@lunora/advisor 1.0.0-alpha.195 → 1.0.0-alpha.197

package/dist/index.d.mts

@@ -1230,6 +1230,8 @@ interface AdvisorQueue {
    * flagged for lacking its own DLQ.
    */
   name: string;
+  /** Set for a `defineSubscription(topic, …)` export: the `defineTopic` export it consumes. */
+  topic?: string;
   /** Push-consumer batch/retry tuning; the `deadLetterQueue`/`maxRetries` the queue lints read. */
   tuning: AdvisorQueueTuning;
 }
@@ -2266,7 +2268,8 @@ interface LintContext {
   queries?: ReadonlyArray<AdvisorQueryRead>;
   /**
    * Queues declared via `defineQueue` exports in `lunora/queues.ts` — the
-   * declaration-side input for the `queue_*` lints (`queue_without_dlq`).
+   * declaration-side input for `queue_without_dlq` and, through each
+   * subscription's `topic`, `topic_too_many_subscriptions`.
    * Supplied by the codegen feeder; absent for runtime callers, where the
    * queue lints find nothing.
    */
@@ -4368,6 +4371,22 @@ declare const storageUploadWithoutMaxSize: Lint;
  * a runtime caller with no insert signal flags nothing rather than every table.
  */
 declare const tableWithoutInsert: Lint;
+/**
+ * Flags a topic with more than {@link MAX_SUBSCRIPTIONS} subscriptions.
+ *
+ * Each subscription is its own queue, so `ctx.topics.<name>.publish` is one
+ * `send` per subscription. A Worker invocation holds at most six connections
+ * waiting on a response, Queues `send` included, so past six the sends wait on
+ * each other and the publish costs several round trips inside the mutation or
+ * action that made it. The fan-out is also not atomic: one failed send rejects
+ * the publish, and the caller's retry re-delivers to every subscription that
+ * already got its copy, so duplicates grow with the count. `INFO`: a large
+ * fan-out can be deliberate.
+ *
+ * Only runs when the declaration feeder supplied evidence (`context.queues`
+ * present); a runtime caller flags nothing.
+ */
+declare const topicTooManySubscriptions: Lint;
 /**
  * A correctness lint with no splinter analogue — Lunora's static edge again: the
  * `.ttl(field)` policy names an epoch-millisecond expiry column, and the DO alarm
@@ -4850,4 +4869,4 @@ interface RunAdvisorOptions {
  * `static` lints at build time and defer `runtime` lints to a live shard.
  */
 declare const runAdvisor: (context: LintContext, options?: RunAdvisorOptions) => Finding[];
-export { ALL_LINTS, type AdvisorAdminRoute, type AdvisorAiRawRun, type AdvisorAiToolSideEffect, type AdvisorArgumentDerivedFetch, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorAuthConfig, type AdvisorBrowserUrlAccess, type AdvisorCallSiteScope, type AdvisorConfigCall, type AdvisorContainer, type AdvisorContainerKeyAccess, type AdvisorContainerOverride, type AdvisorExportSink, type AdvisorFailOpenGuard, type AdvisorFlagRead, type AdvisorFlagSecurityDefault, type AdvisorGeoIndexUsage, type AdvisorHttpActionGuard, type AdvisorHttpHeaderWrite, type AdvisorHyperdriveCall, type AdvisorIdentityClaimRead, type AdvisorImageDeliveryUrlAccess, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorKvKeyAccess, type AdvisorMailRecipientAccess, type AdvisorMap, type AdvisorMaskProcedure, type AdvisorMaskStrategy, type AdvisorModule, type AdvisorMutatorDeclaration, type AdvisorMutatorWrite, type AdvisorNondeterministicCall, type AdvisorNormalizeIdAuthorization, type AdvisorNotifyCall, type AdvisorNotifyConfig, type AdvisorOwnerFieldWrite, type AdvisorPaymentWebhook, type AdvisorPrivilegedDispatch, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorQueue, type AdvisorQueueTuning, type AdvisorR2sqlCall, type AdvisorRatelimitKeySelector, type AdvisorRawRowReturn, type AdvisorRelation, type AdvisorRelationLoad, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShape, type AdvisorShardTraffic, type AdvisorSoftDeleteRead, type AdvisorSqlInterpolation, type AdvisorStaleMigrationImport, type AdvisorStorageKeyAccess, type AdvisorStorageUpload, type AdvisorTable, type AdvisorTableScan, type AdvisorTableWrite, type AdvisorVectorNamespaceAccess, type AdvisorWorkflow, type AdvisorWorkflowCall, type AdvisorWranglerVariable, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type BaselineComparison, type CallSiteMetadata, type Category, type CheckResult, type Coverage, type Facing, type Finding, type Grade, type Level, type Lint, type LintContext, type LintSource, MAP_VERSION, type MapSummary, type ProcedureDelta, type ProcedureScore, type ProjectScore, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, type ScoreAdvisorOptions, type Sensitivity, type SensitivityLevel, actionFetchSsrf, actionWithoutErrorHandling, adminRouteWithoutGuard, aiRawRunEscapeHatch, aiRunWithoutLogging, aiToolSideEffectPromptInjection, aiUnboundedGenerationPublic, allowUnauthenticatedShardAccessEnabled, authApiCallWithoutHeaders, authCsrfCheckDisabled, authEmailVerificationDisabled, authScimWithoutTransactions, authSecureCookiesDisabled, authSessionFreshageZero, authTrustedOriginsWildcard, browserAllowPrivateTargets, browserUserUrlWithoutAllowlist, byCodepoint, callSiteCallers, callSiteDescription, callSiteLabel, callSiteMetadata, circularFk, classifySensitivity, commitOrderedHardDelete, compareToBaseline, containerInstanceKeyFromUserInput, containerOversizedInstance, containerPublicInternet, containerRuntimeEgressRelaxation, containerStartEnableInternetOverride, crossModuleTableWrite, dedupeCacheKeys, duplicateIndex, emptyIndex, errorWithoutCatalog, exportSinkMisconfigured, externalSourceIncrementalNoDeletePath, externalSourceOnGlobal, externalSourceUnscoped, fanOutBreadth, filterOnPrimaryKey, filterWithoutIndex, flagGatesSecurityWithUnsafeDefault, flagReadInSubscription, fromServerSchema, geoIndexFieldNotGeopoint, geoIndexUnused, globalTableNearColumnLimit, gradeFromScore, hardcodedSecret, helperRole, hotShard, httpActionMissingAuthGuard, httpActionResponseHeaderInjection, hyperdriveOutsideAction, identityUndeclaredClaimTrusted, imagesUrlSourceFromUserInput, indexReferencesUnknownField, indexUtilization, insertManyUnsafeUserData, isReachableSite, kvUnscopedUserKeyIdor, mailInboundDispatchWithoutVerify, mailRecipientFromRequestInput, maskUncoveredPiiColumn, maskWeakHashStrategyOnPii, maskedRelationLeakViaWith, mutatorFullRowReplace, mutatorWithoutOwnerScope, nondeterministicQueryMutation, normalizeIdUsedAsAuthorization, notifyMissingPushConfig, notifySendOutsideAction, outputProjectionMissingOnPublicRead, ownerFieldFromArgsNotAuth, parseAdvisorMap, paymentCreateWithoutAuthorize, paymentWebhookWideTolerance, plaintextSecretInWranglerVariables, policyReferencesUnknownTable, privilegedDispatchUnvalidatedPayload, privilegedFanoutFromPublicProcedure, procedureWithoutStructuredEvent, publicArgumentUsesAny, publicMutationWithoutRatelimit, publicTableRlsOptoutConfusion, queueWithoutDlq, r2sqlOutsideAction, ratelimitDefaultMemoryStore, ratelimitKeySpoofableOrGlobal, ratelimitMiddlewareFailOpen, readCallSiteCallers, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, scoreAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, signupMutationWithoutDisposableGating, softDeleteIncludeDeletedFromArgs, sqlInjectionRisk, storageGenerateUploadUrlNoContentTypePin, storageKeyFromUserArgs, storagePresignedUrlForPrivateContent, storageUploadWithoutContentTypeAllowlist, storageUploadWithoutMaxSize, tableWithoutInsert, ttlFieldNotTimestamp, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, unrestrictedWhereBranch, userCreatingMutationWithoutCaptcha, vectorsNamespaceFromUserInput, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };
+export { ALL_LINTS, type AdvisorAdminRoute, type AdvisorAiRawRun, type AdvisorAiToolSideEffect, type AdvisorArgumentDerivedFetch, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorAuthConfig, type AdvisorBrowserUrlAccess, type AdvisorCallSiteScope, type AdvisorConfigCall, type AdvisorContainer, type AdvisorContainerKeyAccess, type AdvisorContainerOverride, type AdvisorExportSink, type AdvisorFailOpenGuard, type AdvisorFlagRead, type AdvisorFlagSecurityDefault, type AdvisorGeoIndexUsage, type AdvisorHttpActionGuard, type AdvisorHttpHeaderWrite, type AdvisorHyperdriveCall, type AdvisorIdentityClaimRead, type AdvisorImageDeliveryUrlAccess, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorKvKeyAccess, type AdvisorMailRecipientAccess, type AdvisorMap, type AdvisorMaskProcedure, type AdvisorMaskStrategy, type AdvisorModule, type AdvisorMutatorDeclaration, type AdvisorMutatorWrite, type AdvisorNondeterministicCall, type AdvisorNormalizeIdAuthorization, type AdvisorNotifyCall, type AdvisorNotifyConfig, type AdvisorOwnerFieldWrite, type AdvisorPaymentWebhook, type AdvisorPrivilegedDispatch, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorQueue, type AdvisorQueueTuning, type AdvisorR2sqlCall, type AdvisorRatelimitKeySelector, type AdvisorRawRowReturn, type AdvisorRelation, type AdvisorRelationLoad, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShape, type AdvisorShardTraffic, type AdvisorSoftDeleteRead, type AdvisorSqlInterpolation, type AdvisorStaleMigrationImport, type AdvisorStorageKeyAccess, type AdvisorStorageUpload, type AdvisorTable, type AdvisorTableScan, type AdvisorTableWrite, type AdvisorVectorNamespaceAccess, type AdvisorWorkflow, type AdvisorWorkflowCall, type AdvisorWranglerVariable, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type BaselineComparison, type CallSiteMetadata, type Category, type CheckResult, type Coverage, type Facing, type Finding, type Grade, type Level, type Lint, type LintContext, type LintSource, MAP_VERSION, type MapSummary, type ProcedureDelta, type ProcedureScore, type ProjectScore, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, type ScoreAdvisorOptions, type Sensitivity, type SensitivityLevel, actionFetchSsrf, actionWithoutErrorHandling, adminRouteWithoutGuard, aiRawRunEscapeHatch, aiRunWithoutLogging, aiToolSideEffectPromptInjection, aiUnboundedGenerationPublic, allowUnauthenticatedShardAccessEnabled, authApiCallWithoutHeaders, authCsrfCheckDisabled, authEmailVerificationDisabled, authScimWithoutTransactions, authSecureCookiesDisabled, authSessionFreshageZero, authTrustedOriginsWildcard, browserAllowPrivateTargets, browserUserUrlWithoutAllowlist, byCodepoint, callSiteCallers, callSiteDescription, callSiteLabel, callSiteMetadata, circularFk, classifySensitivity, commitOrderedHardDelete, compareToBaseline, containerInstanceKeyFromUserInput, containerOversizedInstance, containerPublicInternet, containerRuntimeEgressRelaxation, containerStartEnableInternetOverride, crossModuleTableWrite, dedupeCacheKeys, duplicateIndex, emptyIndex, errorWithoutCatalog, exportSinkMisconfigured, externalSourceIncrementalNoDeletePath, externalSourceOnGlobal, externalSourceUnscoped, fanOutBreadth, filterOnPrimaryKey, filterWithoutIndex, flagGatesSecurityWithUnsafeDefault, flagReadInSubscription, fromServerSchema, geoIndexFieldNotGeopoint, geoIndexUnused, globalTableNearColumnLimit, gradeFromScore, hardcodedSecret, helperRole, hotShard, httpActionMissingAuthGuard, httpActionResponseHeaderInjection, hyperdriveOutsideAction, identityUndeclaredClaimTrusted, imagesUrlSourceFromUserInput, indexReferencesUnknownField, indexUtilization, insertManyUnsafeUserData, isReachableSite, kvUnscopedUserKeyIdor, mailInboundDispatchWithoutVerify, mailRecipientFromRequestInput, maskUncoveredPiiColumn, maskWeakHashStrategyOnPii, maskedRelationLeakViaWith, mutatorFullRowReplace, mutatorWithoutOwnerScope, nondeterministicQueryMutation, normalizeIdUsedAsAuthorization, notifyMissingPushConfig, notifySendOutsideAction, outputProjectionMissingOnPublicRead, ownerFieldFromArgsNotAuth, parseAdvisorMap, paymentCreateWithoutAuthorize, paymentWebhookWideTolerance, plaintextSecretInWranglerVariables, policyReferencesUnknownTable, privilegedDispatchUnvalidatedPayload, privilegedFanoutFromPublicProcedure, procedureWithoutStructuredEvent, publicArgumentUsesAny, publicMutationWithoutRatelimit, publicTableRlsOptoutConfusion, queueWithoutDlq, r2sqlOutsideAction, ratelimitDefaultMemoryStore, ratelimitKeySpoofableOrGlobal, ratelimitMiddlewareFailOpen, readCallSiteCallers, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, scoreAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, signupMutationWithoutDisposableGating, softDeleteIncludeDeletedFromArgs, sqlInjectionRisk, storageGenerateUploadUrlNoContentTypePin, storageKeyFromUserArgs, storagePresignedUrlForPrivateContent, storageUploadWithoutContentTypeAllowlist, storageUploadWithoutMaxSize, tableWithoutInsert, topicTooManySubscriptions, ttlFieldNotTimestamp, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, unrestrictedWhereBranch, userCreatingMutationWithoutCaptcha, vectorsNamespaceFromUserInput, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };

package/dist/index.d.ts

@@ -1230,6 +1230,8 @@ interface AdvisorQueue {
    * flagged for lacking its own DLQ.
    */
   name: string;
+  /** Set for a `defineSubscription(topic, …)` export: the `defineTopic` export it consumes. */
+  topic?: string;
   /** Push-consumer batch/retry tuning; the `deadLetterQueue`/`maxRetries` the queue lints read. */
   tuning: AdvisorQueueTuning;
 }
@@ -2266,7 +2268,8 @@ interface LintContext {
   queries?: ReadonlyArray<AdvisorQueryRead>;
   /**
    * Queues declared via `defineQueue` exports in `lunora/queues.ts` — the
-   * declaration-side input for the `queue_*` lints (`queue_without_dlq`).
+   * declaration-side input for `queue_without_dlq` and, through each
+   * subscription's `topic`, `topic_too_many_subscriptions`.
    * Supplied by the codegen feeder; absent for runtime callers, where the
    * queue lints find nothing.
    */
@@ -4368,6 +4371,22 @@ declare const storageUploadWithoutMaxSize: Lint;
  * a runtime caller with no insert signal flags nothing rather than every table.
  */
 declare const tableWithoutInsert: Lint;
+/**
+ * Flags a topic with more than {@link MAX_SUBSCRIPTIONS} subscriptions.
+ *
+ * Each subscription is its own queue, so `ctx.topics.<name>.publish` is one
+ * `send` per subscription. A Worker invocation holds at most six connections
+ * waiting on a response, Queues `send` included, so past six the sends wait on
+ * each other and the publish costs several round trips inside the mutation or
+ * action that made it. The fan-out is also not atomic: one failed send rejects
+ * the publish, and the caller's retry re-delivers to every subscription that
+ * already got its copy, so duplicates grow with the count. `INFO`: a large
+ * fan-out can be deliberate.
+ *
+ * Only runs when the declaration feeder supplied evidence (`context.queues`
+ * present); a runtime caller flags nothing.
+ */
+declare const topicTooManySubscriptions: Lint;
 /**
  * A correctness lint with no splinter analogue — Lunora's static edge again: the
  * `.ttl(field)` policy names an epoch-millisecond expiry column, and the DO alarm
@@ -4850,4 +4869,4 @@ interface RunAdvisorOptions {
  * `static` lints at build time and defer `runtime` lints to a live shard.
  */
 declare const runAdvisor: (context: LintContext, options?: RunAdvisorOptions) => Finding[];
-export { ALL_LINTS, type AdvisorAdminRoute, type AdvisorAiRawRun, type AdvisorAiToolSideEffect, type AdvisorArgumentDerivedFetch, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorAuthConfig, type AdvisorBrowserUrlAccess, type AdvisorCallSiteScope, type AdvisorConfigCall, type AdvisorContainer, type AdvisorContainerKeyAccess, type AdvisorContainerOverride, type AdvisorExportSink, type AdvisorFailOpenGuard, type AdvisorFlagRead, type AdvisorFlagSecurityDefault, type AdvisorGeoIndexUsage, type AdvisorHttpActionGuard, type AdvisorHttpHeaderWrite, type AdvisorHyperdriveCall, type AdvisorIdentityClaimRead, type AdvisorImageDeliveryUrlAccess, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorKvKeyAccess, type AdvisorMailRecipientAccess, type AdvisorMap, type AdvisorMaskProcedure, type AdvisorMaskStrategy, type AdvisorModule, type AdvisorMutatorDeclaration, type AdvisorMutatorWrite, type AdvisorNondeterministicCall, type AdvisorNormalizeIdAuthorization, type AdvisorNotifyCall, type AdvisorNotifyConfig, type AdvisorOwnerFieldWrite, type AdvisorPaymentWebhook, type AdvisorPrivilegedDispatch, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorQueue, type AdvisorQueueTuning, type AdvisorR2sqlCall, type AdvisorRatelimitKeySelector, type AdvisorRawRowReturn, type AdvisorRelation, type AdvisorRelationLoad, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShape, type AdvisorShardTraffic, type AdvisorSoftDeleteRead, type AdvisorSqlInterpolation, type AdvisorStaleMigrationImport, type AdvisorStorageKeyAccess, type AdvisorStorageUpload, type AdvisorTable, type AdvisorTableScan, type AdvisorTableWrite, type AdvisorVectorNamespaceAccess, type AdvisorWorkflow, type AdvisorWorkflowCall, type AdvisorWranglerVariable, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type BaselineComparison, type CallSiteMetadata, type Category, type CheckResult, type Coverage, type Facing, type Finding, type Grade, type Level, type Lint, type LintContext, type LintSource, MAP_VERSION, type MapSummary, type ProcedureDelta, type ProcedureScore, type ProjectScore, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, type ScoreAdvisorOptions, type Sensitivity, type SensitivityLevel, actionFetchSsrf, actionWithoutErrorHandling, adminRouteWithoutGuard, aiRawRunEscapeHatch, aiRunWithoutLogging, aiToolSideEffectPromptInjection, aiUnboundedGenerationPublic, allowUnauthenticatedShardAccessEnabled, authApiCallWithoutHeaders, authCsrfCheckDisabled, authEmailVerificationDisabled, authScimWithoutTransactions, authSecureCookiesDisabled, authSessionFreshageZero, authTrustedOriginsWildcard, browserAllowPrivateTargets, browserUserUrlWithoutAllowlist, byCodepoint, callSiteCallers, callSiteDescription, callSiteLabel, callSiteMetadata, circularFk, classifySensitivity, commitOrderedHardDelete, compareToBaseline, containerInstanceKeyFromUserInput, containerOversizedInstance, containerPublicInternet, containerRuntimeEgressRelaxation, containerStartEnableInternetOverride, crossModuleTableWrite, dedupeCacheKeys, duplicateIndex, emptyIndex, errorWithoutCatalog, exportSinkMisconfigured, externalSourceIncrementalNoDeletePath, externalSourceOnGlobal, externalSourceUnscoped, fanOutBreadth, filterOnPrimaryKey, filterWithoutIndex, flagGatesSecurityWithUnsafeDefault, flagReadInSubscription, fromServerSchema, geoIndexFieldNotGeopoint, geoIndexUnused, globalTableNearColumnLimit, gradeFromScore, hardcodedSecret, helperRole, hotShard, httpActionMissingAuthGuard, httpActionResponseHeaderInjection, hyperdriveOutsideAction, identityUndeclaredClaimTrusted, imagesUrlSourceFromUserInput, indexReferencesUnknownField, indexUtilization, insertManyUnsafeUserData, isReachableSite, kvUnscopedUserKeyIdor, mailInboundDispatchWithoutVerify, mailRecipientFromRequestInput, maskUncoveredPiiColumn, maskWeakHashStrategyOnPii, maskedRelationLeakViaWith, mutatorFullRowReplace, mutatorWithoutOwnerScope, nondeterministicQueryMutation, normalizeIdUsedAsAuthorization, notifyMissingPushConfig, notifySendOutsideAction, outputProjectionMissingOnPublicRead, ownerFieldFromArgsNotAuth, parseAdvisorMap, paymentCreateWithoutAuthorize, paymentWebhookWideTolerance, plaintextSecretInWranglerVariables, policyReferencesUnknownTable, privilegedDispatchUnvalidatedPayload, privilegedFanoutFromPublicProcedure, procedureWithoutStructuredEvent, publicArgumentUsesAny, publicMutationWithoutRatelimit, publicTableRlsOptoutConfusion, queueWithoutDlq, r2sqlOutsideAction, ratelimitDefaultMemoryStore, ratelimitKeySpoofableOrGlobal, ratelimitMiddlewareFailOpen, readCallSiteCallers, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, scoreAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, signupMutationWithoutDisposableGating, softDeleteIncludeDeletedFromArgs, sqlInjectionRisk, storageGenerateUploadUrlNoContentTypePin, storageKeyFromUserArgs, storagePresignedUrlForPrivateContent, storageUploadWithoutContentTypeAllowlist, storageUploadWithoutMaxSize, tableWithoutInsert, ttlFieldNotTimestamp, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, unrestrictedWhereBranch, userCreatingMutationWithoutCaptcha, vectorsNamespaceFromUserInput, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };
+export { ALL_LINTS, type AdvisorAdminRoute, type AdvisorAiRawRun, type AdvisorAiToolSideEffect, type AdvisorArgumentDerivedFetch, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorAuthConfig, type AdvisorBrowserUrlAccess, type AdvisorCallSiteScope, type AdvisorConfigCall, type AdvisorContainer, type AdvisorContainerKeyAccess, type AdvisorContainerOverride, type AdvisorExportSink, type AdvisorFailOpenGuard, type AdvisorFlagRead, type AdvisorFlagSecurityDefault, type AdvisorGeoIndexUsage, type AdvisorHttpActionGuard, type AdvisorHttpHeaderWrite, type AdvisorHyperdriveCall, type AdvisorIdentityClaimRead, type AdvisorImageDeliveryUrlAccess, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorKvKeyAccess, type AdvisorMailRecipientAccess, type AdvisorMap, type AdvisorMaskProcedure, type AdvisorMaskStrategy, type AdvisorModule, type AdvisorMutatorDeclaration, type AdvisorMutatorWrite, type AdvisorNondeterministicCall, type AdvisorNormalizeIdAuthorization, type AdvisorNotifyCall, type AdvisorNotifyConfig, type AdvisorOwnerFieldWrite, type AdvisorPaymentWebhook, type AdvisorPrivilegedDispatch, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorQueue, type AdvisorQueueTuning, type AdvisorR2sqlCall, type AdvisorRatelimitKeySelector, type AdvisorRawRowReturn, type AdvisorRelation, type AdvisorRelationLoad, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShape, type AdvisorShardTraffic, type AdvisorSoftDeleteRead, type AdvisorSqlInterpolation, type AdvisorStaleMigrationImport, type AdvisorStorageKeyAccess, type AdvisorStorageUpload, type AdvisorTable, type AdvisorTableScan, type AdvisorTableWrite, type AdvisorVectorNamespaceAccess, type AdvisorWorkflow, type AdvisorWorkflowCall, type AdvisorWranglerVariable, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type BaselineComparison, type CallSiteMetadata, type Category, type CheckResult, type Coverage, type Facing, type Finding, type Grade, type Level, type Lint, type LintContext, type LintSource, MAP_VERSION, type MapSummary, type ProcedureDelta, type ProcedureScore, type ProjectScore, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, type ScoreAdvisorOptions, type Sensitivity, type SensitivityLevel, actionFetchSsrf, actionWithoutErrorHandling, adminRouteWithoutGuard, aiRawRunEscapeHatch, aiRunWithoutLogging, aiToolSideEffectPromptInjection, aiUnboundedGenerationPublic, allowUnauthenticatedShardAccessEnabled, authApiCallWithoutHeaders, authCsrfCheckDisabled, authEmailVerificationDisabled, authScimWithoutTransactions, authSecureCookiesDisabled, authSessionFreshageZero, authTrustedOriginsWildcard, browserAllowPrivateTargets, browserUserUrlWithoutAllowlist, byCodepoint, callSiteCallers, callSiteDescription, callSiteLabel, callSiteMetadata, circularFk, classifySensitivity, commitOrderedHardDelete, compareToBaseline, containerInstanceKeyFromUserInput, containerOversizedInstance, containerPublicInternet, containerRuntimeEgressRelaxation, containerStartEnableInternetOverride, crossModuleTableWrite, dedupeCacheKeys, duplicateIndex, emptyIndex, errorWithoutCatalog, exportSinkMisconfigured, externalSourceIncrementalNoDeletePath, externalSourceOnGlobal, externalSourceUnscoped, fanOutBreadth, filterOnPrimaryKey, filterWithoutIndex, flagGatesSecurityWithUnsafeDefault, flagReadInSubscription, fromServerSchema, geoIndexFieldNotGeopoint, geoIndexUnused, globalTableNearColumnLimit, gradeFromScore, hardcodedSecret, helperRole, hotShard, httpActionMissingAuthGuard, httpActionResponseHeaderInjection, hyperdriveOutsideAction, identityUndeclaredClaimTrusted, imagesUrlSourceFromUserInput, indexReferencesUnknownField, indexUtilization, insertManyUnsafeUserData, isReachableSite, kvUnscopedUserKeyIdor, mailInboundDispatchWithoutVerify, mailRecipientFromRequestInput, maskUncoveredPiiColumn, maskWeakHashStrategyOnPii, maskedRelationLeakViaWith, mutatorFullRowReplace, mutatorWithoutOwnerScope, nondeterministicQueryMutation, normalizeIdUsedAsAuthorization, notifyMissingPushConfig, notifySendOutsideAction, outputProjectionMissingOnPublicRead, ownerFieldFromArgsNotAuth, parseAdvisorMap, paymentCreateWithoutAuthorize, paymentWebhookWideTolerance, plaintextSecretInWranglerVariables, policyReferencesUnknownTable, privilegedDispatchUnvalidatedPayload, privilegedFanoutFromPublicProcedure, procedureWithoutStructuredEvent, publicArgumentUsesAny, publicMutationWithoutRatelimit, publicTableRlsOptoutConfusion, queueWithoutDlq, r2sqlOutsideAction, ratelimitDefaultMemoryStore, ratelimitKeySpoofableOrGlobal, ratelimitMiddlewareFailOpen, readCallSiteCallers, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, scoreAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, signupMutationWithoutDisposableGating, softDeleteIncludeDeletedFromArgs, sqlInjectionRisk, storageGenerateUploadUrlNoContentTypePin, storageKeyFromUserArgs, storagePresignedUrlForPrivateContent, storageUploadWithoutContentTypeAllowlist, storageUploadWithoutMaxSize, tableWithoutInsert, topicTooManySubscriptions, ttlFieldNotTimestamp, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, unrestrictedWhereBranch, userCreatingMutationWithoutCaptcha, vectorsNamespaceFromUserInput, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };

package/dist/index.mjs

@@ -1 +1 @@
-import{dedupeCacheKeys as c}from"./packem_shared/dedupeCacheKeys-DtBOHffV.mjs";import d from"./packem_shared/fanOutBreadth-CBtmZnoh.mjs";import u from"./packem_shared/hotShard-BwGYZ3Tq.mjs";import h from"./packem_shared/indexUtilization-CkVPZcVe.mjs";import g from"./packem_shared/actionFetchSsrf-B4ZaOBlW.mjs";import b from"./packem_shared/actionWithoutErrorHandling-4GCBT0_z.mjs";import y from"./packem_shared/adminRouteWithoutGuard-DPE7LuNh.mjs";import S from"./packem_shared/aiRawRunEscapeHatch-B5980eT9.mjs";import w from"./packem_shared/aiRunWithoutLogging-CvHHtEN9.mjs";import v from"./packem_shared/aiToolSideEffectPromptInjection-_3MrX9Ul.mjs";import A from"./packem_shared/aiUnboundedGenerationPublic-C17h6sMV.mjs";import R from"./packem_shared/allowUnauthenticatedShardAccessEnabled-BQufF5Kb.mjs";import U from"./packem_shared/authApiCallWithoutHeaders-D8U1hv8s.mjs";import W from"./packem_shared/authCsrfCheckDisabled-C6bxME5y.mjs";import T from"./packem_shared/authEmailVerificationDisabled-yROPDgn-.mjs";import I from"./packem_shared/authScimWithoutTransactions-w9qb3iBe.mjs";import k from"./packem_shared/authSecureCookiesDisabled-qrCktlch.mjs";import N from"./packem_shared/authSessionFreshageZero-BMisjIIS.mjs";import x from"./packem_shared/authTrustedOriginsWildcard-DFDpfN84.mjs";import C from"./packem_shared/browserAllowPrivateTargets-Cj5sizhv.mjs";import F from"./packem_shared/browserUserUrlWithoutAllowlist-DDNC_W-2.mjs";import M from"./packem_shared/circularFk-DtcWFJxK.mjs";import O from"./packem_shared/commitOrderedHardDelete-BPdwOKA7.mjs";import D from"./packem_shared/containerInstanceKeyFromUserInput-DBdjUnQb.mjs";import $ from"./packem_shared/containerOversizedInstance-Bx89uR7E.mjs";import E from"./packem_shared/containerPublicInternet-BFfZf_P4.mjs";import P from"./packem_shared/containerRuntimeEgressRelaxation-CioCA2zY.mjs";import K from"./packem_shared/containerStartEnableInternetOverride-C6dbznku.mjs";import q from"./packem_shared/crossModuleTableWrite-DjiVTAwK.mjs";import L from"./packem_shared/duplicateIndex-Cip6-Rpu.mjs";import G from"./packem_shared/emptyIndex-BnHDcXza.mjs";import _ from"./packem_shared/errorWithoutCatalog-BTfvaXHR.mjs";import z from"./packem_shared/exportSinkMisconfigured-JfbAx9AI.mjs";import H from"./packem_shared/externalSourceIncrementalNoDeletePath-BCzm3HzF.mjs";import B from"./packem_shared/externalSourceOnGlobal-CH7xbJ49.mjs";import j from"./packem_shared/externalSourceUnscoped-BxU2uSXk.mjs";import V from"./packem_shared/filterOnPrimaryKey-DbFriOZA.mjs";import Q from"./packem_shared/filterWithoutIndex-Dc7Nn0y2.mjs";import X from"./packem_shared/flagGatesSecurityWithUnsafeDefault-DB9M6hLM.mjs";import Z from"./packem_shared/flagReadInSubscription-DabIhYGD.mjs";import J from"./packem_shared/geoIndexFieldNotGeopoint-CDMNbAfp.mjs";import Y from"./packem_shared/geoIndexUnused-D7C9Qr4U.mjs";import oo from"./packem_shared/globalTableNearColumnLimit-BFbBBd6A.mjs";import eo from"./packem_shared/hardcodedSecret-Bw_4FYrs.mjs";import ro from"./packem_shared/httpActionMissingAuthGuard-BhvcmkwW.mjs";import to from"./packem_shared/httpActionResponseHeaderInjection-DKz2SlCa.mjs";import io from"./packem_shared/hyperdriveOutsideAction-CPDdGP2g.mjs";import no from"./packem_shared/identityUndeclaredClaimTrusted-CAUagXkJ.mjs";import ao from"./packem_shared/imagesUrlSourceFromUserInput-C2CJTTCI.mjs";import mo from"./packem_shared/indexReferencesUnknownField-Dm8SL4Tp.mjs";import lo from"./packem_shared/insertManyUnsafeUserData-DWE8d_DF.mjs";import so from"./packem_shared/kvUnscopedUserKeyIdor-CXFKAyM2.mjs";import po from"./packem_shared/mailInboundDispatchWithoutVerify-CWwqXyPX.mjs";import fo from"./packem_shared/mailRecipientFromRequestInput-CQZeOsP9.mjs";import co from"./packem_shared/maskUncoveredPiiColumn-axEka4nd.mjs";import uo from"./packem_shared/maskWeakHashStrategyOnPii-njstapQY.mjs";import ho from"./packem_shared/maskedRelationLeakViaWith-CIFij6vE.mjs";import{e as a}from"./packem_shared/finding-NrKO8idM.mjs";import go from"./packem_shared/mutatorFullRowReplace-BzRpZ47r.mjs";import bo from"./packem_shared/mutatorWithoutOwnerScope-BoS81ns0.mjs";import yo from"./packem_shared/nondeterministicQueryMutation-sxmixc0l.mjs";import So from"./packem_shared/normalizeIdUsedAsAuthorization-BXN-Can6.mjs";import wo from"./packem_shared/notifyMissingPushConfig-DeQMoNwm.mjs";import vo from"./packem_shared/notifySendOutsideAction-BJrDkr4h.mjs";import Ao from"./packem_shared/outputProjectionMissingOnPublicRead-DHivs_73.mjs";import Ro from"./packem_shared/ownerFieldFromArgsNotAuth-BFNc023N.mjs";import Uo from"./packem_shared/paymentCreateWithoutAuthorize-CICGmRFR.mjs";import Wo from"./packem_shared/paymentWebhookWideTolerance-CtZb2AVA.mjs";import To from"./packem_shared/plaintextSecretInWranglerVariables-bNkqmNqV.mjs";import Io from"./packem_shared/policyReferencesUnknownTable-CIKuRZ5Y.mjs";import ko from"./packem_shared/privilegedDispatchUnvalidatedPayload-BJNC9DrB.mjs";import No from"./packem_shared/privilegedFanoutFromPublicProcedure-DV188gHQ.mjs";import xo from"./packem_shared/procedureWithoutStructuredEvent-CZ_B23nM.mjs";import Co from"./packem_shared/publicArgumentUsesAny-BDEvMA8Q.mjs";import Fo from"./packem_shared/publicMutationWithoutRatelimit-BeYapu1F.mjs";import Mo from"./packem_shared/publicTableRlsOptoutConfusion-BFmh1kH0.mjs";import Oo from"./packem_shared/queueWithoutDlq-BvHz3Opg.mjs";import Do from"./packem_shared/r2sqlOutsideAction-BdLiLOAX.mjs";import $o from"./packem_shared/ratelimitDefaultMemoryStore-Dj0Kk7t9.mjs";import Eo from"./packem_shared/ratelimitKeySpoofableOrGlobal-DlvJfSXs.mjs";import Po from"./packem_shared/ratelimitMiddlewareFailOpen-DGtyt-pc.mjs";import Ko from"./packem_shared/relationReferencesUnknownField-CqGEJD57.mjs";import qo from"./packem_shared/relationReferencesUnknownTable-CP4aWtAJ.mjs";import Lo from"./packem_shared/rlsUncoveredTable-CZ4ie4gX.mjs";import Go from"./packem_shared/shapeTargetsGlobalTable-Bu3eEDic.mjs";import _o from"./packem_shared/shapeUnknownTable-CREfNnWi.mjs";import zo from"./packem_shared/signupMutationWithoutDisposableGating-CFtFMJz8.mjs";import Ho from"./packem_shared/softDeleteIncludeDeletedFromArgs-C7Ugg4zb.mjs";import Bo from"./packem_shared/sqlInjectionRisk-y-7c46LJ.mjs";import jo from"./packem_shared/storageGenerateUploadUrlNoContentTypePin-Bx9oGOjM.mjs";import Vo from"./packem_shared/storageKeyFromUserArgs-BryKJJM-.mjs";import Qo from"./packem_shared/storagePresignedUrlForPrivateContent-lqE6LvNu.mjs";import Xo from"./packem_shared/storageUploadWithoutContentTypeAllowlist-DMr7w29r.mjs";import Zo from"./packem_shared/storageUploadWithoutMaxSize-rSNFNb2l.mjs";import Jo from"./packem_shared/tableWithoutInsert-ClJp_jDr.mjs";import Yo from"./packem_shared/ttlFieldNotTimestamp-Dxa-6RfM.mjs";import{s as oe,q as ee,c as re}from"./packem_shared/helpers-BmppB5nL.mjs";import te from"./packem_shared/unboundedStringArgument-jZnCbwB0.mjs";import ie from"./packem_shared/unindexedForeignKey-Dypgn8uH.mjs";import ne from"./packem_shared/unindexedRelationTarget-CSqRJWYZ.mjs";import ae from"./packem_shared/unrestrictedWhereBranch-CcIBmHik.mjs";import me from"./packem_shared/userCreatingMutationWithoutCaptcha-C8yaqIIj.mjs";import le from"./packem_shared/vectorsNamespaceFromUserInput-7I_Kwxvp.mjs";import se from"./packem_shared/workflowDuplicateStepName-B6eAJzwA.mjs";import pe from"./packem_shared/workflowUnknownTarget-Cm1hfTTs.mjs";import fe from"./packem_shared/workflowUnused-DHwwE-1P.mjs";import{callSiteCallers as St,callSiteDescription as wt,callSiteLabel as vt,callSiteMetadata as At,helperRole as Rt,isReachableSite as Ut,readCallSiteCallers as Wt}from"./packem_shared/callSiteCallers-DArHfQSU.mjs";import{compareToBaseline as It,parseAdvisorMap as kt}from"./packem_shared/compareToBaseline-CUG59IOy.mjs";import{gradeFromScore as xt}from"./packem_shared/gradeFromScore-KSt58rj1.mjs";import{MAP_VERSION as Ft,byCodepoint as Mt,scoreAdvisor as Ot}from"./packem_shared/MAP_VERSION-MQ5W2B6n.mjs";import{default as $t}from"./packem_shared/classifySensitivity-JnjaTGYi.mjs";import{fromServerSchema as Pt}from"./packem_shared/fromServerSchema-fAymN8o2.mjs";const ce={convex:"migrating/from-convex",firebase:"migrating/from-firebase",supabase:"migrating/from-supabase"},m={categories:["SCHEMA"],description:"A migrated-away platform's SDK is still imported from `lunora/` source. The code compiles and typechecks, so a half-finished port keeps reading from the old platform at runtime and the two stores silently drift apart.",facing:"INTERNAL",level:"WARN",name:"migration_stale_import",remediation:"Replace the call with its Lunora equivalent and drop the dependency. If the import is deliberate — a second data source you still read from — move it out of `lunora/` so it is not mistaken for an unfinished migration.",run:r=>r.staleMigrationImports===void 0?[]:r.staleMigrationImports.map(o=>a(m,{cacheKey:`migration_stale_import:${o.file}:${o.line.toString()}:${o.moduleSpecifier}`,detail:`\`${o.file}\` (line ${o.line.toString()}) still imports \`${o.moduleSpecifier}\`. Finish the port — see \`${ce[o.platform]}\` — or move the import out of \`lunora/\` if you genuinely still read from ${o.platform}.`,metadata:{file:o.file,line:o.line,moduleSpecifier:o.moduleSpecifier,platform:o.platform}})),source:"static",title:"Stale migration import"},de=new Map([["global",{level:"WARN",scope:r=>`it reads the whole D1 table "${r}" over a cross-region round trip`}],["root",{level:"WARN",scope:r=>`it loads every row of "${r}" from the root Durable Object's SQLite into memory`}],["shardBy",{level:"INFO",scope:r=>`"${r}" is \`.shardBy()\`, so this collects one shard's rows rather than the whole table — bounded by a single tenant's row count`}]]),ue={level:"WARN",scope:r=>`it loads every row of "${r}"`},l={categories:["PERFORMANCE"],description:"A query calls `.collect()` with no `.withIndex()` and no `.filter()`, so it materializes every row of the table. Any live subscription over it also re-sends that whole result to every subscribed client on every write to the table.",facing:"EXTERNAL",level:"WARN",name:"unbounded_collect",remediation:'Narrow the read with `.withIndex("name", (q) => q.eq(...))`, cap it with `.take(n)`, or page it with `.paginate(args.paginationOpts)` so neither the scan nor the subscription payload grows with the table.',run:r=>{const o=[],i=oe(r.schema);for(const e of r.queries??[]){if(e.terminal!=="collect"||e.hasIndex||e.table===""||e.hasFilter)continue;const t=i.get(e.table),{level:n,scope:s}=de.get(t??"")??ue,p=ee(e),f=n==="WARN"?` A live subscription over this query records a whole-table dependency, so every write to "${e.table}" re-runs it and re-sends the full result to each subscribed socket.`:" Cap it with `.take(n)` if that count can grow.";o.push(a(l,{cacheKey:`unbounded_collect:${e.file}:${e.line.toString()}:${e.table}`,detail:`Query on "${e.table}" at ${p} calls .collect() with no index and no filter — ${s(e.table)}.${f}`,level:n,metadata:{...re(e),shardKind:t??"unknown",table:e.table}}))}return o},source:"static",title:"Unbounded collect"},he=[mo,qo,Ko,pe,se,_o,H,B,j,G,oo,_,J,Y,z,Yo,O,M,q,ie,ne,L,Jo,fe,Oo,V,Q,l,Go,go,bo,yo,io,Do,U,Io,Lo,co,uo,$,E,Fo,ae,me,zo,Co,te,eo,Bo,y,Uo,po,$o,C,No,xo,lo,A,g,b,Ro,Vo,so,D,S,w,le,fo,F,ko,K,P,I,x,W,k,T,N,ao,Eo,Mo,R,Xo,Zo,jo,Qo,ro,to,Po,X,Z,v,no,Wo,Ho,ho,Ao,So,vo,wo,To,m],ge=[u,h,d],be=[...he,...ge],gt=(r,o={})=>{const i=o.lints??be,e=[];for(const t of i)o.source!==void 0&&t.source!==o.source||e.push(...t.run(r));return c(e)};export{be as ALL_LINTS,Ft as MAP_VERSION,ge as RUNTIME_LINTS,he as STATIC_LINTS,g as actionFetchSsrf,b as actionWithoutErrorHandling,y as adminRouteWithoutGuard,S as aiRawRunEscapeHatch,w as aiRunWithoutLogging,v as aiToolSideEffectPromptInjection,A as aiUnboundedGenerationPublic,R as allowUnauthenticatedShardAccessEnabled,U as authApiCallWithoutHeaders,W as authCsrfCheckDisabled,T as authEmailVerificationDisabled,I as authScimWithoutTransactions,k as authSecureCookiesDisabled,N as authSessionFreshageZero,x as authTrustedOriginsWildcard,C as browserAllowPrivateTargets,F as browserUserUrlWithoutAllowlist,Mt as byCodepoint,St as callSiteCallers,wt as callSiteDescription,vt as callSiteLabel,At as callSiteMetadata,M as circularFk,$t as classifySensitivity,O as commitOrderedHardDelete,It as compareToBaseline,D as containerInstanceKeyFromUserInput,$ as containerOversizedInstance,E as containerPublicInternet,P as containerRuntimeEgressRelaxation,K as containerStartEnableInternetOverride,q as crossModuleTableWrite,c as dedupeCacheKeys,L as duplicateIndex,G as emptyIndex,_ as errorWithoutCatalog,z as exportSinkMisconfigured,H as externalSourceIncrementalNoDeletePath,B as externalSourceOnGlobal,j as externalSourceUnscoped,d as fanOutBreadth,V as filterOnPrimaryKey,Q as filterWithoutIndex,X as flagGatesSecurityWithUnsafeDefault,Z as flagReadInSubscription,Pt as fromServerSchema,J as geoIndexFieldNotGeopoint,Y as geoIndexUnused,oo as globalTableNearColumnLimit,xt as gradeFromScore,eo as hardcodedSecret,Rt as helperRole,u as hotShard,ro as httpActionMissingAuthGuard,to as httpActionResponseHeaderInjection,io as hyperdriveOutsideAction,no as identityUndeclaredClaimTrusted,ao as imagesUrlSourceFromUserInput,mo as indexReferencesUnknownField,h as indexUtilization,lo as insertManyUnsafeUserData,Ut as isReachableSite,so as kvUnscopedUserKeyIdor,po as mailInboundDispatchWithoutVerify,fo as mailRecipientFromRequestInput,co as maskUncoveredPiiColumn,uo as maskWeakHashStrategyOnPii,ho as maskedRelationLeakViaWith,go as mutatorFullRowReplace,bo as mutatorWithoutOwnerScope,yo as nondeterministicQueryMutation,So as normalizeIdUsedAsAuthorization,wo as notifyMissingPushConfig,vo as notifySendOutsideAction,Ao as outputProjectionMissingOnPublicRead,Ro as ownerFieldFromArgsNotAuth,kt as parseAdvisorMap,Uo as paymentCreateWithoutAuthorize,Wo as paymentWebhookWideTolerance,To as plaintextSecretInWranglerVariables,Io as policyReferencesUnknownTable,ko as privilegedDispatchUnvalidatedPayload,No as privilegedFanoutFromPublicProcedure,xo as procedureWithoutStructuredEvent,Co as publicArgumentUsesAny,Fo as publicMutationWithoutRatelimit,Mo as publicTableRlsOptoutConfusion,Oo as queueWithoutDlq,Do as r2sqlOutsideAction,$o as ratelimitDefaultMemoryStore,Eo as ratelimitKeySpoofableOrGlobal,Po as ratelimitMiddlewareFailOpen,Wt as readCallSiteCallers,Ko as relationReferencesUnknownField,qo as relationReferencesUnknownTable,Lo as rlsUncoveredTable,gt as runAdvisor,Ot as scoreAdvisor,Go as shapeTargetsGlobalTable,_o as shapeUnknownTable,zo as signupMutationWithoutDisposableGating,Ho as softDeleteIncludeDeletedFromArgs,Bo as sqlInjectionRisk,jo as storageGenerateUploadUrlNoContentTypePin,Vo as storageKeyFromUserArgs,Qo as storagePresignedUrlForPrivateContent,Xo as storageUploadWithoutContentTypeAllowlist,Zo as storageUploadWithoutMaxSize,Jo as tableWithoutInsert,Yo as ttlFieldNotTimestamp,te as unboundedStringArgument,ie as unindexedForeignKey,ne as unindexedRelationTarget,ae as unrestrictedWhereBranch,me as userCreatingMutationWithoutCaptcha,le as vectorsNamespaceFromUserInput,se as workflowDuplicateStepName,pe as workflowUnknownTarget,fe as workflowUnused};
+import{dedupeCacheKeys as c}from"./packem_shared/dedupeCacheKeys-DtBOHffV.mjs";import d from"./packem_shared/fanOutBreadth-CBtmZnoh.mjs";import u from"./packem_shared/hotShard-BwGYZ3Tq.mjs";import h from"./packem_shared/indexUtilization-CkVPZcVe.mjs";import g from"./packem_shared/actionFetchSsrf-B4ZaOBlW.mjs";import b from"./packem_shared/actionWithoutErrorHandling-4GCBT0_z.mjs";import y from"./packem_shared/adminRouteWithoutGuard-DPE7LuNh.mjs";import S from"./packem_shared/aiRawRunEscapeHatch-B5980eT9.mjs";import w from"./packem_shared/aiRunWithoutLogging-CvHHtEN9.mjs";import v from"./packem_shared/aiToolSideEffectPromptInjection-_3MrX9Ul.mjs";import A from"./packem_shared/aiUnboundedGenerationPublic-C17h6sMV.mjs";import R from"./packem_shared/allowUnauthenticatedShardAccessEnabled-BQufF5Kb.mjs";import U from"./packem_shared/authApiCallWithoutHeaders-D8U1hv8s.mjs";import W from"./packem_shared/authCsrfCheckDisabled-C6bxME5y.mjs";import T from"./packem_shared/authEmailVerificationDisabled-yROPDgn-.mjs";import I from"./packem_shared/authScimWithoutTransactions-w9qb3iBe.mjs";import k from"./packem_shared/authSecureCookiesDisabled-qrCktlch.mjs";import N from"./packem_shared/authSessionFreshageZero-BMisjIIS.mjs";import x from"./packem_shared/authTrustedOriginsWildcard-DFDpfN84.mjs";import C from"./packem_shared/browserAllowPrivateTargets-Cj5sizhv.mjs";import F from"./packem_shared/browserUserUrlWithoutAllowlist-DDNC_W-2.mjs";import M from"./packem_shared/circularFk-DtcWFJxK.mjs";import O from"./packem_shared/commitOrderedHardDelete-BPdwOKA7.mjs";import D from"./packem_shared/containerInstanceKeyFromUserInput-DBdjUnQb.mjs";import $ from"./packem_shared/containerOversizedInstance-Bx89uR7E.mjs";import E from"./packem_shared/containerPublicInternet-BFfZf_P4.mjs";import P from"./packem_shared/containerRuntimeEgressRelaxation-CioCA2zY.mjs";import K from"./packem_shared/containerStartEnableInternetOverride-C6dbznku.mjs";import q from"./packem_shared/crossModuleTableWrite-DjiVTAwK.mjs";import L from"./packem_shared/duplicateIndex-Cip6-Rpu.mjs";import G from"./packem_shared/emptyIndex-BnHDcXza.mjs";import _ from"./packem_shared/errorWithoutCatalog-BTfvaXHR.mjs";import z from"./packem_shared/exportSinkMisconfigured-JfbAx9AI.mjs";import H from"./packem_shared/externalSourceIncrementalNoDeletePath-BCzm3HzF.mjs";import B from"./packem_shared/externalSourceOnGlobal-CH7xbJ49.mjs";import j from"./packem_shared/externalSourceUnscoped-BxU2uSXk.mjs";import V from"./packem_shared/filterOnPrimaryKey-DbFriOZA.mjs";import Q from"./packem_shared/filterWithoutIndex-Dc7Nn0y2.mjs";import X from"./packem_shared/flagGatesSecurityWithUnsafeDefault-DB9M6hLM.mjs";import Z from"./packem_shared/flagReadInSubscription-DabIhYGD.mjs";import J from"./packem_shared/geoIndexFieldNotGeopoint-CDMNbAfp.mjs";import Y from"./packem_shared/geoIndexUnused-D7C9Qr4U.mjs";import oo from"./packem_shared/globalTableNearColumnLimit-BFbBBd6A.mjs";import eo from"./packem_shared/hardcodedSecret-Bw_4FYrs.mjs";import ro from"./packem_shared/httpActionMissingAuthGuard-BhvcmkwW.mjs";import to from"./packem_shared/httpActionResponseHeaderInjection-DKz2SlCa.mjs";import io from"./packem_shared/hyperdriveOutsideAction-CPDdGP2g.mjs";import no from"./packem_shared/identityUndeclaredClaimTrusted-CAUagXkJ.mjs";import ao from"./packem_shared/imagesUrlSourceFromUserInput-C2CJTTCI.mjs";import mo from"./packem_shared/indexReferencesUnknownField-Dm8SL4Tp.mjs";import lo from"./packem_shared/insertManyUnsafeUserData-DWE8d_DF.mjs";import so from"./packem_shared/kvUnscopedUserKeyIdor-CXFKAyM2.mjs";import po from"./packem_shared/mailInboundDispatchWithoutVerify-CWwqXyPX.mjs";import fo from"./packem_shared/mailRecipientFromRequestInput-CQZeOsP9.mjs";import co from"./packem_shared/maskUncoveredPiiColumn-axEka4nd.mjs";import uo from"./packem_shared/maskWeakHashStrategyOnPii-njstapQY.mjs";import ho from"./packem_shared/maskedRelationLeakViaWith-CIFij6vE.mjs";import{e as a}from"./packem_shared/finding-NrKO8idM.mjs";import go from"./packem_shared/mutatorFullRowReplace-BzRpZ47r.mjs";import bo from"./packem_shared/mutatorWithoutOwnerScope-BoS81ns0.mjs";import yo from"./packem_shared/nondeterministicQueryMutation-sxmixc0l.mjs";import So from"./packem_shared/normalizeIdUsedAsAuthorization-BXN-Can6.mjs";import wo from"./packem_shared/notifyMissingPushConfig-DeQMoNwm.mjs";import vo from"./packem_shared/notifySendOutsideAction-BJrDkr4h.mjs";import Ao from"./packem_shared/outputProjectionMissingOnPublicRead-DHivs_73.mjs";import Ro from"./packem_shared/ownerFieldFromArgsNotAuth-BFNc023N.mjs";import Uo from"./packem_shared/paymentCreateWithoutAuthorize-CICGmRFR.mjs";import Wo from"./packem_shared/paymentWebhookWideTolerance-CtZb2AVA.mjs";import To from"./packem_shared/plaintextSecretInWranglerVariables-bNkqmNqV.mjs";import Io from"./packem_shared/policyReferencesUnknownTable-CIKuRZ5Y.mjs";import ko from"./packem_shared/privilegedDispatchUnvalidatedPayload-BJNC9DrB.mjs";import No from"./packem_shared/privilegedFanoutFromPublicProcedure-DV188gHQ.mjs";import xo from"./packem_shared/procedureWithoutStructuredEvent-CZ_B23nM.mjs";import Co from"./packem_shared/publicArgumentUsesAny-BDEvMA8Q.mjs";import Fo from"./packem_shared/publicMutationWithoutRatelimit-BeYapu1F.mjs";import Mo from"./packem_shared/publicTableRlsOptoutConfusion-BFmh1kH0.mjs";import Oo from"./packem_shared/queueWithoutDlq-BvHz3Opg.mjs";import Do from"./packem_shared/r2sqlOutsideAction-BdLiLOAX.mjs";import $o from"./packem_shared/ratelimitDefaultMemoryStore-Dj0Kk7t9.mjs";import Eo from"./packem_shared/ratelimitKeySpoofableOrGlobal-DlvJfSXs.mjs";import Po from"./packem_shared/ratelimitMiddlewareFailOpen-DGtyt-pc.mjs";import Ko from"./packem_shared/relationReferencesUnknownField-CqGEJD57.mjs";import qo from"./packem_shared/relationReferencesUnknownTable-CP4aWtAJ.mjs";import Lo from"./packem_shared/rlsUncoveredTable-CZ4ie4gX.mjs";import Go from"./packem_shared/shapeTargetsGlobalTable-Bu3eEDic.mjs";import _o from"./packem_shared/shapeUnknownTable-CREfNnWi.mjs";import zo from"./packem_shared/signupMutationWithoutDisposableGating-CFtFMJz8.mjs";import Ho from"./packem_shared/softDeleteIncludeDeletedFromArgs-C7Ugg4zb.mjs";import Bo from"./packem_shared/sqlInjectionRisk-y-7c46LJ.mjs";import jo from"./packem_shared/storageGenerateUploadUrlNoContentTypePin-Bx9oGOjM.mjs";import Vo from"./packem_shared/storageKeyFromUserArgs-BryKJJM-.mjs";import Qo from"./packem_shared/storagePresignedUrlForPrivateContent-lqE6LvNu.mjs";import Xo from"./packem_shared/storageUploadWithoutContentTypeAllowlist-DMr7w29r.mjs";import Zo from"./packem_shared/storageUploadWithoutMaxSize-rSNFNb2l.mjs";import Jo from"./packem_shared/tableWithoutInsert-ClJp_jDr.mjs";import Yo from"./packem_shared/topicTooManySubscriptions-CiZhFm9r.mjs";import oe from"./packem_shared/ttlFieldNotTimestamp-Dxa-6RfM.mjs";import{s as ee,q as re,c as te}from"./packem_shared/helpers-BmppB5nL.mjs";import ie from"./packem_shared/unboundedStringArgument-jZnCbwB0.mjs";import ne from"./packem_shared/unindexedForeignKey-Dypgn8uH.mjs";import ae from"./packem_shared/unindexedRelationTarget-CSqRJWYZ.mjs";import me from"./packem_shared/unrestrictedWhereBranch-CcIBmHik.mjs";import le from"./packem_shared/userCreatingMutationWithoutCaptcha-C8yaqIIj.mjs";import se from"./packem_shared/vectorsNamespaceFromUserInput-7I_Kwxvp.mjs";import pe from"./packem_shared/workflowDuplicateStepName-B6eAJzwA.mjs";import fe from"./packem_shared/workflowUnknownTarget-Cm1hfTTs.mjs";import ce from"./packem_shared/workflowUnused-DHwwE-1P.mjs";import{callSiteCallers as vt,callSiteDescription as At,callSiteLabel as Rt,callSiteMetadata as Ut,helperRole as Wt,isReachableSite as Tt,readCallSiteCallers as It}from"./packem_shared/callSiteCallers-DArHfQSU.mjs";import{compareToBaseline as Nt,parseAdvisorMap as xt}from"./packem_shared/compareToBaseline-CUG59IOy.mjs";import{gradeFromScore as Ft}from"./packem_shared/gradeFromScore-KSt58rj1.mjs";import{MAP_VERSION as Ot,byCodepoint as Dt,scoreAdvisor as $t}from"./packem_shared/MAP_VERSION-MQ5W2B6n.mjs";import{default as Pt}from"./packem_shared/classifySensitivity-JnjaTGYi.mjs";import{fromServerSchema as qt}from"./packem_shared/fromServerSchema-fAymN8o2.mjs";const de={convex:"migrating/from-convex",firebase:"migrating/from-firebase",supabase:"migrating/from-supabase"},m={categories:["SCHEMA"],description:"A migrated-away platform's SDK is still imported from `lunora/` source. The code compiles and typechecks, so a half-finished port keeps reading from the old platform at runtime and the two stores silently drift apart.",facing:"INTERNAL",level:"WARN",name:"migration_stale_import",remediation:"Replace the call with its Lunora equivalent and drop the dependency. If the import is deliberate — a second data source you still read from — move it out of `lunora/` so it is not mistaken for an unfinished migration.",run:r=>r.staleMigrationImports===void 0?[]:r.staleMigrationImports.map(o=>a(m,{cacheKey:`migration_stale_import:${o.file}:${o.line.toString()}:${o.moduleSpecifier}`,detail:`\`${o.file}\` (line ${o.line.toString()}) still imports \`${o.moduleSpecifier}\`. Finish the port — see \`${de[o.platform]}\` — or move the import out of \`lunora/\` if you genuinely still read from ${o.platform}.`,metadata:{file:o.file,line:o.line,moduleSpecifier:o.moduleSpecifier,platform:o.platform}})),source:"static",title:"Stale migration import"},ue=new Map([["global",{level:"WARN",scope:r=>`it reads the whole D1 table "${r}" over a cross-region round trip`}],["root",{level:"WARN",scope:r=>`it loads every row of "${r}" from the root Durable Object's SQLite into memory`}],["shardBy",{level:"INFO",scope:r=>`"${r}" is \`.shardBy()\`, so this collects one shard's rows rather than the whole table — bounded by a single tenant's row count`}]]),he={level:"WARN",scope:r=>`it loads every row of "${r}"`},l={categories:["PERFORMANCE"],description:"A query calls `.collect()` with no `.withIndex()` and no `.filter()`, so it materializes every row of the table. Any live subscription over it also re-sends that whole result to every subscribed client on every write to the table.",facing:"EXTERNAL",level:"WARN",name:"unbounded_collect",remediation:'Narrow the read with `.withIndex("name", (q) => q.eq(...))`, cap it with `.take(n)`, or page it with `.paginate(args.paginationOpts)` so neither the scan nor the subscription payload grows with the table.',run:r=>{const o=[],i=ee(r.schema);for(const e of r.queries??[]){if(e.terminal!=="collect"||e.hasIndex||e.table===""||e.hasFilter)continue;const t=i.get(e.table),{level:n,scope:s}=ue.get(t??"")??he,p=re(e),f=n==="WARN"?` A live subscription over this query records a whole-table dependency, so every write to "${e.table}" re-runs it and re-sends the full result to each subscribed socket.`:" Cap it with `.take(n)` if that count can grow.";o.push(a(l,{cacheKey:`unbounded_collect:${e.file}:${e.line.toString()}:${e.table}`,detail:`Query on "${e.table}" at ${p} calls .collect() with no index and no filter — ${s(e.table)}.${f}`,level:n,metadata:{...te(e),shardKind:t??"unknown",table:e.table}}))}return o},source:"static",title:"Unbounded collect"},ge=[mo,qo,Ko,fe,pe,_o,H,B,j,G,oo,_,J,Y,z,oe,O,M,q,ne,ae,L,Jo,ce,Oo,Yo,V,Q,l,Go,go,bo,yo,io,Do,U,Io,Lo,co,uo,$,E,Fo,me,le,zo,Co,ie,eo,Bo,y,Uo,po,$o,C,No,xo,lo,A,g,b,Ro,Vo,so,D,S,w,se,fo,F,ko,K,P,I,x,W,k,T,N,ao,Eo,Mo,R,Xo,Zo,jo,Qo,ro,to,Po,X,Z,v,no,Wo,Ho,ho,Ao,So,vo,wo,To,m],be=[u,h,d],ye=[...ge,...be],yt=(r,o={})=>{const i=o.lints??ye,e=[];for(const t of i)o.source!==void 0&&t.source!==o.source||e.push(...t.run(r));return c(e)};export{ye as ALL_LINTS,Ot as MAP_VERSION,be as RUNTIME_LINTS,ge as STATIC_LINTS,g as actionFetchSsrf,b as actionWithoutErrorHandling,y as adminRouteWithoutGuard,S as aiRawRunEscapeHatch,w as aiRunWithoutLogging,v as aiToolSideEffectPromptInjection,A as aiUnboundedGenerationPublic,R as allowUnauthenticatedShardAccessEnabled,U as authApiCallWithoutHeaders,W as authCsrfCheckDisabled,T as authEmailVerificationDisabled,I as authScimWithoutTransactions,k as authSecureCookiesDisabled,N as authSessionFreshageZero,x as authTrustedOriginsWildcard,C as browserAllowPrivateTargets,F as browserUserUrlWithoutAllowlist,Dt as byCodepoint,vt as callSiteCallers,At as callSiteDescription,Rt as callSiteLabel,Ut as callSiteMetadata,M as circularFk,Pt as classifySensitivity,O as commitOrderedHardDelete,Nt as compareToBaseline,D as containerInstanceKeyFromUserInput,$ as containerOversizedInstance,E as containerPublicInternet,P as containerRuntimeEgressRelaxation,K as containerStartEnableInternetOverride,q as crossModuleTableWrite,c as dedupeCacheKeys,L as duplicateIndex,G as emptyIndex,_ as errorWithoutCatalog,z as exportSinkMisconfigured,H as externalSourceIncrementalNoDeletePath,B as externalSourceOnGlobal,j as externalSourceUnscoped,d as fanOutBreadth,V as filterOnPrimaryKey,Q as filterWithoutIndex,X as flagGatesSecurityWithUnsafeDefault,Z as flagReadInSubscription,qt as fromServerSchema,J as geoIndexFieldNotGeopoint,Y as geoIndexUnused,oo as globalTableNearColumnLimit,Ft as gradeFromScore,eo as hardcodedSecret,Wt as helperRole,u as hotShard,ro as httpActionMissingAuthGuard,to as httpActionResponseHeaderInjection,io as hyperdriveOutsideAction,no as identityUndeclaredClaimTrusted,ao as imagesUrlSourceFromUserInput,mo as indexReferencesUnknownField,h as indexUtilization,lo as insertManyUnsafeUserData,Tt as isReachableSite,so as kvUnscopedUserKeyIdor,po as mailInboundDispatchWithoutVerify,fo as mailRecipientFromRequestInput,co as maskUncoveredPiiColumn,uo as maskWeakHashStrategyOnPii,ho as maskedRelationLeakViaWith,go as mutatorFullRowReplace,bo as mutatorWithoutOwnerScope,yo as nondeterministicQueryMutation,So as normalizeIdUsedAsAuthorization,wo as notifyMissingPushConfig,vo as notifySendOutsideAction,Ao as outputProjectionMissingOnPublicRead,Ro as ownerFieldFromArgsNotAuth,xt as parseAdvisorMap,Uo as paymentCreateWithoutAuthorize,Wo as paymentWebhookWideTolerance,To as plaintextSecretInWranglerVariables,Io as policyReferencesUnknownTable,ko as privilegedDispatchUnvalidatedPayload,No as privilegedFanoutFromPublicProcedure,xo as procedureWithoutStructuredEvent,Co as publicArgumentUsesAny,Fo as publicMutationWithoutRatelimit,Mo as publicTableRlsOptoutConfusion,Oo as queueWithoutDlq,Do as r2sqlOutsideAction,$o as ratelimitDefaultMemoryStore,Eo as ratelimitKeySpoofableOrGlobal,Po as ratelimitMiddlewareFailOpen,It as readCallSiteCallers,Ko as relationReferencesUnknownField,qo as relationReferencesUnknownTable,Lo as rlsUncoveredTable,yt as runAdvisor,$t as scoreAdvisor,Go as shapeTargetsGlobalTable,_o as shapeUnknownTable,zo as signupMutationWithoutDisposableGating,Ho as softDeleteIncludeDeletedFromArgs,Bo as sqlInjectionRisk,jo as storageGenerateUploadUrlNoContentTypePin,Vo as storageKeyFromUserArgs,Qo as storagePresignedUrlForPrivateContent,Xo as storageUploadWithoutContentTypeAllowlist,Zo as storageUploadWithoutMaxSize,Jo as tableWithoutInsert,Yo as topicTooManySubscriptions,oe as ttlFieldNotTimestamp,ie as unboundedStringArgument,ne as unindexedForeignKey,ae as unindexedRelationTarget,me as unrestrictedWhereBranch,le as userCreatingMutationWithoutCaptcha,se as vectorsNamespaceFromUserInput,pe as workflowDuplicateStepName,fe as workflowUnknownTarget,ce as workflowUnused};

package/dist/packem_shared/topicTooManySubscriptions-CiZhFm9r.mjs

@@ -0,0 +1 @@
+import{e as a}from"./finding-NrKO8idM.mjs";const o=10,p={categories:["PERFORMANCE"],description:`A topic with more than ${String(o)} subscriptions makes every publish one queue send per subscription. A Worker runs at most six sends at once, so the publish adds several round trips to the calling handler, and a retried publish re-delivers to every subscription that already received it.`,facing:"INTERNAL",level:"INFO",name:"topic_too_many_subscriptions",remediation:"Fold subscriptions that do related work into one handler, or publish from an action instead of a mutation so the fan-out is off the write path. Keep every subscription handler idempotent: a retried publish re-delivers to all of them.",run:i=>{if(i.queues===void 0)return[];const r=Map.groupBy(i.queues.filter(e=>e.topic!==void 0),e=>e.topic),s=[];for(const[e,t]of r)t.length<=o||s.push(a(p,{cacheKey:`topic_too_many_subscriptions:${e}`,detail:`Topic "${e}" has ${String(t.length)} subscriptions, so each publish sends to ${String(t.length)} queues.`,metadata:{subscriptions:t.map(n=>n.exportName),topic:e}}));return s},source:"static",title:"Topic has many subscriptions"};export{p as default};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/advisor",
-  "version": "1.0.0-alpha.195",
+  "version": "1.0.0-alpha.197",
   "description": "Schema & query lints (splinter-style advisors) for Lunora, feeding the Studio Advisors view",
   "keywords": [
     "advisor",
@@ -47,7 +47,7 @@
   },
   "dependencies": {
     "@lunora/errors": "1.0.0-alpha.50",
-    "@lunora/server": "1.0.0-alpha.183"
+    "@lunora/server": "1.0.0-alpha.184"
   },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"