 / HTTP)

• ContentStore methods (17: getOriginalMetadata,writeOriginalMetadata,appendUploadMetadata,tenantHasAccess,cacheExists,saveCache,getCache,saveOriginal,saveOriginalFromFile,originalExists,headOriginalSize,getOriginal,streamOriginalToFile,getCacheMetadata,deleteOriginal,deleteCache,deleteOriginalAndCache) — apps/processor/src/cache/content-store.ts:248-700 — S3 SDK; several stamp new Date() (205-633)
• deleteUserAvatars + avatar router handlers — apps/processor/src/api/avatar.ts:59,72,101,159 — S3 list/get/put/delete
• deleteFileRouter — api/delete-file.ts:17; cacheRouter — api/serve.ts:16,70,184 (S3 + db + console); imageRouter — api/optimize.ts:12; ingestRouter — api/ingest.ts:12,75; broadcastRouter — api/broadcast.ts:15; erasureRouter — api/erasure.ts:15
• processImage,optimizeImageForAllPresets,prepareImageForAI — workers/image-processor.ts:11,109,133; extractText — workers/text-extractor.ts:10 (ENCRYPTION_KEY 62); processOCR,performTesseractOCR,performAIVisionOCR — workers/ocr-processor.ts:24,85,98 (ENABLE_EXTERNAL_OCR 45)
• fetchObjectFromS3,runPullPipeline,rejectAndFail,dispatch — api/s3-pull-adapter.ts:43,65,106,115
• sendWebhook,deliverToSiem,deliverToSiemBatched,deliverToSiemWithRetry — services/siem-adapter.ts:298,735,772,844 — fetch (338), new Date() (331,367), console (311)
• createS3AnchorPublisher().publish — services/anchor-publishers.ts:119 — S3 PutObject

Filesystem/process I/O

• processVideo,extractThumbnail,probeVideo — workers/video-processor.ts:15,55,69 — execFile ffmpeg/ffprobe + fs
• extractTextContent,extractPdfText,generateImageVariants,extractVideoMetadata,extractVideoThumbnail,withTempFile — services/processing-pipeline.ts:85,112,128,158,176,144 — fs.mkdtemp/writeFile/rm/readFile + execFile
• detectContentType — services/content-detector.ts:151 — fs.readFile (154)

Socket/IPC side effects

• sendSyslogTcp — services/siem-adapter.ts:538 — new net.Socket() (544); sendSyslogUdp — :612 — dgram.createSocket (618); sendSyslog — :675 (formatSyslogMessage:428 reads HOSTNAME env 441)

Count: ~95 impure functions/handlers.

apps/realtime

Nondeterminism (time/randomness)

• buildMachineSandbox().acquire — apps/realtime/src/index.ts:155 — Date.now() (160), now: () => new Date() (180)
• makeAgentTerminalCheckAuth.writeAudit — index.ts:394 — new Date() (405); persistStreamSessionId — index.ts:1339 — new Date() (1341); createTaskHold taskName — index.ts:1350 — Date.now() (1358)
• endAgentTerminalSession,settleAccruedWindow,resumeBillingClock — terminal/agent-terminal-handler.ts:250,444,538 — Date.now() billing windows (292,455,541)
• establishConnection — terminal/agent-terminal-handler.ts:920 — Date.now() connectedAt/lastInputAt (1037,1107)
• handleTerminalActivityRequest — terminal/terminal-activity.ts:135 — session.lastOutputAt = Date.now() (169)

Environment reads

• getAllowedOrigins — index.ts:444 — CORS_ORIGIN/WEB_APP_URL/ADDITIONAL_ALLOWED_ORIGINS (448-460)
• validateAndLogWebSocketOrigin / validateWebSocketOrigin — index.ts:575,525 — NODE_ENV (594)
• resolveAgentTerminalCommand — terminal/agent-terminal-handler.ts:226 — process.env.SHELL (235)
• assertSandboxRuntime — terminal/realtime-sprites-client.ts:17 — process.versions.node (18)
• module PORT — index.ts:1423; createTaskHold reads resolveTaskHoldConfig(process.env) (1359)

Module-level mutable state

• SocketRegistry (registerSocket,unregisterSocket,trackRoomJoin,trackRoomLeave,getSocketsForUserInRoom) + singleton — socket-registry.ts:27,44,95,112,149,157 — module Maps (13-22)
• PresenceTracker (addViewer,removeViewer,removeSocket) + singleton — presence-tracker.ts:37,64,89,162 — module Maps (25-31)
• fold,anchorHashOf,foldCount,resetFoldCount — terminal/replay-dedupe.ts:184,200,178,179 — module folds counter (177), anchorHashes WeakMap (199)
• getRealtimeSpritesSdk — terminal/realtime-sprites-client.ts:29 — memoizes cachedSdk (8)
• createTerminalSessionMap closures — terminal/terminal-session-map.ts:180 — closured Maps (181-183)
• buildAgentTerminalHandlers — terminal/agent-terminal-handler.ts:727 — closured Sets (744,789,791); setInterval/setTimeout
• openPtyShell — terminal/sprites-shell.ts:533 — mutable closure state + replay timers
• module agentTerminalSessionMap + dbMachine*StorePromise — index.ts:82,85-88

Database I/O

• resolveDriveOwnerContext — index.ts:118; makeAgentTerminalCheckAuth deps (getPageDriveId,getDriveAndUser,resolveMachineRow,resolveAgentTerminalSandbox) — index.ts:353,358,373,252; populateUserMetadata — index.ts:810 (+decryptField); io.use auth middleware — index.ts:838; join handlers (join_channel,join_drive,join_dm_conversation,join_activity_drive,join_activity_page,presence:join_page) — index.ts:951,993,1028,1116,1143,1207; reauthorizePageAccess — per-event-auth.ts:107

Network I/O

• resolveAgentTerminalSandbox / buildMachineSandbox — index.ts:252,145 — Sprite SDK acquire/resolve
• sessionLiveness — terminal/agent-terminal-handler.ts:696 — sprite.listSessions() + setTimeout (701)
• openPtyShell — terminal/sprites-shell.ts:533 — Sprite exec over WebSocket, reconnect
• getRealtimeSpritesSdk — terminal/realtime-sprites-client.ts:29 — dynamic-import + network client

Socket/IPC side effects

• requestListener — index.ts:632 — io.to().emit (708), broadcast/kick/terminal-activity dispatch
• io.on('connection') handler — index.ts:918 — join/leave/emit/disconnect (1250-1410)
• executeKick,handleKickRequest — kick-handler.ts:121,193 — socket.leave + emit('access_revoked') (156,162)
• emitValidationError — validation.ts:112; withPerEventAuth — per-event-auth.ts:201
• broadcastOutput,broadcastClosed — terminal/terminal-session-map.ts:135,140
• viewer emit callbacks + attachToLiveSession,teardownAgentTerminalSession,removeViewer,evictViewer,disconnectConnection,onConnect/onInput/onResize/onDisconnect — terminal/agent-terminal-handler.ts:833,853,315,353,415,817,193-197
• handleTerminalActivityRequest — terminal/terminal-activity.ts:135

Argument or shared-state mutation

• appendScrollback — terminal/terminal-session-map.ts:116 — mutates the passed session.scrollback/scrollbackBytes/hasOutput
• appendPending — terminal/replay-dedupe.ts:335 — writes into shared arena buffer in place
• terminal handler internals mutate the passed session object throughout

Count: ~55 impure functions/handlers.

apps/control-plane

Nondeterminism (time/randomness)

• sendAlert — src/services/alerting-service.ts:45 — Date.now() (51) + new Date(now) (64); sendRecovery — :73 — new Date() (85)
• schema $defaultFn(() => createId()) — src/schema/tenants.ts:20, tenant-events.ts:6, tenant-backups.ts:13
• createBackupService now = () => new Date() default — src/services/backup-service.ts:43 — timestamps via now() (54,87,98)

Environment reads

• start — src/index.ts:22 — CONTROL_PLANE_DATABASE_URL, TENANTS_BASE_PATH, SCRIPTS_PATH, COMPOSE_PATH, STRIPE_SECRET_KEY, STRIPE_PRICE_* (16-92); module PORT/DATABASE_URL (9,16)
• apiKeyAuthPlugin onRequest hook — src/middleware/api-key-auth.ts:5 — CONTROL_PLANE_API_KEY (10)
• stripeWebhookRoute POST — src/routes/stripe-webhooks.ts:55 — STRIPE_WEBHOOK_SECRET (61)
• createShellExecutor().exec/execFile — src/services/shell-executor.ts:33,48 — merges process.env into child env (38,53)

Module-level mutable state

• createAlertingService — src/services/alerting-service.ts:27 — closured lastAlertTime Map (29)
• createHealthMonitor().checkAll — src/services/health-monitor.ts:21 — closured failureCounts Map (30)
• createShellExecutor / createMockExecutor — src/services/shell-executor.ts:28,68 — closured history array + callIndex

Database I/O

• createTenantRepository (11 methods: createTenant,getTenantBySlug,getTenantById,listTenants,updateTenantStatus,updateHealthStatus,deleteTenant,recordEvent,updateTenantStripeIds,getTenantByStripeSubscription,getRecentEvents) — src/repositories/tenant-repository.ts:30-118 — drizzle; new Date() at 79,89,107
• createAdminSeeder().seed — src/services/admin-seeder.ts:25 — SELECT/INSERT + createId/new Date (61)
• start — src/index.ts:104 — SELECT 1 connectivity check

Network I/O

• pollHealth — src/index.ts:54 — fetch tenant /api/health (59) + setTimeout (66)
• stripeWebhookRoute handlers (handleCheckoutCompleted,handleSubscriptionDeleted,handlePaymentFailed,handleSubscriptionUpdated) — src/routes/stripe-webhooks.ts:103,128,141,160
• billing routes — src/routes/billing.ts:67,104 — Stripe checkout/portal sessions
• createHealthMonitor().checkAll — src/services/health-monitor.ts:33 — httpClient.get per tenant (41)
• start — src/index.ts:83 — new Stripe(...) (84)

Filesystem/process I/O

• createShellExecutor().exec/execFile — src/services/shell-executor.ts:33,48 — child_process
• createProvisioningEngine().provision — src/services/provisioning-engine.ts:57 — docker compose exec, fs.mkdir/writeFile/readFile (92,93,111); default email sink console.warn (51)
• createTenantLifecycle suspend,resume,upgrade,destroy,execOrFail — src/services/tenant-lifecycle.ts:48,63,82,102,39
• createUpgradeService upgradeAll,upgradeTenant — src/services/upgrade-service.ts:83,40
• createBackupService backupTenant,pruneBackups,restoreTenant — src/services/backup-service.ts:50,110,145 — pg_dump/tar + fs
• start fsAdapter — src/index.ts:32

Console/logging side effects

• start — src/index.ts:22 — console.log/error + process.exit (12-113)

Count: ~40 impure functions/handlers.

apps/desktop (main process)

Nondeterminism (time/randomness)

• generateAuthExchangeState — src/main/auth-exchange-state.ts:34 — randomBytes(32) (35)
• beginAuthExchangeFlow / peekAuthExchangeState — src/main/auth-exchange-state.ts:96,103 — Date.now() default arg + module pending mutation (98,105)
• WSClient.startHeartbeat — src/main/ws-client.ts:344 — setInterval + Date.now() ping (345)

Environment reads

• getAppUrl — src/main/app-url.ts:5 — NODE_ENV/PAGESPACE_URL (16-19) + store.get('appUrl')
• getEnhancedEnvironment — src/main/command-resolver.ts:90 — process.env, HOME, APPDATA (91,99-101)
• WSClient base-url — src/main/ws-client.ts:53-55; createWindow — src/main/window.ts:144 (NODE_ENV); setupProtocolClient — src/main/deep-links.ts:19 (process.execPath)

Module-level mutable state

• state singletons + setters (mainWindow,tray,isQuitting,isSuspended,suspendTime,cachedMachineId,cachedSession) — src/main/state.ts:4-38
• ensureAuthSessionPath — src/main/auth-storage.ts:16 — memoizes authSessionPath (14)
• resetActiveRequests / handleFetchProxyRequest — src/main/fetch-proxy-handler.ts:13,21 — module activeRequests counter (10)
• startMCPStatusBroadcasting / stopMCPStatusBroadcasting — src/main/mcp-status.ts:15,23 — module mcpStatusInterval (4)
• MCPManager + getMCPManager singleton — src/main/mcp-manager.ts:81,1095 — instance Maps servers/pendingRequests/stdoutBuffers/toolCache/logWriteBuffer/logFlushTimers (83-98), module singleton (1090)
• initializeWSClient/getWSClient/shutdownWSClient + WSClient — src/main/ws-client.ts:427,444,451,34 — module singleton (422)
• resolveCommand/clearCommandCache — src/main/command-resolver.ts:23,188 — module command-path cache

Filesystem/process I/O

• resolveCommand — src/main/command-resolver.ts:23 — spawn which/where (58); getEnhancedEnvironment — :90 — fs.existsSync/readdirSync/statSync (142-167)
• saveAuthSession,loadAuthSession,clearAuthSession — src/main/auth-storage.ts:26,59,139 — fs + safeStorage (40-141)
• MCPManager initialize,loadConfig,saveConfig,startServer,rotateLogs,flushLogBuffer,writeErrorLog,executeTool — src/main/mcp-manager.ts — spawn child MCP servers (314), fs (47-629), new Date/Date.now (320-619), timers

Network I/O

• handleDeepLink — src/main/deep-links.ts:217 — fetch desktop exchange (75), setTimeout abort (71), Date.now cookie expiry (146)
• handleFetchProxyRequest — src/main/fetch-proxy-handler.ts:21 — fetch local AI provider + streaming (49)
• WSClient.connect,fetchWsToken,handleToolExecution — src/main/ws-client.ts:34,117,280 — fetch + WebSocket + timers (218,344,382)
• setupAutoUpdater,checkForUpdates — src/main/updater.ts:8,64 — autoUpdater + setInterval (15), console (20-91)

Socket/IPC side effects

• registerIpcHandlers — src/main/ipc-handlers.ts:42-348 — ipcMain.handle registrations; webContents.send('auth:cleared') (157), Date.now (136), console
• setupPowerMonitor — src/main/power-monitor.ts:6 — powerMonitor.on + webContents.send (13-53), Date.now (9,18)
• broadcastMCPStatusChange,triggerMCPStatusBroadcast — src/main/mcp-status.ts:6,30
• setupProtocolClient,handleDeepLink — src/main/deep-links.ts:16,217 — webContents.send (43-223)
• injectDesktopStyles,injectDoubleClickHandler — src/main/window-injections.ts:3,40 — insertCSS/executeJavaScript
• createWindow,reloadMainWindow — src/main/window.ts:18,149; createMenu — src/main/menu.ts:5; createTray,destroyTray — src/main/tray.ts:6,52; setupMediaPermissionHandlers — src/main/media-permissions.ts:57; app lifecycle handlers — src/main/index.ts:26-97

Console/logging side effects

• logger.{debug,info,warn,error} — src/main/logger.ts:16 — console.* (22-46)

Count: ~45 impure functions/handlers.

apps/atlas

Browser/global state

• scrollToId — apps/atlas/src/App.tsx:201 — document.getElementById(...).scrollIntoView (202)
• App — apps/atlas/src/App.tsx:639 — window.innerWidth (643,647), resize listeners (649,650)
• render entry — apps/atlas/src/main.tsx:11 — document.getElementById('root') + createRoot(...).render

Count: 3 impure functions (architecture-data.ts is pure data).

apps/admin

Nondeterminism (time/randomness)

• isDormant — src/lib/dormancy.ts:9 — now = Date.now() default arg
• populateUserDrive — src/lib/onboarding/drive-setup.ts:23 — new Date() seeds rows (29,89)
• getDateRange — src/lib/monitoring-queries.ts:426 — new Date() window (427-438); getGrowthMetrics — :1224 — relative windows (1225-1358)
• getSystemHealth,getApiMetrics,getUserActivity,getErrorAnalytics — src/lib/monitoring-queries.ts:61,137,220,308 — default new Date(Date.now()-…) (48)
• buildAudienceDefinition — src/components/admin/broadcasts/composer-form.ts:42 — new Date(...).toISOString() (46,47)
• formatDate,formatDateTime,formatLastActive — src/components/admin/users/user-format.ts:14,19,24 — locale/TZ-dependent formatting + Date.now() (16,21,27)

Environment reads

• isOnPrem — src/lib/deployment-mode.ts:2 — NEXT_PUBLIC_DEPLOYMENT_MODE (3)
• getStripeMode / stripeMode / stripeConfig — src/lib/stripe-config.ts:46,59,60 — NEXT_PUBLIC_STRIPE_MODE/NODE_ENV
• cookie-config functions — src/lib/auth/cookie-config.ts:88,105,116,129,143,155,169 — NODE_ENV/COOKIE_DOMAIN (48-72), new Date(0) expiries
• module PROCESSOR_URL — src/lib/broadcast/enqueue.ts:35; module stripe proxy — src/lib/stripe/client.ts:13,21 (STRIPE_SECRET_KEY)

Module-level mutable state

• stripe lazy proxy — src/lib/stripe/client.ts:21 — memoizes _stripe

Database I/O

• provisionHomeDriveIfNeeded — src/lib/onboarding/home-drive.ts:32 — insert/update, new Date() (59,81,82)
• populateUserDrive — src/lib/onboarding/drive-setup.ts:23
• getOrCreateStripeCustomer — src/lib/stripe-customer.ts:25 — DB + Stripe API, new Date() (61)
• updateUserRole,validateAdminAccess — src/lib/auth/admin-role.ts:18,56; verifyAdminAuth — src/lib/auth/auth.ts:44
• 22 analytics query functions (getSystemHealth,getApiMetrics,getUserActivity,getErrorAnalytics,getUnitEconomicsSummary,getMarginByPeriod,getMarginByModel,getTopSpendersByMargin,getMarginByTier,getOutstandingDebtByUser,getBalanceDriftAlerts,getNegativeMarginAccounts,getTokenUsageSummary,getTokenUsageByModel,getTokenUsageByPeriod,getTokenUsageByUser,getProviderCostRollup,getCreditRevenue,getActiveSubscriptionsByTier,getCreditLiability,getLiveHolds,getGrowthMetrics) — src/lib/monitoring-queries.ts:61-1224 — Postgres/ClickHouse

Network I/O

• enqueueBroadcast — src/lib/broadcast/enqueue.ts:143 — fetch processor (80); appendStepResultBestEffort — src/lib/broadcast/step-results.ts:16
• ensureCsrfToken,fetchWithAuth,post,del — src/lib/auth/auth-fetch.ts:10,30,71,79 — client fetch
• giftSubscription,revokeSubscription,suspendUser,unsuspendUser,revokeAllSessions,changeUserRole,eraseUserData — src/components/admin/users/actions.ts:34-58 — authed fetch mutations

Console/logging side effects

• validateCSRF — src/lib/auth/csrf-validation.ts:49 — logs + Response construction

Summary (routes/components)

• src/app/api/**/route.ts — 170 impurity markers across 26 route files (all handlers do DB/network I/O, new Date(), env)
• src/components/** — 102 markers across 14 files; impure non-component helpers listed above (types.ts predicates are pure)

Count: ~55 named impure lib/helper functions (+26 impure route files, 14 stateful component files).

apps/marketing

Environment reads

• SITE_URL / APP_URL — src/lib/metadata.ts:5,9 — NEXT_PUBLIC_MARKETING_URL/NEXT_PUBLIC_APP_URL; createMetadata (23) consumes
• module consts — src/lib/schema.tsx:9,10 — same env; createFAQSchema/createArticleSchema/createBreadcrumbSchema (164,192,222) build on them
• syncThemeToCookie — src/lib/theme-cookie.ts:4 — NEXT_PUBLIC_COOKIE_DOMAIN (5)
• contact route module consts — src/app/api/contact/route.ts:13,14,77,79 — FROM_EMAIL/CONTACT_EMAIL/INTERNAL_API_SECRET/WEB_APP_URL

Module-level mutable state

• getResend — src/app/api/contact/route.ts:17 — memoizes _resend (16,19)

Network I/O

• POST (contact form) — src/app/api/contact/route.ts:24 — rate limit check, Resend send (57), internal fetch (81), console (90,99)

Browser/global state

• syncThemeToCookie / getThemeFromCookie — src/lib/theme-cookie.ts:4,10 — document.cookie (7,11)
• useIsMobile — src/hooks/use-mobile.ts — window.matchMedia + state

Summary (components)

• src/components/** — 58 markers across 12 files (ThemeProvider, ThemeToggle, SearchDialog, ContactForm, GoogleOneTap, NavbarAuthButtons etc. are client-stateful/impure). createMetadata, credits.ts, utils.ts (cn), search-data.ts otherwise pure aside from module env reads.

Count: ~8 named impure lib functions (+1 impure route, 12 stateful component files).

---

Boundary notes: deterministic input-only helpers (parsePgTimestampAsUtc, SIEM row mappers, verifyContentHash, realtime planConnect/planReconnect/planTeardown, control-plane canTransition/validateSlug, admin usd/pct/toCsv) are excluded as pure. new Date(value) parsing a supplied value is treated as pure; only new Date()/Date.now()/Math.random/randomBytes/createId with no deterministic input count as nondeterminism.

---

Generated by Claude Code