@lunora/codegen 1.0.0-alpha.32 → 1.0.0-alpha.34

package/LICENSE.md

@@ -103,3 +103,9 @@ Unless required by applicable law or agreed to in writing, software distributed
 under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
 CONDITIONS OF ANY KIND, either express or implied. See the License for the
 specific language governing permissions and limitations under the License.
+
+<!-- DEPENDENCIES -->
+<!-- /DEPENDENCIES -->
+
+<!-- TYPE_DEPENDENCIES -->
+<!-- /TYPE_DEPENDENCIES -->

package/dist/index.d.mts

@@ -1597,7 +1597,7 @@ interface ProjectIR {
 * pass straight through without conversion. Returns the findings; surfacing them
 * (console, error overlay, studio Advisors table) is the caller's choice.
 */
-declare const lintSchema: (schema: SchemaIR, queries?: ReadonlyArray<QueryReadIR>, inserts?: ReadonlyArray<InsertWriteIR>, authApiCalls?: ReadonlyArray<AuthApiCallIR>, rlsProcedures?: ReadonlyArray<RlsProcedureIR>, containers?: ReadonlyArray<ContainerIR>, workflows?: ReadonlyArray<WorkflowIR>, workflowCalls?: ReadonlyArray<WorkflowCallIR>, maskProcedures?: ReadonlyArray<MaskProcedureIR>, nondeterministicCalls?: ReadonlyArray<NondeterministicCallIR>, procedureProtections?: ReadonlyArray<ProcedureMiddlewareIR>, argumentValidators?: ReadonlyArray<ArgumentValidatorIR>, secretLiterals?: ReadonlyArray<SecretLiteralIR>, sqlInterpolations?: ReadonlyArray<SqlInterpolationIR>, adminRoutes?: ReadonlyArray<AdminRouteIR>, r2sqlCalls?: ReadonlyArray<R2sqlCallIR>, shapes?: ReadonlyArray<ShapeIR>, mutatorWrites?: ReadonlyArray<MutatorWriteIR>, configCalls?: ReadonlyArray<ConfigCallIR>, argumentDerivedFetches?: ReadonlyArray<ArgumentDerivedFetchIR>, kvKeyAccesses?: ReadonlyArray<KvKeyAccessIR>, ownerFieldWrites?: ReadonlyArray<OwnerFieldWriteIR>, storageKeyAccesses?: ReadonlyArray<StorageKeyAccessIR>, aiRawRuns?: ReadonlyArray<AiRawRunIR>, containerKeyAccesses?: ReadonlyArray<ContainerKeyAccessIR>, mailRecipientAccesses?: ReadonlyArray<MailRecipientAccessIR>, vectorNamespaceAccesses?: ReadonlyArray<VectorNamespaceAccessIR>, browserUrlAccesses?: ReadonlyArray<BrowserUrlAccessIR>, privilegedDispatches?: ReadonlyArray<PrivilegedDispatchIR>, containerOverrides?: ReadonlyArray<ContainerOverrideIR>, authConfigs?: ReadonlyArray<AuthConfigIR>, maskStrategies?: ReadonlyArray<MaskStrategyIR>, imageDeliveryUrlAccesses?: ReadonlyArray<ImageDeliveryUrlAccessIR>, ratelimitKeySelectors?: ReadonlyArray<RatelimitKeySelectorIR>, storageUploads?: ReadonlyArray<StorageUploadIR>, httpActionGuards?: ReadonlyArray<HttpActionGuardIR>, httpHeaderWrites?: ReadonlyArray<HttpHeaderWriteIR>, failOpenGuards?: ReadonlyArray<FailOpenGuardIR>, flagSecurityDefaults?: ReadonlyArray<FlagSecurityDefaultIR>, aiToolSideEffects?: ReadonlyArray<AiToolSideEffectIR>, identityClaimReads?: ReadonlyArray<IdentityClaimReadIR>, paymentWebhooks?: ReadonlyArray<PaymentWebhookIR>, softDeleteReads?: ReadonlyArray<SoftDeleteReadIR>, relationLoads?: ReadonlyArray<RelationLoadIR>, rawRowReturns?: ReadonlyArray<RawRowReturnIR>, normalizeIdAuthorizations?: ReadonlyArray<NormalizeIdAuthorizationIR>, wranglerVariables?: ReadonlyArray<WranglerVariableIR>) => Finding[];
+declare const lintSchema: (schema: SchemaIR, queries?: ReadonlyArray<QueryReadIR>, inserts?: ReadonlyArray<InsertWriteIR>, authApiCalls?: ReadonlyArray<AuthApiCallIR>, rlsProcedures?: ReadonlyArray<RlsProcedureIR>, containers?: ReadonlyArray<ContainerIR>, workflows?: ReadonlyArray<WorkflowIR>, workflowCalls?: ReadonlyArray<WorkflowCallIR>, maskProcedures?: ReadonlyArray<MaskProcedureIR>, nondeterministicCalls?: ReadonlyArray<NondeterministicCallIR>, procedureProtections?: ReadonlyArray<ProcedureMiddlewareIR>, argumentValidators?: ReadonlyArray<ArgumentValidatorIR>, secretLiterals?: ReadonlyArray<SecretLiteralIR>, sqlInterpolations?: ReadonlyArray<SqlInterpolationIR>, adminRoutes?: ReadonlyArray<AdminRouteIR>, r2sqlCalls?: ReadonlyArray<R2sqlCallIR>, shapes?: ReadonlyArray<ShapeIR>, mutatorWrites?: ReadonlyArray<MutatorWriteIR>, configCalls?: ReadonlyArray<ConfigCallIR>, argumentDerivedFetches?: ReadonlyArray<ArgumentDerivedFetchIR>, kvKeyAccesses?: ReadonlyArray<KvKeyAccessIR>, ownerFieldWrites?: ReadonlyArray<OwnerFieldWriteIR>, storageKeyAccesses?: ReadonlyArray<StorageKeyAccessIR>, aiRawRuns?: ReadonlyArray<AiRawRunIR>, containerKeyAccesses?: ReadonlyArray<ContainerKeyAccessIR>, mailRecipientAccesses?: ReadonlyArray<MailRecipientAccessIR>, vectorNamespaceAccesses?: ReadonlyArray<VectorNamespaceAccessIR>, browserUrlAccesses?: ReadonlyArray<BrowserUrlAccessIR>, privilegedDispatches?: ReadonlyArray<PrivilegedDispatchIR>, containerOverrides?: ReadonlyArray<ContainerOverrideIR>, authConfigs?: ReadonlyArray<AuthConfigIR>, maskStrategies?: ReadonlyArray<MaskStrategyIR>, imageDeliveryUrlAccesses?: ReadonlyArray<ImageDeliveryUrlAccessIR>, ratelimitKeySelectors?: ReadonlyArray<RatelimitKeySelectorIR>, storageUploads?: ReadonlyArray<StorageUploadIR>, httpActionGuards?: ReadonlyArray<HttpActionGuardIR>, httpHeaderWrites?: ReadonlyArray<HttpHeaderWriteIR>, failOpenGuards?: ReadonlyArray<FailOpenGuardIR>, flagSecurityDefaults?: ReadonlyArray<FlagSecurityDefaultIR>, aiToolSideEffects?: ReadonlyArray<AiToolSideEffectIR>, identityClaimReads?: ReadonlyArray<IdentityClaimReadIR>, paymentWebhooks?: ReadonlyArray<PaymentWebhookIR>, softDeleteReads?: ReadonlyArray<SoftDeleteReadIR>, relationLoads?: ReadonlyArray<RelationLoadIR>, rawRowReturns?: ReadonlyArray<RawRowReturnIR>, normalizeIdAuthorizations?: ReadonlyArray<NormalizeIdAuthorizationIR>, wranglerVariables?: ReadonlyArray<WranglerVariableIR>, queues?: ReadonlyArray<QueueIR>) => Finding[];
 /**
 * Render advisor findings as a single multi-line string for console surfacing:
 * a one-line summary header followed by one `[LEVEL] name: detail` line per

package/dist/index.d.ts

@@ -1597,7 +1597,7 @@ interface ProjectIR {
 * pass straight through without conversion. Returns the findings; surfacing them
 * (console, error overlay, studio Advisors table) is the caller's choice.
 */
-declare const lintSchema: (schema: SchemaIR, queries?: ReadonlyArray<QueryReadIR>, inserts?: ReadonlyArray<InsertWriteIR>, authApiCalls?: ReadonlyArray<AuthApiCallIR>, rlsProcedures?: ReadonlyArray<RlsProcedureIR>, containers?: ReadonlyArray<ContainerIR>, workflows?: ReadonlyArray<WorkflowIR>, workflowCalls?: ReadonlyArray<WorkflowCallIR>, maskProcedures?: ReadonlyArray<MaskProcedureIR>, nondeterministicCalls?: ReadonlyArray<NondeterministicCallIR>, procedureProtections?: ReadonlyArray<ProcedureMiddlewareIR>, argumentValidators?: ReadonlyArray<ArgumentValidatorIR>, secretLiterals?: ReadonlyArray<SecretLiteralIR>, sqlInterpolations?: ReadonlyArray<SqlInterpolationIR>, adminRoutes?: ReadonlyArray<AdminRouteIR>, r2sqlCalls?: ReadonlyArray<R2sqlCallIR>, shapes?: ReadonlyArray<ShapeIR>, mutatorWrites?: ReadonlyArray<MutatorWriteIR>, configCalls?: ReadonlyArray<ConfigCallIR>, argumentDerivedFetches?: ReadonlyArray<ArgumentDerivedFetchIR>, kvKeyAccesses?: ReadonlyArray<KvKeyAccessIR>, ownerFieldWrites?: ReadonlyArray<OwnerFieldWriteIR>, storageKeyAccesses?: ReadonlyArray<StorageKeyAccessIR>, aiRawRuns?: ReadonlyArray<AiRawRunIR>, containerKeyAccesses?: ReadonlyArray<ContainerKeyAccessIR>, mailRecipientAccesses?: ReadonlyArray<MailRecipientAccessIR>, vectorNamespaceAccesses?: ReadonlyArray<VectorNamespaceAccessIR>, browserUrlAccesses?: ReadonlyArray<BrowserUrlAccessIR>, privilegedDispatches?: ReadonlyArray<PrivilegedDispatchIR>, containerOverrides?: ReadonlyArray<ContainerOverrideIR>, authConfigs?: ReadonlyArray<AuthConfigIR>, maskStrategies?: ReadonlyArray<MaskStrategyIR>, imageDeliveryUrlAccesses?: ReadonlyArray<ImageDeliveryUrlAccessIR>, ratelimitKeySelectors?: ReadonlyArray<RatelimitKeySelectorIR>, storageUploads?: ReadonlyArray<StorageUploadIR>, httpActionGuards?: ReadonlyArray<HttpActionGuardIR>, httpHeaderWrites?: ReadonlyArray<HttpHeaderWriteIR>, failOpenGuards?: ReadonlyArray<FailOpenGuardIR>, flagSecurityDefaults?: ReadonlyArray<FlagSecurityDefaultIR>, aiToolSideEffects?: ReadonlyArray<AiToolSideEffectIR>, identityClaimReads?: ReadonlyArray<IdentityClaimReadIR>, paymentWebhooks?: ReadonlyArray<PaymentWebhookIR>, softDeleteReads?: ReadonlyArray<SoftDeleteReadIR>, relationLoads?: ReadonlyArray<RelationLoadIR>, rawRowReturns?: ReadonlyArray<RawRowReturnIR>, normalizeIdAuthorizations?: ReadonlyArray<NormalizeIdAuthorizationIR>, wranglerVariables?: ReadonlyArray<WranglerVariableIR>) => Finding[];
+declare const lintSchema: (schema: SchemaIR, queries?: ReadonlyArray<QueryReadIR>, inserts?: ReadonlyArray<InsertWriteIR>, authApiCalls?: ReadonlyArray<AuthApiCallIR>, rlsProcedures?: ReadonlyArray<RlsProcedureIR>, containers?: ReadonlyArray<ContainerIR>, workflows?: ReadonlyArray<WorkflowIR>, workflowCalls?: ReadonlyArray<WorkflowCallIR>, maskProcedures?: ReadonlyArray<MaskProcedureIR>, nondeterministicCalls?: ReadonlyArray<NondeterministicCallIR>, procedureProtections?: ReadonlyArray<ProcedureMiddlewareIR>, argumentValidators?: ReadonlyArray<ArgumentValidatorIR>, secretLiterals?: ReadonlyArray<SecretLiteralIR>, sqlInterpolations?: ReadonlyArray<SqlInterpolationIR>, adminRoutes?: ReadonlyArray<AdminRouteIR>, r2sqlCalls?: ReadonlyArray<R2sqlCallIR>, shapes?: ReadonlyArray<ShapeIR>, mutatorWrites?: ReadonlyArray<MutatorWriteIR>, configCalls?: ReadonlyArray<ConfigCallIR>, argumentDerivedFetches?: ReadonlyArray<ArgumentDerivedFetchIR>, kvKeyAccesses?: ReadonlyArray<KvKeyAccessIR>, ownerFieldWrites?: ReadonlyArray<OwnerFieldWriteIR>, storageKeyAccesses?: ReadonlyArray<StorageKeyAccessIR>, aiRawRuns?: ReadonlyArray<AiRawRunIR>, containerKeyAccesses?: ReadonlyArray<ContainerKeyAccessIR>, mailRecipientAccesses?: ReadonlyArray<MailRecipientAccessIR>, vectorNamespaceAccesses?: ReadonlyArray<VectorNamespaceAccessIR>, browserUrlAccesses?: ReadonlyArray<BrowserUrlAccessIR>, privilegedDispatches?: ReadonlyArray<PrivilegedDispatchIR>, containerOverrides?: ReadonlyArray<ContainerOverrideIR>, authConfigs?: ReadonlyArray<AuthConfigIR>, maskStrategies?: ReadonlyArray<MaskStrategyIR>, imageDeliveryUrlAccesses?: ReadonlyArray<ImageDeliveryUrlAccessIR>, ratelimitKeySelectors?: ReadonlyArray<RatelimitKeySelectorIR>, storageUploads?: ReadonlyArray<StorageUploadIR>, httpActionGuards?: ReadonlyArray<HttpActionGuardIR>, httpHeaderWrites?: ReadonlyArray<HttpHeaderWriteIR>, failOpenGuards?: ReadonlyArray<FailOpenGuardIR>, flagSecurityDefaults?: ReadonlyArray<FlagSecurityDefaultIR>, aiToolSideEffects?: ReadonlyArray<AiToolSideEffectIR>, identityClaimReads?: ReadonlyArray<IdentityClaimReadIR>, paymentWebhooks?: ReadonlyArray<PaymentWebhookIR>, softDeleteReads?: ReadonlyArray<SoftDeleteReadIR>, relationLoads?: ReadonlyArray<RelationLoadIR>, rawRowReturns?: ReadonlyArray<RawRowReturnIR>, normalizeIdAuthorizations?: ReadonlyArray<NormalizeIdAuthorizationIR>, wranglerVariables?: ReadonlyArray<WranglerVariableIR>, queues?: ReadonlyArray<QueueIR>) => Finding[];
 /**
 * Render advisor findings as a single multi-line string for console surfacing:
 * a one-line summary header followed by one `[LEVEL] name: detail` line per

package/dist/index.mjs

@@ -1,4 +1,4 @@
-export { formatAdvisories, lintSchema } from './packem_shared/formatAdvisories-C9wNBNvL.mjs';
+export { formatAdvisories, lintSchema } from './packem_shared/formatAdvisories-DLIqHq5l.mjs';
 export { CodegenDiagnosticError, diagnosticAt } from './packem_shared/CodegenDiagnosticError-DyQ5FwkM.mjs';
 export { default as discoverAuthApiCalls } from './packem_shared/discoverAuthApiCalls-URDoTADN.mjs';
 export { CONTAINERS_FILENAME, discoverContainers } from './packem_shared/CONTAINERS_FILENAME-DjpXMqhp.mjs';
@@ -23,7 +23,7 @@ export { G as GENERATED_HEADER, e as emitApi, a as emitCollections, b as emitCon
 export { emitApp } from './packem_shared/emitApp-nQ2oC-8G.mjs';
 export { buildOpenApiDocument, emitOpenApi, emitOpenApiModule } from './packem_shared/buildOpenApiDocument-bp1pYSV6.mjs';
 export { OPENRPC_VERSION, buildOpenRpcDocument, emitOpenRpc, emitOpenRpcModule } from './packem_shared/OPENRPC_VERSION-4YIeMkOI.mjs';
-export { SCHEMA_SNAPSHOT_FILENAME, createCodegenProject, refreshCodegenProject, runCodegen } from './packem_shared/SCHEMA_SNAPSHOT_FILENAME-OBXQBJV0.mjs';
+export { SCHEMA_SNAPSHOT_FILENAME, createCodegenProject, refreshCodegenProject, runCodegen } from './packem_shared/SCHEMA_SNAPSHOT_FILENAME-DnD-_HwA.mjs';
 export { SCHEMA_SNAPSHOT_VERSION, SchemaSnapshotParseError, buildSchemaSnapshot, diffSchemaSnapshots, evaluateSchemaDrift, parseSchemaSnapshot, serializeSchemaSnapshot } from './packem_shared/SCHEMA_SNAPSHOT_VERSION-D0ARY6rL.mjs';
 export { schemaFromIr } from './packem_shared/schemaFromIr-DTYsLBaA.mjs';
 export { LUNORA_ERROR_CODES, validatorIrToJsonSchema } from './packem_shared/LUNORA_ERROR_CODES-CySpQPD3.mjs';

package/dist/packem_shared/{SCHEMA_SNAPSHOT_FILENAME-OBXQBJV0.mjs → SCHEMA_SNAPSHOT_FILENAME-DnD-_HwA.mjs}

@@ -3,7 +3,7 @@ import { join, dirname } from 'node:path';
 import { performance } from 'node:perf_hooks';
 import { LunoraError } from '@lunora/errors';
 import { Node, SyntaxKind, Project } from 'ts-morph';
-import { lintSchema } from './formatAdvisories-C9wNBNvL.mjs';
+import { lintSchema } from './formatAdvisories-DLIqHq5l.mjs';
 import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall, inlineHandler as inlineHandler$1, procedureHandler, chainUsesWrappedCall, isDatabaseAccessor, chainHasStep, discoverFunctions } from './discoverFunctions-BJdF7lRs.mjs';
 import discoverAuthApiCalls from './discoverAuthApiCalls-URDoTADN.mjs';
 import { discoverContainers } from './CONTAINERS_FILENAME-DjpXMqhp.mjs';
@@ -644,47 +644,53 @@ const discoverAuthConfig = (project, lunoraDirectory) => {
   return rows;
 };
 
-const BROWSER_URL_METHODS = /* @__PURE__ */ new Set(["content", "pdf", "scrape", "screenshot"]);
-const browserUrlMethod = (node) => {
+const sinkMethod = (node, config) => {
   if (!Node.isPropertyAccessExpression(node)) {
     return void 0;
   }
   const method = node.getName();
-  if (!BROWSER_URL_METHODS.has(method) || node.getExpression().getText() !== "ctx.browser") {
+  if (!config.methods.has(method)) {
     return void 0;
   }
-  return method;
+  return config.matchReceiver(node.getExpression().getText()) ? method : void 0;
 };
-const browserUrlAccessInCall = (call, relativePath) => {
-  const method = browserUrlMethod(call.getExpression());
+const accessInCall = (call, relativePath, config) => {
+  const method = sinkMethod(call.getExpression(), config);
   if (method === void 0) {
     return void 0;
   }
-  const url = call.getArguments()[0];
-  if (!url || !isArgumentDerived(url) || isScopedByContext(url)) {
+  const key = call.getArguments()[config.argIndex];
+  if (!key || !isArgumentDerived(key) || isScopedByContext(key)) {
     return void 0;
   }
   return { exportName: enclosingExportName$1(call), file: relativePath, line: call.getStartLineNumber(), method };
 };
-const browserUrlAccessesInSourceFile = (sourceFile, relativePath) => {
+const accessesInSourceFile = (sourceFile, relativePath, config) => {
   const found = [];
   for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
-    const row = browserUrlAccessInCall(call, relativePath);
-    if (row) {
-      found.push(row);
+    const access = accessInCall(call, relativePath, config);
+    if (access) {
+      found.push(access);
     }
   }
   return found;
 };
-const discoverBrowserUrlAccesses = (project, lunoraDirectory) => {
-  const rows = [];
+const discoverArgumentDerivedAccesses = (project, lunoraDirectory, config) => {
+  const accesses = [];
   for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
     const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
-    rows.push(...browserUrlAccessesInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
+    accesses.push(...accessesInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath), config));
   }
-  return rows;
+  return accesses;
 };
 
+const BROWSER_URL_METHODS = /* @__PURE__ */ new Set(["content", "pdf", "scrape", "screenshot"]);
+const discoverBrowserUrlAccesses = (project, lunoraDirectory) => discoverArgumentDerivedAccesses(project, lunoraDirectory, {
+  argIndex: 0,
+  matchReceiver: (receiver) => receiver === "ctx.browser",
+  methods: BROWSER_URL_METHODS
+});
+
 const FUNCTION_CALLEES = /* @__PURE__ */ new Set(["createBrowser", "createInboundEmailHandler", "createPayment"]);
 const CONSTRUCTOR_CALLEES = /* @__PURE__ */ new Set(["RateLimiter"]);
 const CALLBACK_CALLEES = /* @__PURE__ */ new Set(["extend"]);
@@ -774,50 +780,18 @@ const discoverConfigCalls = (project, lunoraDirectory) => {
 };
 
 const CONTAINER_ACCESSOR_PREFIX = "ctx.containers.";
-const containerGetMethod = (node) => {
-  if (!Node.isPropertyAccessExpression(node)) {
-    return void 0;
-  }
-  const method = node.getName();
-  if (method !== "get") {
-    return void 0;
-  }
-  const receiver = node.getExpression().getText();
+const isContainerInstanceReceiver = (receiver) => {
   if (!receiver.startsWith(CONTAINER_ACCESSOR_PREFIX)) {
-    return void 0;
+    return false;
   }
   const remainder = receiver.slice(CONTAINER_ACCESSOR_PREFIX.length);
-  return remainder.length > 0 && !remainder.includes(".") ? method : void 0;
-};
-const containerAccessInCall = (call, relativePath) => {
-  const method = containerGetMethod(call.getExpression());
-  if (method === void 0) {
-    return void 0;
-  }
-  const key = call.getArguments()[0];
-  if (!key || !isArgumentDerived(key) || isScopedByContext(key)) {
-    return void 0;
-  }
-  return { exportName: enclosingExportName$1(call), file: relativePath, line: call.getStartLineNumber(), method };
-};
-const containerAccessesInSourceFile = (sourceFile, relativePath) => {
-  const found = [];
-  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
-    const access = containerAccessInCall(call, relativePath);
-    if (access) {
-      found.push(access);
-    }
-  }
-  return found;
-};
-const discoverContainerKeyAccesses = (project, lunoraDirectory) => {
-  const accesses = [];
-  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
-    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
-    accesses.push(...containerAccessesInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
-  }
-  return accesses;
+  return remainder.length > 0 && !remainder.includes(".");
 };
+const discoverContainerKeyAccesses = (project, lunoraDirectory) => discoverArgumentDerivedAccesses(project, lunoraDirectory, {
+  argIndex: 0,
+  matchReceiver: isContainerInstanceReceiver,
+  methods: /* @__PURE__ */ new Set(["get"])
+});
 
 const EGRESS_MUTATING_METHODS = /* @__PURE__ */ new Set(["allow", "deny", "setAllowed"]);
 const hasEnableInternetTrue = (call) => {
@@ -1646,46 +1620,11 @@ const discoverImageDeliveryUrlAccesses = (project, lunoraDirectory) => {
 };
 
 const KV_KEY_METHODS = /* @__PURE__ */ new Set(["delete", "get", "getRaw", "getWithMetadata", "put"]);
-const kvKeyMethod = (node) => {
-  if (!Node.isPropertyAccessExpression(node)) {
-    return void 0;
-  }
-  const method = node.getName();
-  if (!KV_KEY_METHODS.has(method)) {
-    return void 0;
-  }
-  const receiver = node.getExpression().getText();
-  return receiver === "ctx.kv" || receiver.startsWith("ctx.kv.") ? method : void 0;
-};
-const kvAccessInCall = (call, relativePath) => {
-  const method = kvKeyMethod(call.getExpression());
-  if (method === void 0) {
-    return void 0;
-  }
-  const key = call.getArguments()[0];
-  if (!key || !isArgumentDerived(key) || isScopedByContext(key)) {
-    return void 0;
-  }
-  return { exportName: enclosingExportName$1(call), file: relativePath, line: call.getStartLineNumber(), method };
-};
-const kvAccessesInSourceFile = (sourceFile, relativePath) => {
-  const found = [];
-  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
-    const access = kvAccessInCall(call, relativePath);
-    if (access) {
-      found.push(access);
-    }
-  }
-  return found;
-};
-const discoverKvKeyAccesses = (project, lunoraDirectory) => {
-  const accesses = [];
-  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
-    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
-    accesses.push(...kvAccessesInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
-  }
-  return accesses;
-};
+const discoverKvKeyAccesses = (project, lunoraDirectory) => discoverArgumentDerivedAccesses(project, lunoraDirectory, {
+  argIndex: 0,
+  matchReceiver: (receiver) => receiver === "ctx.kv" || receiver.startsWith("ctx.kv."),
+  methods: KV_KEY_METHODS
+});
 
 const MAIL_METHODS = /* @__PURE__ */ new Set(["queue", "send"]);
 const RECIPIENT_FIELDS = /* @__PURE__ */ new Set(["bcc", "cc", "to"]);
@@ -2949,46 +2888,11 @@ const KEY_TAKING_METHODS = /* @__PURE__ */ new Set([
   "store",
   "upload"
 ]);
-const storageKeyMethod = (node) => {
-  if (!Node.isPropertyAccessExpression(node)) {
-    return void 0;
-  }
-  const method = node.getName();
-  if (!KEY_TAKING_METHODS.has(method)) {
-    return void 0;
-  }
-  const receiver = node.getExpression().getText();
-  return receiver === "ctx.storage" || receiver.startsWith("ctx.storage.") ? method : void 0;
-};
-const storageKeyInCall = (call, relativePath) => {
-  const method = storageKeyMethod(call.getExpression());
-  if (method === void 0) {
-    return void 0;
-  }
-  const key = call.getArguments()[0];
-  if (!key || !isArgumentDerived(key) || isScopedByContext(key)) {
-    return void 0;
-  }
-  return { exportName: enclosingExportName$1(call), file: relativePath, line: call.getStartLineNumber(), method };
-};
-const storageKeyAccessesInSourceFile = (sourceFile, relativePath) => {
-  const found = [];
-  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
-    const access = storageKeyInCall(call, relativePath);
-    if (access) {
-      found.push(access);
-    }
-  }
-  return found;
-};
-const discoverStorageKeyAccesses = (project, lunoraDirectory) => {
-  const accesses = [];
-  for (const filePath of listLunoraSourceFiles(lunoraDirectory)) {
-    const sourceFile = project.getSourceFile(filePath) ?? project.addSourceFileAtPath(filePath);
-    accesses.push(...storageKeyAccessesInSourceFile(sourceFile, lunoraRelativePath(lunoraDirectory, filePath)));
-  }
-  return accesses;
-};
+const discoverStorageKeyAccesses = (project, lunoraDirectory) => discoverArgumentDerivedAccesses(project, lunoraDirectory, {
+  argIndex: 0,
+  matchReceiver: (receiver) => receiver === "ctx.storage" || receiver.startsWith("ctx.storage."),
+  methods: KEY_TAKING_METHODS
+});
 
 const OPTIONS_ARGUMENT_INDEX = /* @__PURE__ */ new Map([
   ["generateUploadUrl", 1],
@@ -3298,7 +3202,8 @@ const runCodegen = (options) => {
     discoverRelationLoads(project, lunoraDirectory),
     discoverRawRowReturns(project, lunoraDirectory),
     discoverNormalizeIdAuthorization(project, lunoraDirectory),
-    options.wranglerVariables
+    options.wranglerVariables,
+    queues
   );
   const rlsMetadata = discoverRlsMetadata(project, lunoraDirectory);
   const maskMetadata = discoverMaskMetadata(project, lunoraDirectory);

package/dist/packem_shared/{formatAdvisories-C9wNBNvL.mjs → formatAdvisories-DLIqHq5l.mjs}

@@ -49,7 +49,7 @@ const toAdvisorSchema = (schema) => {
 const toAdvisorShapes = (shapes) => shapes.map((shape) => {
   return { exportName: shape.exportName, file: `lunora/${shape.filePath}.ts`, table: shape.table };
 });
-const lintSchema = (schema, queries = [], inserts, authApiCalls, rlsProcedures, containers, workflows, workflowCalls, maskProcedures, nondeterministicCalls, procedureProtections, argumentValidators, secretLiterals, sqlInterpolations, adminRoutes, r2sqlCalls, shapes, mutatorWrites, configCalls, argumentDerivedFetches, kvKeyAccesses, ownerFieldWrites, storageKeyAccesses, aiRawRuns, containerKeyAccesses, mailRecipientAccesses, vectorNamespaceAccesses, browserUrlAccesses, privilegedDispatches, containerOverrides, authConfigs, maskStrategies, imageDeliveryUrlAccesses, ratelimitKeySelectors, storageUploads, httpActionGuards, httpHeaderWrites, failOpenGuards, flagSecurityDefaults, aiToolSideEffects, identityClaimReads, paymentWebhooks, softDeleteReads, relationLoads, rawRowReturns, normalizeIdAuthorizations, wranglerVariables) => runAdvisor(
+const lintSchema = (schema, queries = [], inserts, authApiCalls, rlsProcedures, containers, workflows, workflowCalls, maskProcedures, nondeterministicCalls, procedureProtections, argumentValidators, secretLiterals, sqlInterpolations, adminRoutes, r2sqlCalls, shapes, mutatorWrites, configCalls, argumentDerivedFetches, kvKeyAccesses, ownerFieldWrites, storageKeyAccesses, aiRawRuns, containerKeyAccesses, mailRecipientAccesses, vectorNamespaceAccesses, browserUrlAccesses, privilegedDispatches, containerOverrides, authConfigs, maskStrategies, imageDeliveryUrlAccesses, ratelimitKeySelectors, storageUploads, httpActionGuards, httpHeaderWrites, failOpenGuards, flagSecurityDefaults, aiToolSideEffects, identityClaimReads, paymentWebhooks, softDeleteReads, relationLoads, rawRowReturns, normalizeIdAuthorizations, wranglerVariables, queues) => runAdvisor(
   {
     adminRoutes,
     aiRawRuns,
@@ -82,6 +82,7 @@ const lintSchema = (schema, queries = [], inserts, authApiCalls, rlsProcedures,
     privilegedDispatches,
     procedureProtections,
     queries,
+    queues,
     r2sqlCalls,
     ratelimitKeySelectors,
     rawRowReturns,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/codegen",
-  "version": "1.0.0-alpha.32",
+  "version": "1.0.0-alpha.34",
   "description": "Code generator for Lunora: emits _generated/{api,server,dataModel}.ts from your schema",
   "keywords": [
     "cloudflare",
@@ -46,13 +46,13 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/advisor": "1.0.0-alpha.18",
-    "@lunora/container": "1.0.0-alpha.6",
-    "@lunora/errors": "1.0.0-alpha.1",
-    "@lunora/queue": "1.0.0-alpha.4",
-    "@lunora/scheduler": "1.0.0-alpha.5",
-    "@lunora/values": "1.0.0-alpha.4",
-    "@lunora/workflow": "1.0.0-alpha.6",
+    "@lunora/advisor": "1.0.0-alpha.20",
+    "@lunora/container": "1.0.0-alpha.7",
+    "@lunora/errors": "1.0.0-alpha.2",
+    "@lunora/queue": "1.0.0-alpha.5",
+    "@lunora/scheduler": "1.0.0-alpha.6",
+    "@lunora/values": "1.0.0-alpha.5",
+    "@lunora/workflow": "1.0.0-alpha.7",
     "ts-morph": "^28.0.0"
   },
   "engines": {