@lunora/codegen 1.0.0-alpha.29 → 1.0.0-alpha.30

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (22) hide show
  1. package/dist/index.d.mts +694 -4
  2. package/dist/index.d.ts +694 -4
  3. package/dist/index.mjs +17 -16
  4. package/dist/packem_shared/{FLAGS_FILENAME-CQz5jIns.mjs → FLAGS_FILENAME-BjpS5w08.mjs} +1 -1
  5. package/dist/packem_shared/SCHEMA_SNAPSHOT_FILENAME-Cpfn80SH.mjs +3481 -0
  6. package/dist/packem_shared/{discoverAuthApiCalls-CGjWoLJ3.mjs → discoverAuthApiCalls-URDoTADN.mjs} +1 -1
  7. package/dist/packem_shared/{discoverCrons-De98wIzl.mjs → discoverCrons-DdZOeroL.mjs} +1 -1
  8. package/dist/packem_shared/{discoverFunctions-CCVrvWhX.mjs → discoverFunctions-BJdF7lRs.mjs} +56 -7
  9. package/dist/packem_shared/{discoverHttpRoutes-3tvf_95b.mjs → discoverHttpRoutes-CcwP-Rkr.mjs} +1 -1
  10. package/dist/packem_shared/{discoverInserts-B0k4i6Yu.mjs → discoverInserts-BpFhM32L.mjs} +1 -1
  11. package/dist/packem_shared/{discoverMaskProcedures-C0sofRvW.mjs → discoverMaskProcedures-DT-v8wvj.mjs} +58 -2
  12. package/dist/packem_shared/{discoverMigrations-DfBWvCoA.mjs → discoverMigrations-cG1idBVM.mjs} +1 -1
  13. package/dist/packem_shared/{discoverNondeterministicCalls-DXiWO-nI.mjs → discoverNondeterministicCalls-CEOjmfk4.mjs} +1 -1
  14. package/dist/packem_shared/{discoverQueries-B9KbrYF9.mjs → discoverQueries-DeVBQVAG.mjs} +1 -1
  15. package/dist/packem_shared/{discoverR2sqlCalls-CkBDIqPt.mjs → discoverR2sqlCalls-CWCAU-xJ.mjs} +1 -1
  16. package/dist/packem_shared/{discoverRlsMetadata-BXrKzID4.mjs → discoverRlsMetadata-BL0oukaK.mjs} +1 -1
  17. package/dist/packem_shared/{discoverSchema-B9Xfdg5V.mjs → discoverSchema-CeXJWVKV.mjs} +16 -7
  18. package/dist/packem_shared/{discoverStorageRulesMetadata-C1Q-Ct2p.mjs → discoverStorageRulesMetadata-CFHByjIl.mjs} +1 -1
  19. package/dist/packem_shared/{formatAdvisories-DdjK7sgh.mjs → formatAdvisories-C9wNBNvL.mjs} +35 -3
  20. package/dist/packem_shared/redact-oTmsol5A.mjs +33 -0
  21. package/package.json +2 -2
  22. package/dist/packem_shared/SCHEMA_SNAPSHOT_FILENAME-DtCmOeaL.mjs +0 -1154
@@ -1,7 +1,7 @@
1
1
  import { relative, sep } from 'node:path';
2
2
  import { SyntaxKind, Node } from 'ts-morph';
3
3
  import { T as TS_EXTENSION_RE, e as enclosingExportName } from './discover-ast-CT6BgBr4.mjs';
4
- import { listLunoraSourceFiles } from './discoverFunctions-CCVrvWhX.mjs';
4
+ import { listLunoraSourceFiles } from './discoverFunctions-BJdF7lRs.mjs';
5
5
 
6
6
  const isAuthApiCall = (call) => {
7
7
  const callee = call.getExpression();
@@ -1,7 +1,7 @@
1
1
  import { isValidCronExpression, compileCronSchedule, CRON_SCHEDULE_KINDS } from '@lunora/scheduler';
2
2
  import { SyntaxKind, Node } from 'ts-morph';
3
3
  import { diagnosticAt } from './CodegenDiagnosticError-DyQ5FwkM.mjs';
4
- import { listLunoraSourceFiles } from './discoverFunctions-CCVrvWhX.mjs';
4
+ import { listLunoraSourceFiles } from './discoverFunctions-BJdF7lRs.mjs';
5
5
  import { s as sanitizeNamespace } from './paths-BRd6JHuF.mjs';
6
6
 
7
7
  const CRON_METHODS = /* @__PURE__ */ new Set([...CRON_SCHEDULE_KINDS, "cron"]);
@@ -290,23 +290,72 @@ const classifyProcedureCall = (call) => {
290
290
  if (!Node.isIdentifier(callee)) {
291
291
  return void 0;
292
292
  }
293
- const calleeName = resolveCalleeKind(callee);
294
- if (!calleeName) {
293
+ const calleeName2 = resolveCalleeKind(callee);
294
+ if (!calleeName2) {
295
295
  return void 0;
296
296
  }
297
- if (FUNCTION_KINDS.has(calleeName)) {
298
- return { kind: calleeName, visibility: "public" };
297
+ if (FUNCTION_KINDS.has(calleeName2)) {
298
+ return { kind: calleeName2, visibility: "public" };
299
299
  }
300
- const internalKind = INTERNAL_FACTORIES[calleeName];
300
+ const internalKind = INTERNAL_FACTORIES[calleeName2];
301
301
  if (internalKind) {
302
302
  return { kind: internalKind, visibility: "internal" };
303
303
  }
304
- const lifecycle = LIFECYCLE_FACTORIES[calleeName];
304
+ const lifecycle = LIFECYCLE_FACTORIES[calleeName2];
305
305
  if (lifecycle) {
306
306
  return { kind: "mutation", lifecycle, visibility: "internal" };
307
307
  }
308
308
  return void 0;
309
309
  };
310
+ const inlineHandler = (argument) => argument !== void 0 && (Node.isArrowFunction(argument) || Node.isFunctionExpression(argument)) ? argument : void 0;
311
+ const isDatabaseAccessor = (receiver) => Node.isPropertyAccessExpression(receiver) && receiver.getName() === "db" || Node.isIdentifier(receiver) && receiver.getText() === "db";
312
+ const procedureHandler = (initializer) => {
313
+ const argument = initializer.getArguments()[0];
314
+ const direct = inlineHandler(argument);
315
+ if (direct !== void 0) {
316
+ return direct;
317
+ }
318
+ if (argument === void 0 || !Node.isObjectLiteralExpression(argument)) {
319
+ return void 0;
320
+ }
321
+ const property = argument.getProperty("handler");
322
+ return property !== void 0 && Node.isPropertyAssignment(property) ? inlineHandler(property.getInitializer()) : void 0;
323
+ };
324
+ const calleeName = (callee) => {
325
+ if (Node.isIdentifier(callee)) {
326
+ return callee.getText();
327
+ }
328
+ return Node.isPropertyAccessExpression(callee) ? callee.getName() : "";
329
+ };
330
+ const chainHasStep = (receiver, method) => {
331
+ let node = receiver;
332
+ while (Node.isCallExpression(node)) {
333
+ const callee = node.getExpression();
334
+ if (!Node.isPropertyAccessExpression(callee)) {
335
+ break;
336
+ }
337
+ if (callee.getName() === method) {
338
+ return true;
339
+ }
340
+ node = callee.getExpression();
341
+ }
342
+ return false;
343
+ };
344
+ const chainUsesWrappedCall = (receiver, method, wrappedCallee) => {
345
+ let node = receiver;
346
+ while (Node.isCallExpression(node)) {
347
+ const callee = node.getExpression();
348
+ if (!Node.isPropertyAccessExpression(callee)) {
349
+ break;
350
+ }
351
+ const argument = node.getArguments()[0];
352
+ if (callee.getName() === method && argument !== void 0 && Node.isCallExpression(argument) && calleeName(argument.getExpression()) === wrappedCallee) {
353
+ return true;
354
+ }
355
+ node = callee.getExpression();
356
+ }
357
+ return false;
358
+ };
310
359
  const listLunoraSourceFiles = (directory, accumulator = []) => {
311
360
  let entries;
312
361
  try {
@@ -462,4 +511,4 @@ const discoverFunctions = (project, lunoraDirectory) => {
462
511
  return functions;
463
512
  };
464
513
 
465
- export { classifyProcedureCall, discoverFunctions, listLunoraSourceFiles, lunoraRelativePath };
514
+ export { chainHasStep, chainUsesWrappedCall, classifyProcedureCall, discoverFunctions, inlineHandler, isDatabaseAccessor, listLunoraSourceFiles, lunoraRelativePath, procedureHandler };
@@ -1,6 +1,6 @@
1
1
  import { relative, sep } from 'node:path';
2
2
  import { Node } from 'ts-morph';
3
- import { listLunoraSourceFiles } from './discoverFunctions-CCVrvWhX.mjs';
3
+ import { listLunoraSourceFiles } from './discoverFunctions-BJdF7lRs.mjs';
4
4
  import { p as parseValidator, a as parseObjectShape } from './parse-validator-D6zI2i85.mjs';
5
5
 
6
6
  const TS_EXTENSION_RE = /\.ts$/u;
@@ -1,6 +1,6 @@
1
1
  import { SyntaxKind, Node } from 'ts-morph';
2
2
  import { e as enclosingExportName } from './discover-ast-CT6BgBr4.mjs';
3
- import { listLunoraSourceFiles, lunoraRelativePath } from './discoverFunctions-CCVrvWhX.mjs';
3
+ import { listLunoraSourceFiles, lunoraRelativePath } from './discoverFunctions-BJdF7lRs.mjs';
4
4
 
5
5
  const isDatabaseInsertCall = (call) => {
6
6
  const callee = call.getExpression();
@@ -1,5 +1,5 @@
1
1
  import { Node, SyntaxKind } from 'ts-morph';
2
- import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall } from './discoverFunctions-CCVrvWhX.mjs';
2
+ import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall } from './discoverFunctions-BJdF7lRs.mjs';
3
3
 
4
4
  const isMaskCall = (node) => {
5
5
  if (!Node.isCallExpression(node)) {
@@ -213,5 +213,61 @@ const discoverMaskMetadata = (project, lunoraDirectory) => {
213
213
  }
214
214
  return { columns: [...columnsByKey.values()] };
215
215
  };
216
+ const extractMaskStrategyRows = (maskCall, exportName, relativePath) => {
217
+ const argument = maskCall.getArguments()[0];
218
+ if (!argument || !Node.isObjectLiteralExpression(argument)) {
219
+ return [];
220
+ }
221
+ const rows = [];
222
+ for (const tableProperty of argument.getProperties()) {
223
+ const table = memberName(tableProperty);
224
+ if (table === void 0 || !Node.isPropertyAssignment(tableProperty)) {
225
+ continue;
226
+ }
227
+ const initializer = tableProperty.getInitializer();
228
+ if (!initializer || !Node.isObjectLiteralExpression(initializer)) {
229
+ continue;
230
+ }
231
+ for (const columnProperty of initializer.getProperties()) {
232
+ const column = memberName(columnProperty);
233
+ if (column === void 0) {
234
+ continue;
235
+ }
236
+ const strategy = strategyOf(columnProperty);
237
+ if (strategy === "custom") {
238
+ continue;
239
+ }
240
+ rows.push({ column, exportName, file: relativePath, line: columnProperty.getStartLineNumber(), strategy, table });
241
+ }
242
+ }
243
+ return rows;
244
+ };
245
+ const maskStrategyRowsFromDeclaration = (declaration, relativePath) => {
246
+ if (!Node.isVariableDeclaration(declaration)) {
247
+ return [];
248
+ }
249
+ const initializer = declaration.getInitializer();
250
+ const classified = initializer && Node.isCallExpression(initializer) ? classifyProcedureCall(initializer) : void 0;
251
+ if (!classified?.receiver) {
252
+ return [];
253
+ }
254
+ return maskCallsInChain(classified.receiver).flatMap((maskCall) => extractMaskStrategyRows(maskCall, declaration.getName(), relativePath));
255
+ };
256
+ const discoverMaskStrategies = (project, lunoraDirectory) => {
257
+ const rows = [];
258
+ for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
259
+ const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
260
+ const relativePath = lunoraRelativePath(lunoraDirectory, filePath);
261
+ for (const statement of sourceFile.getVariableStatements()) {
262
+ if (!statement.isExported()) {
263
+ continue;
264
+ }
265
+ for (const declaration of statement.getDeclarations()) {
266
+ rows.push(...maskStrategyRowsFromDeclaration(declaration, relativePath));
267
+ }
268
+ }
269
+ }
270
+ return rows;
271
+ };
216
272
 
217
- export { discoverMaskProcedures as default, discoverMaskMetadata };
273
+ export { discoverMaskProcedures as default, discoverMaskMetadata, discoverMaskStrategies };
@@ -1,7 +1,7 @@
1
1
  import { relative, sep } from 'node:path';
2
2
  import { SyntaxKind, Node } from 'ts-morph';
3
3
  import { diagnosticAt } from './CodegenDiagnosticError-DyQ5FwkM.mjs';
4
- import { listLunoraSourceFiles } from './discoverFunctions-CCVrvWhX.mjs';
4
+ import { listLunoraSourceFiles } from './discoverFunctions-BJdF7lRs.mjs';
5
5
 
6
6
  const TS_EXTENSION_RE = /\.ts$/u;
7
7
  const isDefineMigration = (identifier) => {
@@ -1,5 +1,5 @@
1
1
  import { Node, SyntaxKind } from 'ts-morph';
2
- import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall } from './discoverFunctions-CCVrvWhX.mjs';
2
+ import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall } from './discoverFunctions-BJdF7lRs.mjs';
3
3
 
4
4
  const PROPERTY_CALLS = {
5
5
  "crypto.getRandomValues": "crypto.getRandomValues",
@@ -1,5 +1,5 @@
1
1
  import { SyntaxKind, Node } from 'ts-morph';
2
- import { listLunoraSourceFiles, lunoraRelativePath } from './discoverFunctions-CCVrvWhX.mjs';
2
+ import { listLunoraSourceFiles, lunoraRelativePath } from './discoverFunctions-BJdF7lRs.mjs';
3
3
 
4
4
  const INDEX_METHODS = /* @__PURE__ */ new Set(["withIndex", "withSearchIndex"]);
5
5
  const isDatabaseQueryCall = (call) => {
@@ -1,5 +1,5 @@
1
1
  import { Node, SyntaxKind } from 'ts-morph';
2
- import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall } from './discoverFunctions-CCVrvWhX.mjs';
2
+ import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall } from './discoverFunctions-BJdF7lRs.mjs';
3
3
 
4
4
  const handlerOf = (call, receiver) => {
5
5
  if (receiver) {
@@ -1,5 +1,5 @@
1
1
  import { Node, SyntaxKind } from 'ts-morph';
2
- import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall } from './discoverFunctions-CCVrvWhX.mjs';
2
+ import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall } from './discoverFunctions-BJdF7lRs.mjs';
3
3
 
4
4
  const isRlsCall = (node) => {
5
5
  if (!Node.isCallExpression(node)) {
@@ -449,6 +449,10 @@ const applyTableMethod = (accumulator, method, args, name) => {
449
449
  accumulator.indexes.push(parseIndexCall(args));
450
450
  break;
451
451
  }
452
+ case "public": {
453
+ accumulator.isPublic = true;
454
+ break;
455
+ }
452
456
  case "rankIndex": {
453
457
  accumulator.rankIndexes.push(parseRankIndexCall(args));
454
458
  break;
@@ -491,6 +495,7 @@ const parseTableBuilder = (expression, name) => {
491
495
  const accumulator = {
492
496
  externallyManaged: false,
493
497
  indexes: [],
498
+ isPublic: false,
494
499
  rankIndexes: [],
495
500
  relations: [],
496
501
  searchIndexes: [],
@@ -523,6 +528,7 @@ const parseTableBuilder = (expression, name) => {
523
528
  externalSource: accumulator.externalSource,
524
529
  globalBackend: accumulator.shardMode === "global" ? accumulator.globalBackend ?? "d1" : void 0,
525
530
  indexes: accumulator.indexes,
531
+ isPublic: accumulator.isPublic,
526
532
  name,
527
533
  rankIndexes: accumulator.rankIndexes,
528
534
  relations: accumulator.relations,
@@ -777,8 +783,7 @@ const extendCallsOf = (defineSchemaCall) => {
777
783
  }
778
784
  return calls;
779
785
  };
780
- const JURISDICTIONS = /* @__PURE__ */ new Set(["eu", "fedramp", "us"]);
781
- const jurisdictionOf = (defineSchemaCall) => {
786
+ const chainedStringLiteralArgument = (defineSchemaCall, methodName, noun, allowed, expected) => {
782
787
  let current = defineSchemaCall;
783
788
  for (; ; ) {
784
789
  const parent = current.getParent();
@@ -789,14 +794,14 @@ const jurisdictionOf = (defineSchemaCall) => {
789
794
  if (!callParent || !Node.isCallExpression(callParent)) {
790
795
  break;
791
796
  }
792
- if (parent.getName() === "jurisdiction") {
797
+ if (parent.getName() === methodName) {
793
798
  const argument = callParent.getArguments()[0];
794
799
  if (!argument || !Node.isStringLiteral(argument)) {
795
- throw diagnosticAt(callParent, '`.jurisdiction(...)` expects a string literal ("eu", "us", or "fedramp")');
800
+ throw diagnosticAt(callParent, `\`.${methodName}(...)\` expects a string literal (${expected})`);
796
801
  }
797
802
  const value = argument.getLiteralText();
798
- if (!JURISDICTIONS.has(value)) {
799
- throw diagnosticAt(argument, `unknown jurisdiction ${JSON.stringify(value)} — expected "eu", "us", or "fedramp"`);
803
+ if (!allowed.has(value)) {
804
+ throw diagnosticAt(argument, `unknown ${noun} ${JSON.stringify(value)} — expected ${expected}`);
800
805
  }
801
806
  return value;
802
807
  }
@@ -804,6 +809,10 @@ const jurisdictionOf = (defineSchemaCall) => {
804
809
  }
805
810
  return void 0;
806
811
  };
812
+ const JURISDICTIONS = /* @__PURE__ */ new Set(["eu", "fedramp", "us"]);
813
+ const jurisdictionOf = (defineSchemaCall) => chainedStringLiteralArgument(defineSchemaCall, "jurisdiction", "jurisdiction", JURISDICTIONS, '"eu", "us", or "fedramp"');
814
+ const RLS_MODES = /* @__PURE__ */ new Set(["required"]);
815
+ const rlsModeOf = (defineSchemaCall) => chainedStringLiteralArgument(defineSchemaCall, "rls", "rls mode", RLS_MODES, '"required"');
807
816
  const parseBaseTables = (object) => {
808
817
  const tables = [];
809
818
  for (const property of object.getProperties()) {
@@ -859,7 +868,7 @@ const discoverSchema = (project, schemaPath, projectRoot) => {
859
868
  const standaloneVectorIndexes = standaloneArgument && Node.isObjectLiteralExpression(standaloneArgument) ? parseStandaloneVectorIndexes(standaloneArgument) : [];
860
869
  const extensionStandaloneVectorIndexes = applyExtensions(defineSchemaCall, tables, projectRoot);
861
870
  const vectorIndexes = [...tables.flatMap((table) => table.vectorIndexes), ...standaloneVectorIndexes, ...extensionStandaloneVectorIndexes];
862
- return { jurisdiction: jurisdictionOf(defineSchemaCall), tables, vectorIndexes };
871
+ return { jurisdiction: jurisdictionOf(defineSchemaCall), rlsMode: rlsModeOf(defineSchemaCall), tables, vectorIndexes };
863
872
  };
864
873
 
865
874
  export { discoverSchema as default };
@@ -1,5 +1,5 @@
1
1
  import { Node } from 'ts-morph';
2
- import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall } from './discoverFunctions-CCVrvWhX.mjs';
2
+ import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall } from './discoverFunctions-BJdF7lRs.mjs';
3
3
 
4
4
  const STORAGE_OPERATIONS = /* @__PURE__ */ new Set(["delete", "list", "read", "write"]);
5
5
  const isStorageRulesCall = (node) => {
@@ -16,6 +16,7 @@ const flattenIndexes = (table) => [
16
16
  ];
17
17
  const toAdvisorSchema = (schema) => {
18
18
  return {
19
+ rlsMode: schema.rlsMode,
19
20
  tables: schema.tables.map((table) => {
20
21
  return {
21
22
  externallyManaged: table.externallyManaged ?? false,
@@ -27,6 +28,7 @@ const toAdvisorSchema = (schema) => {
27
28
  } : void 0,
28
29
  fields: Object.keys(table.shape),
29
30
  indexes: flattenIndexes(table),
31
+ isPublic: table.isPublic ?? false,
30
32
  name: table.name,
31
33
  relations: table.relations.map((relation) => {
32
34
  return {
@@ -38,7 +40,8 @@ const toAdvisorSchema = (schema) => {
38
40
  table: relation.table
39
41
  };
40
42
  }),
41
- shardKind: typeof table.shardMode === "string" ? table.shardMode : "shardBy"
43
+ shardKind: typeof table.shardMode === "string" ? table.shardMode : "shardBy",
44
+ softDelete: table.softDelete
42
45
  };
43
46
  })
44
47
  };
@@ -46,26 +49,55 @@ const toAdvisorSchema = (schema) => {
46
49
  const toAdvisorShapes = (shapes) => shapes.map((shape) => {
47
50
  return { exportName: shape.exportName, file: `lunora/${shape.filePath}.ts`, table: shape.table };
48
51
  });
49
- const lintSchema = (schema, queries = [], inserts, authApiCalls, rlsProcedures, containers, workflows, workflowCalls, maskProcedures, nondeterministicCalls, procedureProtections, argumentValidators, secretLiterals, sqlInterpolations, adminRoutes, r2sqlCalls, shapes, mutatorWrites) => runAdvisor(
52
+ const lintSchema = (schema, queries = [], inserts, authApiCalls, rlsProcedures, containers, workflows, workflowCalls, maskProcedures, nondeterministicCalls, procedureProtections, argumentValidators, secretLiterals, sqlInterpolations, adminRoutes, r2sqlCalls, shapes, mutatorWrites, configCalls, argumentDerivedFetches, kvKeyAccesses, ownerFieldWrites, storageKeyAccesses, aiRawRuns, containerKeyAccesses, mailRecipientAccesses, vectorNamespaceAccesses, browserUrlAccesses, privilegedDispatches, containerOverrides, authConfigs, maskStrategies, imageDeliveryUrlAccesses, ratelimitKeySelectors, storageUploads, httpActionGuards, httpHeaderWrites, failOpenGuards, flagSecurityDefaults, aiToolSideEffects, identityClaimReads, paymentWebhooks, softDeleteReads, relationLoads, rawRowReturns, normalizeIdAuthorizations, wranglerVariables) => runAdvisor(
50
53
  {
51
54
  adminRoutes,
55
+ aiRawRuns,
56
+ aiToolSideEffects,
57
+ argumentDerivedFetches,
52
58
  argValidators: argumentValidators,
53
59
  authApiCalls,
60
+ authConfigs,
61
+ browserUrlAccesses,
62
+ configCalls,
63
+ containerKeyAccesses,
64
+ containerOverrides,
54
65
  containers,
66
+ failOpenGuards,
67
+ flagSecurityDefaults,
68
+ httpActionGuards,
69
+ httpHeaderWrites,
70
+ identityClaimReads,
71
+ imageDeliveryUrlAccesses,
55
72
  inserts,
73
+ kvKeyAccesses,
74
+ mailRecipientAccesses,
56
75
  maskProcedures,
76
+ maskStrategies,
57
77
  mutatorWrites,
58
78
  nondeterministicCalls,
79
+ normalizeIdAuthorizations,
80
+ ownerFieldWrites,
81
+ paymentWebhooks,
82
+ privilegedDispatches,
59
83
  procedureProtections,
60
84
  queries,
61
85
  r2sqlCalls,
86
+ ratelimitKeySelectors,
87
+ rawRowReturns,
88
+ relationLoads,
62
89
  rlsProcedures,
63
90
  schema: toAdvisorSchema(schema),
64
91
  secretLiterals,
65
92
  shapes: shapes === void 0 ? void 0 : toAdvisorShapes(shapes),
93
+ softDeleteReads,
66
94
  sqlInterpolations,
95
+ storageKeyAccesses,
96
+ storageUploads,
97
+ vectorNamespaceAccesses,
67
98
  workflowCalls,
68
- workflows
99
+ workflows,
100
+ wranglerVariables
69
101
  },
70
102
  { source: "static" }
71
103
  );
@@ -0,0 +1,33 @@
1
+ const HIGH_ENTROPY_TOKEN_RE = /[\w+/=-]{40,}/u;
2
+ const LOWER_RE = /[a-z]/u;
3
+ const UPPER_RE = /[A-Z]/u;
4
+ const DIGIT_RE = /\d/u;
5
+ const HEX_SECRET_RE = /\b(?:[\da-f]{32,}|[\dA-F]{32,})\b/u;
6
+ const isHighEntropy = (value) => {
7
+ const token = HIGH_ENTROPY_TOKEN_RE.exec(value)?.[0];
8
+ if (token === void 0) {
9
+ return false;
10
+ }
11
+ return LOWER_RE.test(token) && UPPER_RE.test(token) && DIGIT_RE.test(token);
12
+ };
13
+ const isHexSecret = (value) => HEX_SECRET_RE.test(value);
14
+ const STRIPE_LIVE_KEY_RE = /\b(?:sk|rk)_live_[\dA-Za-z]{20,}/u;
15
+ const AWS_ACCESS_KEY_RE = /\bAKIA[\dA-Z]{16}\b/u;
16
+ const GITHUB_TOKEN_RE = /\bgh[posru]_[\dA-Za-z]{36,}/u;
17
+ const OPENAI_KEY_RE = /\bsk-[\dA-Za-z]{32,}/u;
18
+ const SLACK_TOKEN_RE = /\bxox[abprs]-[\dA-Za-z-]{10,}/u;
19
+ const PRIVATE_KEY_RE = /-----BEGIN(?: [A-Z]+)? PRIVATE KEY-----/u;
20
+ const SECRET_RULES = [
21
+ { kind: "stripe_live_key", test: (value) => STRIPE_LIVE_KEY_RE.test(value) },
22
+ { kind: "aws_access_key", test: (value) => AWS_ACCESS_KEY_RE.test(value) },
23
+ { kind: "github_token", test: (value) => GITHUB_TOKEN_RE.test(value) },
24
+ { kind: "openai_key", test: (value) => OPENAI_KEY_RE.test(value) },
25
+ { kind: "slack_token", test: (value) => SLACK_TOKEN_RE.test(value) },
26
+ { kind: "private_key", test: (value) => PRIVATE_KEY_RE.test(value) },
27
+ { kind: "high_entropy", test: isHighEntropy },
28
+ { kind: "hex_secret", test: isHexSecret }
29
+ ];
30
+ const secretKindOf = (value) => SECRET_RULES.find((rule) => rule.test(value))?.kind;
31
+ const redact = (value) => `${value.slice(0, 4)}…(${String(value.length)} chars)`;
32
+
33
+ export { SECRET_RULES, redact, secretKindOf };
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@lunora/codegen",
3
- "version": "1.0.0-alpha.29",
3
+ "version": "1.0.0-alpha.30",
4
4
  "description": "Code generator for Lunora: emits _generated/{api,server,dataModel}.ts from your schema",
5
5
  "keywords": [
6
6
  "cloudflare",
@@ -46,7 +46,7 @@
46
46
  "access": "public"
47
47
  },
48
48
  "dependencies": {
49
- "@lunora/advisor": "1.0.0-alpha.16",
49
+ "@lunora/advisor": "1.0.0-alpha.17",
50
50
  "@lunora/container": "1.0.0-alpha.6",
51
51
  "@lunora/errors": "1.0.0-alpha.1",
52
52
  "@lunora/queue": "1.0.0-alpha.3",