@lunora/advisor 1.0.0-alpha.205 → 1.0.0-alpha.207

package/dist/packem_shared/helpers-BmppB5nL.mjs

@@ -1 +0,0 @@
-import{callSiteMetadata as u,helperRole as p}from"./callSiteCallers-DArHfQSU.mjs";const c=["address","birthdate","creditCard","dateOfBirth","dob","driversLicense","email","firstName","fullName","lastName","nationalId","passport","phone","phoneNumber","socialSecurity","socialSecurityNumber","ssn","taxId"],I=/[^a-z0-9]/giu,S=/([a-z0-9])([A-Z])/gu,h=/[^a-zA-Z0-9]+/u,s=e=>e.replaceAll(I,"").toLowerCase(),n=e=>e.replaceAll(S,"$1_$2").split(h).filter(t=>t.length>0).map(t=>t.toLowerCase()),N=new Set(c.map(e=>s(e))),_=new Set(c.filter(e=>n(e).length===1).map(e=>e.toLowerCase())),f=new Set(["accountId","authorId","createdBy","createdById","organizationId","orgId","ownerId","tenantId","updatedBy","userId","workspaceId"]),A=e=>N.has(s(e))||n(e).some(t=>_.has(t)),O=(e,t)=>{const a=n(e),l=s(e);return t.some(i=>{if(l===s(i))return!0;const o=n(i);return o.length>0&&a.some((L,r)=>o.every((d,m)=>a[r+m]===d))})},P=(e,t)=>e.columnKinds!==void 0&&Object.hasOwn(e.columnKinds,t)?e.columnKinds[t]:void 0,E=new Set(["_creationTime","_id"]),b=e=>e.fields.filter(t=>f.has(t)||A(t)),g=e=>new Set([...E,...e.fields]),y=e=>e.visibility==="public"&&(e.kind==="mutation"||e.kind==="action"),C=e=>e.line>0?`${e.file}:${e.line.toString()}`:e.file,M=e=>{const t=`${e.file}:${e.line.toString()}`;switch(e.scope.kind){case"export":return`\`${e.scope.name}\` (${t})`;case"helper":return`\`${e.scope.name}\` (${t}; ${p(e.scope)})`;default:return`module scope (${t})`}},R=e=>({...u(e.scope),file:e.file,line:e.line}),w=e=>new Map(e.tables.map(t=>[t.name,t.shardKind]));export{M as a,P as b,R as c,y as d,A as i,O as m,b as o,C as q,w as s,g as t};

package/dist/packem_shared/nondeterministicQueryMutation-sxmixc0l.mjs

@@ -1 +0,0 @@
-import{e as l}from"./finding-NrKO8idM.mjs";const c={categories:["SCHEMA"],description:"A `query`/`mutation` handler calls a non-deterministic API (`Date.now`, `Math.random`, `crypto.randomUUID`, `crypto.getRandomValues`, or `fetch`). A `query` may be re-run by a live subscription, so non-determinism there can flicker between evaluations (WARN). An ordinary `mutation` handler does not replay on this runtime — it runs at most once per logical write — so this is informational there (INFO) unless the mutation is itself invoked from a workflow step or queue consumer that can replay.",facing:"EXTERNAL",level:"WARN",name:"nondeterministic_query_mutation",remediation:"For a `query`: move the non-deterministic call into an `action(...)` (which runs once and may use ambient APIs), then pass the computed value into the mutation as an argument, or accept that the value may differ across re-evaluations. For an ordinary `mutation`: no action needed — the handler runs at most once per logical write on this runtime. If the mutation is dispatched from inside a workflow step or queue consumer, treat it like an action value instead, since the surrounding step/consumer can replay.",run:a=>{if(a.nondeterministicCalls===void 0)return[];const t=[],o=new Map;for(const e of a.nondeterministicCalls){const n=`${e.file}:${e.line.toString()}:${e.callee}`,i=(o.get(n)??0)+1;o.set(n,i);const r=i>1?`:${i.toString()}`:"",s={callee:e.callee,exportName:e.exportName,file:e.file,kind:e.kind,line:e.line};if(e.kind==="mutation"){t.push(l(c,{cacheKey:`nondeterministic_query_mutation:${n}${r}`,detail:`\`${e.callee}(…)\` in ${e.exportName} (${e.file}:${e.line.toString()}) runs inside a mutation handler. Ordinary mutations don't replay on this runtime (idempotency dedup returns a cached result rather than re-running the handler, and an OCC conflict throws to the caller instead of retrying internally), so this is informational — no action needed unless \`${e.exportName}\` is invoked from a workflow step or queue consumer that can itself replay.`,facing:"INTERNAL",level:"INFO",metadata:s}));continue}t.push(l(c,{cacheKey:`nondeterministic_query_mutation:${n}${r}`,detail:`\`${e.callee}(…)\` in ${e.exportName} (${e.file}:${e.line.toString()}) runs inside a query handler — a live subscription may re-run this query, so the result can differ between evaluations. Compute it in an \`action\` and pass the value into the mutation as an argument.`,metadata:s}))}return t},source:"static",title:"Non-deterministic call in query/mutation handler"};export{c as default};

package/dist/packem_shared/paymentCreateWithoutAuthorize-CICGmRFR.mjs

@@ -1 +0,0 @@
-import{e as a}from"./finding-NrKO8idM.mjs";const r={categories:["SECURITY"],description:"`createPayment({...})` was constructed without an `authorize` callback, so its access-control gate never runs — any caller that reaches a payment reference id can drive a charge, refund, or subscription change against it (a broken-access-control / IDOR risk on money movement).",facing:"EXTERNAL",level:"ERROR",name:"payment_create_without_authorize",remediation:"Pass an `authorize(referenceId)` callback to `createPayment({...})` that verifies the current caller (via `ctx.auth`) owns the payment/subscription reference before the operation runs. Prefer the `ctx.payments` accessor, which is authorization-scoped by default.",run:t=>t.configCalls===void 0?[]:t.configCalls.filter(e=>e.callee==="createPayment"&&e.analyzable&&!e.presentKeys.includes("authorize")).map(e=>a(r,{cacheKey:`payment_create_without_authorize:${e.file}:${e.line.toString()}`,detail:`\`createPayment({...})\` in ${e.file}:${e.line.toString()} has no \`authorize\` callback — its access-control gate never runs, so any caller reaching the payment reference can move money against it. Add an \`authorize(referenceId)\` gate that checks \`ctx.auth\` ownership before the operation.`,metadata:{callee:e.callee,file:e.file,line:e.line}})),source:"static",title:"createPayment without an authorize gate"};export{r as default};