@lunora/advisor 0.0.0 → 1.0.0-alpha.2

package/dist/packem_shared/rlsUncoveredTable-CxEfZ5eZ.mjs

@@ -0,0 +1,56 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const rlsUncoveredTable = {
+  categories: ["SECURITY"],
+  description: "A public procedure reads or writes a table that is covered by an RLS policy elsewhere in the app, but this procedure's builder chain does not include `.use(rls(...))`. The raw, unwrapped `ctx.db` silently bypasses every policy in the list.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "rls_uncovered_table",
+  remediation: "Add `.use(rls(policies))` to the procedure's builder chain — e.g. `c.use(rls(myPolicies)).query(...)` — so its `ctx.db` is wrapped by the same policy evaluator as the rest of the app. If this procedure is intentionally privileged (e.g. a background job), declare it with `internalQuery` / `internalMutation` / `internalAction` instead of the public builder so the intent is explicit.",
+  // eslint-disable-next-line sonarjs/cognitive-complexity -- the policy/table cross-reference is clearest as one linear pass; splitting it would obscure the flow.
+  run: (context) => {
+    if (context.rlsProcedures === void 0) {
+      return [];
+    }
+    const policyCoveredTables = /* @__PURE__ */ new Set();
+    for (const procedure of context.rlsProcedures) {
+      for (const table of procedure.rlsTables) {
+        if (table !== "") {
+          policyCoveredTables.add(table);
+        }
+      }
+    }
+    if (policyCoveredTables.size === 0) {
+      return [];
+    }
+    const findings = [];
+    for (const procedure of context.rlsProcedures) {
+      if (procedure.usesRls) {
+        continue;
+      }
+      if (procedure.visibility === "internal") {
+        continue;
+      }
+      const touched = /* @__PURE__ */ new Set();
+      for (const table of [...procedure.tablesRead, ...procedure.tablesWritten]) {
+        if (table !== "" && policyCoveredTables.has(table)) {
+          touched.add(table);
+        }
+      }
+      for (const table of touched) {
+        findings.push(
+          emit(rlsUncoveredTable, {
+            cacheKey: `rls_uncovered_table:${procedure.file}:${procedure.exportName}:${table}`,
+            detail: `\`${procedure.exportName}\` in ${procedure.file} accesses table \`${table}\` without \`.use(rls(...))\` — the table is policy-gated elsewhere in the app but this procedure bypasses those policies entirely.`,
+            metadata: { exportName: procedure.exportName, file: procedure.file, table }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "static",
+  title: "RLS-gated table accessed without rls() middleware"
+};
+
+export { rlsUncoveredTable as default };

package/dist/packem_shared/sqlInjectionRisk-zwytYGLt.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const sqlInjectionRisk = {
+  categories: ["SECURITY"],
+  description: "A `ctx.sql` tagged-template interpolates an unparameterized string-building expression (concatenation or nested template) instead of a bound value — splicing raw text into the query and reopening SQL injection.",
+  facing: "EXTERNAL",
+  level: "ERROR",
+  name: "sql_injection_risk",
+  remediation: "Pass the value through a bound placeholder so the driver parameterizes it — keep request input inside a `ctx.sql` placeholder instead of concatenating it into the query string. Never build SQL text from request input by hand.",
+  run: (context) => {
+    if (context.sqlInterpolations === void 0) {
+      return [];
+    }
+    return context.sqlInterpolations.map(
+      (interpolation) => emit(sqlInjectionRisk, {
+        cacheKey: `sql_injection_risk:${interpolation.file}:${interpolation.line.toString()}`,
+        detail: `\`ctx.sql\` in \`${interpolation.exportName}\` (${interpolation.file}:${interpolation.line.toString()}) interpolates a string-building expression instead of a bound value — a SQL-injection vector. Pass the value through a bound placeholder so the driver parameterizes it.`,
+        metadata: { exportName: interpolation.exportName, file: interpolation.file, line: interpolation.line }
+      })
+    );
+  },
+  source: "static",
+  title: "Possible SQL injection in ctx.sql interpolation"
+};
+
+export { sqlInjectionRisk as default };

package/dist/packem_shared/tableWithoutInsert-CbbaYIP4.mjs

@@ -0,0 +1,34 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const tableWithoutInsert = {
+  categories: ["SCHEMA"],
+  description: 'No function inserts into this table via `ctx.db.insert("<table>", …)`. It may be read-only by design (seeded by a migration, replicated, or written through a path the advisor can\'t see) — or it may be dead schema.',
+  facing: "INTERNAL",
+  level: "INFO",
+  name: "table_without_insert",
+  remediation: 'If the table should be writable, add a mutation that calls `ctx.db.insert("<table>", …)`. If it is read-only or seeded elsewhere, this advisory can be ignored.',
+  run: (context) => {
+    if (context.inserts === void 0) {
+      return [];
+    }
+    const insertedTables = new Set(context.inserts.filter((write) => write.table !== "").map((write) => write.table));
+    const findings = [];
+    for (const table of context.schema.tables) {
+      if (insertedTables.has(table.name) || table.externallyManaged === true) {
+        continue;
+      }
+      findings.push(
+        emit(tableWithoutInsert, {
+          cacheKey: `table_without_insert:${table.name}`,
+          detail: `No function calls \`ctx.db.insert("${table.name}", …)\` — table "${table.name}" has no discovered insert path.`,
+          metadata: { table: table.name }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Table has no insert path"
+};
+
+export { tableWithoutInsert as default };

package/dist/packem_shared/unboundedStringArgument-DThg2-wt.mjs

@@ -0,0 +1,32 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const unboundedStringArgument = {
+  categories: ["SECURITY"],
+  description: "A public `v.string()` argument has no maximum-length bound. An unbounded string lets a client submit arbitrarily large input — abusing storage and CPU on every request that processes it.",
+  facing: "EXTERNAL",
+  level: "INFO",
+  name: "unbounded_string_arg",
+  remediation: "Add a max-length bound via `.check(...)` / `.meta({ maxLength })` on the string validator (e.g. cap a name at 256, a body at a few KB). Size the cap to the field's real-world maximum.",
+  run: (context) => {
+    if (context.argValidators === void 0) {
+      return [];
+    }
+    const findings = [];
+    for (const procedure of context.argValidators) {
+      for (const argument of procedure.unboundedStringArgs) {
+        findings.push(
+          emit(unboundedStringArgument, {
+            cacheKey: `unbounded_string_arg:${procedure.file}:${procedure.exportName}:${argument}`,
+            detail: `Arg \`${argument}\` of public procedure \`${procedure.exportName}\` (${procedure.file}:${procedure.line.toString()}) is an unbounded \`v.string()\`. Add a max-length bound to cap payload size.`,
+            metadata: { argument, exportName: procedure.exportName, file: procedure.file, line: procedure.line }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Public string argument has no length bound"
+};
+
+export { unboundedStringArgument as default };

package/dist/packem_shared/unindexedForeignKey-BgJbKyqK.mjs

@@ -0,0 +1,45 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+import { l as leadingIndexedColumns, P as PRIMARY_KEY, s as suggestIndexName } from './fk-index-IUK1ukgs.mjs';
+
+const unindexedForeignKey = {
+  categories: ["PERFORMANCE"],
+  description: "A foreign-key column declared by a `one` relation has no index leading with it. Reads that filter or join on the column full-scan the table, which gets linearly slower as rows accumulate.",
+  facing: "EXTERNAL",
+  level: "INFO",
+  name: "unindexed_foreign_key",
+  remediation: 'Add a secondary index leading with the FK column, e.g. `.index("byAuthorId", ["authorId"])`.',
+  run: (context) => {
+    const findings = [];
+    for (const table of context.schema.tables) {
+      const indexed = leadingIndexedColumns(table);
+      for (const relation of table.relations) {
+        if (relation.kind !== "one") {
+          continue;
+        }
+        const fkColumn = relation.field;
+        if (fkColumn === PRIMARY_KEY || indexed.has(fkColumn)) {
+          continue;
+        }
+        const suggestedIndex = suggestIndexName(fkColumn);
+        findings.push(
+          emit(unindexedForeignKey, {
+            cacheKey: `unindexed_foreign_key:${table.name}:${fkColumn}`,
+            detail: `Relation "${relation.name}" on table "${table.name}" references "${relation.table}" via column "${fkColumn}", which is not the leading column of any index. Reads filtering or joining on "${fkColumn}" full-scan "${table.name}".`,
+            metadata: {
+              fkColumn,
+              references: { column: relation.references, table: relation.table },
+              relation: relation.name,
+              suggestedIndex: { fields: [fkColumn], name: suggestedIndex },
+              table: table.name
+            }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Unindexed foreign key"
+};
+
+export { unindexedForeignKey as default };

package/dist/packem_shared/unindexedRelationTarget-D6eyj6Xx.mjs

@@ -0,0 +1,53 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+import { P as PRIMARY_KEY, l as leadingIndexedColumns, s as suggestIndexName } from './fk-index-IUK1ukgs.mjs';
+
+const unindexedRelationTarget = {
+  categories: ["PERFORMANCE"],
+  description: "A `many` relation's foreign-key column on the target table has no index leading with it. Relation predicates (`some`/`none`/`every`) and `with:` child reads filter the target on that column, full-scanning it as rows accumulate.",
+  facing: "EXTERNAL",
+  level: "INFO",
+  name: "unindexed_relation_target",
+  remediation: 'Add a secondary index on the target table leading with the FK column, e.g. `.index("byAuthorId", ["authorId"])`.',
+  run: (context) => {
+    const findings = [];
+    const tablesByName = new Map(context.schema.tables.map((table) => [table.name, table]));
+    for (const table of context.schema.tables) {
+      for (const relation of table.relations) {
+        if (relation.kind !== "many") {
+          continue;
+        }
+        const target = tablesByName.get(relation.table);
+        if (target === void 0) {
+          continue;
+        }
+        const fkColumn = relation.field;
+        if (fkColumn === PRIMARY_KEY) {
+          continue;
+        }
+        const coveredByForeignKeyLint = target.relations.some((targetRelation) => targetRelation.kind === "one" && targetRelation.field === fkColumn);
+        if (coveredByForeignKeyLint || leadingIndexedColumns(target).has(fkColumn)) {
+          continue;
+        }
+        const suggestedIndex = suggestIndexName(fkColumn);
+        findings.push(
+          emit(unindexedRelationTarget, {
+            cacheKey: `unindexed_relation_target:${relation.table}:${fkColumn}`,
+            detail: `Relation "${relation.name}" on table "${table.name}" is a to-many over "${relation.table}" via its column "${fkColumn}", which is not the leading column of any index on "${relation.table}". Relation predicates (\`some\`/\`none\`/\`every\`) and \`with:\` reads of "${relation.name}" full-scan "${relation.table}".`,
+            metadata: {
+              fkColumn,
+              references: { column: relation.references, table: table.name },
+              relation: relation.name,
+              suggestedIndex: { fields: [fkColumn], name: suggestedIndex },
+              table: relation.table
+            }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Unindexed relation target"
+};
+
+export { unindexedRelationTarget as default };

package/dist/packem_shared/userCreatingMutationWithoutCaptcha-CH31YsUZ.mjs

@@ -0,0 +1,42 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const userCreatingMutationWithoutCaptcha = {
+  categories: ["SECURITY"],
+  description: "A public `mutation`/`action` that creates a user/session or sends mail has no CAPTCHA / bot check. Account-creating and mail-sending endpoints are prime automated-abuse targets (credential stuffing, mailbox flooding, disposable-account farming).",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "user_creating_mutation_without_captcha",
+  remediation: "Add a server-verified human check: `.use(verifyTurnstile({ secret, token }))` from `@lunora/auth`, or wrap it with `.use(protectPublic({ rateLimit, captcha }))` from `@lunora/server`. Pair with a rate limit for defense in depth.",
+  run: (context) => {
+    if (context.procedureProtections === void 0) {
+      return [];
+    }
+    const findings = [];
+    for (const procedure of context.procedureProtections) {
+      const isPublicWrite = procedure.visibility === "public" && (procedure.kind === "mutation" || procedure.kind === "action");
+      const sensitive = procedure.writesUserTable || procedure.callsMail;
+      if (!isPublicWrite || !sensitive || procedure.usesCaptcha) {
+        continue;
+      }
+      const reason = procedure.writesUserTable ? "writes a user/session table" : "sends mail";
+      findings.push(
+        emit(userCreatingMutationWithoutCaptcha, {
+          cacheKey: `user_creating_mutation_without_captcha:${procedure.file}:${procedure.exportName}`,
+          detail: `Public ${procedure.kind} \`${procedure.exportName}\` (${procedure.file}) ${reason} but has no CAPTCHA check. Add \`.use(verifyTurnstile(...))\` or \`.use(protectPublic({ captcha }))\`.`,
+          metadata: {
+            callsMail: procedure.callsMail,
+            exportName: procedure.exportName,
+            file: procedure.file,
+            kind: procedure.kind,
+            writesUserTable: procedure.writesUserTable
+          }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Account-creating / mail-sending write without a CAPTCHA"
+};
+
+export { userCreatingMutationWithoutCaptcha as default };

package/dist/packem_shared/workflowUnknownTarget-Cdd7WhKQ.mjs

@@ -0,0 +1,34 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const workflowUnknownTarget = {
+  categories: ["SCHEMA"],
+  description: 'A `ctx.workflows.get("<name>")` call references a workflow that is not declared by any `defineWorkflow` export in `lunora/workflows.ts`. The name is a typo or points at a removed/renamed workflow — the call throws at runtime.',
+  facing: "INTERNAL",
+  level: "ERROR",
+  name: "workflow_unknown_target",
+  remediation: 'Fix the workflow name in the `ctx.workflows.get("…")` call, or add the missing `defineWorkflow` export to `lunora/workflows.ts`.',
+  run: (context) => {
+    if (context.workflows === void 0 || context.workflowCalls === void 0) {
+      return [];
+    }
+    const declared = new Set(context.workflows.map((workflow) => workflow.exportName));
+    const findings = [];
+    for (const call of context.workflowCalls) {
+      if (call.workflow === "" || declared.has(call.workflow)) {
+        continue;
+      }
+      findings.push(
+        emit(workflowUnknownTarget, {
+          cacheKey: `workflow_unknown_target:${call.file}:${call.exportName}:${call.workflow}`,
+          detail: `\`ctx.workflows.get("${call.workflow}")\` in "${call.exportName}" (${call.file}) references workflow "${call.workflow}", which is not declared in lunora/workflows.ts.`,
+          metadata: { exportName: call.exportName, file: call.file, line: call.line, workflow: call.workflow }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Workflow call references unknown workflow"
+};
+
+export { workflowUnknownTarget as default };

package/dist/packem_shared/workflowUnused-D0jHxdz9.mjs

@@ -0,0 +1,38 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const workflowUnused = {
+  categories: ["SCHEMA"],
+  description: 'No function starts this workflow via `ctx.workflows.get("<name>")`. It may be triggered through a path the advisor can\'t see (the Cloudflare API, a wrangler invocation, a cross-service binding) — or it may be dead code that still deploys as a billable WorkflowEntrypoint.',
+  facing: "INTERNAL",
+  level: "INFO",
+  name: "workflow_unused",
+  remediation: 'If the workflow should be triggered in-app, start it from a mutation/action with `ctx.workflows.get("<name>").create({ params })`. If it is started externally or is no longer needed, this advisory can be ignored (or remove the `defineWorkflow` export).',
+  run: (context) => {
+    if (context.workflows === void 0) {
+      return [];
+    }
+    const calls = context.workflowCalls ?? [];
+    if (calls.some((call) => call.workflow === "")) {
+      return [];
+    }
+    const started = new Set(calls.map((call) => call.workflow));
+    const findings = [];
+    for (const workflow of context.workflows) {
+      if (started.has(workflow.exportName)) {
+        continue;
+      }
+      findings.push(
+        emit(workflowUnused, {
+          cacheKey: `workflow_unused:${workflow.exportName}`,
+          detail: `No function calls \`ctx.workflows.get("${workflow.exportName}")\` — workflow "${workflow.exportName}" is declared but never started in app code.`,
+          metadata: { workflow: workflow.exportName }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Workflow is never started"
+};
+
+export { workflowUnused as default };

package/package.json

@@ -1,31 +1,54 @@
 {
   "name": "@lunora/advisor",
-  "version": "0.0.0",
+  "version": "1.0.0-alpha.2",
   "description": "Schema & query lints (splinter-style advisors) for Lunora, feeding the Studio Advisors view",
-  "license": "FSL-1.1-Apache-2.0",
+  "keywords": [
+    "advisor",
+    "cloudflare",
+    "durable-objects",
+    "lint",
+    "lunora",
+    "schema",
+    "splinter",
+    "workers"
+  ],
   "homepage": "https://lunora.sh",
+  "bugs": "https://github.com/anolilab/lunora/issues",
+  "license": "FSL-1.1-Apache-2.0",
+  "author": {
+    "name": "Daniel Bannert",
+    "email": "d.bannert@anolilab.de"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/anolilab/lunora.git",
     "directory": "packages/advisor"
   },
-  "bugs": {
-    "url": "https://github.com/anolilab/lunora/issues"
-  },
-  "keywords": [
-    "lunora",
-    "cloudflare",
-    "workers",
-    "durable-objects",
-    "lint",
-    "advisor",
-    "schema",
-    "splinter"
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE.md",
+    "__assets__"
   ],
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.mjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs"
+    },
+    "./package.json": "./package.json"
+  },
   "publishConfig": {
     "access": "public"
   },
-  "files": [
-    "README.md"
-  ]
+  "dependencies": {
+    "@lunora/server": "1.0.0-alpha.1"
+  },
+  "engines": {
+    "node": "^22.15.0 || >=24.11.0"
+  }
 }