@lunora/codegen 1.0.0-alpha.39 → 1.0.0-alpha.40

package/dist/index.d.mts

@@ -1598,7 +1598,66 @@ interface ProjectIR {
 * pass straight through without conversion. Returns the findings; surfacing them
 * (console, error overlay, studio Advisors table) is the caller's choice.
 */
-declare const lintSchema: (schema: SchemaIR, queries?: ReadonlyArray<QueryReadIR>, inserts?: ReadonlyArray<InsertWriteIR>, authApiCalls?: ReadonlyArray<AuthApiCallIR>, rlsProcedures?: ReadonlyArray<RlsProcedureIR>, containers?: ReadonlyArray<ContainerIR>, workflows?: ReadonlyArray<WorkflowIR>, workflowCalls?: ReadonlyArray<WorkflowCallIR>, maskProcedures?: ReadonlyArray<MaskProcedureIR>, nondeterministicCalls?: ReadonlyArray<NondeterministicCallIR>, procedureProtections?: ReadonlyArray<ProcedureMiddlewareIR>, argumentValidators?: ReadonlyArray<ArgumentValidatorIR>, secretLiterals?: ReadonlyArray<SecretLiteralIR>, sqlInterpolations?: ReadonlyArray<SqlInterpolationIR>, adminRoutes?: ReadonlyArray<AdminRouteIR>, r2sqlCalls?: ReadonlyArray<R2sqlCallIR>, shapes?: ReadonlyArray<ShapeIR>, mutatorWrites?: ReadonlyArray<MutatorWriteIR>, configCalls?: ReadonlyArray<ConfigCallIR>, argumentDerivedFetches?: ReadonlyArray<ArgumentDerivedFetchIR>, kvKeyAccesses?: ReadonlyArray<KvKeyAccessIR>, ownerFieldWrites?: ReadonlyArray<OwnerFieldWriteIR>, storageKeyAccesses?: ReadonlyArray<StorageKeyAccessIR>, aiRawRuns?: ReadonlyArray<AiRawRunIR>, containerKeyAccesses?: ReadonlyArray<ContainerKeyAccessIR>, mailRecipientAccesses?: ReadonlyArray<MailRecipientAccessIR>, vectorNamespaceAccesses?: ReadonlyArray<VectorNamespaceAccessIR>, browserUrlAccesses?: ReadonlyArray<BrowserUrlAccessIR>, privilegedDispatches?: ReadonlyArray<PrivilegedDispatchIR>, containerOverrides?: ReadonlyArray<ContainerOverrideIR>, authConfigs?: ReadonlyArray<AuthConfigIR>, maskStrategies?: ReadonlyArray<MaskStrategyIR>, imageDeliveryUrlAccesses?: ReadonlyArray<ImageDeliveryUrlAccessIR>, ratelimitKeySelectors?: ReadonlyArray<RatelimitKeySelectorIR>, storageUploads?: ReadonlyArray<StorageUploadIR>, httpActionGuards?: ReadonlyArray<HttpActionGuardIR>, httpHeaderWrites?: ReadonlyArray<HttpHeaderWriteIR>, failOpenGuards?: ReadonlyArray<FailOpenGuardIR>, flagSecurityDefaults?: ReadonlyArray<FlagSecurityDefaultIR>, aiToolSideEffects?: ReadonlyArray<AiToolSideEffectIR>, identityClaimReads?: ReadonlyArray<IdentityClaimReadIR>, paymentWebhooks?: ReadonlyArray<PaymentWebhookIR>, softDeleteReads?: ReadonlyArray<SoftDeleteReadIR>, relationLoads?: ReadonlyArray<RelationLoadIR>, rawRowReturns?: ReadonlyArray<RawRowReturnIR>, normalizeIdAuthorizations?: ReadonlyArray<NormalizeIdAuthorizationIR>, wranglerVariables?: ReadonlyArray<WranglerVariableIR>, queues?: ReadonlyArray<QueueIR>) => Finding[];
+/**
+* Named inputs for {@link lintSchema}. Every feeder is a discrete key rather than
+* a positional argument: the feeder list grows every few releases and many IR
+* types are structurally similar (`{file, exportName, line}`-shaped evidence),
+* so a positional call was a silent-transposition hazard — swapping two adjacent
+* arguments could typecheck yet feed the wrong evidence to the wrong lint and
+* corrupt a security advisory. `schema` is the only required field; every other
+* feeder defaults to "not analyzed" when omitted.
+*/
+interface LintSchemaOptions {
+  adminRoutes?: ReadonlyArray<AdminRouteIR>;
+  aiRawRuns?: ReadonlyArray<AiRawRunIR>;
+  aiToolSideEffects?: ReadonlyArray<AiToolSideEffectIR>;
+  argumentDerivedFetches?: ReadonlyArray<ArgumentDerivedFetchIR>;
+  argumentValidators?: ReadonlyArray<ArgumentValidatorIR>;
+  authApiCalls?: ReadonlyArray<AuthApiCallIR>;
+  authConfigs?: ReadonlyArray<AuthConfigIR>;
+  browserUrlAccesses?: ReadonlyArray<BrowserUrlAccessIR>;
+  configCalls?: ReadonlyArray<ConfigCallIR>;
+  containerKeyAccesses?: ReadonlyArray<ContainerKeyAccessIR>;
+  containerOverrides?: ReadonlyArray<ContainerOverrideIR>;
+  containers?: ReadonlyArray<ContainerIR>;
+  failOpenGuards?: ReadonlyArray<FailOpenGuardIR>;
+  flagSecurityDefaults?: ReadonlyArray<FlagSecurityDefaultIR>;
+  httpActionGuards?: ReadonlyArray<HttpActionGuardIR>;
+  httpHeaderWrites?: ReadonlyArray<HttpHeaderWriteIR>;
+  identityClaimReads?: ReadonlyArray<IdentityClaimReadIR>;
+  imageDeliveryUrlAccesses?: ReadonlyArray<ImageDeliveryUrlAccessIR>;
+  inserts?: ReadonlyArray<InsertWriteIR>;
+  kvKeyAccesses?: ReadonlyArray<KvKeyAccessIR>;
+  mailRecipientAccesses?: ReadonlyArray<MailRecipientAccessIR>;
+  maskProcedures?: ReadonlyArray<MaskProcedureIR>;
+  maskStrategies?: ReadonlyArray<MaskStrategyIR>;
+  mutatorWrites?: ReadonlyArray<MutatorWriteIR>;
+  nondeterministicCalls?: ReadonlyArray<NondeterministicCallIR>;
+  normalizeIdAuthorizations?: ReadonlyArray<NormalizeIdAuthorizationIR>;
+  ownerFieldWrites?: ReadonlyArray<OwnerFieldWriteIR>;
+  paymentWebhooks?: ReadonlyArray<PaymentWebhookIR>;
+  privilegedDispatches?: ReadonlyArray<PrivilegedDispatchIR>;
+  procedureProtections?: ReadonlyArray<ProcedureMiddlewareIR>;
+  queries?: ReadonlyArray<QueryReadIR>;
+  queues?: ReadonlyArray<QueueIR>;
+  r2sqlCalls?: ReadonlyArray<R2sqlCallIR>;
+  ratelimitKeySelectors?: ReadonlyArray<RatelimitKeySelectorIR>;
+  rawRowReturns?: ReadonlyArray<RawRowReturnIR>;
+  relationLoads?: ReadonlyArray<RelationLoadIR>;
+  rlsProcedures?: ReadonlyArray<RlsProcedureIR>;
+  schema: SchemaIR;
+  secretLiterals?: ReadonlyArray<SecretLiteralIR>;
+  shapes?: ReadonlyArray<ShapeIR>;
+  softDeleteReads?: ReadonlyArray<SoftDeleteReadIR>;
+  sqlInterpolations?: ReadonlyArray<SqlInterpolationIR>;
+  storageKeyAccesses?: ReadonlyArray<StorageKeyAccessIR>;
+  storageUploads?: ReadonlyArray<StorageUploadIR>;
+  vectorNamespaceAccesses?: ReadonlyArray<VectorNamespaceAccessIR>;
+  workflowCalls?: ReadonlyArray<WorkflowCallIR>;
+  workflows?: ReadonlyArray<WorkflowIR>;
+  wranglerVariables?: ReadonlyArray<WranglerVariableIR>;
+}
+declare const lintSchema: (options: LintSchemaOptions) => Finding[];
 /**
 * Render advisor findings as a single multi-line string for console surfacing:
 * a one-line summary header followed by one `[LEVEL] name: detail` line per
@@ -2602,4 +2661,4 @@ declare const secretKindOf: (value: string) => string | undefined;
 /** A redacted preview of a secret value — first 4 chars plus its length, never the full value. */
 declare const redact: (value: string) => string;
 declare const VERSION = "0.0.0";
-export { type AuthApiCallIR, CONTAINERS_FILENAME, CodegenDiagnosticError, type CodegenOptions, type CodegenResult, type ContainerIR, type CronJobIR, type DriftChange, type EmitAppOptions, FLAGS_FILENAME, type FieldSnapshot, type FlagsIR, type FunctionIR, GENERATED_HEADER, type HttpRouteIR, type IndexIR, type IndexSnapshot, type InsertWriteIR, LUNORA_ERROR_CODES, MUTATORS_FILENAME, type MaskProcedureIR, type MigrationIR, type MutatorIR, OPENRPC_VERSION, type OpenApiEmitInput, type OpenRpcEmitInput, type ProjectIR, QUEUES_FILENAME, type QueryReadIR, type QueueIR, type R2sqlCallIR, type RelationSnapshot, type RlsMetadataIR, type RlsPolicyIR, type RlsProcedureIR, type RlsRoleIR, SCHEMA_SNAPSHOT_FILENAME, SCHEMA_SNAPSHOT_VERSION, SHAPES_FILENAME, type SchemaDrift, type SchemaDriftDecision, type SchemaIR, type SchemaSnapshot, SchemaSnapshotParseError, type ShapeIR, type StorageRuleIR, type StorageRulesMetadataIR, type TableIR, type TableSnapshot, VERSION, type ValidatorIR, type VectorIndexIR, WORKFLOWS_FILENAME, type WorkflowIR, type WranglerVariableIR, buildOpenApiDocument, buildOpenRpcDocument, buildSchemaSnapshot, createCodegenProject, diagnosticAt, diffSchemaSnapshots, discoverAuthApiCalls, discoverContainers, discoverCrons, discoverFlags, discoverFunctions, discoverHttpRoutes, discoverInserts, discoverMaskProcedures, discoverMigrations, discoverMutators, discoverNondeterministicCalls, discoverQueries, discoverQueues, discoverR2sqlCalls, discoverRlsMetadata, discoverRlsProcedures, discoverSchema, discoverShapes, discoverStorageRulesMetadata, discoverWorkflows, emitApi, emitApp, emitCollections, emitContainers, emitCrons, emitDataModel, emitDrizzleSchema, emitFunctions, emitOpenApi, emitOpenApiModule, emitOpenRpc, emitOpenRpcModule, emitServer, emitShard, emitVectors, emitWorkflows, emitWranglerCronTriggers, evaluateSchemaDrift, formatAdvisories, lintSchema, parseSchemaSnapshot, redact, refreshCodegenProject, runCodegen, schemaFromIr, secretKindOf, serializeSchemaSnapshot, validatorIrToJsonSchema };
+export { type AuthApiCallIR, CONTAINERS_FILENAME, CodegenDiagnosticError, type CodegenOptions, type CodegenResult, type ContainerIR, type CronJobIR, type DriftChange, type EmitAppOptions, FLAGS_FILENAME, type FieldSnapshot, type FlagsIR, type FunctionIR, GENERATED_HEADER, type HttpRouteIR, type IndexIR, type IndexSnapshot, type InsertWriteIR, LUNORA_ERROR_CODES, type LintSchemaOptions, MUTATORS_FILENAME, type MaskProcedureIR, type MigrationIR, type MutatorIR, OPENRPC_VERSION, type OpenApiEmitInput, type OpenRpcEmitInput, type ProjectIR, QUEUES_FILENAME, type QueryReadIR, type QueueIR, type R2sqlCallIR, type RelationSnapshot, type RlsMetadataIR, type RlsPolicyIR, type RlsProcedureIR, type RlsRoleIR, SCHEMA_SNAPSHOT_FILENAME, SCHEMA_SNAPSHOT_VERSION, SHAPES_FILENAME, type SchemaDrift, type SchemaDriftDecision, type SchemaIR, type SchemaSnapshot, SchemaSnapshotParseError, type ShapeIR, type StorageRuleIR, type StorageRulesMetadataIR, type TableIR, type TableSnapshot, VERSION, type ValidatorIR, type VectorIndexIR, WORKFLOWS_FILENAME, type WorkflowIR, type WranglerVariableIR, buildOpenApiDocument, buildOpenRpcDocument, buildSchemaSnapshot, createCodegenProject, diagnosticAt, diffSchemaSnapshots, discoverAuthApiCalls, discoverContainers, discoverCrons, discoverFlags, discoverFunctions, discoverHttpRoutes, discoverInserts, discoverMaskProcedures, discoverMigrations, discoverMutators, discoverNondeterministicCalls, discoverQueries, discoverQueues, discoverR2sqlCalls, discoverRlsMetadata, discoverRlsProcedures, discoverSchema, discoverShapes, discoverStorageRulesMetadata, discoverWorkflows, emitApi, emitApp, emitCollections, emitContainers, emitCrons, emitDataModel, emitDrizzleSchema, emitFunctions, emitOpenApi, emitOpenApiModule, emitOpenRpc, emitOpenRpcModule, emitServer, emitShard, emitVectors, emitWorkflows, emitWranglerCronTriggers, evaluateSchemaDrift, formatAdvisories, lintSchema, parseSchemaSnapshot, redact, refreshCodegenProject, runCodegen, schemaFromIr, secretKindOf, serializeSchemaSnapshot, validatorIrToJsonSchema };

package/dist/index.d.ts

@@ -1598,7 +1598,66 @@ interface ProjectIR {
 * pass straight through without conversion. Returns the findings; surfacing them
 * (console, error overlay, studio Advisors table) is the caller's choice.
 */
-declare const lintSchema: (schema: SchemaIR, queries?: ReadonlyArray<QueryReadIR>, inserts?: ReadonlyArray<InsertWriteIR>, authApiCalls?: ReadonlyArray<AuthApiCallIR>, rlsProcedures?: ReadonlyArray<RlsProcedureIR>, containers?: ReadonlyArray<ContainerIR>, workflows?: ReadonlyArray<WorkflowIR>, workflowCalls?: ReadonlyArray<WorkflowCallIR>, maskProcedures?: ReadonlyArray<MaskProcedureIR>, nondeterministicCalls?: ReadonlyArray<NondeterministicCallIR>, procedureProtections?: ReadonlyArray<ProcedureMiddlewareIR>, argumentValidators?: ReadonlyArray<ArgumentValidatorIR>, secretLiterals?: ReadonlyArray<SecretLiteralIR>, sqlInterpolations?: ReadonlyArray<SqlInterpolationIR>, adminRoutes?: ReadonlyArray<AdminRouteIR>, r2sqlCalls?: ReadonlyArray<R2sqlCallIR>, shapes?: ReadonlyArray<ShapeIR>, mutatorWrites?: ReadonlyArray<MutatorWriteIR>, configCalls?: ReadonlyArray<ConfigCallIR>, argumentDerivedFetches?: ReadonlyArray<ArgumentDerivedFetchIR>, kvKeyAccesses?: ReadonlyArray<KvKeyAccessIR>, ownerFieldWrites?: ReadonlyArray<OwnerFieldWriteIR>, storageKeyAccesses?: ReadonlyArray<StorageKeyAccessIR>, aiRawRuns?: ReadonlyArray<AiRawRunIR>, containerKeyAccesses?: ReadonlyArray<ContainerKeyAccessIR>, mailRecipientAccesses?: ReadonlyArray<MailRecipientAccessIR>, vectorNamespaceAccesses?: ReadonlyArray<VectorNamespaceAccessIR>, browserUrlAccesses?: ReadonlyArray<BrowserUrlAccessIR>, privilegedDispatches?: ReadonlyArray<PrivilegedDispatchIR>, containerOverrides?: ReadonlyArray<ContainerOverrideIR>, authConfigs?: ReadonlyArray<AuthConfigIR>, maskStrategies?: ReadonlyArray<MaskStrategyIR>, imageDeliveryUrlAccesses?: ReadonlyArray<ImageDeliveryUrlAccessIR>, ratelimitKeySelectors?: ReadonlyArray<RatelimitKeySelectorIR>, storageUploads?: ReadonlyArray<StorageUploadIR>, httpActionGuards?: ReadonlyArray<HttpActionGuardIR>, httpHeaderWrites?: ReadonlyArray<HttpHeaderWriteIR>, failOpenGuards?: ReadonlyArray<FailOpenGuardIR>, flagSecurityDefaults?: ReadonlyArray<FlagSecurityDefaultIR>, aiToolSideEffects?: ReadonlyArray<AiToolSideEffectIR>, identityClaimReads?: ReadonlyArray<IdentityClaimReadIR>, paymentWebhooks?: ReadonlyArray<PaymentWebhookIR>, softDeleteReads?: ReadonlyArray<SoftDeleteReadIR>, relationLoads?: ReadonlyArray<RelationLoadIR>, rawRowReturns?: ReadonlyArray<RawRowReturnIR>, normalizeIdAuthorizations?: ReadonlyArray<NormalizeIdAuthorizationIR>, wranglerVariables?: ReadonlyArray<WranglerVariableIR>, queues?: ReadonlyArray<QueueIR>) => Finding[];
+/**
+* Named inputs for {@link lintSchema}. Every feeder is a discrete key rather than
+* a positional argument: the feeder list grows every few releases and many IR
+* types are structurally similar (`{file, exportName, line}`-shaped evidence),
+* so a positional call was a silent-transposition hazard — swapping two adjacent
+* arguments could typecheck yet feed the wrong evidence to the wrong lint and
+* corrupt a security advisory. `schema` is the only required field; every other
+* feeder defaults to "not analyzed" when omitted.
+*/
+interface LintSchemaOptions {
+  adminRoutes?: ReadonlyArray<AdminRouteIR>;
+  aiRawRuns?: ReadonlyArray<AiRawRunIR>;
+  aiToolSideEffects?: ReadonlyArray<AiToolSideEffectIR>;
+  argumentDerivedFetches?: ReadonlyArray<ArgumentDerivedFetchIR>;
+  argumentValidators?: ReadonlyArray<ArgumentValidatorIR>;
+  authApiCalls?: ReadonlyArray<AuthApiCallIR>;
+  authConfigs?: ReadonlyArray<AuthConfigIR>;
+  browserUrlAccesses?: ReadonlyArray<BrowserUrlAccessIR>;
+  configCalls?: ReadonlyArray<ConfigCallIR>;
+  containerKeyAccesses?: ReadonlyArray<ContainerKeyAccessIR>;
+  containerOverrides?: ReadonlyArray<ContainerOverrideIR>;
+  containers?: ReadonlyArray<ContainerIR>;
+  failOpenGuards?: ReadonlyArray<FailOpenGuardIR>;
+  flagSecurityDefaults?: ReadonlyArray<FlagSecurityDefaultIR>;
+  httpActionGuards?: ReadonlyArray<HttpActionGuardIR>;
+  httpHeaderWrites?: ReadonlyArray<HttpHeaderWriteIR>;
+  identityClaimReads?: ReadonlyArray<IdentityClaimReadIR>;
+  imageDeliveryUrlAccesses?: ReadonlyArray<ImageDeliveryUrlAccessIR>;
+  inserts?: ReadonlyArray<InsertWriteIR>;
+  kvKeyAccesses?: ReadonlyArray<KvKeyAccessIR>;
+  mailRecipientAccesses?: ReadonlyArray<MailRecipientAccessIR>;
+  maskProcedures?: ReadonlyArray<MaskProcedureIR>;
+  maskStrategies?: ReadonlyArray<MaskStrategyIR>;
+  mutatorWrites?: ReadonlyArray<MutatorWriteIR>;
+  nondeterministicCalls?: ReadonlyArray<NondeterministicCallIR>;
+  normalizeIdAuthorizations?: ReadonlyArray<NormalizeIdAuthorizationIR>;
+  ownerFieldWrites?: ReadonlyArray<OwnerFieldWriteIR>;
+  paymentWebhooks?: ReadonlyArray<PaymentWebhookIR>;
+  privilegedDispatches?: ReadonlyArray<PrivilegedDispatchIR>;
+  procedureProtections?: ReadonlyArray<ProcedureMiddlewareIR>;
+  queries?: ReadonlyArray<QueryReadIR>;
+  queues?: ReadonlyArray<QueueIR>;
+  r2sqlCalls?: ReadonlyArray<R2sqlCallIR>;
+  ratelimitKeySelectors?: ReadonlyArray<RatelimitKeySelectorIR>;
+  rawRowReturns?: ReadonlyArray<RawRowReturnIR>;
+  relationLoads?: ReadonlyArray<RelationLoadIR>;
+  rlsProcedures?: ReadonlyArray<RlsProcedureIR>;
+  schema: SchemaIR;
+  secretLiterals?: ReadonlyArray<SecretLiteralIR>;
+  shapes?: ReadonlyArray<ShapeIR>;
+  softDeleteReads?: ReadonlyArray<SoftDeleteReadIR>;
+  sqlInterpolations?: ReadonlyArray<SqlInterpolationIR>;
+  storageKeyAccesses?: ReadonlyArray<StorageKeyAccessIR>;
+  storageUploads?: ReadonlyArray<StorageUploadIR>;
+  vectorNamespaceAccesses?: ReadonlyArray<VectorNamespaceAccessIR>;
+  workflowCalls?: ReadonlyArray<WorkflowCallIR>;
+  workflows?: ReadonlyArray<WorkflowIR>;
+  wranglerVariables?: ReadonlyArray<WranglerVariableIR>;
+}
+declare const lintSchema: (options: LintSchemaOptions) => Finding[];
 /**
 * Render advisor findings as a single multi-line string for console surfacing:
 * a one-line summary header followed by one `[LEVEL] name: detail` line per
@@ -2602,4 +2661,4 @@ declare const secretKindOf: (value: string) => string | undefined;
 /** A redacted preview of a secret value — first 4 chars plus its length, never the full value. */
 declare const redact: (value: string) => string;
 declare const VERSION = "0.0.0";
-export { type AuthApiCallIR, CONTAINERS_FILENAME, CodegenDiagnosticError, type CodegenOptions, type CodegenResult, type ContainerIR, type CronJobIR, type DriftChange, type EmitAppOptions, FLAGS_FILENAME, type FieldSnapshot, type FlagsIR, type FunctionIR, GENERATED_HEADER, type HttpRouteIR, type IndexIR, type IndexSnapshot, type InsertWriteIR, LUNORA_ERROR_CODES, MUTATORS_FILENAME, type MaskProcedureIR, type MigrationIR, type MutatorIR, OPENRPC_VERSION, type OpenApiEmitInput, type OpenRpcEmitInput, type ProjectIR, QUEUES_FILENAME, type QueryReadIR, type QueueIR, type R2sqlCallIR, type RelationSnapshot, type RlsMetadataIR, type RlsPolicyIR, type RlsProcedureIR, type RlsRoleIR, SCHEMA_SNAPSHOT_FILENAME, SCHEMA_SNAPSHOT_VERSION, SHAPES_FILENAME, type SchemaDrift, type SchemaDriftDecision, type SchemaIR, type SchemaSnapshot, SchemaSnapshotParseError, type ShapeIR, type StorageRuleIR, type StorageRulesMetadataIR, type TableIR, type TableSnapshot, VERSION, type ValidatorIR, type VectorIndexIR, WORKFLOWS_FILENAME, type WorkflowIR, type WranglerVariableIR, buildOpenApiDocument, buildOpenRpcDocument, buildSchemaSnapshot, createCodegenProject, diagnosticAt, diffSchemaSnapshots, discoverAuthApiCalls, discoverContainers, discoverCrons, discoverFlags, discoverFunctions, discoverHttpRoutes, discoverInserts, discoverMaskProcedures, discoverMigrations, discoverMutators, discoverNondeterministicCalls, discoverQueries, discoverQueues, discoverR2sqlCalls, discoverRlsMetadata, discoverRlsProcedures, discoverSchema, discoverShapes, discoverStorageRulesMetadata, discoverWorkflows, emitApi, emitApp, emitCollections, emitContainers, emitCrons, emitDataModel, emitDrizzleSchema, emitFunctions, emitOpenApi, emitOpenApiModule, emitOpenRpc, emitOpenRpcModule, emitServer, emitShard, emitVectors, emitWorkflows, emitWranglerCronTriggers, evaluateSchemaDrift, formatAdvisories, lintSchema, parseSchemaSnapshot, redact, refreshCodegenProject, runCodegen, schemaFromIr, secretKindOf, serializeSchemaSnapshot, validatorIrToJsonSchema };
+export { type AuthApiCallIR, CONTAINERS_FILENAME, CodegenDiagnosticError, type CodegenOptions, type CodegenResult, type ContainerIR, type CronJobIR, type DriftChange, type EmitAppOptions, FLAGS_FILENAME, type FieldSnapshot, type FlagsIR, type FunctionIR, GENERATED_HEADER, type HttpRouteIR, type IndexIR, type IndexSnapshot, type InsertWriteIR, LUNORA_ERROR_CODES, type LintSchemaOptions, MUTATORS_FILENAME, type MaskProcedureIR, type MigrationIR, type MutatorIR, OPENRPC_VERSION, type OpenApiEmitInput, type OpenRpcEmitInput, type ProjectIR, QUEUES_FILENAME, type QueryReadIR, type QueueIR, type R2sqlCallIR, type RelationSnapshot, type RlsMetadataIR, type RlsPolicyIR, type RlsProcedureIR, type RlsRoleIR, SCHEMA_SNAPSHOT_FILENAME, SCHEMA_SNAPSHOT_VERSION, SHAPES_FILENAME, type SchemaDrift, type SchemaDriftDecision, type SchemaIR, type SchemaSnapshot, SchemaSnapshotParseError, type ShapeIR, type StorageRuleIR, type StorageRulesMetadataIR, type TableIR, type TableSnapshot, VERSION, type ValidatorIR, type VectorIndexIR, WORKFLOWS_FILENAME, type WorkflowIR, type WranglerVariableIR, buildOpenApiDocument, buildOpenRpcDocument, buildSchemaSnapshot, createCodegenProject, diagnosticAt, diffSchemaSnapshots, discoverAuthApiCalls, discoverContainers, discoverCrons, discoverFlags, discoverFunctions, discoverHttpRoutes, discoverInserts, discoverMaskProcedures, discoverMigrations, discoverMutators, discoverNondeterministicCalls, discoverQueries, discoverQueues, discoverR2sqlCalls, discoverRlsMetadata, discoverRlsProcedures, discoverSchema, discoverShapes, discoverStorageRulesMetadata, discoverWorkflows, emitApi, emitApp, emitCollections, emitContainers, emitCrons, emitDataModel, emitDrizzleSchema, emitFunctions, emitOpenApi, emitOpenApiModule, emitOpenRpc, emitOpenRpcModule, emitServer, emitShard, emitVectors, emitWorkflows, emitWranglerCronTriggers, evaluateSchemaDrift, formatAdvisories, lintSchema, parseSchemaSnapshot, redact, refreshCodegenProject, runCodegen, schemaFromIr, secretKindOf, serializeSchemaSnapshot, validatorIrToJsonSchema };

package/dist/index.mjs

@@ -1,32 +1,32 @@
-export { formatAdvisories, lintSchema } from './packem_shared/formatAdvisories-DLIqHq5l.mjs';
+export { formatAdvisories, lintSchema } from './packem_shared/formatAdvisories-DRhEiJUz.mjs';
 export { CodegenDiagnosticError, diagnosticAt } from './packem_shared/CodegenDiagnosticError-DyQ5FwkM.mjs';
-export { default as discoverAuthApiCalls } from './packem_shared/discoverAuthApiCalls-URDoTADN.mjs';
+export { default as discoverAuthApiCalls } from './packem_shared/discoverAuthApiCalls-WMx8L2FG.mjs';
 export { CONTAINERS_FILENAME, discoverContainers } from './packem_shared/CONTAINERS_FILENAME-DjpXMqhp.mjs';
-export { default as discoverCrons } from './packem_shared/discoverCrons-BNL5hAPv.mjs';
-export { FLAGS_FILENAME, discoverFlags } from './packem_shared/FLAGS_FILENAME-BjpS5w08.mjs';
-export { discoverFunctions } from './packem_shared/discoverFunctions-BJdF7lRs.mjs';
-export { default as discoverHttpRoutes } from './packem_shared/discoverHttpRoutes-CcwP-Rkr.mjs';
-export { default as discoverInserts } from './packem_shared/discoverInserts-BpFhM32L.mjs';
-export { default as discoverMaskProcedures } from './packem_shared/discoverMaskProcedures-DT-v8wvj.mjs';
-export { default as discoverMigrations } from './packem_shared/discoverMigrations-cG1idBVM.mjs';
+export { default as discoverCrons } from './packem_shared/discoverCrons-D-jrpm97.mjs';
+export { FLAGS_FILENAME, discoverFlags } from './packem_shared/FLAGS_FILENAME-fEZtzWXi.mjs';
+export { discoverFunctions } from './packem_shared/discoverFunctions-CZ91aenA.mjs';
+export { default as discoverHttpRoutes } from './packem_shared/discoverHttpRoutes-DNZLDCmm.mjs';
+export { default as discoverInserts } from './packem_shared/discoverInserts-DFRJhmCv.mjs';
+export { default as discoverMaskProcedures } from './packem_shared/discoverMaskProcedures-B5iFnZ-X.mjs';
+export { default as discoverMigrations } from './packem_shared/discoverMigrations-CdKtMlBc.mjs';
 export { MUTATORS_FILENAME, discoverMutators } from './packem_shared/MUTATORS_FILENAME-BZOfUhlY.mjs';
-export { default as discoverNondeterministicCalls } from './packem_shared/discoverNondeterministicCalls-CEOjmfk4.mjs';
-export { default as discoverQueries } from './packem_shared/discoverQueries-DeVBQVAG.mjs';
-export { QUEUES_FILENAME, discoverQueues } from './packem_shared/QUEUES_FILENAME-BF0iUmx7.mjs';
-export { default as discoverR2sqlCalls } from './packem_shared/discoverR2sqlCalls-CWCAU-xJ.mjs';
-export { discoverRlsMetadata, default as discoverRlsProcedures } from './packem_shared/discoverRlsMetadata-BL0oukaK.mjs';
-export { default as discoverSchema } from './packem_shared/discoverSchema-CeXJWVKV.mjs';
+export { default as discoverNondeterministicCalls } from './packem_shared/discoverNondeterministicCalls-C_PrQPkA.mjs';
+export { default as discoverQueries } from './packem_shared/discoverQueries-B8W9UPrt.mjs';
+export { QUEUES_FILENAME, discoverQueues } from './packem_shared/QUEUES_FILENAME-Xv6Vy-Ku.mjs';
+export { default as discoverR2sqlCalls } from './packem_shared/discoverR2sqlCalls-Bm7Rfnf4.mjs';
+export { discoverRlsMetadata, default as discoverRlsProcedures } from './packem_shared/discoverRlsMetadata-B4GL4ZKm.mjs';
+export { default as discoverSchema } from './packem_shared/discoverSchema-DFWVgU5o.mjs';
 export { SHAPES_FILENAME, discoverShapes } from './packem_shared/SHAPES_FILENAME-DOhPGi-6.mjs';
-export { default as discoverStorageRulesMetadata } from './packem_shared/discoverStorageRulesMetadata-CFHByjIl.mjs';
-export { WORKFLOWS_FILENAME, discoverWorkflows } from './packem_shared/WORKFLOWS_FILENAME-CCC_42o3.mjs';
-export { G as GENERATED_HEADER, e as emitApi, a as emitCollections, b as emitContainers, c as emitCrons, d as emitDataModel, f as emitDrizzleSchema, g as emitFunctions, h as emitServer, i as emitShard, j as emitVectors, k as emitWorkflows, l as emitWranglerCronTriggers } from './packem_shared/emit-G43y_pKR.mjs';
-export { emitApp } from './packem_shared/emitApp-BgyRbMJU.mjs';
-export { buildOpenApiDocument, emitOpenApi, emitOpenApiModule } from './packem_shared/buildOpenApiDocument-Bfq9qaTd.mjs';
-export { OPENRPC_VERSION, buildOpenRpcDocument, emitOpenRpc, emitOpenRpcModule } from './packem_shared/OPENRPC_VERSION-Ca1zCt-A.mjs';
-export { SCHEMA_SNAPSHOT_FILENAME, createCodegenProject, refreshCodegenProject, runCodegen } from './packem_shared/SCHEMA_SNAPSHOT_FILENAME-CTuUa9Ox.mjs';
+export { default as discoverStorageRulesMetadata } from './packem_shared/discoverStorageRulesMetadata-nosjYcvN.mjs';
+export { WORKFLOWS_FILENAME, discoverWorkflows } from './packem_shared/WORKFLOWS_FILENAME-B2By8S4s.mjs';
+export { G as GENERATED_HEADER, e as emitApi, a as emitCollections, b as emitContainers, c as emitCrons, d as emitDataModel, f as emitDrizzleSchema, g as emitFunctions, h as emitServer, i as emitShard, j as emitVectors, k as emitWorkflows, l as emitWranglerCronTriggers } from './packem_shared/emit-CFz-9dcD.mjs';
+export { emitApp } from './packem_shared/emitApp-D8rVuM__.mjs';
+export { buildOpenApiDocument, emitOpenApi, emitOpenApiModule } from './packem_shared/buildOpenApiDocument-_mwWOc2N.mjs';
+export { OPENRPC_VERSION, buildOpenRpcDocument, emitOpenRpc, emitOpenRpcModule } from './packem_shared/OPENRPC_VERSION-DxbqafcJ.mjs';
+export { SCHEMA_SNAPSHOT_FILENAME, createCodegenProject, refreshCodegenProject, runCodegen } from './packem_shared/SCHEMA_SNAPSHOT_FILENAME-C1yHg38Z.mjs';
 export { SCHEMA_SNAPSHOT_VERSION, SchemaSnapshotParseError, buildSchemaSnapshot, diffSchemaSnapshots, evaluateSchemaDrift, parseSchemaSnapshot, serializeSchemaSnapshot } from './packem_shared/SCHEMA_SNAPSHOT_VERSION-D0ARY6rL.mjs';
 export { schemaFromIr } from './packem_shared/schemaFromIr-DTYsLBaA.mjs';
-export { LUNORA_ERROR_CODES, validatorIrToJsonSchema } from './packem_shared/LUNORA_ERROR_CODES-CySpQPD3.mjs';
+export { LUNORA_ERROR_CODES, validatorIrToJsonSchema } from './packem_shared/LUNORA_ERROR_CODES-DvTLozCu.mjs';
 export { redact, secretKindOf } from './packem_shared/redact-oTmsol5A.mjs';
 export { MESSAGE_SOLUTIONS as LUNORA_SOLUTION_RULES, findSolutionByMessage as findLunoraSolution } from '@lunora/errors';
 

package/dist/packem_shared/{FLAGS_FILENAME-BjpS5w08.mjs → FLAGS_FILENAME-fEZtzWXi.mjs}

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { SyntaxKind, Node } from 'ts-morph';
-import { listLunoraSourceFiles } from './discoverFunctions-BJdF7lRs.mjs';
+import { listLunoraSourceFiles } from './discoverFunctions-CZ91aenA.mjs';
 
 const FLAGS_FILENAME = "flags.ts";
 const FLAG_TYPES = /* @__PURE__ */ new Set(["boolean", "number", "object", "string"]);

package/dist/packem_shared/{GENERATED_HEADER-x-bzN9wy.mjs → GENERATED_HEADER-cUyu5VOU.mjs}

@@ -1,3 +1,3 @@
 import '@lunora/errors';
-export { G as GENERATED_HEADER, m as buildStorageColumns, e as emitApi, a as emitCollections, b as emitContainers, c as emitCrons, d as emitDataModel, f as emitDrizzleSchema, g as emitFunctions, n as emitQueues, o as emitSeed, h as emitServer, i as emitShard, j as emitVectors, k as emitWorkflows, l as emitWranglerCronTriggers } from './emit-G43y_pKR.mjs';
+export { G as GENERATED_HEADER, m as buildStorageColumns, e as emitApi, a as emitCollections, b as emitContainers, c as emitCrons, d as emitDataModel, f as emitDrizzleSchema, g as emitFunctions, n as emitQueues, o as emitSeed, h as emitServer, i as emitShard, j as emitVectors, k as emitWorkflows, l as emitWranglerCronTriggers } from './emit-CFz-9dcD.mjs';
 import './paths-BRd6JHuF.mjs';

package/dist/packem_shared/{LUNORA_ERROR_CODES-CySpQPD3.mjs → LUNORA_ERROR_CODES-DvTLozCu.mjs}

@@ -14,7 +14,14 @@ const literalConst = (literalValue) => {
   if (trimmed === "null") {
     return { const: null, type: "null" };
   }
-  if (trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'")) {
+  if (trimmed.startsWith('"') && trimmed.endsWith('"')) {
+    try {
+      return { const: JSON.parse(trimmed), type: "string" };
+    } catch {
+      return { const: trimmed.slice(1, -1), type: "string" };
+    }
+  }
+  if (trimmed.startsWith("'") && trimmed.endsWith("'")) {
     return { const: trimmed.slice(1, -1), type: "string" };
   }
   const asNumber = Number(trimmed);

package/dist/packem_shared/{OPENRPC_VERSION-Ca1zCt-A.mjs → OPENRPC_VERSION-DxbqafcJ.mjs}

@@ -1,6 +1,6 @@
-import { G as GENERATED_HEADER } from './emit-G43y_pKR.mjs';
+import { G as GENERATED_HEADER } from './emit-CFz-9dcD.mjs';
 import { s as sanitizeNamespace } from './paths-BRd6JHuF.mjs';
-import { argsObjectSchema, LUNORA_ERROR_CODES } from './LUNORA_ERROR_CODES-CySpQPD3.mjs';
+import { argsObjectSchema, LUNORA_ERROR_CODES } from './LUNORA_ERROR_CODES-DvTLozCu.mjs';
 
 const OPENRPC_VERSION = "1.3.2";
 const inferredResultSchema = () => {

package/dist/packem_shared/{QUEUES_FILENAME-BF0iUmx7.mjs → QUEUES_FILENAME-Xv6Vy-Ku.mjs}

@@ -1,5 +1,6 @@
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
+import { LunoraError } from '@lunora/errors';
 import { queueDefaultName, queueBindingName } from '@lunora/queue';
 import { SyntaxKind, Node } from 'ts-morph';
 import { diagnosticAt } from './CodegenDiagnosticError-DyQ5FwkM.mjs';
@@ -105,6 +106,30 @@ const queuesFromSource = (source) => {
   }
   return queues;
 };
+const assertUniqueNames = (queues) => {
+  const seenNames = /* @__PURE__ */ new Map();
+  const seenBindings = /* @__PURE__ */ new Map();
+  for (const queue of queues) {
+    const priorName = seenNames.get(queue.name);
+    if (priorName !== void 0) {
+      throw new LunoraError(
+        "DUPLICATE_QUEUE_NAME",
+        `Duplicate queue name "${queue.name}": produced by both "${priorName}" and "${queue.exportName}". Deployed queue names must be unique across the project.`,
+        { status: 500 }
+      );
+    }
+    seenNames.set(queue.name, queue.exportName);
+    const priorBinding = seenBindings.get(queue.bindingName);
+    if (priorBinding !== void 0) {
+      throw new LunoraError(
+        "DUPLICATE_QUEUE_BINDING",
+        `Duplicate queue binding "${queue.bindingName}": produced by both "${priorBinding}" and "${queue.exportName}". Queue export names must yield unique binding names.`,
+        { status: 500 }
+      );
+    }
+    seenBindings.set(queue.bindingName, queue.exportName);
+  }
+};
 const discoverQueues = (project, lunoraDirectory) => {
   const queuesPath = join(lunoraDirectory, QUEUES_FILENAME);
   if (!existsSync(queuesPath)) {
@@ -113,6 +138,7 @@ const discoverQueues = (project, lunoraDirectory) => {
   const source = project.getSourceFile(queuesPath) ?? project.addSourceFileAtPath(queuesPath);
   const queues = queuesFromSource(source);
   queues.sort((a, b) => a.exportName.localeCompare(b.exportName));
+  assertUniqueNames(queues);
   return queues;
 };
 

package/dist/packem_shared/{SCHEMA_SNAPSHOT_FILENAME-CTuUa9Ox.mjs → SCHEMA_SNAPSHOT_FILENAME-C1yHg38Z.mjs}

@@ -3,33 +3,33 @@ import { join, dirname } from 'node:path';
 import { performance } from 'node:perf_hooks';
 import { LunoraError } from '@lunora/errors';
 import { Node, SyntaxKind, Project } from 'ts-morph';
-import { lintSchema } from './formatAdvisories-DLIqHq5l.mjs';
-import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall, inlineHandler as inlineHandler$1, procedureHandler, chainUsesWrappedCall, isDatabaseAccessor, chainHasStep, discoverFunctions } from './discoverFunctions-BJdF7lRs.mjs';
-import discoverAuthApiCalls from './discoverAuthApiCalls-URDoTADN.mjs';
+import { lintSchema } from './formatAdvisories-DRhEiJUz.mjs';
+import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall, inlineHandler as inlineHandler$1, procedureHandler, chainUsesWrappedCall, isDatabaseAccessor, chainHasStep, discoverFunctions } from './discoverFunctions-CZ91aenA.mjs';
+import discoverAuthApiCalls from './discoverAuthApiCalls-WMx8L2FG.mjs';
 import { discoverContainers } from './CONTAINERS_FILENAME-DjpXMqhp.mjs';
-import discoverCrons from './discoverCrons-BNL5hAPv.mjs';
+import discoverCrons from './discoverCrons-D-jrpm97.mjs';
 import { diagnosticAt } from './CodegenDiagnosticError-DyQ5FwkM.mjs';
-import { C as CAPABILITIES, m as buildStorageColumns, d as emitDataModel, e as emitApi, h as emitServer, g as emitFunctions, i as emitShard, a as emitCollections, b as emitContainers, k as emitWorkflows, n as emitQueues, c as emitCrons, j as emitVectors, f as emitDrizzleSchema, o as emitSeed, l as emitWranglerCronTriggers } from './emit-G43y_pKR.mjs';
-import { discoverFlagKeys } from './FLAGS_FILENAME-BjpS5w08.mjs';
-import discoverHttpRoutes from './discoverHttpRoutes-CcwP-Rkr.mjs';
-import discoverInserts from './discoverInserts-BpFhM32L.mjs';
-import discoverMaskProcedures, { discoverMaskStrategies, discoverMaskMetadata } from './discoverMaskProcedures-DT-v8wvj.mjs';
-import discoverMigrations from './discoverMigrations-cG1idBVM.mjs';
+import { C as CAPABILITIES, m as buildStorageColumns, d as emitDataModel, e as emitApi, h as emitServer, g as emitFunctions, i as emitShard, a as emitCollections, b as emitContainers, k as emitWorkflows, n as emitQueues, c as emitCrons, j as emitVectors, f as emitDrizzleSchema, o as emitSeed, l as emitWranglerCronTriggers } from './emit-CFz-9dcD.mjs';
+import { discoverFlagKeys } from './FLAGS_FILENAME-fEZtzWXi.mjs';
+import discoverHttpRoutes from './discoverHttpRoutes-DNZLDCmm.mjs';
+import discoverInserts from './discoverInserts-DFRJhmCv.mjs';
+import discoverMaskProcedures, { discoverMaskStrategies, discoverMaskMetadata } from './discoverMaskProcedures-B5iFnZ-X.mjs';
+import discoverMigrations from './discoverMigrations-CdKtMlBc.mjs';
 import { MUTATORS_FILENAME, isDefineMutatorCallee, discoverMutators } from './MUTATORS_FILENAME-BZOfUhlY.mjs';
-import discoverNondeterministicCalls from './discoverNondeterministicCalls-CEOjmfk4.mjs';
-import discoverQueries from './discoverQueries-DeVBQVAG.mjs';
-import { discoverQueues } from './QUEUES_FILENAME-BF0iUmx7.mjs';
-import discoverR2sqlCalls from './discoverR2sqlCalls-CWCAU-xJ.mjs';
-import discoverRlsProcedures, { discoverRlsMetadata } from './discoverRlsMetadata-BL0oukaK.mjs';
-import discoverSchema from './discoverSchema-CeXJWVKV.mjs';
+import discoverNondeterministicCalls from './discoverNondeterministicCalls-C_PrQPkA.mjs';
+import discoverQueries from './discoverQueries-B8W9UPrt.mjs';
+import { discoverQueues } from './QUEUES_FILENAME-Xv6Vy-Ku.mjs';
+import discoverR2sqlCalls from './discoverR2sqlCalls-Bm7Rfnf4.mjs';
+import discoverRlsProcedures, { discoverRlsMetadata } from './discoverRlsMetadata-B4GL4ZKm.mjs';
+import discoverSchema from './discoverSchema-DFWVgU5o.mjs';
 import { secretKindOf, redact } from './redact-oTmsol5A.mjs';
 import { discoverShapes } from './SHAPES_FILENAME-DOhPGi-6.mjs';
-import discoverStorageRulesMetadata from './discoverStorageRulesMetadata-CFHByjIl.mjs';
+import discoverStorageRulesMetadata from './discoverStorageRulesMetadata-nosjYcvN.mjs';
 import { e as enclosingExportName$2 } from './discover-ast-CT6BgBr4.mjs';
-import { discoverWorkflows } from './WORKFLOWS_FILENAME-CCC_42o3.mjs';
-import { emitApp } from './emitApp-BgyRbMJU.mjs';
-import { buildOpenApiDocument, emitOpenApiModule } from './buildOpenApiDocument-Bfq9qaTd.mjs';
-import { buildOpenRpcDocument, emitOpenRpcModule } from './OPENRPC_VERSION-Ca1zCt-A.mjs';
+import { discoverWorkflows } from './WORKFLOWS_FILENAME-B2By8S4s.mjs';
+import { emitApp } from './emitApp-D8rVuM__.mjs';
+import { buildOpenApiDocument, emitOpenApiModule } from './buildOpenApiDocument-_mwWOc2N.mjs';
+import { buildOpenRpcDocument, emitOpenRpcModule } from './OPENRPC_VERSION-DxbqafcJ.mjs';
 import { buildSchemaSnapshot, serializeSchemaSnapshot } from './SCHEMA_SNAPSHOT_VERSION-D0ARY6rL.mjs';
 
 const HTTP_VERBS$1 = /* @__PURE__ */ new Set(["delete", "get", "head", "options", "patch", "post", "put"]);
@@ -2709,9 +2709,14 @@ const literalValueOf = (node) => {
   }
   return void 0;
 };
-const isConcatenationOperand = (node) => {
-  const parent = node.getParent();
-  return parent !== void 0 && Node.isBinaryExpression(parent) && parent.getOperatorToken().getKind() === SyntaxKind.PlusToken;
+const isFoldedConcatenationOperand = (node) => {
+  let root = node;
+  let parent = root.getParent();
+  while (parent !== void 0 && Node.isBinaryExpression(parent) && parent.getOperatorToken().getKind() === SyntaxKind.PlusToken) {
+    root = parent;
+    parent = root.getParent();
+  }
+  return root !== node && literalValueOf(root) !== void 0;
 };
 const secretsInSourceFile = (sourceFile, relativePath) => {
   const found = [];
@@ -2722,8 +2727,9 @@ const secretsInSourceFile = (sourceFile, relativePath) => {
     ...sourceFile.getDescendantsOfKind(SyntaxKind.StringLiteral),
     ...sourceFile.getDescendantsOfKind(SyntaxKind.NoSubstitutionTemplateLiteral)
   ];
+  const seen = /* @__PURE__ */ new Set();
   for (const node of nodes) {
-    if (isConcatenationOperand(node)) {
+    if (isFoldedConcatenationOperand(node)) {
       continue;
     }
     const value = literalValueOf(node);
@@ -2731,9 +2737,16 @@ const secretsInSourceFile = (sourceFile, relativePath) => {
       continue;
     }
     const kind = secretKindOf(value);
-    if (kind !== void 0) {
-      found.push({ file: relativePath, kind, line: node.getStartLineNumber(), preview: redact(value) });
+    if (kind === void 0) {
+      continue;
     }
+    const line = node.getStartLineNumber();
+    const dedupeKey = `${String(line)}:${kind}`;
+    if (seen.has(dedupeKey)) {
+      continue;
+    }
+    seen.add(dedupeKey);
+    found.push({ file: relativePath, kind, line, preview: redact(value) });
   }
   return found;
 };
@@ -3155,56 +3168,56 @@ const runCodegen = (options) => {
   const queues = discoverQueues(project, lunoraDirectory);
   const crons = discoverCrons(project, lunoraDirectory, workflows);
   const containers = discoverContainers(project, lunoraDirectory);
-  const advisories = options.lint === false ? [] : lintSchema(
-    schema,
-    discoverQueries(project, lunoraDirectory),
-    discoverInserts(project, lunoraDirectory),
-    discoverAuthApiCalls(project, lunoraDirectory),
-    discoverRlsProcedures(project, lunoraDirectory),
+  const advisories = options.lint === false ? [] : lintSchema({
+    adminRoutes: discoverAdminRoutes(project, lunoraDirectory),
+    aiRawRuns: discoverAiRawRuns(project, lunoraDirectory),
+    aiToolSideEffects: discoverAiToolSideEffects(project, lunoraDirectory),
+    argumentDerivedFetches: discoverArgumentDerivedFetches(project, lunoraDirectory),
+    argumentValidators: discoverArgumentValidators(project, lunoraDirectory),
+    authApiCalls: discoverAuthApiCalls(project, lunoraDirectory),
+    authConfigs: discoverAuthConfig(project, lunoraDirectory),
+    browserUrlAccesses: discoverBrowserUrlAccesses(project, lunoraDirectory),
+    configCalls: discoverConfigCalls(project, lunoraDirectory),
+    containerKeyAccesses: discoverContainerKeyAccesses(project, lunoraDirectory),
+    containerOverrides: discoverContainerOverrides(project, lunoraDirectory),
     containers,
-    workflows,
-    discoverWorkflowCalls(project, lunoraDirectory),
-    discoverMaskProcedures(project, lunoraDirectory),
-    discoverNondeterministicCalls(project, lunoraDirectory),
-    discoverProcedureMiddleware(project, lunoraDirectory),
-    discoverArgumentValidators(project, lunoraDirectory),
-    discoverSecrets(project, lunoraDirectory),
-    discoverSqlInterpolation(project, lunoraDirectory),
-    discoverAdminRoutes(project, lunoraDirectory),
-    discoverR2sqlCalls(project, lunoraDirectory),
+    failOpenGuards: discoverFailOpenGuards(project, lunoraDirectory),
+    flagSecurityDefaults: discoverFlagSecurityDefaults(project, lunoraDirectory),
+    httpActionGuards: discoverHttpActionGuards(project, lunoraDirectory),
+    httpHeaderWrites: discoverHttpHeaderWrites(project, lunoraDirectory),
+    identityClaimReads: discoverIdentityClaimReads(project, lunoraDirectory),
+    imageDeliveryUrlAccesses: discoverImageDeliveryUrlAccesses(project, lunoraDirectory),
+    inserts: discoverInserts(project, lunoraDirectory),
+    kvKeyAccesses: discoverKvKeyAccesses(project, lunoraDirectory),
+    mailRecipientAccesses: discoverMailRecipientAccesses(project, lunoraDirectory),
+    maskProcedures: discoverMaskProcedures(project, lunoraDirectory),
+    maskStrategies: discoverMaskStrategies(project, lunoraDirectory),
+    mutatorWrites: discoverMutatorWrites(project, lunoraDirectory),
+    nondeterministicCalls: discoverNondeterministicCalls(project, lunoraDirectory),
+    normalizeIdAuthorizations: discoverNormalizeIdAuthorization(project, lunoraDirectory),
+    ownerFieldWrites: discoverOwnerFieldWrites(project, lunoraDirectory),
+    paymentWebhooks: discoverPaymentWebhooks(project, lunoraDirectory),
+    privilegedDispatches: discoverPrivilegedDispatches(project, lunoraDirectory),
+    procedureProtections: discoverProcedureMiddleware(project, lunoraDirectory),
+    queries: discoverQueries(project, lunoraDirectory),
+    queues,
+    r2sqlCalls: discoverR2sqlCalls(project, lunoraDirectory),
+    ratelimitKeySelectors: discoverRatelimitKeySelectors(project, lunoraDirectory),
+    rawRowReturns: discoverRawRowReturns(project, lunoraDirectory),
+    relationLoads: discoverRelationLoads(project, lunoraDirectory),
+    rlsProcedures: discoverRlsProcedures(project, lunoraDirectory),
+    schema,
+    secretLiterals: discoverSecrets(project, lunoraDirectory),
     shapes,
-    discoverMutatorWrites(project, lunoraDirectory),
-    discoverConfigCalls(project, lunoraDirectory),
-    discoverArgumentDerivedFetches(project, lunoraDirectory),
-    discoverKvKeyAccesses(project, lunoraDirectory),
-    discoverOwnerFieldWrites(project, lunoraDirectory),
-    discoverStorageKeyAccesses(project, lunoraDirectory),
-    discoverAiRawRuns(project, lunoraDirectory),
-    discoverContainerKeyAccesses(project, lunoraDirectory),
-    discoverMailRecipientAccesses(project, lunoraDirectory),
-    discoverVectorNamespaceAccesses(project, lunoraDirectory),
-    discoverBrowserUrlAccesses(project, lunoraDirectory),
-    discoverPrivilegedDispatches(project, lunoraDirectory),
-    discoverContainerOverrides(project, lunoraDirectory),
-    discoverAuthConfig(project, lunoraDirectory),
-    discoverMaskStrategies(project, lunoraDirectory),
-    discoverImageDeliveryUrlAccesses(project, lunoraDirectory),
-    discoverRatelimitKeySelectors(project, lunoraDirectory),
-    discoverStorageUploads(project, lunoraDirectory),
-    discoverHttpActionGuards(project, lunoraDirectory),
-    discoverHttpHeaderWrites(project, lunoraDirectory),
-    discoverFailOpenGuards(project, lunoraDirectory),
-    discoverFlagSecurityDefaults(project, lunoraDirectory),
-    discoverAiToolSideEffects(project, lunoraDirectory),
-    discoverIdentityClaimReads(project, lunoraDirectory),
-    discoverPaymentWebhooks(project, lunoraDirectory),
-    discoverSoftDeleteReads(project, lunoraDirectory),
-    discoverRelationLoads(project, lunoraDirectory),
-    discoverRawRowReturns(project, lunoraDirectory),
-    discoverNormalizeIdAuthorization(project, lunoraDirectory),
-    options.wranglerVariables,
-    queues
-  );
+    softDeleteReads: discoverSoftDeleteReads(project, lunoraDirectory),
+    sqlInterpolations: discoverSqlInterpolation(project, lunoraDirectory),
+    storageKeyAccesses: discoverStorageKeyAccesses(project, lunoraDirectory),
+    storageUploads: discoverStorageUploads(project, lunoraDirectory),
+    vectorNamespaceAccesses: discoverVectorNamespaceAccesses(project, lunoraDirectory),
+    workflowCalls: discoverWorkflowCalls(project, lunoraDirectory),
+    workflows,
+    wranglerVariables: options.wranglerVariables
+  });
   const rlsMetadata = discoverRlsMetadata(project, lunoraDirectory);
   const maskMetadata = discoverMaskMetadata(project, lunoraDirectory);
   const storageRulesMetadata = discoverStorageRulesMetadata(project, lunoraDirectory);
@@ -3374,14 +3387,10 @@ const runCodegen = (options) => {
     writeIfPresent(join(outputDirectory, "queues.ts"), queuesContent);
     writeIfPresent(join(outputDirectory, "seed.ts"), seedContent);
     writeIfPresent(join(outputDirectory, "collections.ts"), collectionsContent);
-    if (wantsOpenApi) {
-      writeIfChanged(join(outputDirectory, "openapi.json"), openApiContent);
-      writeIfChanged(join(outputDirectory, "openapi.ts"), openApiModuleContent);
-    }
-    if (wantsOpenRpc) {
-      writeIfChanged(join(outputDirectory, "openrpc.json"), openRpcContent);
-      writeIfChanged(join(outputDirectory, "openrpc.ts"), openRpcModuleContent);
-    }
+    writeIfPresent(join(outputDirectory, "openapi.json"), wantsOpenApi ? openApiContent : "");
+    writeIfPresent(join(outputDirectory, "openapi.ts"), wantsOpenApi ? openApiModuleContent : "");
+    writeIfPresent(join(outputDirectory, "openrpc.json"), wantsOpenRpc ? openRpcContent : "");
+    writeIfPresent(join(outputDirectory, "openrpc.ts"), wantsOpenRpc ? openRpcModuleContent : "");
     if (!schemaSnapshotExists || options.updateSchemaBaseline === true) {
       writeIfChanged(schemaSnapshotPath, serializeSchemaSnapshot(schemaSnapshot));
     }

package/dist/packem_shared/{WORKFLOWS_FILENAME-CCC_42o3.mjs → WORKFLOWS_FILENAME-B2By8S4s.mjs}

@@ -1,5 +1,6 @@
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
+import { LunoraError } from '@lunora/errors';
 import { workflowDefaultName, workflowClassName, workflowBindingName } from '@lunora/workflow';
 import { SyntaxKind, Node } from 'ts-morph';
 import { diagnosticAt } from './CodegenDiagnosticError-DyQ5FwkM.mjs';
@@ -110,6 +111,32 @@ const workflowsFromSource = (source) => {
   }
   return workflows;
 };
+const assertUniqueNames = (workflows) => {
+  const seenNames = /* @__PURE__ */ new Map();
+  const seenBindings = /* @__PURE__ */ new Map();
+  for (const workflow of workflows) {
+    const priorName = seenNames.get(workflow.name);
+    if (priorName !== void 0) {
+      throw new LunoraError(
+        // eslint-disable-next-line no-secrets/no-secrets -- an error code, not a secret
+        "DUPLICATE_WORKFLOW_NAME",
+        `Duplicate workflow name "${workflow.name}": produced by both "${priorName}" and "${workflow.exportName}". Deployed workflow names must be unique across the project.`,
+        { status: 500 }
+      );
+    }
+    seenNames.set(workflow.name, workflow.exportName);
+    const priorBinding = seenBindings.get(workflow.bindingName);
+    if (priorBinding !== void 0) {
+      throw new LunoraError(
+        // eslint-disable-next-line no-secrets/no-secrets -- an error code, not a secret
+        "DUPLICATE_WORKFLOW_BINDING",
+        `Duplicate workflow binding "${workflow.bindingName}": produced by both "${priorBinding}" and "${workflow.exportName}". Workflow export names must yield unique binding names.`,
+        { status: 500 }
+      );
+    }
+    seenBindings.set(workflow.bindingName, workflow.exportName);
+  }
+};
 const discoverWorkflows = (project, lunoraDirectory) => {
   const workflowsPath = join(lunoraDirectory, WORKFLOWS_FILENAME);
   if (!existsSync(workflowsPath)) {
@@ -118,6 +145,7 @@ const discoverWorkflows = (project, lunoraDirectory) => {
   const source = project.getSourceFile(workflowsPath) ?? project.addSourceFileAtPath(workflowsPath);
   const workflows = workflowsFromSource(source);
   workflows.sort((a, b) => a.exportName.localeCompare(b.exportName));
+  assertUniqueNames(workflows);
   return workflows;
 };
 

package/dist/packem_shared/{buildOpenApiDocument-Bfq9qaTd.mjs → buildOpenApiDocument-_mwWOc2N.mjs}

@@ -1,6 +1,6 @@
-import { G as GENERATED_HEADER } from './emit-G43y_pKR.mjs';
+import { G as GENERATED_HEADER } from './emit-CFz-9dcD.mjs';
 import { s as sanitizeNamespace } from './paths-BRd6JHuF.mjs';
-import { LUNORA_ERROR_CODES, objectSchema, argsObjectSchema, validatorIrToJsonSchema } from './LUNORA_ERROR_CODES-CySpQPD3.mjs';
+import { LUNORA_ERROR_CODES, objectSchema, argsObjectSchema, validatorIrToJsonSchema } from './LUNORA_ERROR_CODES-DvTLozCu.mjs';
 
 const ERROR_COMPONENT_REF = "#/components/responses/LunoraError";
 const ROUTE_PARAM_RE = /:([A-Za-z_$][\w$]*)/gu;

package/dist/packem_shared/{discoverAuthApiCalls-URDoTADN.mjs → discoverAuthApiCalls-WMx8L2FG.mjs}

@@ -1,7 +1,7 @@
 import { relative, sep } from 'node:path';
 import { SyntaxKind, Node } from 'ts-morph';
 import { T as TS_EXTENSION_RE, e as enclosingExportName } from './discover-ast-CT6BgBr4.mjs';
-import { listLunoraSourceFiles } from './discoverFunctions-BJdF7lRs.mjs';
+import { listLunoraSourceFiles } from './discoverFunctions-CZ91aenA.mjs';
 
 const isAuthApiCall = (call) => {
   const callee = call.getExpression();

package/dist/packem_shared/{discoverCrons-BNL5hAPv.mjs → discoverCrons-D-jrpm97.mjs}

@@ -2,7 +2,7 @@ import { LunoraError } from '@lunora/errors';
 import { isValidCronExpression, compileCronSchedule, CRON_SCHEDULE_KINDS } from '@lunora/scheduler';
 import { SyntaxKind, Node } from 'ts-morph';
 import { diagnosticAt } from './CodegenDiagnosticError-DyQ5FwkM.mjs';
-import { listLunoraSourceFiles } from './discoverFunctions-BJdF7lRs.mjs';
+import { listLunoraSourceFiles } from './discoverFunctions-CZ91aenA.mjs';
 import { s as sanitizeNamespace } from './paths-BRd6JHuF.mjs';
 
 const CRON_METHODS = /* @__PURE__ */ new Set([...CRON_SCHEDULE_KINDS, "cron"]);

package/dist/packem_shared/{discoverFunctions-BJdF7lRs.mjs → discoverFunctions-CZ91aenA.mjs}

@@ -1,11 +1,12 @@
 import { readdirSync, lstatSync } from 'node:fs';
 import { join, extname, relative, sep } from 'node:path';
 import { Node, SyntaxKind } from 'ts-morph';
-import { a as parseObjectShape } from './parse-validator-D6zI2i85.mjs';
+import { a as parseObjectShape } from './parse-validator-BSJo1HGP.mjs';
 import { s as sanitizeNamespace } from './paths-BRd6JHuF.mjs';
 
 const FUNCTION_KINDS = /* @__PURE__ */ new Set(["action", "mutation", "query", "stream"]);
-const ANY_TOKEN_RE = /\bany\b/u;
+const ANY_TOKEN_RE = /\bany\b(?!\s*(?:\?\s*)?:)/u;
+const STRING_LITERAL_SPAN_RE = /"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|`(?:[^`\\]|\\.)*`/gu;
 const IDENTIFIER_RE = /^[A-Za-z_$][\w$]*$/u;
 const renderExpandedPropertyKey = (propertyName) => IDENTIFIER_RE.test(propertyName) ? propertyName : JSON.stringify(propertyName);
 const TS_EXTENSION_RE = /\.ts$/u;
@@ -221,7 +222,7 @@ const unwrapHandlerReturn = (handler) => {
   if (!rendered || rendered === "any" || rendered === "never") {
     return "unknown";
   }
-  if (ANY_TOKEN_RE.test(rendered)) {
+  if (ANY_TOKEN_RE.test(rendered.replaceAll(STRING_LITERAL_SPAN_RE, ""))) {
     return "unknown";
   }
   const handlerFilePath = handler.getSourceFile().getFilePath();
@@ -356,7 +357,7 @@ const chainUsesWrappedCall = (receiver, method, wrappedCallee) => {
   }
   return false;
 };
-const listLunoraSourceFiles = (directory, accumulator = []) => {
+const listLunoraSourceFiles = (directory, accumulator = [], root = directory) => {
   let entries;
   try {
     entries = readdirSync(directory);
@@ -370,8 +371,11 @@ const listLunoraSourceFiles = (directory, accumulator = []) => {
       if (entry === "_generated" || entry === "node_modules") {
         continue;
       }
-      listLunoraSourceFiles(full, accumulator);
-    } else if (info.isFile() && extname(entry) === ".ts" && entry !== "schema.ts") {
+      listLunoraSourceFiles(full, accumulator, root);
+    } else if (info.isFile() && extname(entry) === ".ts") {
+      if (entry === "schema.ts" && directory === root) {
+        continue;
+      }
       accumulator.push(full);
     }
   }

package/dist/packem_shared/{discoverHttpRoutes-CcwP-Rkr.mjs → discoverHttpRoutes-DNZLDCmm.mjs}

@@ -1,7 +1,7 @@
 import { relative, sep } from 'node:path';
 import { Node } from 'ts-morph';
-import { listLunoraSourceFiles } from './discoverFunctions-BJdF7lRs.mjs';
-import { p as parseValidator, a as parseObjectShape } from './parse-validator-D6zI2i85.mjs';
+import { listLunoraSourceFiles } from './discoverFunctions-CZ91aenA.mjs';
+import { p as parseValidator, a as parseObjectShape } from './parse-validator-BSJo1HGP.mjs';
 
 const TS_EXTENSION_RE = /\.ts$/u;
 const HTTP_VERBS = /* @__PURE__ */ new Set(["delete", "get", "head", "options", "patch", "post", "put"]);

package/dist/packem_shared/{discoverInserts-BpFhM32L.mjs → discoverInserts-DFRJhmCv.mjs}

@@ -1,6 +1,6 @@
 import { SyntaxKind, Node } from 'ts-morph';
 import { e as enclosingExportName } from './discover-ast-CT6BgBr4.mjs';
-import { listLunoraSourceFiles, lunoraRelativePath } from './discoverFunctions-BJdF7lRs.mjs';
+import { listLunoraSourceFiles, lunoraRelativePath } from './discoverFunctions-CZ91aenA.mjs';
 
 const isDatabaseInsertCall = (call) => {
   const callee = call.getExpression();

package/dist/packem_shared/{discoverMaskProcedures-DT-v8wvj.mjs → discoverMaskProcedures-B5iFnZ-X.mjs}

@@ -1,5 +1,5 @@
 import { Node, SyntaxKind } from 'ts-morph';
-import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall } from './discoverFunctions-BJdF7lRs.mjs';
+import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall } from './discoverFunctions-CZ91aenA.mjs';
 
 const isMaskCall = (node) => {
   if (!Node.isCallExpression(node)) {

package/dist/packem_shared/{discoverMigrations-cG1idBVM.mjs → discoverMigrations-CdKtMlBc.mjs}

@@ -1,7 +1,7 @@
 import { relative, sep } from 'node:path';
 import { SyntaxKind, Node } from 'ts-morph';
 import { diagnosticAt } from './CodegenDiagnosticError-DyQ5FwkM.mjs';
-import { listLunoraSourceFiles } from './discoverFunctions-BJdF7lRs.mjs';
+import { listLunoraSourceFiles } from './discoverFunctions-CZ91aenA.mjs';
 
 const TS_EXTENSION_RE = /\.ts$/u;
 const isDefineMigration = (identifier) => {

package/dist/packem_shared/{discoverNondeterministicCalls-CEOjmfk4.mjs → discoverNondeterministicCalls-C_PrQPkA.mjs}

@@ -1,5 +1,5 @@
 import { Node, SyntaxKind } from 'ts-morph';
-import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall } from './discoverFunctions-BJdF7lRs.mjs';
+import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall } from './discoverFunctions-CZ91aenA.mjs';
 
 const PROPERTY_CALLS = {
   "crypto.getRandomValues": "crypto.getRandomValues",

package/dist/packem_shared/{discoverQueries-DeVBQVAG.mjs → discoverQueries-B8W9UPrt.mjs}

@@ -1,5 +1,5 @@
 import { SyntaxKind, Node } from 'ts-morph';
-import { listLunoraSourceFiles, lunoraRelativePath } from './discoverFunctions-BJdF7lRs.mjs';
+import { listLunoraSourceFiles, lunoraRelativePath } from './discoverFunctions-CZ91aenA.mjs';
 
 const INDEX_METHODS = /* @__PURE__ */ new Set(["withIndex", "withSearchIndex"]);
 const isDatabaseQueryCall = (call) => {

package/dist/packem_shared/{discoverR2sqlCalls-CWCAU-xJ.mjs → discoverR2sqlCalls-Bm7Rfnf4.mjs}

@@ -1,5 +1,5 @@
 import { Node, SyntaxKind } from 'ts-morph';
-import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall } from './discoverFunctions-BJdF7lRs.mjs';
+import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall } from './discoverFunctions-CZ91aenA.mjs';
 
 const handlerOf = (call, receiver) => {
   if (receiver) {

package/dist/packem_shared/{discoverRlsMetadata-BL0oukaK.mjs → discoverRlsMetadata-B4GL4ZKm.mjs}

@@ -1,5 +1,5 @@
 import { Node, SyntaxKind } from 'ts-morph';
-import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall } from './discoverFunctions-BJdF7lRs.mjs';
+import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall } from './discoverFunctions-CZ91aenA.mjs';
 
 const isRlsCall = (node) => {
   if (!Node.isCallExpression(node)) {

package/dist/packem_shared/{discoverSchema-CeXJWVKV.mjs → discoverSchema-DFWVgU5o.mjs}

@@ -1,7 +1,7 @@
 import { LunoraError } from '@lunora/errors';
 import { Node, SyntaxKind } from 'ts-morph';
 import { diagnosticAt } from './CodegenDiagnosticError-DyQ5FwkM.mjs';
-import { a as parseObjectShape } from './parse-validator-D6zI2i85.mjs';
+import { a as parseObjectShape } from './parse-validator-BSJo1HGP.mjs';
 import { createRequire } from 'node:module';
 import { join } from 'node:path';
 

package/dist/packem_shared/{discoverStorageRulesMetadata-CFHByjIl.mjs → discoverStorageRulesMetadata-nosjYcvN.mjs}

@@ -1,5 +1,5 @@
 import { Node } from 'ts-morph';
-import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall } from './discoverFunctions-BJdF7lRs.mjs';
+import { listLunoraSourceFiles, lunoraRelativePath, classifyProcedureCall } from './discoverFunctions-CZ91aenA.mjs';
 
 const STORAGE_OPERATIONS = /* @__PURE__ */ new Set(["delete", "list", "read", "write"]);
 const isStorageRulesCall = (node) => {

package/dist/packem_shared/{emit-G43y_pKR.mjs → emit-CFz-9dcD.mjs}

@@ -179,7 +179,7 @@ const APP_METHOD_CAPABILITIES = CAPABILITY_ROWS.flatMap(
   (capability) => "appMethod" in capability ? [{ appMethod: capability.appMethod, key: capability.key }] : []
 );
 
-const LITERAL_VALUE_RE = /^(?:"[^"\\]*"|'[^'\\]*'|-?\d+(?:\.\d+)?|true|false|null)$/u;
+const LITERAL_VALUE_RE = /^(?:"(?:[^"\\]|\\(?:["\\/bfnrt]|u[0-9A-Fa-f]{4}))*"|'[^'\\]*'|-?\d+(?:\.\d+)?|true|false|null)$/u;
 
 const PASS_THROUGH_KINDS = /* @__PURE__ */ new Set(["any", "bigint", "boolean", "date", "id", "null", "number", "storage", "string", "timestamp"]);
 const hasColumnModifier = (node) => node.column !== void 0;

package/dist/packem_shared/{emitApp-BgyRbMJU.mjs → emitApp-D8rVuM__.mjs}

@@ -1,4 +1,4 @@
-import { A as APP_METHOD_CAPABILITIES, G as GENERATED_HEADER } from './emit-G43y_pKR.mjs';
+import { A as APP_METHOD_CAPABILITIES, G as GENERATED_HEADER } from './emit-CFz-9dcD.mjs';
 
 const hasFlagKey = (key) => `has${key.charAt(0).toUpperCase()}${key.slice(1)}`;
 const LONG_TAIL = APP_METHOD_CAPABILITIES.map(

package/dist/packem_shared/{formatAdvisories-DLIqHq5l.mjs → formatAdvisories-DRhEiJUz.mjs}

@@ -49,56 +49,56 @@ const toAdvisorSchema = (schema) => {
 const toAdvisorShapes = (shapes) => shapes.map((shape) => {
   return { exportName: shape.exportName, file: `lunora/${shape.filePath}.ts`, table: shape.table };
 });
-const lintSchema = (schema, queries = [], inserts, authApiCalls, rlsProcedures, containers, workflows, workflowCalls, maskProcedures, nondeterministicCalls, procedureProtections, argumentValidators, secretLiterals, sqlInterpolations, adminRoutes, r2sqlCalls, shapes, mutatorWrites, configCalls, argumentDerivedFetches, kvKeyAccesses, ownerFieldWrites, storageKeyAccesses, aiRawRuns, containerKeyAccesses, mailRecipientAccesses, vectorNamespaceAccesses, browserUrlAccesses, privilegedDispatches, containerOverrides, authConfigs, maskStrategies, imageDeliveryUrlAccesses, ratelimitKeySelectors, storageUploads, httpActionGuards, httpHeaderWrites, failOpenGuards, flagSecurityDefaults, aiToolSideEffects, identityClaimReads, paymentWebhooks, softDeleteReads, relationLoads, rawRowReturns, normalizeIdAuthorizations, wranglerVariables, queues) => runAdvisor(
+const lintSchema = (options) => runAdvisor(
   {
-    adminRoutes,
-    aiRawRuns,
-    aiToolSideEffects,
-    argumentDerivedFetches,
-    argValidators: argumentValidators,
-    authApiCalls,
-    authConfigs,
-    browserUrlAccesses,
-    configCalls,
-    containerKeyAccesses,
-    containerOverrides,
-    containers,
-    failOpenGuards,
-    flagSecurityDefaults,
-    httpActionGuards,
-    httpHeaderWrites,
-    identityClaimReads,
-    imageDeliveryUrlAccesses,
-    inserts,
-    kvKeyAccesses,
-    mailRecipientAccesses,
-    maskProcedures,
-    maskStrategies,
-    mutatorWrites,
-    nondeterministicCalls,
-    normalizeIdAuthorizations,
-    ownerFieldWrites,
-    paymentWebhooks,
-    privilegedDispatches,
-    procedureProtections,
-    queries,
-    queues,
-    r2sqlCalls,
-    ratelimitKeySelectors,
-    rawRowReturns,
-    relationLoads,
-    rlsProcedures,
-    schema: toAdvisorSchema(schema),
-    secretLiterals,
-    shapes: shapes === void 0 ? void 0 : toAdvisorShapes(shapes),
-    softDeleteReads,
-    sqlInterpolations,
-    storageKeyAccesses,
-    storageUploads,
-    vectorNamespaceAccesses,
-    workflowCalls,
-    workflows,
-    wranglerVariables
+    adminRoutes: options.adminRoutes,
+    aiRawRuns: options.aiRawRuns,
+    aiToolSideEffects: options.aiToolSideEffects,
+    argumentDerivedFetches: options.argumentDerivedFetches,
+    argValidators: options.argumentValidators,
+    authApiCalls: options.authApiCalls,
+    authConfigs: options.authConfigs,
+    browserUrlAccesses: options.browserUrlAccesses,
+    configCalls: options.configCalls,
+    containerKeyAccesses: options.containerKeyAccesses,
+    containerOverrides: options.containerOverrides,
+    containers: options.containers,
+    failOpenGuards: options.failOpenGuards,
+    flagSecurityDefaults: options.flagSecurityDefaults,
+    httpActionGuards: options.httpActionGuards,
+    httpHeaderWrites: options.httpHeaderWrites,
+    identityClaimReads: options.identityClaimReads,
+    imageDeliveryUrlAccesses: options.imageDeliveryUrlAccesses,
+    inserts: options.inserts,
+    kvKeyAccesses: options.kvKeyAccesses,
+    mailRecipientAccesses: options.mailRecipientAccesses,
+    maskProcedures: options.maskProcedures,
+    maskStrategies: options.maskStrategies,
+    mutatorWrites: options.mutatorWrites,
+    nondeterministicCalls: options.nondeterministicCalls,
+    normalizeIdAuthorizations: options.normalizeIdAuthorizations,
+    ownerFieldWrites: options.ownerFieldWrites,
+    paymentWebhooks: options.paymentWebhooks,
+    privilegedDispatches: options.privilegedDispatches,
+    procedureProtections: options.procedureProtections,
+    queries: options.queries ?? [],
+    queues: options.queues,
+    r2sqlCalls: options.r2sqlCalls,
+    ratelimitKeySelectors: options.ratelimitKeySelectors,
+    rawRowReturns: options.rawRowReturns,
+    relationLoads: options.relationLoads,
+    rlsProcedures: options.rlsProcedures,
+    schema: toAdvisorSchema(options.schema),
+    secretLiterals: options.secretLiterals,
+    shapes: options.shapes === void 0 ? void 0 : toAdvisorShapes(options.shapes),
+    softDeleteReads: options.softDeleteReads,
+    sqlInterpolations: options.sqlInterpolations,
+    storageKeyAccesses: options.storageKeyAccesses,
+    storageUploads: options.storageUploads,
+    vectorNamespaceAccesses: options.vectorNamespaceAccesses,
+    workflowCalls: options.workflowCalls,
+    workflows: options.workflows,
+    wranglerVariables: options.wranglerVariables
   },
   { source: "static" }
 );

package/dist/packem_shared/{parse-validator-D6zI2i85.mjs → parse-validator-BSJo1HGP.mjs}

@@ -61,6 +61,15 @@ const parseObjectShape = (object) => {
   return out;
 };
 const parseArgument = (argument, fallback) => argument && Node.isExpression(argument) ? parseValidator(argument) : fallback;
+const renderLiteralSource = (node) => {
+  if (node === void 0) {
+    return "undefined";
+  }
+  if (Node.isStringLiteral(node) || Node.isNoSubstitutionTemplateLiteral(node)) {
+    return JSON.stringify(node.getLiteralValue());
+  }
+  return node.getText();
+};
 const parseBuilderMember = (member, args) => {
   if (SCALAR_KINDS.has(member)) {
     return { kind: member };
@@ -79,9 +88,10 @@ const parseBuilderMember = (member, args) => {
     case "literal": {
       return {
         kind: "literal",
-        // Captures the source text — for string/number/boolean/null literals
-        // this matches the TS type representation directly.
-        literalValue: first ? first.getText() : "undefined"
+        // Canonical source text — strings/templates are re-encoded via
+        // JSON.stringify (see renderLiteralSource) so escapes/backticks
+        // survive; numbers/booleans/null keep their verbatim text.
+        literalValue: renderLiteralSource(first)
       };
     }
     case "object": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/codegen",
-  "version": "1.0.0-alpha.39",
+  "version": "1.0.0-alpha.40",
   "description": "Code generator for Lunora: emits _generated/{api,server,dataModel}.ts from your schema",
   "keywords": [
     "cloudflare",
@@ -46,13 +46,13 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/advisor": "1.0.0-alpha.25",
-    "@lunora/container": "1.0.0-alpha.8",
-    "@lunora/errors": "1.0.0-alpha.3",
-    "@lunora/queue": "1.0.0-alpha.6",
-    "@lunora/scheduler": "1.0.0-alpha.7",
-    "@lunora/values": "1.0.0-alpha.6",
-    "@lunora/workflow": "1.0.0-alpha.8",
+    "@lunora/advisor": "1.0.0-alpha.26",
+    "@lunora/container": "1.0.0-alpha.9",
+    "@lunora/errors": "1.0.0-alpha.4",
+    "@lunora/queue": "1.0.0-alpha.7",
+    "@lunora/scheduler": "1.0.0-alpha.8",
+    "@lunora/values": "1.0.0-alpha.7",
+    "@lunora/workflow": "1.0.0-alpha.9",
     "ts-morph": "^28.0.0"
   },
   "engines": {