@lunora/advisor 1.0.0-alpha.3 → 1.0.0-alpha.30

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (76) hide show
  1. package/LICENSE.md +6 -0
  2. package/README.md +1 -1
  3. package/__assets__/package-og.svg +1 -1
  4. package/dist/index.d.mts +2215 -10
  5. package/dist/index.d.ts +2215 -10
  6. package/dist/index.mjs +120 -13
  7. package/dist/packem_shared/{AE_METRIC_EVENTS-DexctYv6.mjs → AE_METRIC_EVENTS-BM14d0lm.mjs} +3 -1
  8. package/dist/packem_shared/actionFetchSsrf-wbmYgzmz.mjs +26 -0
  9. package/dist/packem_shared/aiRawRunEscapeHatch-C29jd32J.mjs +26 -0
  10. package/dist/packem_shared/aiToolSideEffectPromptInjection-BtD3alqB.mjs +33 -0
  11. package/dist/packem_shared/aiUnboundedGenerationPublic-CbAcSxLB.mjs +26 -0
  12. package/dist/packem_shared/allowUnauthenticatedShardAccessEnabled-BcASq-jP.mjs +30 -0
  13. package/dist/packem_shared/argument-derived-sink-C1xTTqAt.mjs +30 -0
  14. package/dist/packem_shared/authCsrfCheckDisabled-DCf9FSoD.mjs +26 -0
  15. package/dist/packem_shared/authEmailVerificationDisabled-Dk-Tc5oU.mjs +26 -0
  16. package/dist/packem_shared/authSecureCookiesDisabled-osJrHW9Y.mjs +26 -0
  17. package/dist/packem_shared/authSessionFreshageZero-CjufCc_Q.mjs +26 -0
  18. package/dist/packem_shared/authTrustedOriginsWildcard-ylv4PKzC.mjs +26 -0
  19. package/dist/packem_shared/browserAllowPrivateTargets-CBvQxLAM.mjs +26 -0
  20. package/dist/packem_shared/browserUserUrlWithoutAllowlist-CvhA6w59.mjs +26 -0
  21. package/dist/packem_shared/circularFk-CNcAVuYa.mjs +127 -0
  22. package/dist/packem_shared/{constraintValidator-Dr9Py3FD.mjs → constraintValidator-CxwtpJ6E.mjs} +24 -4
  23. package/dist/packem_shared/containerInstanceKeyFromUserInput-BUXj2J4w.mjs +19 -0
  24. package/dist/packem_shared/containerRuntimeEgressRelaxation-B0LlfmDA.mjs +26 -0
  25. package/dist/packem_shared/containerStartEnableInternetOverride-DDaHZQ1L.mjs +26 -0
  26. package/dist/packem_shared/dedupeCacheKeys-r5B7u_yq.mjs +13 -0
  27. package/dist/packem_shared/externalSourceIncrementalNoDeletePath-DvX9cRBD.mjs +45 -0
  28. package/dist/packem_shared/externalSourceOnGlobal-Bg-NfCX9.mjs +30 -0
  29. package/dist/packem_shared/externalSourceUnscoped-5vT-Bup3.mjs +44 -0
  30. package/dist/packem_shared/flagGatesSecurityWithUnsafeDefault-BhIs0shr.mjs +41 -0
  31. package/dist/packem_shared/{fromServerSchema-DinF1nph.mjs → fromServerSchema-BjAZdvJ6.mjs} +10 -0
  32. package/dist/packem_shared/{hardcodedSecret-W2pz1UZB.mjs → hardcodedSecret-Be-pKVdn.mjs} +3 -7
  33. package/dist/packem_shared/helpers-BySnKhVB.mjs +31 -0
  34. package/dist/packem_shared/hotShard-CkC7qpre.mjs +60 -0
  35. package/dist/packem_shared/httpActionMissingAuthGuard-CxipddNx.mjs +35 -0
  36. package/dist/packem_shared/httpActionResponseHeaderInjection-DOFS7pFT.mjs +39 -0
  37. package/dist/packem_shared/identityUndeclaredClaimTrusted-D8nXV2dd.mjs +32 -0
  38. package/dist/packem_shared/imagesUrlSourceFromUserInput-YcDQ0b_Y.mjs +19 -0
  39. package/dist/packem_shared/{indexReferencesUnknownField-DH0_dbUY.mjs → indexReferencesUnknownField-BSWNngxX.mjs} +1 -1
  40. package/dist/packem_shared/insertManyUnsafeUserData-Dn77XpmX.mjs +26 -0
  41. package/dist/packem_shared/kvUnscopedUserKeyIdor-YWwmfE8X.mjs +19 -0
  42. package/dist/packem_shared/mailInboundDispatchWithoutVerify-CHSRA8zz.mjs +28 -0
  43. package/dist/packem_shared/mailRecipientFromRequestInput-Cka2qu5J.mjs +26 -0
  44. package/dist/packem_shared/maskWeakHashStrategyOnPii-1c4q8Opf.mjs +35 -0
  45. package/dist/packem_shared/maskedRelationLeakViaWith-CPI4s0sl.mjs +76 -0
  46. package/dist/packem_shared/mutatorFullRowReplace-BJnNDaIV.mjs +26 -0
  47. package/dist/packem_shared/normalizeIdUsedAsAuthorization-BVPtCpzT.mjs +50 -0
  48. package/dist/packem_shared/outputProjectionMissingOnPublicRead-Bl5IMx0k.mjs +51 -0
  49. package/dist/packem_shared/ownerFieldFromArgsNotAuth-mOw3hE5z.mjs +26 -0
  50. package/dist/packem_shared/paymentCreateWithoutAuthorize-BYm4JLxo.mjs +26 -0
  51. package/dist/packem_shared/paymentWebhookWideTolerance-D9QQJMJq.mjs +35 -0
  52. package/dist/packem_shared/plaintextSecretInWranglerVariables-NKO4YkKf.mjs +35 -0
  53. package/dist/packem_shared/privilegedDispatchUnvalidatedPayload-5Forjckt.mjs +37 -0
  54. package/dist/packem_shared/privilegedFanoutFromPublicProcedure-D3dL01B8.mjs +26 -0
  55. package/dist/packem_shared/{publicMutationWithoutRatelimit-xBpJ6GWK.mjs → publicMutationWithoutRatelimit-DbIhgi7j.mjs} +2 -2
  56. package/dist/packem_shared/publicTableRlsOptoutConfusion-Bn71yoD4.mjs +38 -0
  57. package/dist/packem_shared/queueWithoutDlq-CSkGNb_0.mjs +41 -0
  58. package/dist/packem_shared/ratelimitDefaultMemoryStore-BISChG5C.mjs +26 -0
  59. package/dist/packem_shared/ratelimitKeySpoofableOrGlobal-DqlHYQQ3.mjs +26 -0
  60. package/dist/packem_shared/ratelimitMiddlewareFailOpen-CJgDCaUw.mjs +33 -0
  61. package/dist/packem_shared/{relationReferencesUnknownField-YznyXt_7.mjs → relationReferencesUnknownField-CjbLScJ1.mjs} +1 -1
  62. package/dist/packem_shared/shapeTargetsGlobalTable-DHrf4Koi.mjs +34 -0
  63. package/dist/packem_shared/shapeUnknownTable-C8aDWFoe.mjs +34 -0
  64. package/dist/packem_shared/softDeleteIncludeDeletedFromArgs-BLqDKrkM.mjs +38 -0
  65. package/dist/packem_shared/storageGenerateUploadUrlNoContentTypePin-Da4L9Ge8.mjs +26 -0
  66. package/dist/packem_shared/storageKeyFromUserArgs-B86elJgS.mjs +19 -0
  67. package/dist/packem_shared/storagePresignedUrlForPrivateContent-yGmb8uqz.mjs +47 -0
  68. package/dist/packem_shared/storageUploadWithoutContentTypeAllowlist-BV-gF1lT.mjs +27 -0
  69. package/dist/packem_shared/storageUploadWithoutMaxSize-DpxO59wU.mjs +27 -0
  70. package/dist/packem_shared/{userCreatingMutationWithoutCaptcha-CH31YsUZ.mjs → userCreatingMutationWithoutCaptcha-2DZtWIPb.mjs} +2 -2
  71. package/dist/packem_shared/vectorsNamespaceFromUserInput-CQhr5bVn.mjs +19 -0
  72. package/dist/packem_shared/workflowDuplicateStepName-ioBxPBCy.mjs +48 -0
  73. package/package.json +4 -3
  74. package/dist/packem_shared/circularFk-B2freHrP.mjs +0 -84
  75. package/dist/packem_shared/helpers-DNCkMWZQ.mjs +0 -4
  76. package/dist/packem_shared/hotShard-Ir5D0B6J.mjs +0 -48
@@ -1,84 +0,0 @@
1
- import { e as emit } from './finding-Dm_zvzS1.mjs';
2
-
3
- const circularFk = {
4
- categories: ["SCHEMA"],
5
- description: "A chain of foreign-key relations forms a cycle (e.g. A → B → C → A). Circular FK dependencies can cause unexpected behavior during DELETE operations — a CASCADE chain may loop indefinitely, and even a RESTRICT cycle prevents deletion of any row in the loop without temporarily disabling constraints.",
6
- facing: "INTERNAL",
7
- level: "WARN",
8
- name: "circular_fk",
9
- remediation: "Remove or break the cycle by dropping at least one FK relation from the loop. Consider replacing the circular dependency with a nullable FK and explicit application logic, or restructure the schema using a junction table.",
10
- run: (context) => {
11
- const findings = [];
12
- const edges = /* @__PURE__ */ new Map();
13
- for (const table of context.schema.tables) {
14
- for (const relation of table.relations) {
15
- if (relation.kind !== "one") {
16
- continue;
17
- }
18
- let targets = edges.get(table.name);
19
- if (targets === void 0) {
20
- targets = /* @__PURE__ */ new Set();
21
- edges.set(table.name, targets);
22
- }
23
- targets.add(relation.table);
24
- }
25
- }
26
- const onStack = /* @__PURE__ */ new Set();
27
- const reported = /* @__PURE__ */ new Set();
28
- const reportBackEdge = (neighbor, path) => {
29
- const cycleStart = path.indexOf(neighbor);
30
- if (cycleStart === -1) {
31
- return;
32
- }
33
- const cycle = path.slice(cycleStart);
34
- if (cycle.length < 2) {
35
- return;
36
- }
37
- let minIndex = 0;
38
- for (let index = 1; index < cycle.length; index += 1) {
39
- if (cycle[index] < cycle[minIndex]) {
40
- minIndex = index;
41
- }
42
- }
43
- const canonical = [...cycle.slice(minIndex), ...cycle.slice(0, minIndex)];
44
- const key = canonical.join("→");
45
- if (reported.has(key)) {
46
- return;
47
- }
48
- reported.add(key);
49
- const displayPath = [...canonical, canonical[0]].join(" → ");
50
- findings.push(
51
- emit(circularFk, {
52
- cacheKey: `circular_fk:${key}`,
53
- detail: `Circular foreign-key dependency detected: ${displayPath}. This cycle can cause unexpected behavior during DELETE operations.`,
54
- metadata: {
55
- cycle: canonical,
56
- path: displayPath,
57
- tables: canonical
58
- }
59
- })
60
- );
61
- };
62
- const dfs = (node, path) => {
63
- onStack.add(node);
64
- path.push(node);
65
- for (const neighbor of edges.get(node) ?? []) {
66
- if (onStack.has(neighbor)) {
67
- reportBackEdge(neighbor, path);
68
- } else {
69
- dfs(neighbor, path);
70
- }
71
- }
72
- path.pop();
73
- onStack.delete(node);
74
- };
75
- for (const table of context.schema.tables) {
76
- dfs(table.name, []);
77
- }
78
- return findings;
79
- },
80
- source: "static",
81
- title: "Circular foreign-key dependency"
82
- };
83
-
84
- export { circularFk as default };
@@ -1,4 +0,0 @@
1
- const SYSTEM_FIELDS = /* @__PURE__ */ new Set(["_creationTime", "_id"]);
2
- const tableColumnSet = (table) => /* @__PURE__ */ new Set([...SYSTEM_FIELDS, ...table.fields]);
3
-
4
- export { tableColumnSet as t };
@@ -1,48 +0,0 @@
1
- import { e as emit } from './finding-Dm_zvzS1.mjs';
2
-
3
- const HOT_SHARE_THRESHOLD = 0.5;
4
- const MIN_TOTAL_REQUESTS = 50;
5
- const hotShard = {
6
- categories: ["PERFORMANCE"],
7
- description: "One shard is taking a disproportionate share of a sharded function's traffic, so the busy shard becomes a single-DO bottleneck while its siblings sit idle — the hot-key skew sharding is meant to avoid.",
8
- facing: "EXTERNAL",
9
- level: "WARN",
10
- name: "hot_shard",
11
- remediation: "Re-shard on a higher-cardinality / more evenly-distributed key, or split the hot entity's state, so request volume spreads across shards instead of concentrating on one.",
12
- run: (context) => {
13
- const active = (context.shardTraffic ?? []).filter((shard) => shard.requests > 0);
14
- const totalRequests = active.reduce((sum, shard) => sum + shard.requests, 0);
15
- if (active.length < 2 || totalRequests < MIN_TOTAL_REQUESTS) {
16
- return [];
17
- }
18
- const findings = [];
19
- for (const shard of active) {
20
- const share = shard.requests / totalRequests;
21
- if (share < HOT_SHARE_THRESHOLD) {
22
- continue;
23
- }
24
- const scope = shard.group !== void 0 && shard.group !== "" ? `"${shard.group}" ` : "";
25
- const label = shard.shardKey === "" ? "the root shard" : `shard "${shard.shardKey}"`;
26
- const percent = Math.round(share * 100);
27
- findings.push(
28
- emit(hotShard, {
29
- cacheKey: `hot_shard:${shard.group ?? ""}:${shard.shardKey}`,
30
- detail: `${scope}${label} handled ${shard.requests.toString()} of ${totalRequests.toString()} requests (${percent.toString()}%) across ${active.length.toString()} shards — a hot-key skew. Re-shard on a more evenly-distributed key.`,
31
- metadata: {
32
- group: shard.group,
33
- requests: shard.requests,
34
- shardCount: active.length,
35
- shardKey: shard.shardKey,
36
- share,
37
- totalRequests
38
- }
39
- })
40
- );
41
- }
42
- return findings;
43
- },
44
- source: "runtime",
45
- title: "Hot shard"
46
- };
47
-
48
- export { hotShard as default };