@lunora/advisor 1.0.0-alpha.31 → 1.0.0-alpha.33

package/dist/index.d.mts

@@ -280,6 +280,39 @@ interface AdvisorContainer {
   /** Declared `sleepAfter` value, when a static literal. */
   sleepAfter?: number | string;
 }
+/**
+ * One CDC export-sink construction discovered in a function body — the input the
+ * `export_sink_misconfigured` lint consumes. Produced by the codegen feeder,
+ * which walks the lunora source for the three sink factories the export tap
+ * (plan 170) ships: `defineExportSink({ name, deliver })`,
+ * `webhookExportSink({ name, url, … })`, and `r2Sink({ name, bucket, … })`.
+ *
+ * A sink missing a required field can never deliver a change batch — a webhook
+ * with no `url` would POST to `undefined`, an R2 sink with no `bucket` binding has
+ * nowhere to write, and a custom sink with no `deliver` has no delivery path. The
+ * runtime `defineExportSink` guard throws for a missing `name`/`deliver`, but the
+ * built-in `webhookExportSink`/`r2Sink` don't validate `url`/`bucket`, so catching
+ * the misconfiguration statically beats a silently-dead export tap at runtime.
+ * Runtime callers don't supply this, so the lint finds nothing there.
+ */
+interface AdvisorExportSink {
+  /**
+   * True when the factory's config argument is a statically analyzable object
+   * literal. A non-literal config (a variable, a spread) is not decidable, so
+   * the lint skips it rather than raising a false alarm.
+   */
+  analyzable: boolean;
+  /** Present keys whose value is an empty-string literal (`""`) — treated as missing. */
+  emptyKeys: string[];
+  /** Which sink factory was called. */
+  factory: "defineExportSink" | "r2Sink" | "webhookExportSink";
+  /** Source file the construction appears in (relative to the lunora dir, no extension). */
+  file: string;
+  /** 1-based line of the factory call, or `0` when unknown. */
+  line: number;
+  /** Config keys present on the object literal, regardless of value. */
+  presentKeys: string[];
+}
 /**
  * One rate-limit / Turnstile middleware call — the `ratelimit_middleware_fail_open`
  * lint input. `rateLimit`/`dbRateLimit` (`@lunora/ratelimit`) and
@@ -328,6 +361,27 @@ interface AdvisorFlagSecurityDefault {
   /** 1-based line of the `ctx.flags.boolean` call, or `0` when unknown. */
   line: number;
 }
+/**
+ * One `withGeoIndex("name", …)` read discovered in a function body — the use-side
+ * input the `geo_index_unused` lint cross-references against the declared geo
+ * indexes in the lint context's schema. Produced by the codegen feeder, which
+ * walks the lunora source for `ctx.db.query("t").withGeoIndex(name, …)` /
+ * `ctx.db.<table>.withGeoIndex(name, …)` reads and records each referenced index
+ * name. Runtime callers don't supply it, so the lint finds nothing there.
+ *
+ * A `.geoIndex(name, { field })` maintains a geohash companion column on every
+ * write; if no handler ever reads it via `withGeoIndex(name, …)` the companion is
+ * dead overhead (maintained on every write, read by nothing) — the geo analogue
+ * of a dead regular index.
+ */
+interface AdvisorGeoIndexUsage {
+  /** Source file the read appears in (relative to the lunora dir, no extension). */
+  file: string;
+  /** The referenced geo-index name; empty when the `withGeoIndex(...)` argument is not a string literal. */
+  indexName: string;
+  /** 1-based line of the `withGeoIndex(...)` call, or `0` when unknown. */
+  line: number;
+}
 /**
  * One discovered `httpAction`/`httpRoute` handler that performs a side effect
  * (`ctx.runMutation` / `ctx.runAction` / a `ctx.db.{insert,patch,replace,delete,
@@ -688,6 +742,48 @@ interface AdvisorNormalizeIdAuthorization {
   /** `"internal"` for `internalQuery`/`internalMutation`; `"public"` for `query`/`mutation`. */
   visibility: "internal" | "public";
 }
+/**
+ * One `ctx.notify` / `ctx.push` send discovered lexically inside a `query(...)`
+ * or `mutation(...)` handler body — the input the `notify_send_outside_action`
+ * lint consumes. Produced by the codegen feeder, which walks each exported
+ * function's handler with ts-morph and records the `@lunora/notify` send surface
+ * (`ctx.notify.send`, `ctx.notify.chat/inApp/webhook`, `ctx.push.send`,
+ * `ctx.push.broadcast`).
+ *
+ * A notification send is external I/O (a `fetch` to a push service / FCM): it is
+ * non-deterministic like `fetch`, so it breaks the determinism the coordinator
+ * relies on when re-running a query on subscription re-evaluation or a mutation on
+ * OCC retry (a retried mutation would re-send). It therefore belongs **only** in
+ * `action(...)` handlers. Calls inside `action(...)` are intentionally **not**
+ * recorded — actions are the escape hatch. Runtime callers don't supply this, so
+ * the lint finds nothing there.
+ */
+interface AdvisorNotifyCall {
+  /** The send surface accessed, e.g. `ctx.push.broadcast` / `ctx.notify.send`. */
+  callee: string;
+  /** The exported function performing the send (e.g. `sendWelcome`). */
+  exportName: string;
+  /** Source file the send appears in (relative to the lunora dir, no extension). */
+  file: string;
+  /** Which procedure kind the send lives in — only `query`/`mutation` are flagged; actions are exempt. */
+  kind: "mutation" | "query";
+  /** 1-based line of the send, or `0` when unknown. */
+  line: number;
+}
+/**
+ * Whether an app uses `ctx.push` and which push channels `defineNotify(...)`
+ * configures — the input the `notify_missing_push_config` lint consumes. Produced
+ * by the codegen feeder from the resolved `lunora/notify.ts` definition and the
+ * discovered `ctx.push` usage; absent for runtime callers.
+ */
+interface AdvisorNotifyConfig {
+  /** Whether `defineNotify` wired the FCM channel. */
+  hasFcm: boolean;
+  /** Whether `defineNotify` wired the Web Push channel. */
+  hasWebPush: boolean;
+  /** Whether any handler sends a push (`ctx.push.send` / `ctx.push.broadcast`). */
+  usesPush: boolean;
+}
 /**
  * One `ctx.db` write (`insert` / `replace` / `patch` / `insertManyUnsafe`) that
  * sets an ownership / identity column — `userId`, `ownerId`, `tenantId`, and the
@@ -786,6 +882,8 @@ interface AdvisorProcedureProtection {
   unboundedAiGeneration: boolean;
   /** `true` when the chain carries `.use(verifyTurnstile(...))` or a `protectPublic({ captcha })` bundle. */
   usesCaptcha: boolean;
+  /** `true` when the chain carries `.use(emailGateMiddleware(...))` from `@lunora/auth`. Read by the `signup_mutation_without_disposable_gating` lint (paired with public visibility + a user-table write). */
+  usesEmailGate: boolean;
   /** `true` when the handler calls `ctx.db.insertManyUnsafe(...)`, which bypasses validators and triggers. Read by the `insert_many_unsafe_user_data` lint (paired with public visibility). */
   usesInsertManyUnsafe: boolean;
   /** `true` when the chain carries `.use(mask(...))`. */
@@ -1000,6 +1098,14 @@ interface AdvisorSchema {
 }
 /** A table plus the column/index/relation metadata lints inspect. */
 interface AdvisorTable {
+  /**
+   * Effective validator kind per declared column (a `v.optional(...)` is
+   * unwrapped to its inner kind). Read by the schema-type lints
+   * (`ttl_field_not_timestamp`, `geo_index_field_not_geopoint`) to check a
+   * referenced column's type. Optional — a feeder that doesn't track column
+   * kinds omits it, and the type lints then skip the check.
+   */
+  columnKinds?: Record<string, string>;
   /**
    * `true` when the table is written outside Lunora's discoverable insert path
    * — declared via `.externallyManaged()` (e.g. `@lunora/auth`'s better-auth
@@ -1067,6 +1173,15 @@ interface AdvisorTable {
   softDelete?: {
     field: string;
   };
+  /**
+   * Set when the table declared `.ttl(field, { after? })`. Read by the
+   * `ttl_field_not_timestamp` lint to confirm the expiry column is time-typed.
+   * Optional — a feeder that doesn't track TTL omits it.
+   */
+  ttl?: {
+    after?: number;
+    field: string;
+  };
 }
 /**
  * One declared index, flattened across Lunora's index kinds so a single lint can
@@ -1079,7 +1194,7 @@ interface AdvisorTable {
  */
 interface AdvisorIndex {
   fields: ReadonlyArray<string>;
-  kind: "index" | "rank" | "search" | "vector";
+  kind: "geo" | "index" | "rank" | "search" | "vector";
   name: string;
   unique?: boolean;
 }
@@ -1558,6 +1673,16 @@ interface LintContext {
    * the container lints find nothing.
    */
   containers?: ReadonlyArray<AdvisorContainer>;
+  /**
+   * CDC export-sink constructions (`defineExportSink` / `webhookExportSink` /
+   * `r2Sink`) discovered in function bodies — the `export_sink_misconfigured`
+   * input. Each carries which config keys were present (and which were an empty
+   * string), so the lint can flag a sink missing a required field (a webhook
+   * with no `url`, an R2 sink with no `bucket`, a sink with no `name`/`deliver`).
+   * Supplied by the codegen feeder; absent for runtime callers, where the lint
+   * finds nothing.
+   */
+  exportSinks?: ReadonlyArray<AdvisorExportSink>;
   /**
    * `rateLimit`/`dbRateLimit` (`@lunora/ratelimit`) and `verifyTurnstileMiddleware`
    * (`@lunora/auth`) middleware calls, each with whether its options literal set
@@ -1579,6 +1704,15 @@ interface LintContext {
    * codegen feeder; absent for runtime callers, where the lint finds nothing.
    */
   flagSecurityDefaults?: ReadonlyArray<AdvisorFlagSecurityDefault>;
+  /**
+   * `withGeoIndex("name", …)` reads discovered in function bodies — the use-side
+   * input the `geo_index_unused` lint cross-references against the declared geo
+   * indexes in {@link LintContext.schema}. A declared `.geoIndex(name, …)` with
+   * no matching read is dead overhead (its geohash companion is maintained on
+   * every write and read by nothing). Supplied by the codegen feeder; absent for
+   * runtime callers, where the lint finds nothing.
+   */
+  geoIndexUsages?: ReadonlyArray<AdvisorGeoIndexUsage>;
   /**
    * `httpAction`/`httpRoute` handlers that perform a side effect
    * (`ctx.runMutation` / `ctx.runAction` / a `ctx.db` write) from the HTTP edge,
@@ -1706,6 +1840,21 @@ interface LintContext {
    * for runtime callers, where the lint finds nothing.
    */
   normalizeIdAuthorizations?: ReadonlyArray<AdvisorNormalizeIdAuthorization>;
+  /**
+   * `ctx.notify` / `ctx.push` sends discovered lexically inside `query`/`mutation`
+   * handler bodies — the `notify_send_outside_action` input. Supplied by the
+   * codegen feeder, which omits `action` handlers (where these facades are the
+   * typed, intended surface); absent for runtime callers, where the lint finds
+   * nothing.
+   */
+  notifyCalls?: ReadonlyArray<AdvisorNotifyCall>;
+  /**
+   * Whether the app uses `ctx.push` and which push channels `defineNotify(...)`
+   * wires — the `notify_missing_push_config` input. Supplied by the codegen
+   * feeder from the resolved `lunora/notify.ts` definition; absent for runtime
+   * callers, where the lint finds nothing.
+   */
+  notifyConfig?: AdvisorNotifyConfig;
   /**
    * `ctx.db` writes (`insert` / `replace` / `patch` / `insertManyUnsafe`) that set
    * an ownership / identity column (`userId`, `ownerId`, `tenantId`, …) from the
@@ -2469,6 +2618,24 @@ declare const duplicateIndex: Lint;
  * least one field by construction, so only `kind: "index"` is checked.)
  */
 declare const emptyIndex: Lint;
+/**
+ * Flags a misconfigured CDC export sink (plan 170) — a `defineExportSink` /
+ * `webhookExportSink` / `r2Sink` construction with a required config field
+ * missing or set to an empty string.
+ *
+ * The runtime `defineExportSink` guard throws for a missing `name`/`deliver`, but
+ * the built-in `webhookExportSink` / `r2Sink` never validate their `url` /
+ * `bucket`, so a webhook sink with no URL or an R2 sink with no bucket binding
+ * ships and silently fails to drain — the export tap advances no cursor and the
+ * warehouse never sees a row. Catching it at codegen time beats a dead tap in
+ * production.
+ *
+ * A non-literal config (a variable, a spread that could supply the key) is not
+ * statically decidable, so those constructions are skipped rather than flagged.
+ * Only runs when the codegen feeder supplied evidence (`context.exportSinks`
+ * present); a runtime caller flags nothing.
+ */
+declare const exportSinkMisconfigured: Lint;
 /**
  * Flags a `.source({ mode: "incremental" })` table that declares neither a
  * `reconcileEveryMs` sweep nor a `softDeleteColumn` (plan 136).
@@ -2559,6 +2726,33 @@ declare const filterWithoutIndex: Lint;
  * low. One finding per read.
  */
 declare const flagGatesSecurityWithUnsafeDefault: Lint;
+/**
+ * A correctness lint exploiting Lunora's static edge: a `.geoIndex(name, { field })`
+ * maintains a geohash companion over a `v.geoPoint()` column, and
+ * `withGeoIndex(...).near()/.within()` reads its `lat`/`lng`. If `field` is any
+ * other type, the companion can't be built from `{ lat, lng }` and the index is
+ * dead — it can never answer a geo query. Catching it at codegen time beats a
+ * silently-empty proximity result at runtime.
+ */
+declare const geoIndexFieldNotGeopoint: Lint;
+/**
+ * Flags a declared `.geoIndex(name, { field })` that no handler queries via
+ * `withGeoIndex(name, …)`.
+ *
+ * A geo index maintains a geohash companion column on the row: every write stamps
+ * it, every byte of storage holds it. If nothing ever reads it through
+ * `withGeoIndex(name, q => q.near(…) | q.within(…))` the companion is pure dead
+ * overhead — the geo analogue of a dead regular index. Cross-references every geo
+ * index in the schema against the set of index names some handler references via
+ * `withGeoIndex("&lt;name>")`.
+ *
+ * Suppressed entirely when any usage passes a non-literal name
+ * (`withGeoIndex(someVariable, …)`), because a dynamic reference could target any
+ * declared geo index — flagging "unused" then would be a false positive. Only
+ * runs when the usage feeder supplied evidence (`context.geoIndexUsages`
+ * present); a runtime caller with no evidence flags nothing.
+ */
+declare const geoIndexUnused: Lint;
 /**
  * Flags a secret-shaped string literal checked into the lunora source.
  *
@@ -2911,6 +3105,38 @@ declare const nondeterministicQueryMutation: Lint;
  * runtime caller flags nothing.
  */
 declare const normalizeIdUsedAsAuthorization: Lint;
+/**
+ * Flags an app that sends push notifications (`ctx.push.send` / `ctx.push.broadcast`)
+ * but whose `defineNotify(...)` wires **neither** the Web Push nor the FCM channel.
+ *
+ * With no push channel configured, every `ctx.push` send fails at runtime (the
+ * routing push provider has nothing to dispatch to) — a silent, deploy-time-only
+ * misconfiguration. Web Push additionally needs the `VAPID_*` secrets and FCM the
+ * `FCM_*` secrets; those are scaffolded into `.dev.vars` from `@lunora/config`'s
+ * package-secrets registry, but the channel must still be wired in `defineNotify`.
+ *
+ * This lint runs when the codegen feeder has supplied config evidence
+ * (`context.notifyConfig` present); a runtime caller with no evidence flags
+ * nothing.
+ */
+declare const notifyMissingPushConfig: Lint;
+/**
+ * Flags a `@lunora/notify` send (`ctx.notify.*` / `ctx.push.*`) inside a
+ * `query(...)` or `mutation(...)` handler body.
+ *
+ * A notification send is external I/O — a `fetch` to a Web Push service or FCM.
+ * Like `fetch`/`ctx.sql`, it is non-deterministic, so it breaks the determinism
+ * the coordinator relies on when it re-runs a query on subscription re-evaluation
+ * or a mutation on OCC retry — a retried mutation would fire the notification
+ * again (duplicate pushes). `ctx.notify` / `ctx.push` are therefore wired onto
+ * `ActionCtx` only and belong exclusively in `action(...)` handlers.
+ *
+ * This lint runs when the codegen feeder has supplied send evidence
+ * (`context.notifyCalls` present); a runtime caller with no evidence flags
+ * nothing rather than raising false alarms. The feeder records sends only inside
+ * `query`/`mutation` handlers, so `action(...)` bodies never reach here.
+ */
+declare const notifySendOutsideAction: Lint;
 /**
  * Nudges a `.public()` `query` whose handler returns raw table rows — with no
  * `.output(...)` projection and no `.use(mask(...))` — when that table carries
@@ -3328,6 +3554,24 @@ declare const shapeTargetsGlobalTable: Lint;
  * rather than raising false alarms.
  */
 declare const shapeUnknownTable: Lint;
+/**
+ * Flags a public `mutation`/`action` that creates a user/session/account row but
+ * installs no email-domain gate.
+ *
+ * Account-minting endpoints are the classic throwaway-signup surface: disposable
+ * mailboxes farm free trials, evade bans, and pollute the user table. Lunora
+ * ships `emailGateMiddleware` (`@lunora/auth/email-guard`) — pure-data on the
+ * default (edge-safe) path — that rejects disposable domains at signup. This lint
+ * fires when a public procedure writes a user/session/account-shaped table with
+ * no email gate, pairing with the existing `user_creating_mutation_without_captcha`
+ * lint (a CAPTCHA stops bots; the email gate stops throwaway domains — both are
+ * worth having).
+ *
+ * Runs only when the codegen feeder supplies protection evidence
+ * (`context.procedureProtections`); a runtime caller with no evidence flags
+ * nothing.
+ */
+declare const signupMutationWithoutDisposableGating: Lint;
 /**
  * Flags a public read that resurfaces soft-deleted rows via `includeDeleted` —
  * either hardcoded `true` or wired from the handler's `args`.
@@ -3487,6 +3731,15 @@ declare const storageUploadWithoutMaxSize: Lint;
  * a runtime caller with no insert signal flags nothing rather than every table.
  */
 declare const tableWithoutInsert: Lint;
+/**
+ * A correctness lint with no splinter analogue — Lunora's static edge again: the
+ * `.ttl(field)` policy names an epoch-millisecond expiry column, and the DO alarm
+ * sweep compares `field < now`. If `field` is a non-time column (a string token, a
+ * boolean flag, an object), the comparison is meaningless and rows either never
+ * expire or expire unpredictably — a bug the fully-declared schema catches at
+ * codegen time rather than at 3am when the sweep silently misbehaves.
+ */
+declare const ttlFieldNotTimestamp: Lint;
 /**
  * Flags a public `v.string()` argument with no length bound.
  *
@@ -3653,4 +3906,4 @@ interface RunAdvisorOptions {
  * `static` lints at build time and defer `runtime` lints to a live shard.
  */
 declare const runAdvisor: (context: LintContext, options?: RunAdvisorOptions) => Finding[];
-export { AE_METRIC_EVENTS, ALL_LINTS, type AdvisorAdminRoute, type AdvisorAiRawRun, type AdvisorAiToolSideEffect, type AdvisorArgumentDerivedFetch, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorAuthConfig, type AdvisorBrowserUrlAccess, type AdvisorConfigCall, type AdvisorContainer, type AdvisorContainerKeyAccess, type AdvisorContainerOverride, type AdvisorFailOpenGuard, type AdvisorFlagSecurityDefault, type AdvisorHttpActionGuard, type AdvisorHttpHeaderWrite, type AdvisorHyperdriveCall, type AdvisorIdentityClaimRead, type AdvisorImageDeliveryUrlAccess, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorKvKeyAccess, type AdvisorMailRecipientAccess, type AdvisorMaskProcedure, type AdvisorMaskStrategy, type AdvisorMutatorWrite, type AdvisorNondeterministicCall, type AdvisorNormalizeIdAuthorization, type AdvisorOwnerFieldWrite, type AdvisorPaymentWebhook, type AdvisorPrivilegedDispatch, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorQueue, type AdvisorQueueTuning, type AdvisorR2sqlCall, type AdvisorRatelimitKeySelector, type AdvisorRawRowReturn, type AdvisorRelation, type AdvisorRelationLoad, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShape, type AdvisorShardTraffic, type AdvisorSoftDeleteRead, type AdvisorSqlInterpolation, type AdvisorStorageKeyAccess, type AdvisorStorageUpload, type AdvisorTable, type AdvisorTableSample, type AdvisorTableScan, type AdvisorVectorNamespaceAccess, type AdvisorWorkflow, type AdvisorWorkflowCall, type AdvisorWranglerVariable, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type Category, type Facing, type Finding, type Level, type Lint, type LintContext, type LintSource, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, actionFetchSsrf, adminRouteWithoutGuard, aiRawRunEscapeHatch, aiToolSideEffectPromptInjection, aiUnboundedGenerationPublic, allowUnauthenticatedShardAccessEnabled, authApiCallWithoutHeaders, authCsrfCheckDisabled, authEmailVerificationDisabled, authSecureCookiesDisabled, authSessionFreshageZero, authTrustedOriginsWildcard, browserAllowPrivateTargets, browserUserUrlWithoutAllowlist, circularFk, constraintValidator, containerInstanceKeyFromUserInput, containerOversizedInstance, containerPublicInternet, containerRuntimeEgressRelaxation, containerStartEnableInternetOverride, dedupeCacheKeys, duplicateIndex, emptyIndex, externalSourceIncrementalNoDeletePath, externalSourceOnGlobal, externalSourceUnscoped, filterWithoutIndex, flagGatesSecurityWithUnsafeDefault, fromServerSchema, hardcodedSecret, hotShard, httpActionMissingAuthGuard, httpActionResponseHeaderInjection, hyperdriveOutsideAction, identityUndeclaredClaimTrusted, imagesUrlSourceFromUserInput, indexReferencesUnknownField, indexUtilization, insertManyUnsafeUserData, kvUnscopedUserKeyIdor, loadAnalyticsRuntimeMetrics, mailInboundDispatchWithoutVerify, mailRecipientFromRequestInput, maskUncoveredPiiColumn, maskWeakHashStrategyOnPii, maskedRelationLeakViaWith, mutatorFullRowReplace, nondeterministicQueryMutation, normalizeIdUsedAsAuthorization, outputProjectionMissingOnPublicRead, ownerFieldFromArgsNotAuth, paymentCreateWithoutAuthorize, paymentWebhookWideTolerance, plaintextSecretInWranglerVariables, policyReferencesUnknownTable, privilegedDispatchUnvalidatedPayload, privilegedFanoutFromPublicProcedure, publicArgumentUsesAny, publicMutationWithoutRatelimit, publicTableRlsOptoutConfusion, queueWithoutDlq, r2sqlOutsideAction, ratelimitDefaultMemoryStore, ratelimitKeySpoofableOrGlobal, ratelimitMiddlewareFailOpen, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, softDeleteIncludeDeletedFromArgs, sqlInjectionRisk, storageGenerateUploadUrlNoContentTypePin, storageKeyFromUserArgs, storagePresignedUrlForPrivateContent, storageUploadWithoutContentTypeAllowlist, storageUploadWithoutMaxSize, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, vectorsNamespaceFromUserInput, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };
+export { AE_METRIC_EVENTS, ALL_LINTS, type AdvisorAdminRoute, type AdvisorAiRawRun, type AdvisorAiToolSideEffect, type AdvisorArgumentDerivedFetch, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorAuthConfig, type AdvisorBrowserUrlAccess, type AdvisorConfigCall, type AdvisorContainer, type AdvisorContainerKeyAccess, type AdvisorContainerOverride, type AdvisorExportSink, type AdvisorFailOpenGuard, type AdvisorFlagSecurityDefault, type AdvisorGeoIndexUsage, type AdvisorHttpActionGuard, type AdvisorHttpHeaderWrite, type AdvisorHyperdriveCall, type AdvisorIdentityClaimRead, type AdvisorImageDeliveryUrlAccess, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorKvKeyAccess, type AdvisorMailRecipientAccess, type AdvisorMaskProcedure, type AdvisorMaskStrategy, type AdvisorMutatorWrite, type AdvisorNondeterministicCall, type AdvisorNormalizeIdAuthorization, type AdvisorNotifyCall, type AdvisorNotifyConfig, type AdvisorOwnerFieldWrite, type AdvisorPaymentWebhook, type AdvisorPrivilegedDispatch, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorQueue, type AdvisorQueueTuning, type AdvisorR2sqlCall, type AdvisorRatelimitKeySelector, type AdvisorRawRowReturn, type AdvisorRelation, type AdvisorRelationLoad, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShape, type AdvisorShardTraffic, type AdvisorSoftDeleteRead, type AdvisorSqlInterpolation, type AdvisorStorageKeyAccess, type AdvisorStorageUpload, type AdvisorTable, type AdvisorTableSample, type AdvisorTableScan, type AdvisorVectorNamespaceAccess, type AdvisorWorkflow, type AdvisorWorkflowCall, type AdvisorWranglerVariable, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type Category, type Facing, type Finding, type Level, type Lint, type LintContext, type LintSource, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, actionFetchSsrf, adminRouteWithoutGuard, aiRawRunEscapeHatch, aiToolSideEffectPromptInjection, aiUnboundedGenerationPublic, allowUnauthenticatedShardAccessEnabled, authApiCallWithoutHeaders, authCsrfCheckDisabled, authEmailVerificationDisabled, authSecureCookiesDisabled, authSessionFreshageZero, authTrustedOriginsWildcard, browserAllowPrivateTargets, browserUserUrlWithoutAllowlist, circularFk, constraintValidator, containerInstanceKeyFromUserInput, containerOversizedInstance, containerPublicInternet, containerRuntimeEgressRelaxation, containerStartEnableInternetOverride, dedupeCacheKeys, duplicateIndex, emptyIndex, exportSinkMisconfigured, externalSourceIncrementalNoDeletePath, externalSourceOnGlobal, externalSourceUnscoped, filterWithoutIndex, flagGatesSecurityWithUnsafeDefault, fromServerSchema, geoIndexFieldNotGeopoint, geoIndexUnused, hardcodedSecret, hotShard, httpActionMissingAuthGuard, httpActionResponseHeaderInjection, hyperdriveOutsideAction, identityUndeclaredClaimTrusted, imagesUrlSourceFromUserInput, indexReferencesUnknownField, indexUtilization, insertManyUnsafeUserData, kvUnscopedUserKeyIdor, loadAnalyticsRuntimeMetrics, mailInboundDispatchWithoutVerify, mailRecipientFromRequestInput, maskUncoveredPiiColumn, maskWeakHashStrategyOnPii, maskedRelationLeakViaWith, mutatorFullRowReplace, nondeterministicQueryMutation, normalizeIdUsedAsAuthorization, notifyMissingPushConfig, notifySendOutsideAction, outputProjectionMissingOnPublicRead, ownerFieldFromArgsNotAuth, paymentCreateWithoutAuthorize, paymentWebhookWideTolerance, plaintextSecretInWranglerVariables, policyReferencesUnknownTable, privilegedDispatchUnvalidatedPayload, privilegedFanoutFromPublicProcedure, publicArgumentUsesAny, publicMutationWithoutRatelimit, publicTableRlsOptoutConfusion, queueWithoutDlq, r2sqlOutsideAction, ratelimitDefaultMemoryStore, ratelimitKeySpoofableOrGlobal, ratelimitMiddlewareFailOpen, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, signupMutationWithoutDisposableGating, softDeleteIncludeDeletedFromArgs, sqlInjectionRisk, storageGenerateUploadUrlNoContentTypePin, storageKeyFromUserArgs, storagePresignedUrlForPrivateContent, storageUploadWithoutContentTypeAllowlist, storageUploadWithoutMaxSize, tableWithoutInsert, ttlFieldNotTimestamp, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, vectorsNamespaceFromUserInput, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };

package/dist/index.d.ts

@@ -280,6 +280,39 @@ interface AdvisorContainer {
   /** Declared `sleepAfter` value, when a static literal. */
   sleepAfter?: number | string;
 }
+/**
+ * One CDC export-sink construction discovered in a function body — the input the
+ * `export_sink_misconfigured` lint consumes. Produced by the codegen feeder,
+ * which walks the lunora source for the three sink factories the export tap
+ * (plan 170) ships: `defineExportSink({ name, deliver })`,
+ * `webhookExportSink({ name, url, … })`, and `r2Sink({ name, bucket, … })`.
+ *
+ * A sink missing a required field can never deliver a change batch — a webhook
+ * with no `url` would POST to `undefined`, an R2 sink with no `bucket` binding has
+ * nowhere to write, and a custom sink with no `deliver` has no delivery path. The
+ * runtime `defineExportSink` guard throws for a missing `name`/`deliver`, but the
+ * built-in `webhookExportSink`/`r2Sink` don't validate `url`/`bucket`, so catching
+ * the misconfiguration statically beats a silently-dead export tap at runtime.
+ * Runtime callers don't supply this, so the lint finds nothing there.
+ */
+interface AdvisorExportSink {
+  /**
+   * True when the factory's config argument is a statically analyzable object
+   * literal. A non-literal config (a variable, a spread) is not decidable, so
+   * the lint skips it rather than raising a false alarm.
+   */
+  analyzable: boolean;
+  /** Present keys whose value is an empty-string literal (`""`) — treated as missing. */
+  emptyKeys: string[];
+  /** Which sink factory was called. */
+  factory: "defineExportSink" | "r2Sink" | "webhookExportSink";
+  /** Source file the construction appears in (relative to the lunora dir, no extension). */
+  file: string;
+  /** 1-based line of the factory call, or `0` when unknown. */
+  line: number;
+  /** Config keys present on the object literal, regardless of value. */
+  presentKeys: string[];
+}
 /**
  * One rate-limit / Turnstile middleware call — the `ratelimit_middleware_fail_open`
  * lint input. `rateLimit`/`dbRateLimit` (`@lunora/ratelimit`) and
@@ -328,6 +361,27 @@ interface AdvisorFlagSecurityDefault {
   /** 1-based line of the `ctx.flags.boolean` call, or `0` when unknown. */
   line: number;
 }
+/**
+ * One `withGeoIndex("name", …)` read discovered in a function body — the use-side
+ * input the `geo_index_unused` lint cross-references against the declared geo
+ * indexes in the lint context's schema. Produced by the codegen feeder, which
+ * walks the lunora source for `ctx.db.query("t").withGeoIndex(name, …)` /
+ * `ctx.db.<table>.withGeoIndex(name, …)` reads and records each referenced index
+ * name. Runtime callers don't supply it, so the lint finds nothing there.
+ *
+ * A `.geoIndex(name, { field })` maintains a geohash companion column on every
+ * write; if no handler ever reads it via `withGeoIndex(name, …)` the companion is
+ * dead overhead (maintained on every write, read by nothing) — the geo analogue
+ * of a dead regular index.
+ */
+interface AdvisorGeoIndexUsage {
+  /** Source file the read appears in (relative to the lunora dir, no extension). */
+  file: string;
+  /** The referenced geo-index name; empty when the `withGeoIndex(...)` argument is not a string literal. */
+  indexName: string;
+  /** 1-based line of the `withGeoIndex(...)` call, or `0` when unknown. */
+  line: number;
+}
 /**
  * One discovered `httpAction`/`httpRoute` handler that performs a side effect
  * (`ctx.runMutation` / `ctx.runAction` / a `ctx.db.{insert,patch,replace,delete,
@@ -688,6 +742,48 @@ interface AdvisorNormalizeIdAuthorization {
   /** `"internal"` for `internalQuery`/`internalMutation`; `"public"` for `query`/`mutation`. */
   visibility: "internal" | "public";
 }
+/**
+ * One `ctx.notify` / `ctx.push` send discovered lexically inside a `query(...)`
+ * or `mutation(...)` handler body — the input the `notify_send_outside_action`
+ * lint consumes. Produced by the codegen feeder, which walks each exported
+ * function's handler with ts-morph and records the `@lunora/notify` send surface
+ * (`ctx.notify.send`, `ctx.notify.chat/inApp/webhook`, `ctx.push.send`,
+ * `ctx.push.broadcast`).
+ *
+ * A notification send is external I/O (a `fetch` to a push service / FCM): it is
+ * non-deterministic like `fetch`, so it breaks the determinism the coordinator
+ * relies on when re-running a query on subscription re-evaluation or a mutation on
+ * OCC retry (a retried mutation would re-send). It therefore belongs **only** in
+ * `action(...)` handlers. Calls inside `action(...)` are intentionally **not**
+ * recorded — actions are the escape hatch. Runtime callers don't supply this, so
+ * the lint finds nothing there.
+ */
+interface AdvisorNotifyCall {
+  /** The send surface accessed, e.g. `ctx.push.broadcast` / `ctx.notify.send`. */
+  callee: string;
+  /** The exported function performing the send (e.g. `sendWelcome`). */
+  exportName: string;
+  /** Source file the send appears in (relative to the lunora dir, no extension). */
+  file: string;
+  /** Which procedure kind the send lives in — only `query`/`mutation` are flagged; actions are exempt. */
+  kind: "mutation" | "query";
+  /** 1-based line of the send, or `0` when unknown. */
+  line: number;
+}
+/**
+ * Whether an app uses `ctx.push` and which push channels `defineNotify(...)`
+ * configures — the input the `notify_missing_push_config` lint consumes. Produced
+ * by the codegen feeder from the resolved `lunora/notify.ts` definition and the
+ * discovered `ctx.push` usage; absent for runtime callers.
+ */
+interface AdvisorNotifyConfig {
+  /** Whether `defineNotify` wired the FCM channel. */
+  hasFcm: boolean;
+  /** Whether `defineNotify` wired the Web Push channel. */
+  hasWebPush: boolean;
+  /** Whether any handler sends a push (`ctx.push.send` / `ctx.push.broadcast`). */
+  usesPush: boolean;
+}
 /**
  * One `ctx.db` write (`insert` / `replace` / `patch` / `insertManyUnsafe`) that
  * sets an ownership / identity column — `userId`, `ownerId`, `tenantId`, and the
@@ -786,6 +882,8 @@ interface AdvisorProcedureProtection {
   unboundedAiGeneration: boolean;
   /** `true` when the chain carries `.use(verifyTurnstile(...))` or a `protectPublic({ captcha })` bundle. */
   usesCaptcha: boolean;
+  /** `true` when the chain carries `.use(emailGateMiddleware(...))` from `@lunora/auth`. Read by the `signup_mutation_without_disposable_gating` lint (paired with public visibility + a user-table write). */
+  usesEmailGate: boolean;
   /** `true` when the handler calls `ctx.db.insertManyUnsafe(...)`, which bypasses validators and triggers. Read by the `insert_many_unsafe_user_data` lint (paired with public visibility). */
   usesInsertManyUnsafe: boolean;
   /** `true` when the chain carries `.use(mask(...))`. */
@@ -1000,6 +1098,14 @@ interface AdvisorSchema {
 }
 /** A table plus the column/index/relation metadata lints inspect. */
 interface AdvisorTable {
+  /**
+   * Effective validator kind per declared column (a `v.optional(...)` is
+   * unwrapped to its inner kind). Read by the schema-type lints
+   * (`ttl_field_not_timestamp`, `geo_index_field_not_geopoint`) to check a
+   * referenced column's type. Optional — a feeder that doesn't track column
+   * kinds omits it, and the type lints then skip the check.
+   */
+  columnKinds?: Record<string, string>;
   /**
    * `true` when the table is written outside Lunora's discoverable insert path
    * — declared via `.externallyManaged()` (e.g. `@lunora/auth`'s better-auth
@@ -1067,6 +1173,15 @@ interface AdvisorTable {
   softDelete?: {
     field: string;
   };
+  /**
+   * Set when the table declared `.ttl(field, { after? })`. Read by the
+   * `ttl_field_not_timestamp` lint to confirm the expiry column is time-typed.
+   * Optional — a feeder that doesn't track TTL omits it.
+   */
+  ttl?: {
+    after?: number;
+    field: string;
+  };
 }
 /**
  * One declared index, flattened across Lunora's index kinds so a single lint can
@@ -1079,7 +1194,7 @@ interface AdvisorTable {
  */
 interface AdvisorIndex {
   fields: ReadonlyArray<string>;
-  kind: "index" | "rank" | "search" | "vector";
+  kind: "geo" | "index" | "rank" | "search" | "vector";
   name: string;
   unique?: boolean;
 }
@@ -1558,6 +1673,16 @@ interface LintContext {
    * the container lints find nothing.
    */
   containers?: ReadonlyArray<AdvisorContainer>;
+  /**
+   * CDC export-sink constructions (`defineExportSink` / `webhookExportSink` /
+   * `r2Sink`) discovered in function bodies — the `export_sink_misconfigured`
+   * input. Each carries which config keys were present (and which were an empty
+   * string), so the lint can flag a sink missing a required field (a webhook
+   * with no `url`, an R2 sink with no `bucket`, a sink with no `name`/`deliver`).
+   * Supplied by the codegen feeder; absent for runtime callers, where the lint
+   * finds nothing.
+   */
+  exportSinks?: ReadonlyArray<AdvisorExportSink>;
   /**
    * `rateLimit`/`dbRateLimit` (`@lunora/ratelimit`) and `verifyTurnstileMiddleware`
    * (`@lunora/auth`) middleware calls, each with whether its options literal set
@@ -1579,6 +1704,15 @@ interface LintContext {
    * codegen feeder; absent for runtime callers, where the lint finds nothing.
    */
   flagSecurityDefaults?: ReadonlyArray<AdvisorFlagSecurityDefault>;
+  /**
+   * `withGeoIndex("name", …)` reads discovered in function bodies — the use-side
+   * input the `geo_index_unused` lint cross-references against the declared geo
+   * indexes in {@link LintContext.schema}. A declared `.geoIndex(name, …)` with
+   * no matching read is dead overhead (its geohash companion is maintained on
+   * every write and read by nothing). Supplied by the codegen feeder; absent for
+   * runtime callers, where the lint finds nothing.
+   */
+  geoIndexUsages?: ReadonlyArray<AdvisorGeoIndexUsage>;
   /**
    * `httpAction`/`httpRoute` handlers that perform a side effect
    * (`ctx.runMutation` / `ctx.runAction` / a `ctx.db` write) from the HTTP edge,
@@ -1706,6 +1840,21 @@ interface LintContext {
    * for runtime callers, where the lint finds nothing.
    */
   normalizeIdAuthorizations?: ReadonlyArray<AdvisorNormalizeIdAuthorization>;
+  /**
+   * `ctx.notify` / `ctx.push` sends discovered lexically inside `query`/`mutation`
+   * handler bodies — the `notify_send_outside_action` input. Supplied by the
+   * codegen feeder, which omits `action` handlers (where these facades are the
+   * typed, intended surface); absent for runtime callers, where the lint finds
+   * nothing.
+   */
+  notifyCalls?: ReadonlyArray<AdvisorNotifyCall>;
+  /**
+   * Whether the app uses `ctx.push` and which push channels `defineNotify(...)`
+   * wires — the `notify_missing_push_config` input. Supplied by the codegen
+   * feeder from the resolved `lunora/notify.ts` definition; absent for runtime
+   * callers, where the lint finds nothing.
+   */
+  notifyConfig?: AdvisorNotifyConfig;
   /**
    * `ctx.db` writes (`insert` / `replace` / `patch` / `insertManyUnsafe`) that set
    * an ownership / identity column (`userId`, `ownerId`, `tenantId`, …) from the
@@ -2469,6 +2618,24 @@ declare const duplicateIndex: Lint;
  * least one field by construction, so only `kind: "index"` is checked.)
  */
 declare const emptyIndex: Lint;
+/**
+ * Flags a misconfigured CDC export sink (plan 170) — a `defineExportSink` /
+ * `webhookExportSink` / `r2Sink` construction with a required config field
+ * missing or set to an empty string.
+ *
+ * The runtime `defineExportSink` guard throws for a missing `name`/`deliver`, but
+ * the built-in `webhookExportSink` / `r2Sink` never validate their `url` /
+ * `bucket`, so a webhook sink with no URL or an R2 sink with no bucket binding
+ * ships and silently fails to drain — the export tap advances no cursor and the
+ * warehouse never sees a row. Catching it at codegen time beats a dead tap in
+ * production.
+ *
+ * A non-literal config (a variable, a spread that could supply the key) is not
+ * statically decidable, so those constructions are skipped rather than flagged.
+ * Only runs when the codegen feeder supplied evidence (`context.exportSinks`
+ * present); a runtime caller flags nothing.
+ */
+declare const exportSinkMisconfigured: Lint;
 /**
  * Flags a `.source({ mode: "incremental" })` table that declares neither a
  * `reconcileEveryMs` sweep nor a `softDeleteColumn` (plan 136).
@@ -2559,6 +2726,33 @@ declare const filterWithoutIndex: Lint;
  * low. One finding per read.
  */
 declare const flagGatesSecurityWithUnsafeDefault: Lint;
+/**
+ * A correctness lint exploiting Lunora's static edge: a `.geoIndex(name, { field })`
+ * maintains a geohash companion over a `v.geoPoint()` column, and
+ * `withGeoIndex(...).near()/.within()` reads its `lat`/`lng`. If `field` is any
+ * other type, the companion can't be built from `{ lat, lng }` and the index is
+ * dead — it can never answer a geo query. Catching it at codegen time beats a
+ * silently-empty proximity result at runtime.
+ */
+declare const geoIndexFieldNotGeopoint: Lint;
+/**
+ * Flags a declared `.geoIndex(name, { field })` that no handler queries via
+ * `withGeoIndex(name, …)`.
+ *
+ * A geo index maintains a geohash companion column on the row: every write stamps
+ * it, every byte of storage holds it. If nothing ever reads it through
+ * `withGeoIndex(name, q => q.near(…) | q.within(…))` the companion is pure dead
+ * overhead — the geo analogue of a dead regular index. Cross-references every geo
+ * index in the schema against the set of index names some handler references via
+ * `withGeoIndex("&lt;name>")`.
+ *
+ * Suppressed entirely when any usage passes a non-literal name
+ * (`withGeoIndex(someVariable, …)`), because a dynamic reference could target any
+ * declared geo index — flagging "unused" then would be a false positive. Only
+ * runs when the usage feeder supplied evidence (`context.geoIndexUsages`
+ * present); a runtime caller with no evidence flags nothing.
+ */
+declare const geoIndexUnused: Lint;
 /**
  * Flags a secret-shaped string literal checked into the lunora source.
  *
@@ -2911,6 +3105,38 @@ declare const nondeterministicQueryMutation: Lint;
  * runtime caller flags nothing.
  */
 declare const normalizeIdUsedAsAuthorization: Lint;
+/**
+ * Flags an app that sends push notifications (`ctx.push.send` / `ctx.push.broadcast`)
+ * but whose `defineNotify(...)` wires **neither** the Web Push nor the FCM channel.
+ *
+ * With no push channel configured, every `ctx.push` send fails at runtime (the
+ * routing push provider has nothing to dispatch to) — a silent, deploy-time-only
+ * misconfiguration. Web Push additionally needs the `VAPID_*` secrets and FCM the
+ * `FCM_*` secrets; those are scaffolded into `.dev.vars` from `@lunora/config`'s
+ * package-secrets registry, but the channel must still be wired in `defineNotify`.
+ *
+ * This lint runs when the codegen feeder has supplied config evidence
+ * (`context.notifyConfig` present); a runtime caller with no evidence flags
+ * nothing.
+ */
+declare const notifyMissingPushConfig: Lint;
+/**
+ * Flags a `@lunora/notify` send (`ctx.notify.*` / `ctx.push.*`) inside a
+ * `query(...)` or `mutation(...)` handler body.
+ *
+ * A notification send is external I/O — a `fetch` to a Web Push service or FCM.
+ * Like `fetch`/`ctx.sql`, it is non-deterministic, so it breaks the determinism
+ * the coordinator relies on when it re-runs a query on subscription re-evaluation
+ * or a mutation on OCC retry — a retried mutation would fire the notification
+ * again (duplicate pushes). `ctx.notify` / `ctx.push` are therefore wired onto
+ * `ActionCtx` only and belong exclusively in `action(...)` handlers.
+ *
+ * This lint runs when the codegen feeder has supplied send evidence
+ * (`context.notifyCalls` present); a runtime caller with no evidence flags
+ * nothing rather than raising false alarms. The feeder records sends only inside
+ * `query`/`mutation` handlers, so `action(...)` bodies never reach here.
+ */
+declare const notifySendOutsideAction: Lint;
 /**
  * Nudges a `.public()` `query` whose handler returns raw table rows — with no
  * `.output(...)` projection and no `.use(mask(...))` — when that table carries
@@ -3328,6 +3554,24 @@ declare const shapeTargetsGlobalTable: Lint;
  * rather than raising false alarms.
  */
 declare const shapeUnknownTable: Lint;
+/**
+ * Flags a public `mutation`/`action` that creates a user/session/account row but
+ * installs no email-domain gate.
+ *
+ * Account-minting endpoints are the classic throwaway-signup surface: disposable
+ * mailboxes farm free trials, evade bans, and pollute the user table. Lunora
+ * ships `emailGateMiddleware` (`@lunora/auth/email-guard`) — pure-data on the
+ * default (edge-safe) path — that rejects disposable domains at signup. This lint
+ * fires when a public procedure writes a user/session/account-shaped table with
+ * no email gate, pairing with the existing `user_creating_mutation_without_captcha`
+ * lint (a CAPTCHA stops bots; the email gate stops throwaway domains — both are
+ * worth having).
+ *
+ * Runs only when the codegen feeder supplies protection evidence
+ * (`context.procedureProtections`); a runtime caller with no evidence flags
+ * nothing.
+ */
+declare const signupMutationWithoutDisposableGating: Lint;
 /**
  * Flags a public read that resurfaces soft-deleted rows via `includeDeleted` —
  * either hardcoded `true` or wired from the handler's `args`.
@@ -3487,6 +3731,15 @@ declare const storageUploadWithoutMaxSize: Lint;
  * a runtime caller with no insert signal flags nothing rather than every table.
  */
 declare const tableWithoutInsert: Lint;
+/**
+ * A correctness lint with no splinter analogue — Lunora's static edge again: the
+ * `.ttl(field)` policy names an epoch-millisecond expiry column, and the DO alarm
+ * sweep compares `field < now`. If `field` is a non-time column (a string token, a
+ * boolean flag, an object), the comparison is meaningless and rows either never
+ * expire or expire unpredictably — a bug the fully-declared schema catches at
+ * codegen time rather than at 3am when the sweep silently misbehaves.
+ */
+declare const ttlFieldNotTimestamp: Lint;
 /**
  * Flags a public `v.string()` argument with no length bound.
  *
@@ -3653,4 +3906,4 @@ interface RunAdvisorOptions {
  * `static` lints at build time and defer `runtime` lints to a live shard.
  */
 declare const runAdvisor: (context: LintContext, options?: RunAdvisorOptions) => Finding[];
-export { AE_METRIC_EVENTS, ALL_LINTS, type AdvisorAdminRoute, type AdvisorAiRawRun, type AdvisorAiToolSideEffect, type AdvisorArgumentDerivedFetch, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorAuthConfig, type AdvisorBrowserUrlAccess, type AdvisorConfigCall, type AdvisorContainer, type AdvisorContainerKeyAccess, type AdvisorContainerOverride, type AdvisorFailOpenGuard, type AdvisorFlagSecurityDefault, type AdvisorHttpActionGuard, type AdvisorHttpHeaderWrite, type AdvisorHyperdriveCall, type AdvisorIdentityClaimRead, type AdvisorImageDeliveryUrlAccess, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorKvKeyAccess, type AdvisorMailRecipientAccess, type AdvisorMaskProcedure, type AdvisorMaskStrategy, type AdvisorMutatorWrite, type AdvisorNondeterministicCall, type AdvisorNormalizeIdAuthorization, type AdvisorOwnerFieldWrite, type AdvisorPaymentWebhook, type AdvisorPrivilegedDispatch, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorQueue, type AdvisorQueueTuning, type AdvisorR2sqlCall, type AdvisorRatelimitKeySelector, type AdvisorRawRowReturn, type AdvisorRelation, type AdvisorRelationLoad, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShape, type AdvisorShardTraffic, type AdvisorSoftDeleteRead, type AdvisorSqlInterpolation, type AdvisorStorageKeyAccess, type AdvisorStorageUpload, type AdvisorTable, type AdvisorTableSample, type AdvisorTableScan, type AdvisorVectorNamespaceAccess, type AdvisorWorkflow, type AdvisorWorkflowCall, type AdvisorWranglerVariable, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type Category, type Facing, type Finding, type Level, type Lint, type LintContext, type LintSource, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, actionFetchSsrf, adminRouteWithoutGuard, aiRawRunEscapeHatch, aiToolSideEffectPromptInjection, aiUnboundedGenerationPublic, allowUnauthenticatedShardAccessEnabled, authApiCallWithoutHeaders, authCsrfCheckDisabled, authEmailVerificationDisabled, authSecureCookiesDisabled, authSessionFreshageZero, authTrustedOriginsWildcard, browserAllowPrivateTargets, browserUserUrlWithoutAllowlist, circularFk, constraintValidator, containerInstanceKeyFromUserInput, containerOversizedInstance, containerPublicInternet, containerRuntimeEgressRelaxation, containerStartEnableInternetOverride, dedupeCacheKeys, duplicateIndex, emptyIndex, externalSourceIncrementalNoDeletePath, externalSourceOnGlobal, externalSourceUnscoped, filterWithoutIndex, flagGatesSecurityWithUnsafeDefault, fromServerSchema, hardcodedSecret, hotShard, httpActionMissingAuthGuard, httpActionResponseHeaderInjection, hyperdriveOutsideAction, identityUndeclaredClaimTrusted, imagesUrlSourceFromUserInput, indexReferencesUnknownField, indexUtilization, insertManyUnsafeUserData, kvUnscopedUserKeyIdor, loadAnalyticsRuntimeMetrics, mailInboundDispatchWithoutVerify, mailRecipientFromRequestInput, maskUncoveredPiiColumn, maskWeakHashStrategyOnPii, maskedRelationLeakViaWith, mutatorFullRowReplace, nondeterministicQueryMutation, normalizeIdUsedAsAuthorization, outputProjectionMissingOnPublicRead, ownerFieldFromArgsNotAuth, paymentCreateWithoutAuthorize, paymentWebhookWideTolerance, plaintextSecretInWranglerVariables, policyReferencesUnknownTable, privilegedDispatchUnvalidatedPayload, privilegedFanoutFromPublicProcedure, publicArgumentUsesAny, publicMutationWithoutRatelimit, publicTableRlsOptoutConfusion, queueWithoutDlq, r2sqlOutsideAction, ratelimitDefaultMemoryStore, ratelimitKeySpoofableOrGlobal, ratelimitMiddlewareFailOpen, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, softDeleteIncludeDeletedFromArgs, sqlInjectionRisk, storageGenerateUploadUrlNoContentTypePin, storageKeyFromUserArgs, storagePresignedUrlForPrivateContent, storageUploadWithoutContentTypeAllowlist, storageUploadWithoutMaxSize, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, vectorsNamespaceFromUserInput, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };
+export { AE_METRIC_EVENTS, ALL_LINTS, type AdvisorAdminRoute, type AdvisorAiRawRun, type AdvisorAiToolSideEffect, type AdvisorArgumentDerivedFetch, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorAuthConfig, type AdvisorBrowserUrlAccess, type AdvisorConfigCall, type AdvisorContainer, type AdvisorContainerKeyAccess, type AdvisorContainerOverride, type AdvisorExportSink, type AdvisorFailOpenGuard, type AdvisorFlagSecurityDefault, type AdvisorGeoIndexUsage, type AdvisorHttpActionGuard, type AdvisorHttpHeaderWrite, type AdvisorHyperdriveCall, type AdvisorIdentityClaimRead, type AdvisorImageDeliveryUrlAccess, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorKvKeyAccess, type AdvisorMailRecipientAccess, type AdvisorMaskProcedure, type AdvisorMaskStrategy, type AdvisorMutatorWrite, type AdvisorNondeterministicCall, type AdvisorNormalizeIdAuthorization, type AdvisorNotifyCall, type AdvisorNotifyConfig, type AdvisorOwnerFieldWrite, type AdvisorPaymentWebhook, type AdvisorPrivilegedDispatch, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorQueue, type AdvisorQueueTuning, type AdvisorR2sqlCall, type AdvisorRatelimitKeySelector, type AdvisorRawRowReturn, type AdvisorRelation, type AdvisorRelationLoad, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShape, type AdvisorShardTraffic, type AdvisorSoftDeleteRead, type AdvisorSqlInterpolation, type AdvisorStorageKeyAccess, type AdvisorStorageUpload, type AdvisorTable, type AdvisorTableSample, type AdvisorTableScan, type AdvisorVectorNamespaceAccess, type AdvisorWorkflow, type AdvisorWorkflowCall, type AdvisorWranglerVariable, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type Category, type Facing, type Finding, type Level, type Lint, type LintContext, type LintSource, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, actionFetchSsrf, adminRouteWithoutGuard, aiRawRunEscapeHatch, aiToolSideEffectPromptInjection, aiUnboundedGenerationPublic, allowUnauthenticatedShardAccessEnabled, authApiCallWithoutHeaders, authCsrfCheckDisabled, authEmailVerificationDisabled, authSecureCookiesDisabled, authSessionFreshageZero, authTrustedOriginsWildcard, browserAllowPrivateTargets, browserUserUrlWithoutAllowlist, circularFk, constraintValidator, containerInstanceKeyFromUserInput, containerOversizedInstance, containerPublicInternet, containerRuntimeEgressRelaxation, containerStartEnableInternetOverride, dedupeCacheKeys, duplicateIndex, emptyIndex, exportSinkMisconfigured, externalSourceIncrementalNoDeletePath, externalSourceOnGlobal, externalSourceUnscoped, filterWithoutIndex, flagGatesSecurityWithUnsafeDefault, fromServerSchema, geoIndexFieldNotGeopoint, geoIndexUnused, hardcodedSecret, hotShard, httpActionMissingAuthGuard, httpActionResponseHeaderInjection, hyperdriveOutsideAction, identityUndeclaredClaimTrusted, imagesUrlSourceFromUserInput, indexReferencesUnknownField, indexUtilization, insertManyUnsafeUserData, kvUnscopedUserKeyIdor, loadAnalyticsRuntimeMetrics, mailInboundDispatchWithoutVerify, mailRecipientFromRequestInput, maskUncoveredPiiColumn, maskWeakHashStrategyOnPii, maskedRelationLeakViaWith, mutatorFullRowReplace, nondeterministicQueryMutation, normalizeIdUsedAsAuthorization, notifyMissingPushConfig, notifySendOutsideAction, outputProjectionMissingOnPublicRead, ownerFieldFromArgsNotAuth, paymentCreateWithoutAuthorize, paymentWebhookWideTolerance, plaintextSecretInWranglerVariables, policyReferencesUnknownTable, privilegedDispatchUnvalidatedPayload, privilegedFanoutFromPublicProcedure, publicArgumentUsesAny, publicMutationWithoutRatelimit, publicTableRlsOptoutConfusion, queueWithoutDlq, r2sqlOutsideAction, ratelimitDefaultMemoryStore, ratelimitKeySpoofableOrGlobal, ratelimitMiddlewareFailOpen, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, signupMutationWithoutDisposableGating, softDeleteIncludeDeletedFromArgs, sqlInjectionRisk, storageGenerateUploadUrlNoContentTypePin, storageKeyFromUserArgs, storagePresignedUrlForPrivateContent, storageUploadWithoutContentTypeAllowlist, storageUploadWithoutMaxSize, tableWithoutInsert, ttlFieldNotTimestamp, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, vectorsNamespaceFromUserInput, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };

package/dist/index.mjs

@@ -24,11 +24,14 @@ import containerRuntimeEgressRelaxation from './packem_shared/containerRuntimeEg
 import containerStartEnableInternetOverride from './packem_shared/containerStartEnableInternetOverride-DDaHZQ1L.mjs';
 import duplicateIndex from './packem_shared/duplicateIndex-BOublMSt.mjs';
 import emptyIndex from './packem_shared/emptyIndex-BX8EuEY7.mjs';
+import exportSinkMisconfigured from './packem_shared/exportSinkMisconfigured-897sVMUa.mjs';
 import externalSourceIncrementalNoDeletePath from './packem_shared/externalSourceIncrementalNoDeletePath-DvX9cRBD.mjs';
 import externalSourceOnGlobal from './packem_shared/externalSourceOnGlobal-Bg-NfCX9.mjs';
 import externalSourceUnscoped from './packem_shared/externalSourceUnscoped-5vT-Bup3.mjs';
 import filterWithoutIndex from './packem_shared/filterWithoutIndex-BYVeJaSs.mjs';
 import flagGatesSecurityWithUnsafeDefault from './packem_shared/flagGatesSecurityWithUnsafeDefault-BhIs0shr.mjs';
+import geoIndexFieldNotGeopoint from './packem_shared/geoIndexFieldNotGeopoint-CcaInLhY.mjs';
+import geoIndexUnused from './packem_shared/geoIndexUnused-D7I0UyND.mjs';
 import hardcodedSecret from './packem_shared/hardcodedSecret-Be-pKVdn.mjs';
 import httpActionMissingAuthGuard from './packem_shared/httpActionMissingAuthGuard-CxipddNx.mjs';
 import httpActionResponseHeaderInjection from './packem_shared/httpActionResponseHeaderInjection-DOFS7pFT.mjs';
@@ -46,6 +49,8 @@ import maskedRelationLeakViaWith from './packem_shared/maskedRelationLeakViaWith
 import mutatorFullRowReplace from './packem_shared/mutatorFullRowReplace-BJnNDaIV.mjs';
 import nondeterministicQueryMutation from './packem_shared/nondeterministicQueryMutation-GXES1fLp.mjs';
 import normalizeIdUsedAsAuthorization from './packem_shared/normalizeIdUsedAsAuthorization-BVPtCpzT.mjs';
+import notifyMissingPushConfig from './packem_shared/notifyMissingPushConfig-Ca9EzRzy.mjs';
+import notifySendOutsideAction from './packem_shared/notifySendOutsideAction-BUZSIZa4.mjs';
 import outputProjectionMissingOnPublicRead from './packem_shared/outputProjectionMissingOnPublicRead-Bl5IMx0k.mjs';
 import ownerFieldFromArgsNotAuth from './packem_shared/ownerFieldFromArgsNotAuth-mOw3hE5z.mjs';
 import paymentCreateWithoutAuthorize from './packem_shared/paymentCreateWithoutAuthorize-BYm4JLxo.mjs';
@@ -67,6 +72,7 @@ import relationReferencesUnknownTable from './packem_shared/relationReferencesUn
 import rlsUncoveredTable from './packem_shared/rlsUncoveredTable-CxEfZ5eZ.mjs';
 import shapeTargetsGlobalTable from './packem_shared/shapeTargetsGlobalTable-DHrf4Koi.mjs';
 import shapeUnknownTable from './packem_shared/shapeUnknownTable-C8aDWFoe.mjs';
+import signupMutationWithoutDisposableGating from './packem_shared/signupMutationWithoutDisposableGating-Dnbol2CS.mjs';
 import softDeleteIncludeDeletedFromArgs from './packem_shared/softDeleteIncludeDeletedFromArgs-BLqDKrkM.mjs';
 import sqlInjectionRisk from './packem_shared/sqlInjectionRisk-zwytYGLt.mjs';
 import storageGenerateUploadUrlNoContentTypePin from './packem_shared/storageGenerateUploadUrlNoContentTypePin-Da4L9Ge8.mjs';
@@ -75,6 +81,7 @@ import storagePresignedUrlForPrivateContent from './packem_shared/storagePresign
 import storageUploadWithoutContentTypeAllowlist from './packem_shared/storageUploadWithoutContentTypeAllowlist-BV-gF1lT.mjs';
 import storageUploadWithoutMaxSize from './packem_shared/storageUploadWithoutMaxSize-DpxO59wU.mjs';
 import tableWithoutInsert from './packem_shared/tableWithoutInsert-CbbaYIP4.mjs';
+import ttlFieldNotTimestamp from './packem_shared/ttlFieldNotTimestamp-Dpaj63Z6.mjs';
 import unboundedStringArgument from './packem_shared/unboundedStringArgument-DThg2-wt.mjs';
 import unindexedForeignKey from './packem_shared/unindexedForeignKey-BgJbKyqK.mjs';
 import unindexedRelationTarget from './packem_shared/unindexedRelationTarget-D6eyj6Xx.mjs';
@@ -84,7 +91,7 @@ import workflowDuplicateStepName from './packem_shared/workflowDuplicateStepName
 import workflowUnknownTarget from './packem_shared/workflowUnknownTarget-Cdd7WhKQ.mjs';
 import workflowUnused from './packem_shared/workflowUnused-D0jHxdz9.mjs';
 export { AE_METRIC_EVENTS, loadAnalyticsRuntimeMetrics } from './packem_shared/AE_METRIC_EVENTS-BM14d0lm.mjs';
-export { fromServerSchema } from './packem_shared/fromServerSchema-BjAZdvJ6.mjs';
+export { fromServerSchema } from './packem_shared/fromServerSchema-CVnbSf8j.mjs';
 
 const STATIC_LINTS = [
   indexReferencesUnknownField,
@@ -97,6 +104,10 @@ const STATIC_LINTS = [
   externalSourceOnGlobal,
   externalSourceUnscoped,
   emptyIndex,
+  geoIndexFieldNotGeopoint,
+  geoIndexUnused,
+  exportSinkMisconfigured,
+  ttlFieldNotTimestamp,
   circularFk,
   unindexedForeignKey,
   unindexedRelationTarget,
@@ -119,6 +130,7 @@ const STATIC_LINTS = [
   containerPublicInternet,
   publicMutationWithoutRatelimit,
   userCreatingMutationWithoutCaptcha,
+  signupMutationWithoutDisposableGating,
   publicArgumentUsesAny,
   unboundedStringArgument,
   hardcodedSecret,
@@ -167,6 +179,8 @@ const STATIC_LINTS = [
   maskedRelationLeakViaWith,
   outputProjectionMissingOnPublicRead,
   normalizeIdUsedAsAuthorization,
+  notifySendOutsideAction,
+  notifyMissingPushConfig,
   plaintextSecretInWranglerVariables
 ];
 const RUNTIME_LINTS = [hotShard, indexUtilization, constraintValidator];
@@ -183,4 +197,4 @@ const runAdvisor = (context, options = {}) => {
   return dedupeCacheKeys(findings);
 };
 
-export { ALL_LINTS, RUNTIME_LINTS, STATIC_LINTS, actionFetchSsrf, adminRouteWithoutGuard, aiRawRunEscapeHatch, aiToolSideEffectPromptInjection, aiUnboundedGenerationPublic, allowUnauthenticatedShardAccessEnabled, authApiCallWithoutHeaders, authCsrfCheckDisabled, authEmailVerificationDisabled, authSecureCookiesDisabled, authSessionFreshageZero, authTrustedOriginsWildcard, browserAllowPrivateTargets, browserUserUrlWithoutAllowlist, circularFk, constraintValidator, containerInstanceKeyFromUserInput, containerOversizedInstance, containerPublicInternet, containerRuntimeEgressRelaxation, containerStartEnableInternetOverride, dedupeCacheKeys, duplicateIndex, emptyIndex, externalSourceIncrementalNoDeletePath, externalSourceOnGlobal, externalSourceUnscoped, filterWithoutIndex, flagGatesSecurityWithUnsafeDefault, hardcodedSecret, hotShard, httpActionMissingAuthGuard, httpActionResponseHeaderInjection, hyperdriveOutsideAction, identityUndeclaredClaimTrusted, imagesUrlSourceFromUserInput, indexReferencesUnknownField, indexUtilization, insertManyUnsafeUserData, kvUnscopedUserKeyIdor, mailInboundDispatchWithoutVerify, mailRecipientFromRequestInput, maskUncoveredPiiColumn, maskWeakHashStrategyOnPii, maskedRelationLeakViaWith, mutatorFullRowReplace, nondeterministicQueryMutation, normalizeIdUsedAsAuthorization, outputProjectionMissingOnPublicRead, ownerFieldFromArgsNotAuth, paymentCreateWithoutAuthorize, paymentWebhookWideTolerance, plaintextSecretInWranglerVariables, policyReferencesUnknownTable, privilegedDispatchUnvalidatedPayload, privilegedFanoutFromPublicProcedure, publicArgumentUsesAny, publicMutationWithoutRatelimit, publicTableRlsOptoutConfusion, queueWithoutDlq, r2sqlOutsideAction, ratelimitDefaultMemoryStore, ratelimitKeySpoofableOrGlobal, ratelimitMiddlewareFailOpen, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, softDeleteIncludeDeletedFromArgs, sqlInjectionRisk, storageGenerateUploadUrlNoContentTypePin, storageKeyFromUserArgs, storagePresignedUrlForPrivateContent, storageUploadWithoutContentTypeAllowlist, storageUploadWithoutMaxSize, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, vectorsNamespaceFromUserInput, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };
+export { ALL_LINTS, RUNTIME_LINTS, STATIC_LINTS, actionFetchSsrf, adminRouteWithoutGuard, aiRawRunEscapeHatch, aiToolSideEffectPromptInjection, aiUnboundedGenerationPublic, allowUnauthenticatedShardAccessEnabled, authApiCallWithoutHeaders, authCsrfCheckDisabled, authEmailVerificationDisabled, authSecureCookiesDisabled, authSessionFreshageZero, authTrustedOriginsWildcard, browserAllowPrivateTargets, browserUserUrlWithoutAllowlist, circularFk, constraintValidator, containerInstanceKeyFromUserInput, containerOversizedInstance, containerPublicInternet, containerRuntimeEgressRelaxation, containerStartEnableInternetOverride, dedupeCacheKeys, duplicateIndex, emptyIndex, exportSinkMisconfigured, externalSourceIncrementalNoDeletePath, externalSourceOnGlobal, externalSourceUnscoped, filterWithoutIndex, flagGatesSecurityWithUnsafeDefault, geoIndexFieldNotGeopoint, geoIndexUnused, hardcodedSecret, hotShard, httpActionMissingAuthGuard, httpActionResponseHeaderInjection, hyperdriveOutsideAction, identityUndeclaredClaimTrusted, imagesUrlSourceFromUserInput, indexReferencesUnknownField, indexUtilization, insertManyUnsafeUserData, kvUnscopedUserKeyIdor, mailInboundDispatchWithoutVerify, mailRecipientFromRequestInput, maskUncoveredPiiColumn, maskWeakHashStrategyOnPii, maskedRelationLeakViaWith, mutatorFullRowReplace, nondeterministicQueryMutation, normalizeIdUsedAsAuthorization, notifyMissingPushConfig, notifySendOutsideAction, outputProjectionMissingOnPublicRead, ownerFieldFromArgsNotAuth, paymentCreateWithoutAuthorize, paymentWebhookWideTolerance, plaintextSecretInWranglerVariables, policyReferencesUnknownTable, privilegedDispatchUnvalidatedPayload, privilegedFanoutFromPublicProcedure, publicArgumentUsesAny, publicMutationWithoutRatelimit, publicTableRlsOptoutConfusion, queueWithoutDlq, r2sqlOutsideAction, ratelimitDefaultMemoryStore, ratelimitKeySpoofableOrGlobal, ratelimitMiddlewareFailOpen, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, signupMutationWithoutDisposableGating, softDeleteIncludeDeletedFromArgs, sqlInjectionRisk, storageGenerateUploadUrlNoContentTypePin, storageKeyFromUserArgs, storagePresignedUrlForPrivateContent, storageUploadWithoutContentTypeAllowlist, storageUploadWithoutMaxSize, tableWithoutInsert, ttlFieldNotTimestamp, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, vectorsNamespaceFromUserInput, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };

package/dist/packem_shared/exportSinkMisconfigured-897sVMUa.mjs

@@ -0,0 +1,46 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const REQUIRED_KEYS = {
+  defineExportSink: ["name", "deliver"],
+  r2Sink: ["bucket", "name"],
+  webhookExportSink: ["name", "url"]
+};
+const exportSinkMisconfigured = {
+  categories: ["SCHEMA"],
+  description: "A CDC export sink (`defineExportSink` / `webhookExportSink` / `r2Sink`) is missing a required config field (a webhook with no `url`, an R2 sink with no `bucket`, or a sink with no `name`/`deliver`). The sink can never deliver a change batch, so the export tap silently drains nothing.",
+  facing: "INTERNAL",
+  level: "ERROR",
+  name: "export_sink_misconfigured",
+  remediation: "Supply the missing field: a non-empty `url` for `webhookExportSink`, a `bucket` R2 binding for `r2Sink`, or `name` + `deliver` for `defineExportSink`.",
+  run: (context) => {
+    if (context.exportSinks === void 0) {
+      return [];
+    }
+    const findings = [];
+    for (const sink of context.exportSinks) {
+      if (!sink.analyzable) {
+        continue;
+      }
+      const present = new Set(sink.presentKeys);
+      const empty = new Set(sink.emptyKeys);
+      for (const key of REQUIRED_KEYS[sink.factory] ?? []) {
+        if (present.has(key) && !empty.has(key)) {
+          continue;
+        }
+        const reason = empty.has(key) ? "is set to an empty string" : "is missing";
+        findings.push(
+          emit(exportSinkMisconfigured, {
+            cacheKey: `export_sink_misconfigured:${sink.file}:${sink.line.toString()}:${key}`,
+            detail: `\`${sink.factory}({ … })\` in ${sink.file}:${sink.line.toString()} ${reason} its required \`${key}\` field — the sink can never deliver a change batch, so the export tap drains nothing.`,
+            metadata: { factory: sink.factory, field: key, file: sink.file, line: sink.line }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Export sink is misconfigured"
+};
+
+export { exportSinkMisconfigured as default };

package/dist/packem_shared/{fromServerSchema-BjAZdvJ6.mjs → fromServerSchema-CVnbSf8j.mjs}

@@ -14,8 +14,16 @@ const fromServerSchema = (schema) => {
         }),
         ...table.vectorIndexes.map((index) => {
           return { fields: [index.field], kind: "vector", name: index.name };
+        }),
+        ...table.geoIndexes.map((index) => {
+          return { fields: [index.field], kind: "geo", name: index.name };
         })
       ];
+      const columnKinds = {};
+      for (const [fieldName, validator] of Object.entries(table.shape)) {
+        const inner = validator.kind === "optional" ? validator._meta?.inner : validator;
+        columnKinds[fieldName] = inner?.kind ?? validator.kind;
+      }
       const optionalFields = /* @__PURE__ */ new Set();
       for (const [fieldName, validator] of Object.entries(table.shape)) {
         if (validator.kind === "optional") {
@@ -35,6 +43,7 @@ const fromServerSchema = (schema) => {
           hasTenantBy: table.externalSource.tenantBy !== void 0,
           mode: table.externalSource.mode
         } : void 0,
+        columnKinds,
         fields: Object.keys(table.shape),
         indexes,
         isPublic: table.isPublic ?? false,
@@ -42,6 +51,7 @@ const fromServerSchema = (schema) => {
         optionalFields,
         shardKind: table.shardMode.kind,
         softDelete: table.softDeleteMode,
+        ttl: table.ttlPolicy,
         relations: Object.entries(table.relationMap).map(([accessor, relation]) => {
           return {
             field: relation.field,

package/dist/packem_shared/geoIndexFieldNotGeopoint-CcaInLhY.mjs

@@ -0,0 +1,40 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const geoIndexFieldNotGeopoint = {
+  categories: ["SCHEMA"],
+  description: "A `.geoIndex(name, { field })` points at a column that is not a `v.geoPoint()`, so its geohash companion can't be built and `withGeoIndex(...)` can never match.",
+  facing: "INTERNAL",
+  level: "ERROR",
+  name: "geo_index_field_not_geopoint",
+  remediation: "Point the geo index at a `v.geoPoint()` column, or change the column's type to `v.geoPoint()`.",
+  run: (context) => {
+    const findings = [];
+    for (const table of context.schema.tables) {
+      for (const index of table.indexes) {
+        if (index.kind !== "geo") {
+          continue;
+        }
+        const field = index.fields[0];
+        if (field === void 0) {
+          continue;
+        }
+        const kind = table.columnKinds?.[field];
+        if (kind === void 0 || kind === "geoPoint") {
+          continue;
+        }
+        findings.push(
+          emit(geoIndexFieldNotGeopoint, {
+            cacheKey: `geo_index_field_not_geopoint:${table.name}:${index.name}:${field}`,
+            detail: `Geo index "${index.name}" on table "${table.name}" indexes column "${field}", which is a ${kind}, not a v.geoPoint().`,
+            metadata: { field, index: index.name, kind, table: table.name }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Geo index field is not a geoPoint"
+};
+
+export { geoIndexFieldNotGeopoint as default };

package/dist/packem_shared/geoIndexUnused-D7I0UyND.mjs

@@ -0,0 +1,40 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const geoIndexUnused = {
+  categories: ["SCHEMA"],
+  description: "A `.geoIndex(name, { field })` is declared but no handler reads it via `withGeoIndex(name, …)`. The geohash companion column is maintained on every write and read by nothing — dead overhead, the geo analogue of a dead index.",
+  facing: "INTERNAL",
+  level: "INFO",
+  name: "geo_index_unused",
+  remediation: 'Query the index from a handler with `ctx.db.query("<table>").withGeoIndex("<name>", q => q.near(point, radius))`, or drop the `.geoIndex(...)` declaration so writes stop maintaining its geohash companion.',
+  run: (context) => {
+    if (context.geoIndexUsages === void 0) {
+      return [];
+    }
+    const usages = context.geoIndexUsages;
+    if (usages.some((usage) => usage.indexName === "")) {
+      return [];
+    }
+    const used = new Set(usages.map((usage) => usage.indexName));
+    const findings = [];
+    for (const table of context.schema.tables) {
+      for (const index of table.indexes) {
+        if (index.kind !== "geo" || used.has(index.name)) {
+          continue;
+        }
+        findings.push(
+          emit(geoIndexUnused, {
+            cacheKey: `geo_index_unused:${table.name}:${index.name}`,
+            detail: `No handler reads geo index "${index.name}" on table "${table.name}" via \`withGeoIndex("${index.name}", …)\` — it's declared but never queried, so its geohash companion is maintained on every write for nothing.`,
+            metadata: { index: index.name, table: table.name }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Geo index is declared but never queried"
+};
+
+export { geoIndexUnused as default };

package/dist/packem_shared/notifyMissingPushConfig-Ca9EzRzy.mjs

@@ -0,0 +1,27 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const notifyMissingPushConfig = {
+  categories: ["SCHEMA"],
+  description: "The app sends push notifications via `ctx.push` but `defineNotify(...)` configures neither a Web Push nor an FCM channel, so every send fails at runtime. Wire at least one push channel (`webPush` and/or `fcm`) and provide its secrets (`VAPID_*` / `FCM_*`).",
+  facing: "INTERNAL",
+  level: "WARN",
+  name: "notify_missing_push_config",
+  remediation: "In `lunora/notify.ts`, wire a push channel: `defineNotify({ webPush: (env) => webPushFromEnv(env) })` and set `VAPID_PUBLIC_KEY` / `VAPID_PRIVATE_KEY` / `VAPID_SUBJECT` in `.dev.vars` (or configure `fcm` with `FCM_PROJECT_ID`). Generate a VAPID keypair with `npx web-push generate-vapid-keys`.",
+  run: (context) => {
+    const config = context.notifyConfig;
+    if (config === void 0 || !config.usesPush || config.hasWebPush || config.hasFcm) {
+      return [];
+    }
+    return [
+      emit(notifyMissingPushConfig, {
+        cacheKey: "notify_missing_push_config",
+        detail: "`ctx.push` is used to send notifications, but `defineNotify(...)` wires neither `webPush` nor `fcm` — every push send will fail at runtime. Configure at least one push channel and its secrets.",
+        metadata: { hasFcm: config.hasFcm, hasWebPush: config.hasWebPush, usesPush: config.usesPush }
+      })
+    ];
+  },
+  source: "static",
+  title: "Push used with no Web Push / FCM channel configured"
+};
+
+export { notifyMissingPushConfig as default };

package/dist/packem_shared/notifySendOutsideAction-BUZSIZa4.mjs

@@ -0,0 +1,30 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const notifySendOutsideAction = {
+  categories: ["SCHEMA"],
+  description: "A `query`/`mutation` handler sends a notification via `ctx.notify`/`ctx.push`. A send is external I/O (a `fetch` to a push service / FCM): it is non-deterministic like `fetch`, and a mutation re-run on OCC retry would re-send it (duplicate pushes). These facades are available on `ActionCtx` only and must be confined to `action` handlers.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "notify_send_outside_action",
+  remediation: "Move the `ctx.notify`/`ctx.push` send into an `action(...)`, where external I/O is allowed. If a query/mutation must trigger a notification, have it enqueue the send (`enqueuePushBroadcast` via `@lunora/queue`) or schedule an action — the queue/scheduler runs the send exactly once, off the transactional path.",
+  run: (context) => {
+    if (context.notifyCalls === void 0) {
+      return [];
+    }
+    const findings = [];
+    for (const call of context.notifyCalls) {
+      findings.push(
+        emit(notifySendOutsideAction, {
+          cacheKey: `notify_send_outside_action:${call.file}:${call.line.toString()}:${call.callee}`,
+          detail: `\`${call.callee}(…)\` in ${call.exportName} (${call.file}:${call.line.toString()}) runs inside a ${call.kind} handler — a notification send is non-deterministic external I/O and a retried ${call.kind} would re-send it. Move it into an \`action\`, or enqueue/schedule the send.`,
+          metadata: { callee: call.callee, exportName: call.exportName, file: call.file, kind: call.kind, line: call.line }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Notification send used outside an action"
+};
+
+export { notifySendOutsideAction as default };

package/dist/packem_shared/signupMutationWithoutDisposableGating-Dnbol2CS.mjs

@@ -0,0 +1,39 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+import { i as isPublicWrite } from './helpers-BySnKhVB.mjs';
+
+const signupMutationWithoutDisposableGating = {
+  categories: ["SECURITY"],
+  description: "A public `mutation`/`action` that creates a user/session/account row has no disposable-email gate. Throwaway mailboxes farm free trials, evade bans, and pollute the user table.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "signup_mutation_without_disposable_gating",
+  remediation: "Add `.use(emailGateMiddleware({ email: (ctx) => ctx.args.email }))` from `@lunora/auth/email-guard` to reject disposable domains at signup, or gate better-auth's native signup with `withEmailGate(...)` / `emailGateDatabaseHooks(...)`.",
+  run: (context) => {
+    if (context.procedureProtections === void 0) {
+      return [];
+    }
+    const findings = [];
+    for (const procedure of context.procedureProtections) {
+      if (!isPublicWrite(procedure) || !procedure.writesUserTable || procedure.usesEmailGate) {
+        continue;
+      }
+      findings.push(
+        emit(signupMutationWithoutDisposableGating, {
+          cacheKey: `signup_mutation_without_disposable_gating:${procedure.file}:${procedure.exportName}`,
+          detail: `Public ${procedure.kind} \`${procedure.exportName}\` (${procedure.file}) writes a user/session/account table but has no disposable-email gate. Add \`.use(emailGateMiddleware(...))\` from \`@lunora/auth/email-guard\`.`,
+          metadata: {
+            exportName: procedure.exportName,
+            file: procedure.file,
+            kind: procedure.kind,
+            writesUserTable: procedure.writesUserTable
+          }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Account-creating write without a disposable-email gate"
+};
+
+export { signupMutationWithoutDisposableGating as default };

package/dist/packem_shared/ttlFieldNotTimestamp-Dpaj63Z6.mjs

@@ -0,0 +1,36 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const TIME_KINDS = /* @__PURE__ */ new Set(["date", "number", "timestamp"]);
+const ttlFieldNotTimestamp = {
+  categories: ["SCHEMA"],
+  description: "A `.ttl(field)` policy points at a column that is not an epoch-millisecond timestamp, so the alarm sweep's `field < now` comparison can't decide expiry correctly.",
+  facing: "INTERNAL",
+  level: "ERROR",
+  name: "ttl_field_not_timestamp",
+  remediation: "Point `.ttl(field)` at a `v.timestamp()` / `v.date()` / `v.number()` (epoch-ms) column, or add such a column.",
+  run: (context) => {
+    const findings = [];
+    for (const table of context.schema.tables) {
+      const { ttl } = table;
+      if (!ttl) {
+        continue;
+      }
+      const kind = table.columnKinds?.[ttl.field];
+      if (kind === void 0 || TIME_KINDS.has(kind)) {
+        continue;
+      }
+      findings.push(
+        emit(ttlFieldNotTimestamp, {
+          cacheKey: `ttl_field_not_timestamp:${table.name}:${ttl.field}`,
+          detail: `Table "${table.name}" declares \`.ttl("${ttl.field}")\`, but "${ttl.field}" is a ${kind} column, not an epoch-millisecond timestamp.`,
+          metadata: { field: ttl.field, kind, table: table.name }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "TTL field is not a timestamp"
+};
+
+export { ttlFieldNotTimestamp as default };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/advisor",
-  "version": "1.0.0-alpha.31",
+  "version": "1.0.0-alpha.33",
   "description": "Schema & query lints (splinter-style advisors) for Lunora, feeding the Studio Advisors view",
   "keywords": [
     "advisor",
@@ -46,8 +46,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.6",
-    "@lunora/server": "1.0.0-alpha.28"
+    "@lunora/errors": "1.0.0-alpha.7",
+    "@lunora/server": "1.0.0-alpha.30"
   },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"