@lunora/codegen 1.0.0-alpha.5 → 1.0.0-alpha.50

package/dist/packem_shared/{emitApp-Ci_hcJNO.mjs → emitApp-CzzrjVqH.mjs}

@@ -1,29 +1,35 @@
-import { GENERATED_HEADER } from './GENERATED_HEADER-DF1hQcix.mjs';
-
-const LONG_TAIL = [
-  ["hasAi", "ai", "ai", "Override the Workers AI binding backing `ctx.ai` (defaults to `env.AI`)."],
-  ["hasAnalytics", "analytics", "analytics", "Override the Analytics Engine dataset backing `ctx.analytics` (defaults to `env.ANALYTICS`)."],
-  ["hasBrowser", "browser", "browser", "Override the Browser Rendering binding backing `ctx.browser` (defaults to `env.BROWSER`)."],
-  [
-    "hasHyperdrive",
-    "hyperdrive",
-    "sql",
-    "Wire the Hyperdrive SQL client backing `ctx.sql` — build it with `createHyperdrive` + `fromPostgresJs`/`fromNodePg`/`fromMysql2`."
-  ],
-  ["hasImages", "images", "images", "Override the Images binding backing `ctx.images` (defaults to `env.IMAGES`)."],
-  ["hasKv", "kv", "kv", "Override the Workers KV binding backing `ctx.kv` (defaults to `env.KV`)."],
-  ["hasPayments", "payment", "payment", "Wire the payment options backing `ctx.payments`."],
-  [
-    "hasR2sql",
-    "r2sql",
-    "r2sql",
-    "Wire the R2 SQL client backing `ctx.r2sql` — build it with `createR2Sql({ accountId, apiToken, bucket })` (defaults to env `R2_SQL_TOKEN` / `R2_SQL_ACCOUNT_ID` / `R2_SQL_BUCKET`)."
-  ],
-  ["hasVectors", "vectors", "vectors", "Wire the Vectorize index map backing `ctx.vectors`."]
-];
+import { A as APP_METHOD_CAPABILITIES, G as GENERATED_HEADER } from './emit-ClTbCLy4.mjs';
+
+const hasFlagKey = (key) => `has${key.charAt(0).toUpperCase()}${key.slice(1)}`;
+const LONG_TAIL = APP_METHOD_CAPABILITIES.map(
+  ({ appMethod, key }) => [hasFlagKey(key), appMethod.method, appMethod.configKey, appMethod.doc]
+);
 const hasAnyLongTail = (options) => LONG_TAIL.some(([flag]) => options[flag]);
+const buildIdentityImports = (identity) => identity ? [`import * as lunoraIdentityContract from "../identity.js";`] : [];
+const buildAccessImports = (hasAccess, hasAuth) => hasAccess ? [
+  `import type { CreateAccessResolverOptions } from "@lunora/cloudflare-access";`,
+  `import { createAccessResolver${hasAuth ? ", composeResolvers" : ""} } from "@lunora/cloudflare-access";`
+] : [];
+const buildKvImports = (hasKv) => hasKv ? [`import { createKvIntrospectorFromEnv } from "@lunora/bindings/kv";`] : [];
+const hasEmailAgents = (options) => (options.emailAgents?.length ?? 0) > 0;
+const buildInboundImports = (options) => hasEmailAgents(options) ? [`import { dispatchAgentEmail } from "@lunora/agent/inbound";`] : [];
+const buildAgentDefinitionsImport = (options) => hasEmailAgents(options) ? [`import * as lunoraAgentDefinitions from "../agents.js";`] : [];
 const buildImportLines = (options) => {
-  const { hasAuth, hasFramework, hasGlobal, hasHyperdriveGlobal, hasScheduler, hasStorage, hasWorkflow, useUmbrella, wantsOpenApi, wantsOpenRpc } = options;
+  const {
+    hasAccess,
+    hasAuth,
+    hasFramework,
+    hasGlobal,
+    hasHyperdriveGlobal,
+    hasKv,
+    hasQueue,
+    hasScheduler,
+    hasStorage,
+    hasWorkflow,
+    useUmbrella,
+    wantsOpenApi,
+    wantsOpenRpc
+  } = options;
   const runtimeModule = useUmbrella ? "lunorash/runtime" : "@lunora/runtime";
   const runtimeTypeImports = ["ExecutionContextLike", "LunoraWorker", "Route", "ScheduledControllerLike", "ShardNamespaceLike", "WorkerOptions"];
   if (hasGlobal) {
@@ -35,6 +41,7 @@ const buildImportLines = (options) => {
   const runtimeValueImports = [
     ...hasGlobal || hasHyperdriveGlobal ? ["createCrossShardRelationCapabilities"] : [],
     "createWorker",
+    "resolveLogArchiveFromEnv",
     ...hasFramework ? ["withFrameworkWorker"] : []
   ].join(", ");
   return [
@@ -42,6 +49,7 @@ const buildImportLines = (options) => {
       `import type { LunoraAuth, LunoraAuthOptions } from "@lunora/auth";`,
       `import { createAuth, createAuthAdmin, ensureMigrated, handleAuthRequest, lunoraD1Adapter } from "@lunora/auth";`
     ] : [],
+    ...buildAccessImports(hasAccess, hasAuth),
     ...hasGlobal ? [
       `import type { D1CtxDbOptions, D1DatabaseLike, D1Exec } from "@lunora/d1";`,
       `import { createD1CtxDb, facetGlobalColumn, listGlobalTables, readGlobalTablePage } from "@lunora/d1";`
@@ -51,15 +59,23 @@ const buildImportLines = (options) => {
       `import { createHyperdriveGlobalCtxDb } from "@lunora/hyperdrive/global";`,
       `import type { SqlCtxDbOptions, SqlExec } from "@lunora/sql-store";`
     ] : [],
+    ...buildKvImports(hasKv),
     ...hasScheduler ? [`import type { DurableObjectNamespaceLike } from "@lunora/scheduler";`, `import { createScheduler } from "@lunora/scheduler";`] : [],
     ...hasStorage ? [`import type { R2BucketLike, Storage } from "@lunora/storage";`, `import { createBucketStorage, createStorage } from "@lunora/storage";`] : [],
     ...hasWorkflow ? [`import { createWorkflowsRestClient } from "@lunora/workflow";`] : [],
+    ...buildInboundImports(options),
     `import type { ${[...runtimeTypeImports].toSorted((a, b) => a.localeCompare(b)).join(", ")} } from "${runtimeModule}";`,
     `import { ${runtimeValueImports} } from "${runtimeModule}";`,
     ``,
+    ...buildIdentityImports(options.identity),
+    ...buildAgentDefinitionsImport(options),
     ...hasGlobal || hasHyperdriveGlobal ? [`import schema from "../schema.js";`] : [],
     `import { LUNORA_CRONS } from "./crons.js";`,
     `import { LUNORA_FUNCTIONS } from "./functions.js";`,
+    ...hasQueue ? [
+      `import { createQueueCaptureSink, dispatchQueueBatch, shouldCaptureQueue } from "@lunora/queue";`,
+      `import { LUNORA_QUEUE_REGISTRY } from "./queues.js";`
+    ] : [],
     ...wantsOpenApi ? [`import { openApiSpec } from "./openapi.js";`] : [],
     ...wantsOpenRpc ? [`import { openRpcSpec } from "./openrpc.js";`] : [],
     `import { createShardDO } from "./shard.js";`
@@ -119,9 +135,10 @@ interface AuthDeclaration<Env> {
   ] : []
 ];
 const buildFieldLines = (options) => [
+  ...options.hasAccess ? [`    private accessSelector?: Selector<Env, CreateAccessResolverOptions>;`] : [],
   `    private adminToken?: Selector<Env, string>;`,
   ...options.hasAuth ? [`    private authDeclaration?: AuthDeclaration<Env>;`] : [],
-  `    private readonly extendFns: ((env: Env) => Partial<WorkerOptions>)[] = [];`,
+  `    private readonly extendFns: ((env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>)[] = [];`,
   ...options.hasGlobal ? [`    private globalDeclaration?: GlobalDeclaration<Env>;`] : [],
   ...options.hasHyperdriveGlobal ? [`    private hyperdriveGlobalDeclaration?: HyperdriveGlobalDeclaration<Env>;`] : [],
   `    private readonly routeMap: Record<string, Route> = {};`,
@@ -139,6 +156,14 @@ const buildLongTailMethods = (options) => LONG_TAIL.filter(([flag]) => options[f
     }`
 );
 const buildMethodBlocks = (options) => [
+  ...options.hasAccess ? [
+    `    /** Wire Cloudflare Access (Zero Trust) — verifies the \`Cf-Access-Jwt-Assertion\` JWT and feeds the identity into \`ctx.auth\` / RLS via \`resolveIdentity\`. When \`.auth(...)\` is also configured, Access is composed ahead of it (Access wins when its JWT is present; everyone else falls through to the app session). */
+    public access(selector: Selector<Env, CreateAccessResolverOptions>): this {
+        this.accessSelector = selector;
+
+        return this;
+    }`
+  ] : [],
   `    /** Bearer token gating the \`/_lunora/admin/*\` endpoints the studio calls. */
     public admin(selector: Selector<Env, string>): this {
         this.adminToken = selector;
@@ -153,8 +178,8 @@ const buildMethodBlocks = (options) => [
         return this;
     }`
   ] : [],
-  `    /** Escape hatch — merge raw \`WorkerOptions\` (anything not yet sugared) over the derived options at build time. */
-    public extend(fn: (env: Env) => Partial<WorkerOptions>): this {
+  `    /** Escape hatch — merge raw \`WorkerOptions\` (anything not yet sugared) over the derived options at build time. The second \`derived\` argument is a snapshot of the options assembled so far (after \`.auth(...)\` etc.), so you can compose rather than clobber — e.g. wrap \`derived.resolveIdentity\` instead of replacing it. */
+    public extend(fn: (env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>): this {
         this.extendFns.push(fn);
 
         return this;
@@ -274,7 +299,7 @@ const buildShardFactoryBody = (options) => {
                           const namespace = this.schedulerDeclaration?.namespace(env);
                           const origin = this.schedulerDeclaration?.origin?.(env);
 
-                          return namespace && origin ? createScheduler({ namespace, originUrl: origin }) : undefined;
+                          return namespace && origin ? createScheduler({${options.jurisdiction ? ` jurisdiction: ${JSON.stringify(options.jurisdiction)},` : ""} namespace, originUrl: origin }) : undefined;
                       },
                   }
                 : {}),`
@@ -321,6 +346,17 @@ const buildWorkerOptionLines = (options) => [
             Object.assign(options, this.buildStorageAdmin(env));
         }`
   ] : [],
+  // The studio's KV browser is wired zero-config: `createKvIntrospectorFromEnv`
+  // scans `env` for every bound Workers KV namespace, so each `kv_namespaces`
+  // entry in wrangler.jsonc appears under its binding name (any name, any count)
+  // with no manual `createKvIntrospector` call. A deployment with no KV binding
+  // yields an empty namespace list rather than crashing.
+  ...options.hasKv ? [`        options.kvIntrospector = createKvIntrospectorFromEnv(env);`] : [],
+  // The studio's Logs → Archive feed is wired zero-config: when the operator sets
+  // `LUNORA_LOG_ARCHIVE_TABLE` (the R2 Data Catalog table `pipelineLogSink` writes
+  // to), the durable archive becomes readable; unset ⇒ `undefined` ⇒ the feed
+  // reports "not configured". The R2 SQL credentials come from `R2_SQL_*` env vars.
+  `        options.logArchive = resolveLogArchiveFromEnv(env);`,
   ...options.hasAuth ? [
     `        if (this.authDeclaration) {
             options.authHandler = (request) => {
@@ -343,13 +379,64 @@ const buildWorkerOptionLines = (options) => [
 
             options.authAdmin = authInstance ? createAuthAdmin(authInstance) : undefined;
         }`
+  ] : [],
+  // Cloudflare Access — runs AFTER the auth block so it can compose ahead of
+  // the better-auth resolver rather than clobber it. With `.auth()` present,
+  // a request carrying a verified Access JWT is authenticated by Access and
+  // everyone else falls through to the app session; without it, Access is the
+  // sole resolver.
+  ...options.hasAccess ? [
+    options.hasAuth ? `        if (this.accessSelector) {
+            const accessResolver = createAccessResolver(this.accessSelector(env));
+            const fallback = options.resolveIdentity;
+
+            options.resolveIdentity = fallback ? composeResolvers(accessResolver, fallback) : accessResolver;
+        }` : `        if (this.accessSelector) {
+            options.resolveIdentity = createAccessResolver(this.accessSelector(env));
+        }`
+  ] : [],
+  // Voice-enabled agents: map each export name to its `VOICE_*` Durable Object
+  // namespace so the runtime serves `/_lunora/voice/<exportName>`. Read off
+  // `env` structurally (the binding is provisioned by the config layer's
+  // reconcile step, so it may not be on the generated `Env` type). Emitted only
+  // when at least one agent opted into voice — voice-free output is unchanged.
+  ...options.voiceAgents && options.voiceAgents.length > 0 ? [
+    `        options.voiceAgents = {
+${options.voiceAgents.map(
+      (agent) => `            ${JSON.stringify(agent.exportName)}: (env as Record<string, unknown>)[${JSON.stringify(agent.bindingName)}] as ShardNamespaceLike,`
+    ).join("\n")}
+        };`
   ] : []
 ];
 const buildBaseWorkerOptions = (options) => [
   `            cronJobs: LUNORA_CRONS,`,
   `            functions: LUNORA_FUNCTIONS,`,
+  // The declared `defineIdentity(...)` contract — wires the runtime trust
+  // boundary so `wrapResolverWithContract` validates every resolved identity
+  // against it before it becomes `ctx.auth`. Emitted only when the app declares
+  // a contract, so apps without one keep unchanged output.
+  ...options.identity ? [`            identity: lunoraIdentityContract.${options.identity.exportName},`] : [],
+  // Schema `.jurisdiction("…")` pins every DO the worker reaches to the
+  // Cloudflare data-residency region. Emitted only when declared, so apps
+  // without it keep the un-pinned global namespace (and unchanged output).
+  ...options.jurisdiction ? [`            jurisdiction: ${JSON.stringify(options.jurisdiction)},`] : [],
   ...options.wantsOpenApi ? [`            openApiSpec,`] : [],
   ...options.wantsOpenRpc ? [`            openRpcSpec,`] : [],
+  // The push-consumer handler backing the worker's `queue(batch, …)` entry:
+  // routes each delivered batch to its `defineQueue` handler. Built from
+  // `@lunora/queue` here (keeping the runtime decoupled) and wired only when the
+  // app declares push queues in `lunora/queues.ts`. In a dev environment (or with
+  // `LUNORA_QUEUE_CAPTURE`), every consumed message is recorded into the studio's
+  // Queues log via the root shard's `recordQueueMessage` admin RPC.
+  ...options.hasQueue ? [
+    `            queue: (batch: unknown, queueEnv: unknown, _context: ExecutionContextLike): Promise<void> =>`,
+    `                dispatchQueueBatch(batch as Parameters<typeof dispatchQueueBatch>[0], LUNORA_QUEUE_REGISTRY, {`,
+    `                    capture: shouldCaptureQueue(queueEnv as Record<string, unknown>)`,
+    `                        ? createQueueCaptureSink(queueEnv as Record<string, unknown>${options.jurisdiction ? `, { jurisdiction: ${JSON.stringify(options.jurisdiction)} }` : ""})`,
+    `                        : undefined,`,
+    `                    env: queueEnv as Record<string, unknown>,`,
+    `                }),`
+  ] : [],
   `            routes: this.routeMap,`,
   `            shardDO: this.shardSelector?.(env) ?? (undefined as unknown as ShardNamespaceLike),`
 ];
@@ -490,6 +577,12 @@ const emitApp = (options) => {
   const buildWorkerLine = options.hasFramework ? `        const buildWorker = (env: Env): LunoraWorker =>
             host ? withFrameworkWorker(host, (hostEnv) => this.buildWorkerOptions(hostEnv as Env, ${getAuthArgument})) : createWorker(this.buildWorkerOptions(env, ${getAuthArgument}));` : `        const buildWorker = (env: Env): LunoraWorker => createWorker(this.buildWorkerOptions(env, ${getAuthArgument}));`;
   const assembleParameter = options.hasFramework ? `host?: FrameworkHostHandler` : ``;
+  const emailAgents = options.emailAgents ?? [];
+  const emailAgentsBlock = emailAgents.length > 0 ? `        composed.email = dispatchAgentEmail([
+${emailAgents.map((agent) => `            { agent: lunoraAgentDefinitions.${agent.exportName}, binding: ${JSON.stringify(agent.bindingName)} },`).join("\n")}
+        ]);
+
+` : "";
   const buildTerminals = `    /** Materialise the standalone Cloudflare worker + \`ShardDO\` class. */
     public build(): ComposedApp {
         return this.assemble();
@@ -558,10 +651,15 @@ ${buildWorkerLine}
                 worker ??= buildWorker(rawEnv as Env);
 
                 return worker.serverQuery(request, rawEnv, reference, args, options);
-            },
+            },${options.hasQueue ? `
+            queue: async (batch: unknown, rawEnv: unknown, context: ExecutionContextLike): Promise<void> => {
+                worker ??= buildWorker(rawEnv as Env);
+
+                return worker.queue?.(batch, rawEnv, context);
+            },` : ""}
         };
 
-        if (this.emailHandler) {
+${emailAgentsBlock}        if (this.emailHandler) {
             const handler = this.emailHandler;
 
             composed.email = (message, rawEnv, context) => handler(rawEnv as Env)(message, rawEnv, context);
@@ -581,7 +679,7 @@ ${buildBaseWorkerOptions(options).join("\n")}
         }
 
 ${workerOptionLines.join("\n\n")}${workerOptionLines.length > 0 ? "\n\n" : ""}        for (const fn of this.extendFns) {
-            Object.assign(options, fn(env));
+            Object.assign(options, fn(env, { ...options }));
         }
 
         return options;

package/dist/packem_shared/formatAdvisories-BmF7Mplc.mjs

@@ -0,0 +1,115 @@
+import { runAdvisor } from '@lunora/advisor';
+
+const flattenIndexes = (table) => [
+  ...table.indexes.map((index) => {
+    return { fields: index.fields, kind: "index", name: index.name, unique: index.unique };
+  }),
+  ...table.searchIndexes.map((index) => {
+    return { fields: [index.field, ...index.filterFields ?? []], kind: "search", name: index.name };
+  }),
+  ...table.rankIndexes.map((index) => {
+    return { fields: [...index.sortBy.map((key) => key.field), ...index.partitionBy ?? []], kind: "rank", name: index.name };
+  }),
+  ...table.vectorIndexes.filter((index) => index.field !== void 0).map((index) => {
+    return { fields: [index.field], kind: "vector", name: index.name };
+  })
+];
+const toAdvisorSchema = (schema) => {
+  return {
+    rlsMode: schema.rlsMode,
+    tables: schema.tables.map((table) => {
+      return {
+        externallyManaged: table.externallyManaged ?? false,
+        externalSource: table.externalSource ? {
+          hasReconcile: table.externalSource.hasReconcile ?? false,
+          hasSoftDelete: table.externalSource.hasSoftDelete ?? false,
+          hasTenantBy: table.externalSource.hasTenantBy,
+          mode: table.externalSource.mode,
+          unanalyzable: table.externalSource.unanalyzable
+        } : void 0,
+        fields: Object.keys(table.shape),
+        indexes: flattenIndexes(table),
+        isPublic: table.isPublic ?? false,
+        name: table.name,
+        relations: table.relations.map((relation) => {
+          return {
+            field: relation.field,
+            kind: relation.kind,
+            name: relation.name,
+            onDelete: relation.onDelete,
+            references: relation.references,
+            table: relation.table
+          };
+        }),
+        shardKind: typeof table.shardMode === "string" ? table.shardMode : "shardBy",
+        softDelete: table.softDelete
+      };
+    })
+  };
+};
+const toAdvisorShapes = (shapes) => shapes.map((shape) => {
+  return { exportName: shape.exportName, file: `lunora/${shape.filePath}.ts`, table: shape.table };
+});
+const lintSchema = (options) => runAdvisor(
+  {
+    adminRoutes: options.adminRoutes,
+    aiRawRuns: options.aiRawRuns,
+    aiToolSideEffects: options.aiToolSideEffects,
+    argumentDerivedFetches: options.argumentDerivedFetches,
+    argValidators: options.argumentValidators,
+    authApiCalls: options.authApiCalls,
+    authConfigs: options.authConfigs,
+    browserUrlAccesses: options.browserUrlAccesses,
+    configCalls: options.configCalls,
+    containerKeyAccesses: options.containerKeyAccesses,
+    containerOverrides: options.containerOverrides,
+    containers: options.containers,
+    failOpenGuards: options.failOpenGuards,
+    flagSecurityDefaults: options.flagSecurityDefaults,
+    httpActionGuards: options.httpActionGuards,
+    httpHeaderWrites: options.httpHeaderWrites,
+    identityClaimReads: options.identityClaimReads,
+    imageDeliveryUrlAccesses: options.imageDeliveryUrlAccesses,
+    inserts: options.inserts,
+    kvKeyAccesses: options.kvKeyAccesses,
+    mailRecipientAccesses: options.mailRecipientAccesses,
+    maskProcedures: options.maskProcedures,
+    maskStrategies: options.maskStrategies,
+    mutatorWrites: options.mutatorWrites,
+    nondeterministicCalls: options.nondeterministicCalls,
+    normalizeIdAuthorizations: options.normalizeIdAuthorizations,
+    ownerFieldWrites: options.ownerFieldWrites,
+    paymentWebhooks: options.paymentWebhooks,
+    privilegedDispatches: options.privilegedDispatches,
+    procedureProtections: options.procedureProtections,
+    queries: options.queries ?? [],
+    queues: options.queues,
+    r2sqlCalls: options.r2sqlCalls,
+    ratelimitKeySelectors: options.ratelimitKeySelectors,
+    rawRowReturns: options.rawRowReturns,
+    relationLoads: options.relationLoads,
+    rlsProcedures: options.rlsProcedures,
+    schema: toAdvisorSchema(options.schema),
+    secretLiterals: options.secretLiterals,
+    shapes: options.shapes === void 0 ? void 0 : toAdvisorShapes(options.shapes),
+    softDeleteReads: options.softDeleteReads,
+    sqlInterpolations: options.sqlInterpolations,
+    storageKeyAccesses: options.storageKeyAccesses,
+    storageUploads: options.storageUploads,
+    vectorNamespaceAccesses: options.vectorNamespaceAccesses,
+    workflowCalls: options.workflowCalls,
+    workflows: options.workflows,
+    wranglerVariables: options.wranglerVariables
+  },
+  { source: "static" }
+);
+const formatAdvisories = (findings) => {
+  if (findings.length === 0) {
+    return "";
+  }
+  const header = `@lunora/codegen: ${String(findings.length)} schema advisor finding${findings.length === 1 ? "" : "s"}`;
+  const lines = findings.map((finding) => `  [${finding.level}] ${finding.name}: ${finding.detail}`);
+  return [header, ...lines].join("\n");
+};
+
+export { formatAdvisories, lintSchema };

package/dist/packem_shared/{parse-validator-tuQtHrsr.mjs → parse-validator-BSJo1HGP.mjs}

@@ -1,3 +1,4 @@
+import { LunoraError } from '@lunora/errors';
 import { Node } from 'ts-morph';
 
 const FIELD_NAME_RE = /^[A-Za-z_$][\w$]*$/u;
@@ -53,13 +54,22 @@ const parseObjectShape = (object) => {
     }
     const fieldName = property.getName();
     if (!FIELD_NAME_RE.test(fieldName)) {
-      throw new Error(`@lunora/codegen: field name is not a valid JS identifier: ${JSON.stringify(fieldName)}`);
+      throw new LunoraError("INTERNAL", `@lunora/codegen: field name is not a valid JS identifier: ${JSON.stringify(fieldName)}`);
     }
     out[fieldName] = parseValidator(initializer);
   }
   return out;
 };
 const parseArgument = (argument, fallback) => argument && Node.isExpression(argument) ? parseValidator(argument) : fallback;
+const renderLiteralSource = (node) => {
+  if (node === void 0) {
+    return "undefined";
+  }
+  if (Node.isStringLiteral(node) || Node.isNoSubstitutionTemplateLiteral(node)) {
+    return JSON.stringify(node.getLiteralValue());
+  }
+  return node.getText();
+};
 const parseBuilderMember = (member, args) => {
   if (SCALAR_KINDS.has(member)) {
     return { kind: member };
@@ -78,9 +88,10 @@ const parseBuilderMember = (member, args) => {
     case "literal": {
       return {
         kind: "literal",
-        // Captures the source text — for string/number/boolean/null literals
-        // this matches the TS type representation directly.
-        literalValue: first ? first.getText() : "undefined"
+        // Canonical source text — strings/templates are re-encoded via
+        // JSON.stringify (see renderLiteralSource) so escapes/backticks
+        // survive; numbers/booleans/null keep their verbatim text.
+        literalValue: renderLiteralSource(first)
       };
     }
     case "object": {
@@ -106,7 +117,7 @@ const parseBuilderMember = (member, args) => {
       };
     }
     default: {
-      throw new Error(`Unsupported validator kind: ${member}`);
+      throw new LunoraError("INTERNAL", `Unsupported validator kind: ${member}`);
     }
   }
 };
@@ -124,7 +135,8 @@ const parseValidatorCall = (call) => {
   }
   if (TRANSPARENT_MODIFIERS.has(member)) {
     const receiver = callee.getExpression();
-    return Node.isExpression(receiver) ? parseValidator(receiver) : { kind: "any" };
+    const base = Node.isExpression(receiver) ? parseValidator(receiver) : { kind: "any" };
+    return member === "check" ? { ...base, hasRefinement: true } : base;
   }
   return parseBuilderMember(member, args);
 };

package/dist/packem_shared/redact-oTmsol5A.mjs

@@ -0,0 +1,33 @@
+const HIGH_ENTROPY_TOKEN_RE = /[\w+/=-]{40,}/u;
+const LOWER_RE = /[a-z]/u;
+const UPPER_RE = /[A-Z]/u;
+const DIGIT_RE = /\d/u;
+const HEX_SECRET_RE = /\b(?:[\da-f]{32,}|[\dA-F]{32,})\b/u;
+const isHighEntropy = (value) => {
+  const token = HIGH_ENTROPY_TOKEN_RE.exec(value)?.[0];
+  if (token === void 0) {
+    return false;
+  }
+  return LOWER_RE.test(token) && UPPER_RE.test(token) && DIGIT_RE.test(token);
+};
+const isHexSecret = (value) => HEX_SECRET_RE.test(value);
+const STRIPE_LIVE_KEY_RE = /\b(?:sk|rk)_live_[\dA-Za-z]{20,}/u;
+const AWS_ACCESS_KEY_RE = /\bAKIA[\dA-Z]{16}\b/u;
+const GITHUB_TOKEN_RE = /\bgh[posru]_[\dA-Za-z]{36,}/u;
+const OPENAI_KEY_RE = /\bsk-[\dA-Za-z]{32,}/u;
+const SLACK_TOKEN_RE = /\bxox[abprs]-[\dA-Za-z-]{10,}/u;
+const PRIVATE_KEY_RE = /-----BEGIN(?: [A-Z]+)? PRIVATE KEY-----/u;
+const SECRET_RULES = [
+  { kind: "stripe_live_key", test: (value) => STRIPE_LIVE_KEY_RE.test(value) },
+  { kind: "aws_access_key", test: (value) => AWS_ACCESS_KEY_RE.test(value) },
+  { kind: "github_token", test: (value) => GITHUB_TOKEN_RE.test(value) },
+  { kind: "openai_key", test: (value) => OPENAI_KEY_RE.test(value) },
+  { kind: "slack_token", test: (value) => SLACK_TOKEN_RE.test(value) },
+  { kind: "private_key", test: (value) => PRIVATE_KEY_RE.test(value) },
+  { kind: "high_entropy", test: isHighEntropy },
+  { kind: "hex_secret", test: isHexSecret }
+];
+const secretKindOf = (value) => SECRET_RULES.find((rule) => rule.test(value))?.kind;
+const redact = (value) => `${value.slice(0, 4)}…(${String(value.length)} chars)`;
+
+export { SECRET_RULES, redact, secretKindOf };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/codegen",
-  "version": "1.0.0-alpha.5",
+  "version": "1.0.0-alpha.50",
   "description": "Code generator for Lunora: emits _generated/{api,server,dataModel}.ts from your schema",
   "keywords": [
     "cloudflare",
@@ -25,7 +25,7 @@
     "directory": "packages/codegen"
   },
   "files": [
-    "dist",
+    "./dist",
     "__assets__",
     "README.md",
     "LICENSE.md"
@@ -46,11 +46,14 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/advisor": "1.0.0-alpha.3",
-    "@lunora/container": "1.0.0-alpha.1",
-    "@lunora/scheduler": "1.0.0-alpha.1",
-    "@lunora/values": "1.0.0-alpha.1",
-    "@lunora/workflow": "1.0.0-alpha.1",
+    "@lunora/advisor": "1.0.0-alpha.32",
+    "@lunora/agent": "1.0.0-alpha.7",
+    "@lunora/container": "1.0.0-alpha.13",
+    "@lunora/errors": "1.0.0-alpha.6",
+    "@lunora/queue": "1.0.0-alpha.9",
+    "@lunora/scheduler": "1.0.0-alpha.11",
+    "@lunora/values": "1.0.0-alpha.9",
+    "@lunora/workflow": "1.0.0-alpha.11",
     "ts-morph": "^28.0.0"
   },
   "engines": {