@lunora/advisor 1.0.0-alpha.25 → 1.0.0-alpha.27

package/dist/index.d.mts

@@ -2023,6 +2023,22 @@ interface AnalyticsRuntimeMetrics {
 */
 declare const loadAnalyticsRuntimeMetrics: (source: AnalyticsMetricsSource, options: AnalyticsMetricsOptions) => Promise<AnalyticsRuntimeMetrics>;
 /**
+* Disambiguate {@link Finding}s that share a `cacheKey`.
+*
+* A `cacheKey` is the studio's dedup / dismissal id (see {@link Finding.cacheKey}):
+* two findings with the same key collapse to one row, and a single dismissal
+* silences both. A lint keyed on `name:file:line` (the argument-derived sinks,
+* `sql_injection_risk`, `kv_unscoped_user_key_idor`, `hardcoded_secret`, …) can
+* legitimately emit two occurrences on one physical source line, so without a
+* within-line discriminator the second finding is silently hidden.
+*
+* This suffixes the second-and-later occurrence of any repeated key with
+* `:&lt;n>` (`:2`, `:3`, …), leaving the first occurrence unsuffixed so existing
+* single-occurrence keys stay stable across runs. Order is preserved. Keys are
+* lint-name-prefixed, so this never merges across lints.
+*/
+declare const dedupeCacheKeys: (findings: ReadonlyArray<Finding>) => Finding[];
+/**
 * Constraint validator — flag rows that violate declared FK / NOT NULL / UNIQUE
 * constraints by cross-checking sampled row data against the schema.
 *
@@ -2351,7 +2367,7 @@ declare const browserAllowPrivateTargets: Lint;
 */
 declare const browserUserUrlWithoutAllowlist: Lint;
 /**
-* Detect FK cycles in the declared relation graph via a DFS.
+* Detect FK cycles in the declared relation graph.
 *
 * A "circular FK" exists when a chain of `one` relations forms a loop — for
 * example `A.authorId → B`, `B.ownerId → C`, `C.postId → A`. Such cycles can
@@ -2370,11 +2386,18 @@ declare const browserUserUrlWithoutAllowlist: Lint;
 * would be noise. Only multi-table cycles — the ones the description illustrates
 * — are surfaced.
 *
-* Each unique cycle is reported once: the cycle path is canonicalized to its
-* lexicographically smallest rotation so two DFS traversals that enter the same
-* ring at different nodes emit the same cacheKey and detail. A representative
-* cycle is reported for each distinct simple cycle in the graph; overlapping or
-* chord cycles that share interior nodes are each detected independently.
+* Cycle enumeration uses **Johnson's algorithm** rather than a naive
+* enumerate-all-paths DFS. A plain path-DFS re-walks every simple path in the
+* graph, which is worst-case exponential even on a fully **acyclic** schema
+* (reconverging FK fan-out — many tables referencing shared parents in a chain —
+* makes codegen appear to hang). Johnson blocks a vertex once a fruitless
+* subtree is exhausted and only unblocks it when a new cycle through it is
+* found, so it runs in `O((V + E)(C + 1))` for `C` elementary circuits — no
+* blowup on acyclic input. Each circuit is enumerated exactly once from its
+* lowest-indexed member (vertices are ordered lexicographically), so overlapping
+* / chord cycles that share interior nodes are each detected independently. The
+* emitted cycle is still canonicalized to its lexicographically smallest
+* rotation for a stable cacheKey.
 */
 declare const circularFk: Lint;
 /**
@@ -3604,4 +3627,4 @@ interface RunAdvisorOptions {
 * `static` lints at build time and defer `runtime` lints to a live shard.
 */
 declare const runAdvisor: (context: LintContext, options?: RunAdvisorOptions) => Finding[];
-export { AE_METRIC_EVENTS, ALL_LINTS, type AdvisorAdminRoute, type AdvisorAiRawRun, type AdvisorAiToolSideEffect, type AdvisorArgumentDerivedFetch, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorAuthConfig, type AdvisorBrowserUrlAccess, type AdvisorConfigCall, type AdvisorContainer, type AdvisorContainerKeyAccess, type AdvisorContainerOverride, type AdvisorFailOpenGuard, type AdvisorFlagSecurityDefault, type AdvisorHttpActionGuard, type AdvisorHttpHeaderWrite, type AdvisorHyperdriveCall, type AdvisorIdentityClaimRead, type AdvisorImageDeliveryUrlAccess, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorKvKeyAccess, type AdvisorMailRecipientAccess, type AdvisorMaskProcedure, type AdvisorMaskStrategy, type AdvisorMutatorWrite, type AdvisorNondeterministicCall, type AdvisorNormalizeIdAuthorization, type AdvisorOwnerFieldWrite, type AdvisorPaymentWebhook, type AdvisorPrivilegedDispatch, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorQueue, type AdvisorQueueTuning, type AdvisorR2sqlCall, type AdvisorRatelimitKeySelector, type AdvisorRawRowReturn, type AdvisorRelation, type AdvisorRelationLoad, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShape, type AdvisorShardTraffic, type AdvisorSoftDeleteRead, type AdvisorSqlInterpolation, type AdvisorStorageKeyAccess, type AdvisorStorageUpload, type AdvisorTable, type AdvisorTableSample, type AdvisorTableScan, type AdvisorVectorNamespaceAccess, type AdvisorWorkflow, type AdvisorWorkflowCall, type AdvisorWranglerVariable, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type Category, type Facing, type Finding, type Level, type Lint, type LintContext, type LintSource, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, actionFetchSsrf, adminRouteWithoutGuard, aiRawRunEscapeHatch, aiToolSideEffectPromptInjection, aiUnboundedGenerationPublic, allowUnauthenticatedShardAccessEnabled, authApiCallWithoutHeaders, authCsrfCheckDisabled, authEmailVerificationDisabled, authSecureCookiesDisabled, authSessionFreshageZero, authTrustedOriginsWildcard, browserAllowPrivateTargets, browserUserUrlWithoutAllowlist, circularFk, constraintValidator, containerInstanceKeyFromUserInput, containerOversizedInstance, containerPublicInternet, containerRuntimeEgressRelaxation, containerStartEnableInternetOverride, duplicateIndex, emptyIndex, externalSourceOnGlobal, externalSourceUnscoped, filterWithoutIndex, flagGatesSecurityWithUnsafeDefault, fromServerSchema, hardcodedSecret, hotShard, httpActionMissingAuthGuard, httpActionResponseHeaderInjection, hyperdriveOutsideAction, identityUndeclaredClaimTrusted, imagesUrlSourceFromUserInput, indexReferencesUnknownField, indexUtilization, insertManyUnsafeUserData, kvUnscopedUserKeyIdor, loadAnalyticsRuntimeMetrics, mailInboundDispatchWithoutVerify, mailRecipientFromRequestInput, maskUncoveredPiiColumn, maskWeakHashStrategyOnPii, maskedRelationLeakViaWith, mutatorFullRowReplace, nondeterministicQueryMutation, normalizeIdUsedAsAuthorization, outputProjectionMissingOnPublicRead, ownerFieldFromArgsNotAuth, paymentCreateWithoutAuthorize, paymentWebhookWideTolerance, plaintextSecretInWranglerVariables, policyReferencesUnknownTable, privilegedDispatchUnvalidatedPayload, privilegedFanoutFromPublicProcedure, publicArgumentUsesAny, publicMutationWithoutRatelimit, publicTableRlsOptoutConfusion, queueWithoutDlq, r2sqlOutsideAction, ratelimitDefaultMemoryStore, ratelimitKeySpoofableOrGlobal, ratelimitMiddlewareFailOpen, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, softDeleteIncludeDeletedFromArgs, sqlInjectionRisk, storageGenerateUploadUrlNoContentTypePin, storageKeyFromUserArgs, storagePresignedUrlForPrivateContent, storageUploadWithoutContentTypeAllowlist, storageUploadWithoutMaxSize, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, vectorsNamespaceFromUserInput, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };
+export { AE_METRIC_EVENTS, ALL_LINTS, type AdvisorAdminRoute, type AdvisorAiRawRun, type AdvisorAiToolSideEffect, type AdvisorArgumentDerivedFetch, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorAuthConfig, type AdvisorBrowserUrlAccess, type AdvisorConfigCall, type AdvisorContainer, type AdvisorContainerKeyAccess, type AdvisorContainerOverride, type AdvisorFailOpenGuard, type AdvisorFlagSecurityDefault, type AdvisorHttpActionGuard, type AdvisorHttpHeaderWrite, type AdvisorHyperdriveCall, type AdvisorIdentityClaimRead, type AdvisorImageDeliveryUrlAccess, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorKvKeyAccess, type AdvisorMailRecipientAccess, type AdvisorMaskProcedure, type AdvisorMaskStrategy, type AdvisorMutatorWrite, type AdvisorNondeterministicCall, type AdvisorNormalizeIdAuthorization, type AdvisorOwnerFieldWrite, type AdvisorPaymentWebhook, type AdvisorPrivilegedDispatch, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorQueue, type AdvisorQueueTuning, type AdvisorR2sqlCall, type AdvisorRatelimitKeySelector, type AdvisorRawRowReturn, type AdvisorRelation, type AdvisorRelationLoad, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShape, type AdvisorShardTraffic, type AdvisorSoftDeleteRead, type AdvisorSqlInterpolation, type AdvisorStorageKeyAccess, type AdvisorStorageUpload, type AdvisorTable, type AdvisorTableSample, type AdvisorTableScan, type AdvisorVectorNamespaceAccess, type AdvisorWorkflow, type AdvisorWorkflowCall, type AdvisorWranglerVariable, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type Category, type Facing, type Finding, type Level, type Lint, type LintContext, type LintSource, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, actionFetchSsrf, adminRouteWithoutGuard, aiRawRunEscapeHatch, aiToolSideEffectPromptInjection, aiUnboundedGenerationPublic, allowUnauthenticatedShardAccessEnabled, authApiCallWithoutHeaders, authCsrfCheckDisabled, authEmailVerificationDisabled, authSecureCookiesDisabled, authSessionFreshageZero, authTrustedOriginsWildcard, browserAllowPrivateTargets, browserUserUrlWithoutAllowlist, circularFk, constraintValidator, containerInstanceKeyFromUserInput, containerOversizedInstance, containerPublicInternet, containerRuntimeEgressRelaxation, containerStartEnableInternetOverride, dedupeCacheKeys, duplicateIndex, emptyIndex, externalSourceOnGlobal, externalSourceUnscoped, filterWithoutIndex, flagGatesSecurityWithUnsafeDefault, fromServerSchema, hardcodedSecret, hotShard, httpActionMissingAuthGuard, httpActionResponseHeaderInjection, hyperdriveOutsideAction, identityUndeclaredClaimTrusted, imagesUrlSourceFromUserInput, indexReferencesUnknownField, indexUtilization, insertManyUnsafeUserData, kvUnscopedUserKeyIdor, loadAnalyticsRuntimeMetrics, mailInboundDispatchWithoutVerify, mailRecipientFromRequestInput, maskUncoveredPiiColumn, maskWeakHashStrategyOnPii, maskedRelationLeakViaWith, mutatorFullRowReplace, nondeterministicQueryMutation, normalizeIdUsedAsAuthorization, outputProjectionMissingOnPublicRead, ownerFieldFromArgsNotAuth, paymentCreateWithoutAuthorize, paymentWebhookWideTolerance, plaintextSecretInWranglerVariables, policyReferencesUnknownTable, privilegedDispatchUnvalidatedPayload, privilegedFanoutFromPublicProcedure, publicArgumentUsesAny, publicMutationWithoutRatelimit, publicTableRlsOptoutConfusion, queueWithoutDlq, r2sqlOutsideAction, ratelimitDefaultMemoryStore, ratelimitKeySpoofableOrGlobal, ratelimitMiddlewareFailOpen, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, softDeleteIncludeDeletedFromArgs, sqlInjectionRisk, storageGenerateUploadUrlNoContentTypePin, storageKeyFromUserArgs, storagePresignedUrlForPrivateContent, storageUploadWithoutContentTypeAllowlist, storageUploadWithoutMaxSize, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, vectorsNamespaceFromUserInput, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };

package/dist/index.d.ts

@@ -2023,6 +2023,22 @@ interface AnalyticsRuntimeMetrics {
 */
 declare const loadAnalyticsRuntimeMetrics: (source: AnalyticsMetricsSource, options: AnalyticsMetricsOptions) => Promise<AnalyticsRuntimeMetrics>;
 /**
+* Disambiguate {@link Finding}s that share a `cacheKey`.
+*
+* A `cacheKey` is the studio's dedup / dismissal id (see {@link Finding.cacheKey}):
+* two findings with the same key collapse to one row, and a single dismissal
+* silences both. A lint keyed on `name:file:line` (the argument-derived sinks,
+* `sql_injection_risk`, `kv_unscoped_user_key_idor`, `hardcoded_secret`, …) can
+* legitimately emit two occurrences on one physical source line, so without a
+* within-line discriminator the second finding is silently hidden.
+*
+* This suffixes the second-and-later occurrence of any repeated key with
+* `:&lt;n>` (`:2`, `:3`, …), leaving the first occurrence unsuffixed so existing
+* single-occurrence keys stay stable across runs. Order is preserved. Keys are
+* lint-name-prefixed, so this never merges across lints.
+*/
+declare const dedupeCacheKeys: (findings: ReadonlyArray<Finding>) => Finding[];
+/**
 * Constraint validator — flag rows that violate declared FK / NOT NULL / UNIQUE
 * constraints by cross-checking sampled row data against the schema.
 *
@@ -2351,7 +2367,7 @@ declare const browserAllowPrivateTargets: Lint;
 */
 declare const browserUserUrlWithoutAllowlist: Lint;
 /**
-* Detect FK cycles in the declared relation graph via a DFS.
+* Detect FK cycles in the declared relation graph.
 *
 * A "circular FK" exists when a chain of `one` relations forms a loop — for
 * example `A.authorId → B`, `B.ownerId → C`, `C.postId → A`. Such cycles can
@@ -2370,11 +2386,18 @@ declare const browserUserUrlWithoutAllowlist: Lint;
 * would be noise. Only multi-table cycles — the ones the description illustrates
 * — are surfaced.
 *
-* Each unique cycle is reported once: the cycle path is canonicalized to its
-* lexicographically smallest rotation so two DFS traversals that enter the same
-* ring at different nodes emit the same cacheKey and detail. A representative
-* cycle is reported for each distinct simple cycle in the graph; overlapping or
-* chord cycles that share interior nodes are each detected independently.
+* Cycle enumeration uses **Johnson's algorithm** rather than a naive
+* enumerate-all-paths DFS. A plain path-DFS re-walks every simple path in the
+* graph, which is worst-case exponential even on a fully **acyclic** schema
+* (reconverging FK fan-out — many tables referencing shared parents in a chain —
+* makes codegen appear to hang). Johnson blocks a vertex once a fruitless
+* subtree is exhausted and only unblocks it when a new cycle through it is
+* found, so it runs in `O((V + E)(C + 1))` for `C` elementary circuits — no
+* blowup on acyclic input. Each circuit is enumerated exactly once from its
+* lowest-indexed member (vertices are ordered lexicographically), so overlapping
+* / chord cycles that share interior nodes are each detected independently. The
+* emitted cycle is still canonicalized to its lexicographically smallest
+* rotation for a stable cacheKey.
 */
 declare const circularFk: Lint;
 /**
@@ -3604,4 +3627,4 @@ interface RunAdvisorOptions {
 * `static` lints at build time and defer `runtime` lints to a live shard.
 */
 declare const runAdvisor: (context: LintContext, options?: RunAdvisorOptions) => Finding[];
-export { AE_METRIC_EVENTS, ALL_LINTS, type AdvisorAdminRoute, type AdvisorAiRawRun, type AdvisorAiToolSideEffect, type AdvisorArgumentDerivedFetch, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorAuthConfig, type AdvisorBrowserUrlAccess, type AdvisorConfigCall, type AdvisorContainer, type AdvisorContainerKeyAccess, type AdvisorContainerOverride, type AdvisorFailOpenGuard, type AdvisorFlagSecurityDefault, type AdvisorHttpActionGuard, type AdvisorHttpHeaderWrite, type AdvisorHyperdriveCall, type AdvisorIdentityClaimRead, type AdvisorImageDeliveryUrlAccess, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorKvKeyAccess, type AdvisorMailRecipientAccess, type AdvisorMaskProcedure, type AdvisorMaskStrategy, type AdvisorMutatorWrite, type AdvisorNondeterministicCall, type AdvisorNormalizeIdAuthorization, type AdvisorOwnerFieldWrite, type AdvisorPaymentWebhook, type AdvisorPrivilegedDispatch, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorQueue, type AdvisorQueueTuning, type AdvisorR2sqlCall, type AdvisorRatelimitKeySelector, type AdvisorRawRowReturn, type AdvisorRelation, type AdvisorRelationLoad, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShape, type AdvisorShardTraffic, type AdvisorSoftDeleteRead, type AdvisorSqlInterpolation, type AdvisorStorageKeyAccess, type AdvisorStorageUpload, type AdvisorTable, type AdvisorTableSample, type AdvisorTableScan, type AdvisorVectorNamespaceAccess, type AdvisorWorkflow, type AdvisorWorkflowCall, type AdvisorWranglerVariable, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type Category, type Facing, type Finding, type Level, type Lint, type LintContext, type LintSource, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, actionFetchSsrf, adminRouteWithoutGuard, aiRawRunEscapeHatch, aiToolSideEffectPromptInjection, aiUnboundedGenerationPublic, allowUnauthenticatedShardAccessEnabled, authApiCallWithoutHeaders, authCsrfCheckDisabled, authEmailVerificationDisabled, authSecureCookiesDisabled, authSessionFreshageZero, authTrustedOriginsWildcard, browserAllowPrivateTargets, browserUserUrlWithoutAllowlist, circularFk, constraintValidator, containerInstanceKeyFromUserInput, containerOversizedInstance, containerPublicInternet, containerRuntimeEgressRelaxation, containerStartEnableInternetOverride, duplicateIndex, emptyIndex, externalSourceOnGlobal, externalSourceUnscoped, filterWithoutIndex, flagGatesSecurityWithUnsafeDefault, fromServerSchema, hardcodedSecret, hotShard, httpActionMissingAuthGuard, httpActionResponseHeaderInjection, hyperdriveOutsideAction, identityUndeclaredClaimTrusted, imagesUrlSourceFromUserInput, indexReferencesUnknownField, indexUtilization, insertManyUnsafeUserData, kvUnscopedUserKeyIdor, loadAnalyticsRuntimeMetrics, mailInboundDispatchWithoutVerify, mailRecipientFromRequestInput, maskUncoveredPiiColumn, maskWeakHashStrategyOnPii, maskedRelationLeakViaWith, mutatorFullRowReplace, nondeterministicQueryMutation, normalizeIdUsedAsAuthorization, outputProjectionMissingOnPublicRead, ownerFieldFromArgsNotAuth, paymentCreateWithoutAuthorize, paymentWebhookWideTolerance, plaintextSecretInWranglerVariables, policyReferencesUnknownTable, privilegedDispatchUnvalidatedPayload, privilegedFanoutFromPublicProcedure, publicArgumentUsesAny, publicMutationWithoutRatelimit, publicTableRlsOptoutConfusion, queueWithoutDlq, r2sqlOutsideAction, ratelimitDefaultMemoryStore, ratelimitKeySpoofableOrGlobal, ratelimitMiddlewareFailOpen, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, softDeleteIncludeDeletedFromArgs, sqlInjectionRisk, storageGenerateUploadUrlNoContentTypePin, storageKeyFromUserArgs, storagePresignedUrlForPrivateContent, storageUploadWithoutContentTypeAllowlist, storageUploadWithoutMaxSize, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, vectorsNamespaceFromUserInput, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };
+export { AE_METRIC_EVENTS, ALL_LINTS, type AdvisorAdminRoute, type AdvisorAiRawRun, type AdvisorAiToolSideEffect, type AdvisorArgumentDerivedFetch, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorAuthConfig, type AdvisorBrowserUrlAccess, type AdvisorConfigCall, type AdvisorContainer, type AdvisorContainerKeyAccess, type AdvisorContainerOverride, type AdvisorFailOpenGuard, type AdvisorFlagSecurityDefault, type AdvisorHttpActionGuard, type AdvisorHttpHeaderWrite, type AdvisorHyperdriveCall, type AdvisorIdentityClaimRead, type AdvisorImageDeliveryUrlAccess, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorKvKeyAccess, type AdvisorMailRecipientAccess, type AdvisorMaskProcedure, type AdvisorMaskStrategy, type AdvisorMutatorWrite, type AdvisorNondeterministicCall, type AdvisorNormalizeIdAuthorization, type AdvisorOwnerFieldWrite, type AdvisorPaymentWebhook, type AdvisorPrivilegedDispatch, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorQueue, type AdvisorQueueTuning, type AdvisorR2sqlCall, type AdvisorRatelimitKeySelector, type AdvisorRawRowReturn, type AdvisorRelation, type AdvisorRelationLoad, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShape, type AdvisorShardTraffic, type AdvisorSoftDeleteRead, type AdvisorSqlInterpolation, type AdvisorStorageKeyAccess, type AdvisorStorageUpload, type AdvisorTable, type AdvisorTableSample, type AdvisorTableScan, type AdvisorVectorNamespaceAccess, type AdvisorWorkflow, type AdvisorWorkflowCall, type AdvisorWranglerVariable, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type Category, type Facing, type Finding, type Level, type Lint, type LintContext, type LintSource, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, actionFetchSsrf, adminRouteWithoutGuard, aiRawRunEscapeHatch, aiToolSideEffectPromptInjection, aiUnboundedGenerationPublic, allowUnauthenticatedShardAccessEnabled, authApiCallWithoutHeaders, authCsrfCheckDisabled, authEmailVerificationDisabled, authSecureCookiesDisabled, authSessionFreshageZero, authTrustedOriginsWildcard, browserAllowPrivateTargets, browserUserUrlWithoutAllowlist, circularFk, constraintValidator, containerInstanceKeyFromUserInput, containerOversizedInstance, containerPublicInternet, containerRuntimeEgressRelaxation, containerStartEnableInternetOverride, dedupeCacheKeys, duplicateIndex, emptyIndex, externalSourceOnGlobal, externalSourceUnscoped, filterWithoutIndex, flagGatesSecurityWithUnsafeDefault, fromServerSchema, hardcodedSecret, hotShard, httpActionMissingAuthGuard, httpActionResponseHeaderInjection, hyperdriveOutsideAction, identityUndeclaredClaimTrusted, imagesUrlSourceFromUserInput, indexReferencesUnknownField, indexUtilization, insertManyUnsafeUserData, kvUnscopedUserKeyIdor, loadAnalyticsRuntimeMetrics, mailInboundDispatchWithoutVerify, mailRecipientFromRequestInput, maskUncoveredPiiColumn, maskWeakHashStrategyOnPii, maskedRelationLeakViaWith, mutatorFullRowReplace, nondeterministicQueryMutation, normalizeIdUsedAsAuthorization, outputProjectionMissingOnPublicRead, ownerFieldFromArgsNotAuth, paymentCreateWithoutAuthorize, paymentWebhookWideTolerance, plaintextSecretInWranglerVariables, policyReferencesUnknownTable, privilegedDispatchUnvalidatedPayload, privilegedFanoutFromPublicProcedure, publicArgumentUsesAny, publicMutationWithoutRatelimit, publicTableRlsOptoutConfusion, queueWithoutDlq, r2sqlOutsideAction, ratelimitDefaultMemoryStore, ratelimitKeySpoofableOrGlobal, ratelimitMiddlewareFailOpen, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, softDeleteIncludeDeletedFromArgs, sqlInjectionRisk, storageGenerateUploadUrlNoContentTypePin, storageKeyFromUserArgs, storagePresignedUrlForPrivateContent, storageUploadWithoutContentTypeAllowlist, storageUploadWithoutMaxSize, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, vectorsNamespaceFromUserInput, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };

package/dist/index.mjs

@@ -1,5 +1,6 @@
-import constraintValidator from './packem_shared/constraintValidator-Dr9Py3FD.mjs';
-import hotShard from './packem_shared/hotShard-Ir5D0B6J.mjs';
+import { dedupeCacheKeys } from './packem_shared/dedupeCacheKeys-r5B7u_yq.mjs';
+import constraintValidator from './packem_shared/constraintValidator-CxwtpJ6E.mjs';
+import hotShard from './packem_shared/hotShard-CkC7qpre.mjs';
 import indexUtilization from './packem_shared/indexUtilization-B5DMQ3bI.mjs';
 import actionFetchSsrf from './packem_shared/actionFetchSsrf-wbmYgzmz.mjs';
 import adminRouteWithoutGuard from './packem_shared/adminRouteWithoutGuard-UUGBkAjU.mjs';
@@ -15,7 +16,7 @@ import authSessionFreshageZero from './packem_shared/authSessionFreshageZero-Cju
 import authTrustedOriginsWildcard from './packem_shared/authTrustedOriginsWildcard-ylv4PKzC.mjs';
 import browserAllowPrivateTargets from './packem_shared/browserAllowPrivateTargets-CBvQxLAM.mjs';
 import browserUserUrlWithoutAllowlist from './packem_shared/browserUserUrlWithoutAllowlist-CvhA6w59.mjs';
-import circularFk from './packem_shared/circularFk-B2freHrP.mjs';
+import circularFk from './packem_shared/circularFk-CNcAVuYa.mjs';
 import containerInstanceKeyFromUserInput from './packem_shared/containerInstanceKeyFromUserInput-BUXj2J4w.mjs';
 import containerOversizedInstance from './packem_shared/containerOversizedInstance-5U1VKPRM.mjs';
 import containerPublicInternet from './packem_shared/containerPublicInternet-CuNerJE5.mjs';
@@ -23,9 +24,11 @@ import containerRuntimeEgressRelaxation from './packem_shared/containerRuntimeEg
 import containerStartEnableInternetOverride from './packem_shared/containerStartEnableInternetOverride-DDaHZQ1L.mjs';
 import duplicateIndex from './packem_shared/duplicateIndex-BOublMSt.mjs';
 import emptyIndex from './packem_shared/emptyIndex-BX8EuEY7.mjs';
+import externalSourceOnGlobal from './packem_shared/externalSourceOnGlobal-Bg-NfCX9.mjs';
+import externalSourceUnscoped from './packem_shared/externalSourceUnscoped-5vT-Bup3.mjs';
 import filterWithoutIndex from './packem_shared/filterWithoutIndex-BYVeJaSs.mjs';
 import flagGatesSecurityWithUnsafeDefault from './packem_shared/flagGatesSecurityWithUnsafeDefault-BhIs0shr.mjs';
-import hardcodedSecret from './packem_shared/hardcodedSecret-W2pz1UZB.mjs';
+import hardcodedSecret from './packem_shared/hardcodedSecret-Be-pKVdn.mjs';
 import httpActionMissingAuthGuard from './packem_shared/httpActionMissingAuthGuard-CxipddNx.mjs';
 import httpActionResponseHeaderInjection from './packem_shared/httpActionResponseHeaderInjection-DOFS7pFT.mjs';
 import hyperdriveOutsideAction from './packem_shared/hyperdriveOutsideAction-BgZqX7Xg.mjs';
@@ -80,8 +83,6 @@ import workflowDuplicateStepName from './packem_shared/workflowDuplicateStepName
 import workflowUnknownTarget from './packem_shared/workflowUnknownTarget-Cdd7WhKQ.mjs';
 import workflowUnused from './packem_shared/workflowUnused-D0jHxdz9.mjs';
 export { AE_METRIC_EVENTS, loadAnalyticsRuntimeMetrics } from './packem_shared/AE_METRIC_EVENTS-BM14d0lm.mjs';
-export { default as externalSourceOnGlobal } from './packem_shared/externalSourceOnGlobal-Bg-NfCX9.mjs';
-export { default as externalSourceUnscoped } from './packem_shared/externalSourceUnscoped-5vT-Bup3.mjs';
 export { fromServerSchema } from './packem_shared/fromServerSchema-BiB6JSiW.mjs';
 
 const STATIC_LINTS = [
@@ -91,6 +92,8 @@ const STATIC_LINTS = [
   workflowUnknownTarget,
   workflowDuplicateStepName,
   shapeUnknownTable,
+  externalSourceOnGlobal,
+  externalSourceUnscoped,
   emptyIndex,
   circularFk,
   unindexedForeignKey,
@@ -175,7 +178,7 @@ const runAdvisor = (context, options = {}) => {
     }
     findings.push(...lint.run(context));
   }
-  return findings;
+  return dedupeCacheKeys(findings);
 };
 
-export { ALL_LINTS, RUNTIME_LINTS, STATIC_LINTS, actionFetchSsrf, adminRouteWithoutGuard, aiRawRunEscapeHatch, aiToolSideEffectPromptInjection, aiUnboundedGenerationPublic, allowUnauthenticatedShardAccessEnabled, authApiCallWithoutHeaders, authCsrfCheckDisabled, authEmailVerificationDisabled, authSecureCookiesDisabled, authSessionFreshageZero, authTrustedOriginsWildcard, browserAllowPrivateTargets, browserUserUrlWithoutAllowlist, circularFk, constraintValidator, containerInstanceKeyFromUserInput, containerOversizedInstance, containerPublicInternet, containerRuntimeEgressRelaxation, containerStartEnableInternetOverride, duplicateIndex, emptyIndex, filterWithoutIndex, flagGatesSecurityWithUnsafeDefault, hardcodedSecret, hotShard, httpActionMissingAuthGuard, httpActionResponseHeaderInjection, hyperdriveOutsideAction, identityUndeclaredClaimTrusted, imagesUrlSourceFromUserInput, indexReferencesUnknownField, indexUtilization, insertManyUnsafeUserData, kvUnscopedUserKeyIdor, mailInboundDispatchWithoutVerify, mailRecipientFromRequestInput, maskUncoveredPiiColumn, maskWeakHashStrategyOnPii, maskedRelationLeakViaWith, mutatorFullRowReplace, nondeterministicQueryMutation, normalizeIdUsedAsAuthorization, outputProjectionMissingOnPublicRead, ownerFieldFromArgsNotAuth, paymentCreateWithoutAuthorize, paymentWebhookWideTolerance, plaintextSecretInWranglerVariables, policyReferencesUnknownTable, privilegedDispatchUnvalidatedPayload, privilegedFanoutFromPublicProcedure, publicArgumentUsesAny, publicMutationWithoutRatelimit, publicTableRlsOptoutConfusion, queueWithoutDlq, r2sqlOutsideAction, ratelimitDefaultMemoryStore, ratelimitKeySpoofableOrGlobal, ratelimitMiddlewareFailOpen, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, softDeleteIncludeDeletedFromArgs, sqlInjectionRisk, storageGenerateUploadUrlNoContentTypePin, storageKeyFromUserArgs, storagePresignedUrlForPrivateContent, storageUploadWithoutContentTypeAllowlist, storageUploadWithoutMaxSize, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, vectorsNamespaceFromUserInput, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };
+export { ALL_LINTS, RUNTIME_LINTS, STATIC_LINTS, actionFetchSsrf, adminRouteWithoutGuard, aiRawRunEscapeHatch, aiToolSideEffectPromptInjection, aiUnboundedGenerationPublic, allowUnauthenticatedShardAccessEnabled, authApiCallWithoutHeaders, authCsrfCheckDisabled, authEmailVerificationDisabled, authSecureCookiesDisabled, authSessionFreshageZero, authTrustedOriginsWildcard, browserAllowPrivateTargets, browserUserUrlWithoutAllowlist, circularFk, constraintValidator, containerInstanceKeyFromUserInput, containerOversizedInstance, containerPublicInternet, containerRuntimeEgressRelaxation, containerStartEnableInternetOverride, dedupeCacheKeys, duplicateIndex, emptyIndex, externalSourceOnGlobal, externalSourceUnscoped, filterWithoutIndex, flagGatesSecurityWithUnsafeDefault, hardcodedSecret, hotShard, httpActionMissingAuthGuard, httpActionResponseHeaderInjection, hyperdriveOutsideAction, identityUndeclaredClaimTrusted, imagesUrlSourceFromUserInput, indexReferencesUnknownField, indexUtilization, insertManyUnsafeUserData, kvUnscopedUserKeyIdor, mailInboundDispatchWithoutVerify, mailRecipientFromRequestInput, maskUncoveredPiiColumn, maskWeakHashStrategyOnPii, maskedRelationLeakViaWith, mutatorFullRowReplace, nondeterministicQueryMutation, normalizeIdUsedAsAuthorization, outputProjectionMissingOnPublicRead, ownerFieldFromArgsNotAuth, paymentCreateWithoutAuthorize, paymentWebhookWideTolerance, plaintextSecretInWranglerVariables, policyReferencesUnknownTable, privilegedDispatchUnvalidatedPayload, privilegedFanoutFromPublicProcedure, publicArgumentUsesAny, publicMutationWithoutRatelimit, publicTableRlsOptoutConfusion, queueWithoutDlq, r2sqlOutsideAction, ratelimitDefaultMemoryStore, ratelimitKeySpoofableOrGlobal, ratelimitMiddlewareFailOpen, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, softDeleteIncludeDeletedFromArgs, sqlInjectionRisk, storageGenerateUploadUrlNoContentTypePin, storageKeyFromUserArgs, storagePresignedUrlForPrivateContent, storageUploadWithoutContentTypeAllowlist, storageUploadWithoutMaxSize, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, vectorsNamespaceFromUserInput, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };

package/dist/packem_shared/circularFk-CNcAVuYa.mjs

@@ -0,0 +1,127 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const MAX_CYCLES = 100;
+const circularFk = {
+  categories: ["SCHEMA"],
+  description: "A chain of foreign-key relations forms a cycle (e.g. A → B → C → A). Circular FK dependencies can cause unexpected behavior during DELETE operations — a CASCADE chain may loop indefinitely, and even a RESTRICT cycle prevents deletion of any row in the loop without temporarily disabling constraints.",
+  facing: "INTERNAL",
+  level: "WARN",
+  name: "circular_fk",
+  remediation: "Remove or break the cycle by dropping at least one FK relation from the loop. Consider replacing the circular dependency with a nullable FK and explicit application logic, or restructure the schema using a junction table.",
+  run: (context) => {
+    const findings = [];
+    const order = [...new Set(context.schema.tables.map((table) => table.name))].sort();
+    const indexOf = new Map(order.map((name, index) => [name, index]));
+    const adjacency = /* @__PURE__ */ new Map();
+    for (const table of context.schema.tables) {
+      for (const relation of table.relations) {
+        if (relation.kind !== "one" || !indexOf.has(relation.table)) {
+          continue;
+        }
+        let targets = adjacency.get(table.name);
+        if (targets === void 0) {
+          targets = /* @__PURE__ */ new Set();
+          adjacency.set(table.name, targets);
+        }
+        targets.add(relation.table);
+      }
+    }
+    const blocked = /* @__PURE__ */ new Set();
+    const blockMap = /* @__PURE__ */ new Map();
+    const stack = [];
+    const reported = /* @__PURE__ */ new Set();
+    let capped = false;
+    const unblock = (vertex) => {
+      blocked.delete(vertex);
+      const dependents = blockMap.get(vertex);
+      if (dependents === void 0) {
+        return;
+      }
+      for (const dependent of dependents) {
+        dependents.delete(dependent);
+        if (blocked.has(dependent)) {
+          unblock(dependent);
+        }
+      }
+    };
+    const emitCurrentCycle = () => {
+      const cycle = [...stack];
+      if (cycle.length < 2) {
+        return;
+      }
+      let minIndex = 0;
+      for (let index = 1; index < cycle.length; index += 1) {
+        if (cycle[index] < cycle[minIndex]) {
+          minIndex = index;
+        }
+      }
+      const canonical = [...cycle.slice(minIndex), ...cycle.slice(0, minIndex)];
+      const key = canonical.join("→");
+      if (reported.has(key)) {
+        return;
+      }
+      reported.add(key);
+      const displayPath = [...canonical, canonical[0]].join(" → ");
+      findings.push(
+        emit(circularFk, {
+          cacheKey: `circular_fk:${key}`,
+          detail: `Circular foreign-key dependency detected: ${displayPath}. This cycle can cause unexpected behavior during DELETE operations.`,
+          metadata: {
+            cycle: canonical,
+            path: displayPath,
+            tables: canonical
+          }
+        })
+      );
+      if (reported.size >= MAX_CYCLES) {
+        capped = true;
+      }
+    };
+    const circuit = (vertex, start, startIndex) => {
+      let foundCycle = false;
+      stack.push(vertex);
+      blocked.add(vertex);
+      for (const neighbor of adjacency.get(vertex) ?? []) {
+        if (capped) {
+          break;
+        }
+        if (indexOf.get(neighbor) < startIndex) {
+          continue;
+        }
+        if (neighbor === start) {
+          emitCurrentCycle();
+          foundCycle = true;
+        } else if (!blocked.has(neighbor) && circuit(neighbor, start, startIndex)) {
+          foundCycle = true;
+        }
+      }
+      if (foundCycle) {
+        unblock(vertex);
+      } else {
+        for (const neighbor of adjacency.get(vertex) ?? []) {
+          if (indexOf.get(neighbor) < startIndex) {
+            continue;
+          }
+          let dependents = blockMap.get(neighbor);
+          if (dependents === void 0) {
+            dependents = /* @__PURE__ */ new Set();
+            blockMap.set(neighbor, dependents);
+          }
+          dependents.add(vertex);
+        }
+      }
+      stack.pop();
+      return foundCycle;
+    };
+    for (let startIndex = 0; startIndex < order.length && !capped; startIndex += 1) {
+      blocked.clear();
+      blockMap.clear();
+      circuit(order[startIndex], order[startIndex], startIndex);
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Circular foreign-key dependency"
+};
+
+export { circularFk as default };

package/dist/packem_shared/{constraintValidator-Dr9Py3FD.mjs → constraintValidator-CxwtpJ6E.mjs}

@@ -9,10 +9,28 @@ const formatExamples = (ids, total) => {
   const list = examples.map((id) => `"${id}"`).join(", ");
   return more > 0 ? `${list} (+${more.toString()} more)` : list;
 };
+const resolveReferenceValues = (referencedColumn, targetSample) => {
+  if (referencedColumn === "_id") {
+    return targetSample.existingIds;
+  }
+  const values = /* @__PURE__ */ new Set();
+  for (const row of targetSample.rows) {
+    const value = row[referencedColumn];
+    if (value !== null && value !== void 0) {
+      values.add(String(value));
+    }
+  }
+  return values;
+};
 const checkFkRelation = (lint, sample, relation, targetSample) => {
   if (relation.kind !== "one") {
     return void 0;
   }
+  if (targetSample.truncated) {
+    return void 0;
+  }
+  const referencedColumn = relation.references;
+  const referenceValues = resolveReferenceValues(referencedColumn, targetSample);
   const fkColumn = relation.field;
   const danglingIds = [];
   for (const row of sample.rows) {
@@ -21,16 +39,17 @@ const checkFkRelation = (lint, sample, relation, targetSample) => {
       continue;
     }
     const fkString = String(fkValue);
-    if (!targetSample.existingIds.has(fkString)) {
+    if (!referenceValues.has(fkString)) {
       danglingIds.push(rowId(row));
     }
   }
   if (danglingIds.length === 0) {
     return void 0;
   }
-  const isTruncated = sample.truncated || targetSample.truncated;
-  const cap = Math.min(sample.cap, targetSample.cap);
-  const detail = `Table "${sample.table}": ${danglingIds.length.toString()} sampled row(s) have a dangling FK value in column "${fkColumn}" — the referenced "${relation.table}" row does not exist. Row ids: ${formatExamples(danglingIds, danglingIds.length)}${truncatedSuffix(isTruncated, cap, "more rows may exist beyond the window")}.`;
+  const isTruncated = sample.truncated;
+  const { cap } = sample;
+  const referencedLabel = referencedColumn === "_id" ? `"${relation.table}"` : `"${relation.table}"."${referencedColumn}"`;
+  const detail = `Table "${sample.table}": ${danglingIds.length.toString()} sampled row(s) have a dangling FK value in column "${fkColumn}" — the referenced ${referencedLabel} row does not exist. Row ids: ${formatExamples(danglingIds, danglingIds.length)}${truncatedSuffix(isTruncated, cap, "more rows may exist beyond the window")}.`;
   return emit(lint, {
     cacheKey: `constraint_validator:fk:${sample.table}:${fkColumn}`,
     detail,
@@ -40,6 +59,7 @@ const checkFkRelation = (lint, sample, relation, targetSample) => {
       count: danglingIds.length,
       examples: danglingIds.slice(0, MAX_EXAMPLE_IDS),
       kind: "fk",
+      references: referencedColumn,
       referencesTable: relation.table,
       table: sample.table,
       truncated: isTruncated

package/dist/packem_shared/dedupeCacheKeys-r5B7u_yq.mjs

@@ -0,0 +1,13 @@
+const dedupeCacheKeys = (findings) => {
+  const seen = /* @__PURE__ */ new Map();
+  return findings.map((finding) => {
+    const occurrence = (seen.get(finding.cacheKey) ?? 0) + 1;
+    seen.set(finding.cacheKey, occurrence);
+    if (occurrence === 1) {
+      return finding;
+    }
+    return { ...finding, cacheKey: `${finding.cacheKey}:${occurrence.toString()}` };
+  });
+};
+
+export { dedupeCacheKeys };

package/dist/packem_shared/{hardcodedSecret-W2pz1UZB.mjs → hardcodedSecret-Be-pKVdn.mjs}

@@ -1,3 +1,4 @@
+import { dedupeCacheKeys } from './dedupeCacheKeys-r5B7u_yq.mjs';
 import { e as emit } from './finding-Dm_zvzS1.mjs';
 
 const hardcodedSecret = {
@@ -12,21 +13,16 @@ const hardcodedSecret = {
       return [];
     }
     const findings = [];
-    const occurrenceCount = /* @__PURE__ */ new Map();
     for (const secret of context.secretLiterals) {
-      const baseKey = `${secret.file}:${secret.line.toString()}:${secret.kind}`;
-      const occurrence = (occurrenceCount.get(baseKey) ?? 0) + 1;
-      occurrenceCount.set(baseKey, occurrence);
-      const occurrenceSuffix = occurrence > 1 ? `:${occurrence.toString()}` : "";
       findings.push(
         emit(hardcodedSecret, {
-          cacheKey: `hardcoded_secret:${baseKey}${occurrenceSuffix}`,
+          cacheKey: `hardcoded_secret:${secret.file}:${secret.line.toString()}:${secret.kind}`,
           detail: `A ${secret.kind.replaceAll("_", " ")} (${secret.preview}) is hard-coded at ${secret.file}:${secret.line.toString()}. Move it to \`.dev.vars\` / \`wrangler secret put\` and read it from \`env\`. Rotate the exposed value.`,
           metadata: { file: secret.file, kind: secret.kind, line: secret.line, preview: secret.preview }
         })
       );
     }
-    return findings;
+    return dedupeCacheKeys(findings);
   },
   source: "static",
   title: "Hard-coded secret in source"

package/dist/packem_shared/hotShard-CkC7qpre.mjs

@@ -0,0 +1,60 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const HOT_SHARE_THRESHOLD = 0.5;
+const MIN_TOTAL_REQUESTS = 50;
+const hotShard = {
+  categories: ["PERFORMANCE"],
+  description: "One shard is taking a disproportionate share of a sharded function's traffic, so the busy shard becomes a single-DO bottleneck while its siblings sit idle — the hot-key skew sharding is meant to avoid.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "hot_shard",
+  remediation: "Re-shard on a higher-cardinality / more evenly-distributed key, or split the hot entity's state, so request volume spreads across shards instead of concentrating on one.",
+  run: (context) => {
+    const active = (context.shardTraffic ?? []).filter((shard) => shard.requests > 0);
+    const byGroup = /* @__PURE__ */ new Map();
+    for (const shard of active) {
+      const groupKey = shard.group ?? "";
+      const bucket = byGroup.get(groupKey);
+      if (bucket === void 0) {
+        byGroup.set(groupKey, [shard]);
+      } else {
+        bucket.push(shard);
+      }
+    }
+    const findings = [];
+    for (const [groupKey, groupShards] of byGroup) {
+      const totalRequests = groupShards.reduce((sum, shard) => sum + shard.requests, 0);
+      if (groupShards.length < 2 || totalRequests < MIN_TOTAL_REQUESTS) {
+        continue;
+      }
+      for (const shard of groupShards) {
+        const share = shard.requests / totalRequests;
+        if (share < HOT_SHARE_THRESHOLD) {
+          continue;
+        }
+        const scope = shard.group !== void 0 && shard.group !== "" ? `"${shard.group}" ` : "";
+        const label = shard.shardKey === "" ? "the root shard" : `shard "${shard.shardKey}"`;
+        const percent = Math.round(share * 100);
+        findings.push(
+          emit(hotShard, {
+            cacheKey: `hot_shard:${groupKey}:${shard.shardKey}`,
+            detail: `${scope}${label} handled ${shard.requests.toString()} of ${totalRequests.toString()} requests (${percent.toString()}%) across ${groupShards.length.toString()} shards — a hot-key skew. Re-shard on a more evenly-distributed key.`,
+            metadata: {
+              group: shard.group,
+              requests: shard.requests,
+              shardCount: groupShards.length,
+              shardKey: shard.shardKey,
+              share,
+              totalRequests
+            }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "runtime",
+  title: "Hot shard"
+};
+
+export { hotShard as default };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/advisor",
-  "version": "1.0.0-alpha.25",
+  "version": "1.0.0-alpha.27",
   "description": "Schema & query lints (splinter-style advisors) for Lunora, feeding the Studio Advisors view",
   "keywords": [
     "advisor",
@@ -46,8 +46,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.3",
-    "@lunora/server": "1.0.0-alpha.22"
+    "@lunora/errors": "1.0.0-alpha.4",
+    "@lunora/server": "1.0.0-alpha.24"
   },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"

package/dist/packem_shared/circularFk-B2freHrP.mjs

@@ -1,84 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const circularFk = {
-  categories: ["SCHEMA"],
-  description: "A chain of foreign-key relations forms a cycle (e.g. A → B → C → A). Circular FK dependencies can cause unexpected behavior during DELETE operations — a CASCADE chain may loop indefinitely, and even a RESTRICT cycle prevents deletion of any row in the loop without temporarily disabling constraints.",
-  facing: "INTERNAL",
-  level: "WARN",
-  name: "circular_fk",
-  remediation: "Remove or break the cycle by dropping at least one FK relation from the loop. Consider replacing the circular dependency with a nullable FK and explicit application logic, or restructure the schema using a junction table.",
-  run: (context) => {
-    const findings = [];
-    const edges = /* @__PURE__ */ new Map();
-    for (const table of context.schema.tables) {
-      for (const relation of table.relations) {
-        if (relation.kind !== "one") {
-          continue;
-        }
-        let targets = edges.get(table.name);
-        if (targets === void 0) {
-          targets = /* @__PURE__ */ new Set();
-          edges.set(table.name, targets);
-        }
-        targets.add(relation.table);
-      }
-    }
-    const onStack = /* @__PURE__ */ new Set();
-    const reported = /* @__PURE__ */ new Set();
-    const reportBackEdge = (neighbor, path) => {
-      const cycleStart = path.indexOf(neighbor);
-      if (cycleStart === -1) {
-        return;
-      }
-      const cycle = path.slice(cycleStart);
-      if (cycle.length < 2) {
-        return;
-      }
-      let minIndex = 0;
-      for (let index = 1; index < cycle.length; index += 1) {
-        if (cycle[index] < cycle[minIndex]) {
-          minIndex = index;
-        }
-      }
-      const canonical = [...cycle.slice(minIndex), ...cycle.slice(0, minIndex)];
-      const key = canonical.join("→");
-      if (reported.has(key)) {
-        return;
-      }
-      reported.add(key);
-      const displayPath = [...canonical, canonical[0]].join(" → ");
-      findings.push(
-        emit(circularFk, {
-          cacheKey: `circular_fk:${key}`,
-          detail: `Circular foreign-key dependency detected: ${displayPath}. This cycle can cause unexpected behavior during DELETE operations.`,
-          metadata: {
-            cycle: canonical,
-            path: displayPath,
-            tables: canonical
-          }
-        })
-      );
-    };
-    const dfs = (node, path) => {
-      onStack.add(node);
-      path.push(node);
-      for (const neighbor of edges.get(node) ?? []) {
-        if (onStack.has(neighbor)) {
-          reportBackEdge(neighbor, path);
-        } else {
-          dfs(neighbor, path);
-        }
-      }
-      path.pop();
-      onStack.delete(node);
-    };
-    for (const table of context.schema.tables) {
-      dfs(table.name, []);
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Circular foreign-key dependency"
-};
-
-export { circularFk as default };

package/dist/packem_shared/hotShard-Ir5D0B6J.mjs

@@ -1,48 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const HOT_SHARE_THRESHOLD = 0.5;
-const MIN_TOTAL_REQUESTS = 50;
-const hotShard = {
-  categories: ["PERFORMANCE"],
-  description: "One shard is taking a disproportionate share of a sharded function's traffic, so the busy shard becomes a single-DO bottleneck while its siblings sit idle — the hot-key skew sharding is meant to avoid.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "hot_shard",
-  remediation: "Re-shard on a higher-cardinality / more evenly-distributed key, or split the hot entity's state, so request volume spreads across shards instead of concentrating on one.",
-  run: (context) => {
-    const active = (context.shardTraffic ?? []).filter((shard) => shard.requests > 0);
-    const totalRequests = active.reduce((sum, shard) => sum + shard.requests, 0);
-    if (active.length < 2 || totalRequests < MIN_TOTAL_REQUESTS) {
-      return [];
-    }
-    const findings = [];
-    for (const shard of active) {
-      const share = shard.requests / totalRequests;
-      if (share < HOT_SHARE_THRESHOLD) {
-        continue;
-      }
-      const scope = shard.group !== void 0 && shard.group !== "" ? `"${shard.group}" ` : "";
-      const label = shard.shardKey === "" ? "the root shard" : `shard "${shard.shardKey}"`;
-      const percent = Math.round(share * 100);
-      findings.push(
-        emit(hotShard, {
-          cacheKey: `hot_shard:${shard.group ?? ""}:${shard.shardKey}`,
-          detail: `${scope}${label} handled ${shard.requests.toString()} of ${totalRequests.toString()} requests (${percent.toString()}%) across ${active.length.toString()} shards — a hot-key skew. Re-shard on a more evenly-distributed key.`,
-          metadata: {
-            group: shard.group,
-            requests: shard.requests,
-            shardCount: active.length,
-            shardKey: shard.shardKey,
-            share,
-            totalRequests
-          }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "runtime",
-  title: "Hot shard"
-};
-
-export { hotShard as default };