@lunora/advisor 1.0.0-alpha.1 → 1.0.0-alpha.11

package/dist/index.d.mts

@@ -214,6 +214,28 @@ interface AdvisorMaskProcedure {
   visibility: "internal" | "public";
 }
 /**
+* One whole-row `ctx.db.replace(id, document)` write discovered inside a custom
+* mutator's authoritative `server` impl (`lunora/mutators.ts`) — the input the
+* `mutator_full_row_replace` lint consumes.
+*
+* In the local-first sync engine a `replace` overwrites the entire row, so a
+* concurrent edit to a *different* column (committed between this mutator's read
+* and its write) is silently clobbered. `patch(id, { onlyTheField })` merges at
+* the column level instead, letting independent field edits coexist — the
+* blessed pattern for mutators on a synced (poke-live) table. Produced by the
+* codegen feeder, which attributes each `replace` to the mutator export
+* performing it; runtime callers don't supply it, so the lint finds nothing
+* there.
+*/
+interface AdvisorMutatorWrite {
+  /** The mutator export whose `server` impl performs the replace (e.g. `renameChannel`). */
+  exportName: string;
+  /** Openable source path the replace appears in — always `lunora/mutators.ts`. */
+  file: string;
+  /** 1-based line of the `replace(...)` call, or `0` when unknown. */
+  line: number;
+}
+/**
 * One non-deterministic API call discovered lexically inside a `query(...)` or
 * `mutation(...)` handler body — the input the `nondeterministic_query_mutation`
 * lint consumes. Produced by the codegen feeder, which walks each exported
@@ -285,6 +307,33 @@ interface AdvisorQueryRead {
   table: string;
 }
 /**
+* One `ctx.r2sql` access discovered lexically inside a `query(...)` or
+* `mutation(...)` handler body — the input the `r2sql_outside_action` lint
+* consumes. Produced by the codegen feeder, which walks each exported function's
+* handler with ts-morph and records reads of the R2 SQL `ctx.r2sql` surface
+* (`ctx.r2sql.query(...)`, `ctx.r2sql.from(...)`, …).
+*
+* R2 SQL queries Apache Iceberg tables over an **external** REST endpoint Lunora
+* does not own (there is no Workers binding): a `ctx.r2sql` call is a network
+* round-trip with a mutable result (non-deterministic, like `fetch`) and its
+* reads are invisible to Lunora live queries. It therefore belongs **only** in
+* `action(...)` handlers. Calls inside `action(...)` are intentionally **not**
+* recorded — actions are the escape hatch. Runtime callers don't supply this, so
+* the lint finds nothing there.
+*/
+interface AdvisorR2sqlCall {
+  /** The accessed `ctx.r2sql` surface, e.g. `ctx.r2sql.query` / `ctx.r2sql.from`. */
+  callee: string;
+  /** The exported function performing the access (e.g. `topPerRegion`). */
+  exportName: string;
+  /** Source file the access appears in (relative to the lunora dir, no extension). */
+  file: string;
+  /** Which procedure kind the access lives in — only `query`/`mutation` are flagged; actions are exempt. */
+  kind: "mutation" | "query";
+  /** 1-based line of the access, or `0` when unknown. */
+  line: number;
+}
+/**
 * One procedure (query / mutation / action) discovered in the lunora source,
 * reduced to the facts the `rls_uncovered_table` lint needs: whether the
 * procedure's builder chain includes `.use(rls(...))`, and which tables the
@@ -336,6 +385,14 @@ interface AdvisorTable {
   */
   externallyManaged?: boolean;
   /**
+  * Set when the table was declared with `.source(...)` (plan 077) —
+  * materialized from an external Hyperdrive-backed database. Read by the
+  * `external_source_*` lints to enforce the tenant-scope boundary (mandatory
+  * `tenantBy` under `.shardBy()`) and reject sourcing a `.global()` table.
+  * Optional — feeders that don't know about sourced tables omit it.
+  */
+  externalSource?: AdvisorExternalSource;
+  /**
   * Declared column names (the `defineTable({...})` keys). Excludes the
   * framework-managed system fields `_id` / `_creationTime`, which every table
   * has implicitly — lints that resolve a column treat those as always valid.
@@ -357,6 +414,16 @@ interface AdvisorTable {
   optionalFields?: ReadonlySet<string>;
   /** Declared relations (`.relations((r) => …)`). */
   relations: ReadonlyArray<AdvisorRelation>;
+  /**
+  * Storage tier the table is declared in: `"global"` (a `.global()` table,
+  * lives in D1 — the cross-shard tier), `"shardBy"` (partitioned across
+  * shard DOs by a key), or `"root"` (the default single-DO table). Read by
+  * the `shape_*` lints to flag replication shapes targeting a `.global()`
+  * table (poll-refreshed/latency-tiered, not poke-live). Optional — the
+  * codegen feeder always supplies it, the runtime feeder derives it; a feeder
+  * that omits it leaves tier-sensitive lints to treat the table as local.
+  */
+  shardKind?: "global" | "root" | "shardBy";
 }
 /**
 * One declared index, flattened across Lunora's index kinds so a single lint can
@@ -373,6 +440,21 @@ interface AdvisorIndex {
   name: string;
   unique?: boolean;
 }
+/** The statically-knowable `.source(...)` bits the `external_source_*` lints read. */
+interface AdvisorExternalSource {
+  /** `true` when a `reconcileEveryMs` was given (the incremental-mode delete-visibility companion). */
+  hasReconcile?: boolean;
+  /** `true` when a `tenantBy` mapper was given — the tenant-isolation boundary. */
+  hasTenantBy: boolean;
+  /** Delete-detection mode literal, when given (`"full-pull"` | `"incremental"`). */
+  mode?: string;
+  /**
+  * `true` when `.source(...)` was declared but its config wasn't a static object
+  * literal, so `hasTenantBy` (and the rest) couldn't be read. Only the codegen
+  * feeder can hit this; the runtime feeder always holds the real config.
+  */
+  unanalyzable?: boolean;
+}
 /**
 * One declared relation. For a `one` relation the FK column `field` lives on
 * the holding table; for `many` it lives on the target. `name` is the accessor
@@ -413,6 +495,28 @@ interface AdvisorSecretLiteral {
   preview: string;
 }
 /**
+* A replication shape declared via `defineShape({ table, where, columns? })` in
+* `lunora/shapes.ts` (the local-first sync engine's partial-replication unit).
+* The `shape_*` lints cross-reference each shape's {@link AdvisorShape.table}
+* against the declared schema to flag a shape targeting an unknown table or a
+* `.global()` table (which replicates through the latency-tiered D1 poll path,
+* not the poke-live op-log). Supplied by the codegen feeder, which lifts only
+* the export name + the static `table` literal; absent for runtime callers,
+* where the shape lints find nothing.
+*/
+interface AdvisorShape {
+  /** Export binding name — the shape's registry key (e.g. `channelMessages`). */
+  exportName: string;
+  /** File the shape is declared in (relative, for the operator to open). */
+  file: string;
+  /**
+  * The `table` string literal the shape replicates from, or `undefined` when
+  * the feeder could not read it as a plain string literal — tier-sensitive
+  * lints skip a shape with no resolvable table rather than guessing.
+  */
+  table?: string;
+}
+/**
 * One shard's observed traffic share — the input the `hot_shard` runtime lint
 * consumes. Produced by the studio backend, which fans out over a sharded
 * function's shards and reads each shard's recorded request volume from the
@@ -496,10 +600,27 @@ interface AdvisorTableSample {
 * how `AdvisorContainer` tracks `ContainerIR` and `AdvisorInsertWrite` tracks
 * `InsertWriteIR`).
 */
+/** One durable step call lifted from a workflow handler body — the input the duplicate-step-name lint compares. Structural subset of codegen's `WorkflowStepIR`. */
+interface AdvisorWorkflowStep {
+  /** 1-based line of the durable step call, or `0` when unknown. */
+  line: number;
+  /** The native step method invoked: `do` / `sleep` / `sleepUntil` / `waitForEvent`. */
+  method: string;
+  /** The step's static label (the first string-literal argument). */
+  name: string;
+}
 /** One workflow declared via a `defineWorkflow()` export in `lunora/workflows.ts`. */
 interface AdvisorWorkflow {
   /** The `lunora/workflows.ts` export name, e.g. `orderPipeline`. */
   exportName: string;
+  /**
+  * The durable step labels discovered in the handler body, in source order —
+  * the duplicate-step-name input. Cloudflare memoizes a step by its name, so a
+  * name used twice makes the second call silently return the first's cached
+  * result. Supplied by the codegen feeder; `undefined` for runtime callers,
+  * where the lint finds nothing.
+  */
+  steps?: ReadonlyArray<AdvisorWorkflowStep>;
 }
 /** One `ctx.workflows.get("name")` call discovered in a function body. */
 interface AdvisorWorkflowCall {
@@ -633,6 +754,14 @@ interface LintContext {
   */
   maskProcedures?: ReadonlyArray<AdvisorMaskProcedure>;
   /**
+  * Whole-row `ctx.db.replace(id, document)` writes lifted from custom
+  * mutators' authoritative `server` impls (the `mutator_full_row_replace`
+  * input). Each `replace` overwrites the entire row, clobbering a concurrent
+  * edit to a different column on a synced table. Supplied by the codegen
+  * feeder; absent for runtime callers, where the lint finds nothing.
+  */
+  mutatorWrites?: ReadonlyArray<AdvisorMutatorWrite>;
+  /**
   * Non-deterministic API calls (`Date.now`, `Math.random`,
   * `crypto.randomUUID`, `crypto.getRandomValues`, `fetch`) discovered lexically
   * inside `query`/`mutation` handler bodies — the `nondeterministic_query_mutation`
@@ -657,6 +786,13 @@ interface LintContext {
   */
   queries?: ReadonlyArray<AdvisorQueryRead>;
   /**
+  * R2 SQL `ctx.r2sql` accesses discovered lexically inside `query`/`mutation`
+  * handler bodies — the `r2sql_outside_action` input. Supplied by the codegen
+  * feeder, which omits `action` handlers (where `ctx.r2sql` is the typed,
+  * intended surface); absent for runtime callers, where the lint finds nothing.
+  */
+  r2sqlCalls?: ReadonlyArray<AdvisorR2sqlCall>;
+  /**
   * Per-procedure RLS usage discovered in function bodies (the
   * `rls_uncovered_table` input). Carries whether each procedure's builder chain
   * includes `.use(rls(...))`, which tables the procedure reads/writes, and which
@@ -674,6 +810,14 @@ interface LintContext {
   */
   secretLiterals?: ReadonlyArray<AdvisorSecretLiteral>;
   /**
+  * Replication shapes declared via `defineShape` in `lunora/shapes.ts` — the
+  * `shape_unknown_table` and `shape_targets_global_table` lint input. Each
+  * carries the export name and its static `table` literal, cross-referenced
+  * against {@link LintContext.schema}. Supplied by the codegen feeder; absent
+  * for runtime callers, where the shape lints find nothing.
+  */
+  shapes?: ReadonlyArray<AdvisorShape>;
+  /**
   * Per-shard observed traffic — the `hot_shard` lint input. Supplied by the
   * studio backend, which fans out over a sharded function's shards and reads
   * each shard's recorded request volume from the durable `__lunora_metrics`
@@ -752,9 +896,9 @@ interface Lint {
   title: string;
 }
 /**
-* Minimal structural view of the `@lunora/analytics` SQL client — just its
+* Minimal structural view of the `@lunora/bindings/analytics` SQL client — just its
 * `query(sql)` method. Kept structural (not an `import type` from
-* `@lunora/analytics`) so the advisor needn't depend on the analytics package;
+* `@lunora/bindings/analytics`) so the advisor needn't depend on the analytics package;
 * the real `AnalyticsSqlClient` satisfies it, as does a plain test double.
 */
 interface AnalyticsMetricsSource {
@@ -997,6 +1141,40 @@ declare const duplicateIndex: Lint;
 */
 declare const emptyIndex: Lint;
 /**
+* Flags a table that is both `.source(...)` and `.global()`.
+*
+* The two are contradictory. `.global()` already places a table in an external
+* store (D1, or a Hyperdrive-fronted Postgres/MySQL) that Lunora owns the schema
+* for and reads through the global backend. `.source(...)` declares the table as
+* **materialized from** an external database into a shard DO's SQLite by the
+* ingest poll loop. A table cannot simultaneously live in the global tier and be
+* polled into per-shard SQLite — the ingest loop has no DO-local table to write,
+* and the global backend has no poll loop. This is a definite misconfiguration,
+* so it is an `ERROR`.
+*
+* **Evidence supply**: reads `table.externalSource` + `table.shardKind`. Skipped
+* unless both a sourced declaration and the `global` tier are present.
+*/
+declare const externalSourceOnGlobal: Lint;
+/**
+* Flags a `.source(...)` + `.shardBy(...)` table that has no `tenantBy` mapper.
+*
+* Per-shard SQLite isolation only controls *where* materialized rows land — not
+* what* the ingest query pulls. A sourced + sharded table whose `tenantBy` is
+* absent runs the same unscoped membership query on every tenant's Durable
+* Object, so each agent replicates the **entire** multitenant table into its own
+* SQLite (and then to its clients via `defineShape`). That is a cross-tenant data
+* leak, not a performance nit — so it is an `ERROR` that fails the build.
+*
+* `tenantBy(shardKey)` is the boundary: it binds this DO's shard key into the
+* query's parameters so the tenant can only ever pull its own rows.
+*
+* **Evidence supply**: reads `table.externalSource` (the codegen feeder captures
+* it from `.source({...})`; the runtime feeder derives it). A table without a
+* sourced declaration, or one not sharded, is skipped.
+*/
+declare const externalSourceUnscoped: Lint;
+/**
 * Flags a query read that calls `.filter()` without first narrowing with
 * `.withIndex()` / `.withSearchIndex()`. Such a read loads *every* row of the
 * table and applies the predicate in memory — a full table scan that degrades
@@ -1099,6 +1277,30 @@ declare const indexReferencesUnknownField: Lint;
 */
 declare const maskUncoveredPiiColumn: Lint;
 /**
+* Flags a custom mutator whose authoritative `server` impl writes a row with
+* `ctx.db.replace(id, document)` — a whole-document overwrite.
+*
+* The local-first sync engine serializes mutators in the shard DO, so two
+* mutators that touch the *same row* but *different columns* both run to
+* completion — but only if each writes its own column. A `replace` overwrites
+* the entire row from the document the mutator assembled, so a concurrent edit
+* to another column (committed between this mutator's read and its write, or
+* carried as a pending optimistic overlay on a client) is silently clobbered:
+* the kind of "two offline edits to different fields fight each other" data loss
+* a column-level merge avoids. `ctx.db.patch(id, { onlyTheChangedField })`
+* merges at the column level instead, so independent field edits coexist.
+*
+* `WARN`, not `ERROR`: `replace` is legitimate when the mutator genuinely owns
+* the whole row (a full-form save, a state-machine transition that rewrites
+* every field). The lint just surfaces the column-clobber risk so a developer
+* reaches for `patch` by default on a synced table.
+*
+* **Evidence supply**: runs only when the codegen feeder supplies
+* `context.mutatorWrites` (each a `replace` call lifted from a mutator's inline
+* `server` body); absent for runtime callers, where the lint finds nothing.
+*/
+declare const mutatorFullRowReplace: Lint;
+/**
 * Flags a non-deterministic API call inside a `query(...)` or `mutation(...)`
 * handler body.
 *
@@ -1172,6 +1374,31 @@ declare const publicArgumentUsesAny: Lint;
 */
 declare const publicMutationWithoutRatelimit: Lint;
 /**
+* Flags an R2 SQL `ctx.r2sql` access inside a `query(...)` or `mutation(...)`
+* handler body.
+*
+* R2 SQL (`@lunora/bindings/r2sql`) queries Apache Iceberg tables over an **external**
+* REST endpoint Lunora does not own — there is no Workers binding, every query
+* is an HTTPS round-trip. A `ctx.r2sql` query is therefore non-deterministic
+* (exactly like `fetch`), which breaks the determinism the coordinator relies on
+* when it re-runs a query on subscription re-evaluation or a mutation on OCC
+* retry. And R2 SQL reads are invisible to the DO/SQLite change-feed, so a
+* subscription will never re-fire on them. `ctx.r2sql` is therefore wired onto
+* `ActionCtx` **only** and belongs exclusively in `action(...)` handlers; using
+* it in a query/mutation is the same class of bug as `fetch`/`Date.now`.
+*
+* This mirrors `hyperdrive_outside_action` — the action-only enforcement teeth
+* for external, non-reactive I/O. Runtime enforcement is still absent (see
+* `MEMORY.md` "Query/mutation determinism not enforced"), so the lint is the
+* guardrail.
+*
+* This lint runs when the codegen feeder has supplied access evidence
+* (`context.r2sqlCalls` present); a runtime caller with no evidence flags nothing
+* rather than raising false alarms. The feeder records accesses only inside
+* `query`/`mutation` handlers, so `action(...)` bodies never reach here.
+*/
+declare const r2sqlOutsideAction: Lint;
+/**
 * A correctness lint covering the columns a relation wires together: the FK
 * `field` and the `references` column must each exist on their respective
 * tables, or the join can never resolve. Caught here at codegen time rather
@@ -1226,6 +1453,48 @@ declare const relationReferencesUnknownTable: Lint;
 */
 declare const rlsUncoveredTable: Lint;
 /**
+* Flags a replication shape whose `table` is a `.global()` table.
+*
+* Poke-live replication is a per-shard-DO property: the shard owns its SQLite
+* and a monotonic `__cdc_log`, so a write produces an ordered op the DO pokes to
+* every subscriber at the next flush. A `.global()` table lives outside the
+* shard DO's SQLite op-log (in a global backend — D1, or Hyperdrive-fronted
+* Postgres/MySQL) — so a shape over a global table cannot be poke-live. It is
+* served through the cross-shard tier: **coordinator/poll-refreshed, latency-
+* tiered**, not live. That is a real and supported tier (it is the recommended
+* answer for cross-shard reads — denormalize, or move the joined table to
+* `.global()` and read through the global backend), but its freshness semantics
+* differ from a sharded shape's, so the boundary is surfaced rather than hidden.
+*
+* `WARN`, not `ERROR`: a global-table shape is a legitimate design once you
+* accept the poll-refresh latency; the lint just makes the tier explicit so a
+* developer does not assume poke-live freshness.
+*
+* **Evidence supply**: runs only when the codegen feeder supplies
+* `context.shapes`; the table's tier comes from the schema's `shardKind`. A
+* shape whose table is unknown (caught by `shape_unknown_table`) or whose tier
+* the feeder didn't supply is skipped.
+*/
+declare const shapeTargetsGlobalTable: Lint;
+/**
+* Flags a replication shape whose `table` names a table that does not exist in
+* the schema.
+*
+* `defineShape({ table: "messages", … })` binds a shape to a table by a plain
+* string. A live `subscribeShape("…")` resolves that shape server-side and runs
+* its membership query against the named table — so a typo, a stale name after a
+* rename, or a copy-paste mistake produces a shape that can never resolve a
+* rowset: the subscription seeds empty and then errors at the first flush
+* (`no such table`). This is a definite, build-time-detectable break, so it is
+* an `ERROR` — surfaced before the broken shape ever ships.
+*
+* **Evidence supply**: runs only when the codegen feeder supplies
+* `context.shapes`. A shape whose `table` wasn't a static string literal (no
+* resolvable name) is skipped rather than guessed at, so the lint under-reports
+* rather than raising false alarms.
+*/
+declare const shapeUnknownTable: Lint;
+/**
 * Flags a `ctx.sql` tagged-template that splices an unparameterized
 * string-building expression into the query.
 *
@@ -1328,6 +1597,25 @@ declare const unindexedRelationTarget: Lint;
 */
 declare const userCreatingMutationWithoutCaptcha: Lint;
 /**
+* Flags a durable step name reused within one workflow.
+*
+* Cloudflare Workflows memoizes every `step.do` / `step.sleep` / `step.sleepUntil`
+* / `step.waitForEvent` call by its name: on replay the runtime returns the cached
+* result for a name it has already seen. Two distinct steps that share a name are
+* therefore a silent bug — the second call never runs its body and instead yields
+* the first's result, skipping the work (a charge, a write, an external wait)
+* without error. Hence `ERROR`/`INTERNAL`: it is a developer-facing correctness
+* defect in the workflow's own code, not a runtime-data nit.
+*
+* Only the first string-literal argument of each step call is compared; a step
+* named dynamically (`step.do(\`load-${id}\`, …)`) is omitted by the feeder, so a
+* deliberately-parameterized fan-out is never flagged. `ctx.runStep(stepDef, …)`
+* names (which come from `defineStep` in another file) are out of scope here.
+* Only runs when the declaration feeder supplied step evidence
+* (`workflow.steps` present); a runtime caller flags nothing.
+*/
+declare const workflowDuplicateStepName: Lint;
+/**
 * A correctness lint: every `ctx.workflows.get("name")` call must reference a
 * workflow that exists — i.e. a `defineWorkflow` export in `lunora/workflows.ts`.
 * A `.get("x")` whose `"x"` resolves to no declared workflow is a typo or a
@@ -1389,4 +1677,4 @@ interface RunAdvisorOptions {
 * `static` lints at build time and defer `runtime` lints to a live shard.
 */
 declare const runAdvisor: (context: LintContext, options?: RunAdvisorOptions) => Finding[];
-export { AE_METRIC_EVENTS, ALL_LINTS, type AdvisorAdminRoute, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorContainer, type AdvisorHyperdriveCall, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorMaskProcedure, type AdvisorNondeterministicCall, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorRelation, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShardTraffic, type AdvisorSqlInterpolation, type AdvisorTable, type AdvisorTableSample, type AdvisorTableScan, type AdvisorWorkflow, type AdvisorWorkflowCall, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type Category, type Facing, type Finding, type Level, type Lint, type LintContext, type LintSource, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, adminRouteWithoutGuard, authApiCallWithoutHeaders, circularFk, constraintValidator, containerOversizedInstance, containerPublicInternet, duplicateIndex, emptyIndex, filterWithoutIndex, fromServerSchema, hardcodedSecret, hotShard, hyperdriveOutsideAction, indexReferencesUnknownField, indexUtilization, loadAnalyticsRuntimeMetrics, maskUncoveredPiiColumn, nondeterministicQueryMutation, policyReferencesUnknownTable, publicArgumentUsesAny, publicMutationWithoutRatelimit, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, sqlInjectionRisk, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, workflowUnknownTarget, workflowUnused };
+export { AE_METRIC_EVENTS, ALL_LINTS, type AdvisorAdminRoute, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorContainer, type AdvisorHyperdriveCall, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorMaskProcedure, type AdvisorMutatorWrite, type AdvisorNondeterministicCall, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorR2sqlCall, type AdvisorRelation, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShape, type AdvisorShardTraffic, type AdvisorSqlInterpolation, type AdvisorTable, type AdvisorTableSample, type AdvisorTableScan, type AdvisorWorkflow, type AdvisorWorkflowCall, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type Category, type Facing, type Finding, type Level, type Lint, type LintContext, type LintSource, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, adminRouteWithoutGuard, authApiCallWithoutHeaders, circularFk, constraintValidator, containerOversizedInstance, containerPublicInternet, duplicateIndex, emptyIndex, externalSourceOnGlobal, externalSourceUnscoped, filterWithoutIndex, fromServerSchema, hardcodedSecret, hotShard, hyperdriveOutsideAction, indexReferencesUnknownField, indexUtilization, loadAnalyticsRuntimeMetrics, maskUncoveredPiiColumn, mutatorFullRowReplace, nondeterministicQueryMutation, policyReferencesUnknownTable, publicArgumentUsesAny, publicMutationWithoutRatelimit, r2sqlOutsideAction, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, sqlInjectionRisk, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };