@lunora/codegen 1.0.0-alpha.3 → 1.0.0-alpha.31

package/dist/packem_shared/{emitApp-CzSxVDaG.mjs → emitApp-BUCrHOeI.mjs}

@@ -1,4 +1,4 @@
-import { GENERATED_HEADER } from './GENERATED_HEADER-CuLyj0WQ.mjs';
+import { GENERATED_HEADER } from './GENERATED_HEADER-f6nMvllu.mjs';
 
 const LONG_TAIL = [
   ["hasAi", "ai", "ai", "Override the Workers AI binding backing `ctx.ai` (defaults to `env.AI`)."],
@@ -22,8 +22,28 @@ const LONG_TAIL = [
   ["hasVectors", "vectors", "vectors", "Wire the Vectorize index map backing `ctx.vectors`."]
 ];
 const hasAnyLongTail = (options) => LONG_TAIL.some(([flag]) => options[flag]);
+const buildIdentityImports = (identity) => identity ? [`import * as lunoraIdentityContract from "../identity.js";`] : [];
+const buildAccessImports = (hasAccess, hasAuth) => hasAccess ? [
+  `import type { CreateAccessResolverOptions } from "@lunora/cloudflare-access";`,
+  `import { createAccessResolver${hasAuth ? ", composeResolvers" : ""} } from "@lunora/cloudflare-access";`
+] : [];
+const buildKvImports = (hasKv) => hasKv ? [`import { createKvIntrospectorFromEnv } from "@lunora/bindings/kv";`] : [];
 const buildImportLines = (options) => {
-  const { hasAuth, hasFramework, hasGlobal, hasHyperdriveGlobal, hasScheduler, hasStorage, hasWorkflow, useUmbrella, wantsOpenApi, wantsOpenRpc } = options;
+  const {
+    hasAccess,
+    hasAuth,
+    hasFramework,
+    hasGlobal,
+    hasHyperdriveGlobal,
+    hasKv,
+    hasQueue,
+    hasScheduler,
+    hasStorage,
+    hasWorkflow,
+    useUmbrella,
+    wantsOpenApi,
+    wantsOpenRpc
+  } = options;
   const runtimeModule = useUmbrella ? "lunorash/runtime" : "@lunora/runtime";
   const runtimeTypeImports = ["ExecutionContextLike", "LunoraWorker", "Route", "ScheduledControllerLike", "ShardNamespaceLike", "WorkerOptions"];
   if (hasGlobal) {
@@ -42,6 +62,7 @@ const buildImportLines = (options) => {
       `import type { LunoraAuth, LunoraAuthOptions } from "@lunora/auth";`,
       `import { createAuth, createAuthAdmin, ensureMigrated, handleAuthRequest, lunoraD1Adapter } from "@lunora/auth";`
     ] : [],
+    ...buildAccessImports(hasAccess, hasAuth),
     ...hasGlobal ? [
       `import type { D1CtxDbOptions, D1DatabaseLike, D1Exec } from "@lunora/d1";`,
       `import { createD1CtxDb, facetGlobalColumn, listGlobalTables, readGlobalTablePage } from "@lunora/d1";`
@@ -51,15 +72,21 @@ const buildImportLines = (options) => {
       `import { createHyperdriveGlobalCtxDb } from "@lunora/hyperdrive/global";`,
       `import type { SqlCtxDbOptions, SqlExec } from "@lunora/sql-store";`
     ] : [],
+    ...buildKvImports(hasKv),
     ...hasScheduler ? [`import type { DurableObjectNamespaceLike } from "@lunora/scheduler";`, `import { createScheduler } from "@lunora/scheduler";`] : [],
     ...hasStorage ? [`import type { R2BucketLike, Storage } from "@lunora/storage";`, `import { createBucketStorage, createStorage } from "@lunora/storage";`] : [],
     ...hasWorkflow ? [`import { createWorkflowsRestClient } from "@lunora/workflow";`] : [],
     `import type { ${[...runtimeTypeImports].toSorted((a, b) => a.localeCompare(b)).join(", ")} } from "${runtimeModule}";`,
     `import { ${runtimeValueImports} } from "${runtimeModule}";`,
     ``,
+    ...buildIdentityImports(options.identity),
     ...hasGlobal || hasHyperdriveGlobal ? [`import schema from "../schema.js";`] : [],
     `import { LUNORA_CRONS } from "./crons.js";`,
     `import { LUNORA_FUNCTIONS } from "./functions.js";`,
+    ...hasQueue ? [
+      `import { createQueueCaptureSink, dispatchQueueBatch, shouldCaptureQueue } from "@lunora/queue";`,
+      `import { LUNORA_QUEUE_REGISTRY } from "./queues.js";`
+    ] : [],
     ...wantsOpenApi ? [`import { openApiSpec } from "./openapi.js";`] : [],
     ...wantsOpenRpc ? [`import { openRpcSpec } from "./openrpc.js";`] : [],
     `import { createShardDO } from "./shard.js";`
@@ -119,9 +146,10 @@ interface AuthDeclaration<Env> {
   ] : []
 ];
 const buildFieldLines = (options) => [
+  ...options.hasAccess ? [`    private accessSelector?: Selector<Env, CreateAccessResolverOptions>;`] : [],
   `    private adminToken?: Selector<Env, string>;`,
   ...options.hasAuth ? [`    private authDeclaration?: AuthDeclaration<Env>;`] : [],
-  `    private readonly extendFns: ((env: Env) => Partial<WorkerOptions>)[] = [];`,
+  `    private readonly extendFns: ((env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>)[] = [];`,
   ...options.hasGlobal ? [`    private globalDeclaration?: GlobalDeclaration<Env>;`] : [],
   ...options.hasHyperdriveGlobal ? [`    private hyperdriveGlobalDeclaration?: HyperdriveGlobalDeclaration<Env>;`] : [],
   `    private readonly routeMap: Record<string, Route> = {};`,
@@ -139,6 +167,14 @@ const buildLongTailMethods = (options) => LONG_TAIL.filter(([flag]) => options[f
     }`
 );
 const buildMethodBlocks = (options) => [
+  ...options.hasAccess ? [
+    `    /** Wire Cloudflare Access (Zero Trust) — verifies the \`Cf-Access-Jwt-Assertion\` JWT and feeds the identity into \`ctx.auth\` / RLS via \`resolveIdentity\`. When \`.auth(...)\` is also configured, Access is composed ahead of it (Access wins when its JWT is present; everyone else falls through to the app session). */
+    public access(selector: Selector<Env, CreateAccessResolverOptions>): this {
+        this.accessSelector = selector;
+
+        return this;
+    }`
+  ] : [],
   `    /** Bearer token gating the \`/_lunora/admin/*\` endpoints the studio calls. */
     public admin(selector: Selector<Env, string>): this {
         this.adminToken = selector;
@@ -153,8 +189,8 @@ const buildMethodBlocks = (options) => [
         return this;
     }`
   ] : [],
-  `    /** Escape hatch — merge raw \`WorkerOptions\` (anything not yet sugared) over the derived options at build time. */
-    public extend(fn: (env: Env) => Partial<WorkerOptions>): this {
+  `    /** Escape hatch — merge raw \`WorkerOptions\` (anything not yet sugared) over the derived options at build time. The second \`derived\` argument is a snapshot of the options assembled so far (after \`.auth(...)\` etc.), so you can compose rather than clobber — e.g. wrap \`derived.resolveIdentity\` instead of replacing it. */
+    public extend(fn: (env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>): this {
         this.extendFns.push(fn);
 
         return this;
@@ -274,7 +310,7 @@ const buildShardFactoryBody = (options) => {
                           const namespace = this.schedulerDeclaration?.namespace(env);
                           const origin = this.schedulerDeclaration?.origin?.(env);
 
-                          return namespace && origin ? createScheduler({ namespace, originUrl: origin }) : undefined;
+                          return namespace && origin ? createScheduler({${options.jurisdiction ? ` jurisdiction: ${JSON.stringify(options.jurisdiction)},` : ""} namespace, originUrl: origin }) : undefined;
                       },
                   }
                 : {}),`
@@ -321,6 +357,12 @@ const buildWorkerOptionLines = (options) => [
             Object.assign(options, this.buildStorageAdmin(env));
         }`
   ] : [],
+  // The studio's KV browser is wired zero-config: `createKvIntrospectorFromEnv`
+  // scans `env` for every bound Workers KV namespace, so each `kv_namespaces`
+  // entry in wrangler.jsonc appears under its binding name (any name, any count)
+  // with no manual `createKvIntrospector` call. A deployment with no KV binding
+  // yields an empty namespace list rather than crashing.
+  ...options.hasKv ? [`        options.kvIntrospector = createKvIntrospectorFromEnv(env);`] : [],
   ...options.hasAuth ? [
     `        if (this.authDeclaration) {
             options.authHandler = (request) => {
@@ -343,13 +385,52 @@ const buildWorkerOptionLines = (options) => [
 
             options.authAdmin = authInstance ? createAuthAdmin(authInstance) : undefined;
         }`
+  ] : [],
+  // Cloudflare Access — runs AFTER the auth block so it can compose ahead of
+  // the better-auth resolver rather than clobber it. With `.auth()` present,
+  // a request carrying a verified Access JWT is authenticated by Access and
+  // everyone else falls through to the app session; without it, Access is the
+  // sole resolver.
+  ...options.hasAccess ? [
+    options.hasAuth ? `        if (this.accessSelector) {
+            const accessResolver = createAccessResolver(this.accessSelector(env));
+            const fallback = options.resolveIdentity;
+
+            options.resolveIdentity = fallback ? composeResolvers(accessResolver, fallback) : accessResolver;
+        }` : `        if (this.accessSelector) {
+            options.resolveIdentity = createAccessResolver(this.accessSelector(env));
+        }`
   ] : []
 ];
 const buildBaseWorkerOptions = (options) => [
   `            cronJobs: LUNORA_CRONS,`,
   `            functions: LUNORA_FUNCTIONS,`,
+  // The declared `defineIdentity(...)` contract — wires the runtime trust
+  // boundary so `wrapResolverWithContract` validates every resolved identity
+  // against it before it becomes `ctx.auth`. Emitted only when the app declares
+  // a contract, so apps without one keep unchanged output.
+  ...options.identity ? [`            identity: lunoraIdentityContract.${options.identity.exportName},`] : [],
+  // Schema `.jurisdiction("…")` pins every DO the worker reaches to the
+  // Cloudflare data-residency region. Emitted only when declared, so apps
+  // without it keep the un-pinned global namespace (and unchanged output).
+  ...options.jurisdiction ? [`            jurisdiction: ${JSON.stringify(options.jurisdiction)},`] : [],
   ...options.wantsOpenApi ? [`            openApiSpec,`] : [],
   ...options.wantsOpenRpc ? [`            openRpcSpec,`] : [],
+  // The push-consumer handler backing the worker's `queue(batch, …)` entry:
+  // routes each delivered batch to its `defineQueue` handler. Built from
+  // `@lunora/queue` here (keeping the runtime decoupled) and wired only when the
+  // app declares push queues in `lunora/queues.ts`. In a dev environment (or with
+  // `LUNORA_QUEUE_CAPTURE`), every consumed message is recorded into the studio's
+  // Queues log via the root shard's `recordQueueMessage` admin RPC.
+  ...options.hasQueue ? [
+    `            queue: (batch: unknown, queueEnv: unknown, _context: ExecutionContextLike): Promise<void> =>`,
+    `                dispatchQueueBatch(batch as Parameters<typeof dispatchQueueBatch>[0], LUNORA_QUEUE_REGISTRY, {`,
+    `                    capture: shouldCaptureQueue(queueEnv as Record<string, unknown>)`,
+    `                        ? createQueueCaptureSink(queueEnv as Record<string, unknown>${options.jurisdiction ? `, { jurisdiction: ${JSON.stringify(options.jurisdiction)} }` : ""})`,
+    `                        : undefined,`,
+    `                    env: queueEnv as Record<string, unknown>,`,
+    `                }),`
+  ] : [],
   `            routes: this.routeMap,`,
   `            shardDO: this.shardSelector?.(env) ?? (undefined as unknown as ShardNamespaceLike),`
 ];
@@ -558,7 +639,12 @@ ${buildWorkerLine}
                 worker ??= buildWorker(rawEnv as Env);
 
                 return worker.serverQuery(request, rawEnv, reference, args, options);
-            },
+            },${options.hasQueue ? `
+            queue: async (batch: unknown, rawEnv: unknown, context: ExecutionContextLike): Promise<void> => {
+                worker ??= buildWorker(rawEnv as Env);
+
+                return worker.queue?.(batch, rawEnv, context);
+            },` : ""}
         };
 
         if (this.emailHandler) {
@@ -581,7 +667,7 @@ ${buildBaseWorkerOptions(options).join("\n")}
         }
 
 ${workerOptionLines.join("\n\n")}${workerOptionLines.length > 0 ? "\n\n" : ""}        for (const fn of this.extendFns) {
-            Object.assign(options, fn(env));
+            Object.assign(options, fn(env, { ...options }));
         }
 
         return options;

package/dist/packem_shared/{formatAdvisories-8NIv1k0I.mjs → formatAdvisories-C9wNBNvL.mjs}

@@ -16,11 +16,19 @@ const flattenIndexes = (table) => [
 ];
 const toAdvisorSchema = (schema) => {
   return {
+    rlsMode: schema.rlsMode,
     tables: schema.tables.map((table) => {
       return {
         externallyManaged: table.externallyManaged ?? false,
+        externalSource: table.externalSource ? {
+          hasReconcile: table.externalSource.hasReconcile ?? false,
+          hasTenantBy: table.externalSource.hasTenantBy,
+          mode: table.externalSource.mode,
+          unanalyzable: table.externalSource.unanalyzable
+        } : void 0,
         fields: Object.keys(table.shape),
         indexes: flattenIndexes(table),
+        isPublic: table.isPublic ?? false,
         name: table.name,
         relations: table.relations.map((relation) => {
           return {
@@ -31,29 +39,65 @@ const toAdvisorSchema = (schema) => {
             references: relation.references,
             table: relation.table
           };
-        })
+        }),
+        shardKind: typeof table.shardMode === "string" ? table.shardMode : "shardBy",
+        softDelete: table.softDelete
       };
     })
   };
 };
-const lintSchema = (schema, queries = [], inserts, authApiCalls, rlsProcedures, containers, workflows, workflowCalls, maskProcedures, nondeterministicCalls, procedureProtections, argumentValidators, secretLiterals, sqlInterpolations, adminRoutes, r2sqlCalls) => runAdvisor(
+const toAdvisorShapes = (shapes) => shapes.map((shape) => {
+  return { exportName: shape.exportName, file: `lunora/${shape.filePath}.ts`, table: shape.table };
+});
+const lintSchema = (schema, queries = [], inserts, authApiCalls, rlsProcedures, containers, workflows, workflowCalls, maskProcedures, nondeterministicCalls, procedureProtections, argumentValidators, secretLiterals, sqlInterpolations, adminRoutes, r2sqlCalls, shapes, mutatorWrites, configCalls, argumentDerivedFetches, kvKeyAccesses, ownerFieldWrites, storageKeyAccesses, aiRawRuns, containerKeyAccesses, mailRecipientAccesses, vectorNamespaceAccesses, browserUrlAccesses, privilegedDispatches, containerOverrides, authConfigs, maskStrategies, imageDeliveryUrlAccesses, ratelimitKeySelectors, storageUploads, httpActionGuards, httpHeaderWrites, failOpenGuards, flagSecurityDefaults, aiToolSideEffects, identityClaimReads, paymentWebhooks, softDeleteReads, relationLoads, rawRowReturns, normalizeIdAuthorizations, wranglerVariables) => runAdvisor(
   {
     adminRoutes,
+    aiRawRuns,
+    aiToolSideEffects,
+    argumentDerivedFetches,
     argValidators: argumentValidators,
     authApiCalls,
+    authConfigs,
+    browserUrlAccesses,
+    configCalls,
+    containerKeyAccesses,
+    containerOverrides,
     containers,
+    failOpenGuards,
+    flagSecurityDefaults,
+    httpActionGuards,
+    httpHeaderWrites,
+    identityClaimReads,
+    imageDeliveryUrlAccesses,
     inserts,
+    kvKeyAccesses,
+    mailRecipientAccesses,
     maskProcedures,
+    maskStrategies,
+    mutatorWrites,
     nondeterministicCalls,
+    normalizeIdAuthorizations,
+    ownerFieldWrites,
+    paymentWebhooks,
+    privilegedDispatches,
     procedureProtections,
     queries,
     r2sqlCalls,
+    ratelimitKeySelectors,
+    rawRowReturns,
+    relationLoads,
     rlsProcedures,
     schema: toAdvisorSchema(schema),
     secretLiterals,
+    shapes: shapes === void 0 ? void 0 : toAdvisorShapes(shapes),
+    softDeleteReads,
     sqlInterpolations,
+    storageKeyAccesses,
+    storageUploads,
+    vectorNamespaceAccesses,
     workflowCalls,
-    workflows
+    workflows,
+    wranglerVariables
   },
   { source: "static" }
 );

package/dist/packem_shared/{parse-validator-tuQtHrsr.mjs → parse-validator-D6zI2i85.mjs}

@@ -1,3 +1,4 @@
+import { LunoraError } from '@lunora/errors';
 import { Node } from 'ts-morph';
 
 const FIELD_NAME_RE = /^[A-Za-z_$][\w$]*$/u;
@@ -53,7 +54,7 @@ const parseObjectShape = (object) => {
     }
     const fieldName = property.getName();
     if (!FIELD_NAME_RE.test(fieldName)) {
-      throw new Error(`@lunora/codegen: field name is not a valid JS identifier: ${JSON.stringify(fieldName)}`);
+      throw new LunoraError("INTERNAL", `@lunora/codegen: field name is not a valid JS identifier: ${JSON.stringify(fieldName)}`);
     }
     out[fieldName] = parseValidator(initializer);
   }
@@ -106,7 +107,7 @@ const parseBuilderMember = (member, args) => {
       };
     }
     default: {
-      throw new Error(`Unsupported validator kind: ${member}`);
+      throw new LunoraError("INTERNAL", `Unsupported validator kind: ${member}`);
     }
   }
 };
@@ -124,7 +125,8 @@ const parseValidatorCall = (call) => {
   }
   if (TRANSPARENT_MODIFIERS.has(member)) {
     const receiver = callee.getExpression();
-    return Node.isExpression(receiver) ? parseValidator(receiver) : { kind: "any" };
+    const base = Node.isExpression(receiver) ? parseValidator(receiver) : { kind: "any" };
+    return member === "check" ? { ...base, hasRefinement: true } : base;
   }
   return parseBuilderMember(member, args);
 };

package/dist/packem_shared/redact-oTmsol5A.mjs

@@ -0,0 +1,33 @@
+const HIGH_ENTROPY_TOKEN_RE = /[\w+/=-]{40,}/u;
+const LOWER_RE = /[a-z]/u;
+const UPPER_RE = /[A-Z]/u;
+const DIGIT_RE = /\d/u;
+const HEX_SECRET_RE = /\b(?:[\da-f]{32,}|[\dA-F]{32,})\b/u;
+const isHighEntropy = (value) => {
+  const token = HIGH_ENTROPY_TOKEN_RE.exec(value)?.[0];
+  if (token === void 0) {
+    return false;
+  }
+  return LOWER_RE.test(token) && UPPER_RE.test(token) && DIGIT_RE.test(token);
+};
+const isHexSecret = (value) => HEX_SECRET_RE.test(value);
+const STRIPE_LIVE_KEY_RE = /\b(?:sk|rk)_live_[\dA-Za-z]{20,}/u;
+const AWS_ACCESS_KEY_RE = /\bAKIA[\dA-Z]{16}\b/u;
+const GITHUB_TOKEN_RE = /\bgh[posru]_[\dA-Za-z]{36,}/u;
+const OPENAI_KEY_RE = /\bsk-[\dA-Za-z]{32,}/u;
+const SLACK_TOKEN_RE = /\bxox[abprs]-[\dA-Za-z-]{10,}/u;
+const PRIVATE_KEY_RE = /-----BEGIN(?: [A-Z]+)? PRIVATE KEY-----/u;
+const SECRET_RULES = [
+  { kind: "stripe_live_key", test: (value) => STRIPE_LIVE_KEY_RE.test(value) },
+  { kind: "aws_access_key", test: (value) => AWS_ACCESS_KEY_RE.test(value) },
+  { kind: "github_token", test: (value) => GITHUB_TOKEN_RE.test(value) },
+  { kind: "openai_key", test: (value) => OPENAI_KEY_RE.test(value) },
+  { kind: "slack_token", test: (value) => SLACK_TOKEN_RE.test(value) },
+  { kind: "private_key", test: (value) => PRIVATE_KEY_RE.test(value) },
+  { kind: "high_entropy", test: isHighEntropy },
+  { kind: "hex_secret", test: isHexSecret }
+];
+const secretKindOf = (value) => SECRET_RULES.find((rule) => rule.test(value))?.kind;
+const redact = (value) => `${value.slice(0, 4)}…(${String(value.length)} chars)`;
+
+export { SECRET_RULES, redact, secretKindOf };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/codegen",
-  "version": "1.0.0-alpha.3",
+  "version": "1.0.0-alpha.31",
   "description": "Code generator for Lunora: emits _generated/{api,server,dataModel}.ts from your schema",
   "keywords": [
     "cloudflare",
@@ -25,7 +25,7 @@
     "directory": "packages/codegen"
   },
   "files": [
-    "dist",
+    "./dist",
     "__assets__",
     "README.md",
     "LICENSE.md"
@@ -46,11 +46,13 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/advisor": "1.0.0-alpha.2",
-    "@lunora/container": "1.0.0-alpha.1",
-    "@lunora/scheduler": "1.0.0-alpha.1",
-    "@lunora/values": "1.0.0-alpha.1",
-    "@lunora/workflow": "1.0.0-alpha.1",
+    "@lunora/advisor": "1.0.0-alpha.17",
+    "@lunora/container": "1.0.0-alpha.6",
+    "@lunora/errors": "1.0.0-alpha.1",
+    "@lunora/queue": "1.0.0-alpha.4",
+    "@lunora/scheduler": "1.0.0-alpha.5",
+    "@lunora/values": "1.0.0-alpha.4",
+    "@lunora/workflow": "1.0.0-alpha.6",
     "ts-morph": "^28.0.0"
   },
   "engines": {