@lunora/advisor 1.0.0-alpha.21 → 1.0.0-alpha.211

package/dist/packem_shared/userCreatingMutationWithoutCaptcha-2DZtWIPb.mjs

@@ -1,42 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-import { i as isPublicWrite } from './helpers-BySnKhVB.mjs';
-
-const userCreatingMutationWithoutCaptcha = {
-  categories: ["SECURITY"],
-  description: "A public `mutation`/`action` that creates a user/session or sends mail has no CAPTCHA / bot check. Account-creating and mail-sending endpoints are prime automated-abuse targets (credential stuffing, mailbox flooding, disposable-account farming).",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "user_creating_mutation_without_captcha",
-  remediation: "Add a server-verified human check: `.use(verifyTurnstile({ secret, token }))` from `@lunora/auth`, or wrap it with `.use(protectPublic({ rateLimit, captcha }))` from `@lunora/server`. Pair with a rate limit for defense in depth.",
-  run: (context) => {
-    if (context.procedureProtections === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const procedure of context.procedureProtections) {
-      const sensitive = procedure.writesUserTable || procedure.callsMail;
-      if (!isPublicWrite(procedure) || !sensitive || procedure.usesCaptcha) {
-        continue;
-      }
-      const reason = procedure.writesUserTable ? "writes a user/session table" : "sends mail";
-      findings.push(
-        emit(userCreatingMutationWithoutCaptcha, {
-          cacheKey: `user_creating_mutation_without_captcha:${procedure.file}:${procedure.exportName}`,
-          detail: `Public ${procedure.kind} \`${procedure.exportName}\` (${procedure.file}) ${reason} but has no CAPTCHA check. Add \`.use(verifyTurnstile(...))\` or \`.use(protectPublic({ captcha }))\`.`,
-          metadata: {
-            callsMail: procedure.callsMail,
-            exportName: procedure.exportName,
-            file: procedure.file,
-            kind: procedure.kind,
-            writesUserTable: procedure.writesUserTable
-          }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Account-creating / mail-sending write without a CAPTCHA"
-};
-
-export { userCreatingMutationWithoutCaptcha as default };

package/dist/packem_shared/vectorsNamespaceFromUserInput-CQhr5bVn.mjs

@@ -1,19 +0,0 @@
-import { m as makeArgumentDerivedSinkLint } from './argument-derived-sink-C1xTTqAt.mjs';
-
-const vectorsNamespaceFromUserInput = makeArgumentDerivedSinkLint({
-  cacheKey: (access) => `vectors_namespace_from_user_input:${access.file}:${access.line.toString()}`,
-  categories: ["SECURITY"],
-  description: "A `ctx.vectors.query`/`upsert`/`upsertMany` call uses a `namespace` derived from the handler's `args` with no server-side scoping. A Vectorize namespace partitions one index into isolated sub-collections, so an unscoped namespace lets any caller read or poison another tenant's vectors.",
-  detail: (access) => `\`ctx.vectors.${access.method}\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) uses a Vectorize namespace derived from \`args\` with no server-side scoping — any caller can read or poison another tenant's vectors. Derive the namespace from a server-trusted identity (e.g. \`\${ctx.auth.orgId}\`), never from \`args\`.`,
-  facing: "EXTERNAL",
-  getAccesses: (context) => context.vectorNamespaceAccesses,
-  level: "WARN",
-  metadata: (access) => {
-    return { exportName: access.exportName, file: access.file, line: access.line, method: access.method };
-  },
-  name: "vectors_namespace_from_user_input",
-  remediation: `Derive the \`namespace\` from a server-trusted identity (e.g. \`\${ctx.auth.orgId}\`), never from \`args\`.`,
-  title: "Vectorize namespace derived from unscoped user input"
-});
-
-export { vectorsNamespaceFromUserInput as default };

package/dist/packem_shared/workflowDuplicateStepName-ioBxPBCy.mjs

@@ -1,48 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const workflowDuplicateStepName = {
-  categories: ["SCHEMA"],
-  description: "Two durable steps in this workflow share a name. Cloudflare memoizes a step by its name, so on replay the second call returns the first step's cached result instead of running its body — silently skipping the work without an error.",
-  facing: "INTERNAL",
-  level: "ERROR",
-  // eslint-disable-next-line no-secrets/no-secrets -- the lint's rule id, not a credential
-  name: "workflow_duplicate_step_name",
-  remediation: "Give every `step.do` / `step.sleep` / `step.sleepUntil` / `step.waitForEvent` call in the workflow a unique name. If a step legitimately repeats (e.g. a loop), make the name distinct per iteration by interpolating the item id into the step name.",
-  run: (context) => {
-    if (context.workflows === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const workflow of context.workflows) {
-      const { steps } = workflow;
-      if (steps === void 0 || steps.length === 0) {
-        continue;
-      }
-      const firstLineByName = /* @__PURE__ */ new Map();
-      const reported = /* @__PURE__ */ new Set();
-      for (const step of steps) {
-        const firstLine = firstLineByName.get(step.name);
-        if (firstLine === void 0) {
-          firstLineByName.set(step.name, step.line);
-          continue;
-        }
-        if (reported.has(step.name)) {
-          continue;
-        }
-        reported.add(step.name);
-        findings.push(
-          emit(workflowDuplicateStepName, {
-            cacheKey: `workflow_duplicate_step_name:${workflow.exportName}:${step.name}`,
-            detail: `Workflow "${workflow.exportName}" reuses the durable step name "${step.name}" (first at line ${String(firstLine)}, again at line ${String(step.line)}). The second call returns the first's cached result instead of running.`,
-            metadata: { firstLine, line: step.line, stepName: step.name, workflow: workflow.exportName }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Duplicate durable step name in workflow"
-};
-
-export { workflowDuplicateStepName as default };

package/dist/packem_shared/workflowUnknownTarget-Cdd7WhKQ.mjs

@@ -1,34 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const workflowUnknownTarget = {
-  categories: ["SCHEMA"],
-  description: 'A `ctx.workflows.get("<name>")` call references a workflow that is not declared by any `defineWorkflow` export in `lunora/workflows.ts`. The name is a typo or points at a removed/renamed workflow — the call throws at runtime.',
-  facing: "INTERNAL",
-  level: "ERROR",
-  name: "workflow_unknown_target",
-  remediation: 'Fix the workflow name in the `ctx.workflows.get("…")` call, or add the missing `defineWorkflow` export to `lunora/workflows.ts`.',
-  run: (context) => {
-    if (context.workflows === void 0 || context.workflowCalls === void 0) {
-      return [];
-    }
-    const declared = new Set(context.workflows.map((workflow) => workflow.exportName));
-    const findings = [];
-    for (const call of context.workflowCalls) {
-      if (call.workflow === "" || declared.has(call.workflow)) {
-        continue;
-      }
-      findings.push(
-        emit(workflowUnknownTarget, {
-          cacheKey: `workflow_unknown_target:${call.file}:${call.exportName}:${call.workflow}`,
-          detail: `\`ctx.workflows.get("${call.workflow}")\` in "${call.exportName}" (${call.file}) references workflow "${call.workflow}", which is not declared in lunora/workflows.ts.`,
-          metadata: { exportName: call.exportName, file: call.file, line: call.line, workflow: call.workflow }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Workflow call references unknown workflow"
-};
-
-export { workflowUnknownTarget as default };

package/dist/packem_shared/workflowUnused-D0jHxdz9.mjs

@@ -1,38 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const workflowUnused = {
-  categories: ["SCHEMA"],
-  description: 'No function starts this workflow via `ctx.workflows.get("<name>")`. It may be triggered through a path the advisor can\'t see (the Cloudflare API, a wrangler invocation, a cross-service binding) — or it may be dead code that still deploys as a billable WorkflowEntrypoint.',
-  facing: "INTERNAL",
-  level: "INFO",
-  name: "workflow_unused",
-  remediation: 'If the workflow should be triggered in-app, start it from a mutation/action with `ctx.workflows.get("<name>").create({ params })`. If it is started externally or is no longer needed, this advisory can be ignored (or remove the `defineWorkflow` export).',
-  run: (context) => {
-    if (context.workflows === void 0) {
-      return [];
-    }
-    const calls = context.workflowCalls ?? [];
-    if (calls.some((call) => call.workflow === "")) {
-      return [];
-    }
-    const started = new Set(calls.map((call) => call.workflow));
-    const findings = [];
-    for (const workflow of context.workflows) {
-      if (started.has(workflow.exportName)) {
-        continue;
-      }
-      findings.push(
-        emit(workflowUnused, {
-          cacheKey: `workflow_unused:${workflow.exportName}`,
-          detail: `No function calls \`ctx.workflows.get("${workflow.exportName}")\` — workflow "${workflow.exportName}" is declared but never started in app code.`,
-          metadata: { workflow: workflow.exportName }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Workflow is never started"
-};
-
-export { workflowUnused as default };