@lunora/advisor 1.0.0-alpha.7 → 1.0.0-alpha.9

package/dist/index.d.mts

@@ -214,6 +214,28 @@ interface AdvisorMaskProcedure {
   visibility: "internal" | "public";
 }
 /**
+* One whole-row `ctx.db.replace(id, document)` write discovered inside a custom
+* mutator's authoritative `server` impl (`lunora/mutators.ts`) — the input the
+* `mutator_full_row_replace` lint consumes.
+*
+* In the local-first sync engine a `replace` overwrites the entire row, so a
+* concurrent edit to a *different* column (committed between this mutator's read
+* and its write) is silently clobbered. `patch(id, { onlyTheField })` merges at
+* the column level instead, letting independent field edits coexist — the
+* blessed pattern for mutators on a synced (poke-live) table. Produced by the
+* codegen feeder, which attributes each `replace` to the mutator export
+* performing it; runtime callers don't supply it, so the lint finds nothing
+* there.
+*/
+interface AdvisorMutatorWrite {
+  /** The mutator export whose `server` impl performs the replace (e.g. `renameChannel`). */
+  exportName: string;
+  /** Openable source path the replace appears in — always `lunora/mutators.ts`. */
+  file: string;
+  /** 1-based line of the `replace(...)` call, or `0` when unknown. */
+  line: number;
+}
+/**
 * One non-deterministic API call discovered lexically inside a `query(...)` or
 * `mutation(...)` handler body — the input the `nondeterministic_query_mutation`
 * lint consumes. Produced by the codegen feeder, which walks each exported
@@ -384,6 +406,16 @@ interface AdvisorTable {
   optionalFields?: ReadonlySet<string>;
   /** Declared relations (`.relations((r) => …)`). */
   relations: ReadonlyArray<AdvisorRelation>;
+  /**
+  * Storage tier the table is declared in: `"global"` (a `.global()` table,
+  * lives in D1 — the cross-shard tier), `"shardBy"` (partitioned across
+  * shard DOs by a key), or `"root"` (the default single-DO table). Read by
+  * the `shape_*` lints to flag replication shapes targeting a `.global()`
+  * table (poll-refreshed/latency-tiered, not poke-live). Optional — the
+  * codegen feeder always supplies it, the runtime feeder derives it; a feeder
+  * that omits it leaves tier-sensitive lints to treat the table as local.
+  */
+  shardKind?: "global" | "root" | "shardBy";
 }
 /**
 * One declared index, flattened across Lunora's index kinds so a single lint can
@@ -440,6 +472,28 @@ interface AdvisorSecretLiteral {
   preview: string;
 }
 /**
+* A replication shape declared via `defineShape({ table, where, columns? })` in
+* `lunora/shapes.ts` (the local-first sync engine's partial-replication unit).
+* The `shape_*` lints cross-reference each shape's {@link AdvisorShape.table}
+* against the declared schema to flag a shape targeting an unknown table or a
+* `.global()` table (which replicates through the latency-tiered D1 poll path,
+* not the poke-live op-log). Supplied by the codegen feeder, which lifts only
+* the export name + the static `table` literal; absent for runtime callers,
+* where the shape lints find nothing.
+*/
+interface AdvisorShape {
+  /** Export binding name — the shape's registry key (e.g. `channelMessages`). */
+  exportName: string;
+  /** File the shape is declared in (relative, for the operator to open). */
+  file: string;
+  /**
+  * The `table` string literal the shape replicates from, or `undefined` when
+  * the feeder could not read it as a plain string literal — tier-sensitive
+  * lints skip a shape with no resolvable table rather than guessing.
+  */
+  table?: string;
+}
+/**
 * One shard's observed traffic share — the input the `hot_shard` runtime lint
 * consumes. Produced by the studio backend, which fans out over a sharded
 * function's shards and reads each shard's recorded request volume from the
@@ -523,10 +577,27 @@ interface AdvisorTableSample {
 * how `AdvisorContainer` tracks `ContainerIR` and `AdvisorInsertWrite` tracks
 * `InsertWriteIR`).
 */
+/** One durable step call lifted from a workflow handler body — the input the duplicate-step-name lint compares. Structural subset of codegen's `WorkflowStepIR`. */
+interface AdvisorWorkflowStep {
+  /** 1-based line of the durable step call, or `0` when unknown. */
+  line: number;
+  /** The native step method invoked: `do` / `sleep` / `sleepUntil` / `waitForEvent`. */
+  method: string;
+  /** The step's static label (the first string-literal argument). */
+  name: string;
+}
 /** One workflow declared via a `defineWorkflow()` export in `lunora/workflows.ts`. */
 interface AdvisorWorkflow {
   /** The `lunora/workflows.ts` export name, e.g. `orderPipeline`. */
   exportName: string;
+  /**
+  * The durable step labels discovered in the handler body, in source order —
+  * the duplicate-step-name input. Cloudflare memoizes a step by its name, so a
+  * name used twice makes the second call silently return the first's cached
+  * result. Supplied by the codegen feeder; `undefined` for runtime callers,
+  * where the lint finds nothing.
+  */
+  steps?: ReadonlyArray<AdvisorWorkflowStep>;
 }
 /** One `ctx.workflows.get("name")` call discovered in a function body. */
 interface AdvisorWorkflowCall {
@@ -660,6 +731,14 @@ interface LintContext {
   */
   maskProcedures?: ReadonlyArray<AdvisorMaskProcedure>;
   /**
+  * Whole-row `ctx.db.replace(id, document)` writes lifted from custom
+  * mutators' authoritative `server` impls (the `mutator_full_row_replace`
+  * input). Each `replace` overwrites the entire row, clobbering a concurrent
+  * edit to a different column on a synced table. Supplied by the codegen
+  * feeder; absent for runtime callers, where the lint finds nothing.
+  */
+  mutatorWrites?: ReadonlyArray<AdvisorMutatorWrite>;
+  /**
   * Non-deterministic API calls (`Date.now`, `Math.random`,
   * `crypto.randomUUID`, `crypto.getRandomValues`, `fetch`) discovered lexically
   * inside `query`/`mutation` handler bodies — the `nondeterministic_query_mutation`
@@ -708,6 +787,14 @@ interface LintContext {
   */
   secretLiterals?: ReadonlyArray<AdvisorSecretLiteral>;
   /**
+  * Replication shapes declared via `defineShape` in `lunora/shapes.ts` — the
+  * `shape_unknown_table` and `shape_targets_global_table` lint input. Each
+  * carries the export name and its static `table` literal, cross-referenced
+  * against {@link LintContext.schema}. Supplied by the codegen feeder; absent
+  * for runtime callers, where the shape lints find nothing.
+  */
+  shapes?: ReadonlyArray<AdvisorShape>;
+  /**
   * Per-shard observed traffic — the `hot_shard` lint input. Supplied by the
   * studio backend, which fans out over a sharded function's shards and reads
   * each shard's recorded request volume from the durable `__lunora_metrics`
@@ -1133,6 +1220,30 @@ declare const indexReferencesUnknownField: Lint;
 */
 declare const maskUncoveredPiiColumn: Lint;
 /**
+* Flags a custom mutator whose authoritative `server` impl writes a row with
+* `ctx.db.replace(id, document)` — a whole-document overwrite.
+*
+* The local-first sync engine serializes mutators in the shard DO, so two
+* mutators that touch the *same row* but *different columns* both run to
+* completion — but only if each writes its own column. A `replace` overwrites
+* the entire row from the document the mutator assembled, so a concurrent edit
+* to another column (committed between this mutator's read and its write, or
+* carried as a pending optimistic overlay on a client) is silently clobbered:
+* the kind of "two offline edits to different fields fight each other" data loss
+* a column-level merge avoids. `ctx.db.patch(id, { onlyTheChangedField })`
+* merges at the column level instead, so independent field edits coexist.
+*
+* `WARN`, not `ERROR`: `replace` is legitimate when the mutator genuinely owns
+* the whole row (a full-form save, a state-machine transition that rewrites
+* every field). The lint just surfaces the column-clobber risk so a developer
+* reaches for `patch` by default on a synced table.
+*
+* **Evidence supply**: runs only when the codegen feeder supplies
+* `context.mutatorWrites` (each a `replace` call lifted from a mutator's inline
+* `server` body); absent for runtime callers, where the lint finds nothing.
+*/
+declare const mutatorFullRowReplace: Lint;
+/**
 * Flags a non-deterministic API call inside a `query(...)` or `mutation(...)`
 * handler body.
 *
@@ -1285,6 +1396,48 @@ declare const relationReferencesUnknownTable: Lint;
 */
 declare const rlsUncoveredTable: Lint;
 /**
+* Flags a replication shape whose `table` is a `.global()` table.
+*
+* Poke-live replication is a per-shard-DO property: the shard owns its SQLite
+* and a monotonic `__cdc_log`, so a write produces an ordered op the DO pokes to
+* every subscriber at the next flush. A `.global()` table lives outside the
+* shard DO's SQLite op-log (in a global backend — D1, or Hyperdrive-fronted
+* Postgres/MySQL) — so a shape over a global table cannot be poke-live. It is
+* served through the cross-shard tier: **coordinator/poll-refreshed, latency-
+* tiered**, not live. That is a real and supported tier (it is the recommended
+* answer for cross-shard reads — denormalize, or move the joined table to
+* `.global()` and read through the global backend), but its freshness semantics
+* differ from a sharded shape's, so the boundary is surfaced rather than hidden.
+*
+* `WARN`, not `ERROR`: a global-table shape is a legitimate design once you
+* accept the poll-refresh latency; the lint just makes the tier explicit so a
+* developer does not assume poke-live freshness.
+*
+* **Evidence supply**: runs only when the codegen feeder supplies
+* `context.shapes`; the table's tier comes from the schema's `shardKind`. A
+* shape whose table is unknown (caught by `shape_unknown_table`) or whose tier
+* the feeder didn't supply is skipped.
+*/
+declare const shapeTargetsGlobalTable: Lint;
+/**
+* Flags a replication shape whose `table` names a table that does not exist in
+* the schema.
+*
+* `defineShape({ table: "messages", … })` binds a shape to a table by a plain
+* string. A live `subscribeShape("…")` resolves that shape server-side and runs
+* its membership query against the named table — so a typo, a stale name after a
+* rename, or a copy-paste mistake produces a shape that can never resolve a
+* rowset: the subscription seeds empty and then errors at the first flush
+* (`no such table`). This is a definite, build-time-detectable break, so it is
+* an `ERROR` — surfaced before the broken shape ever ships.
+*
+* **Evidence supply**: runs only when the codegen feeder supplies
+* `context.shapes`. A shape whose `table` wasn't a static string literal (no
+* resolvable name) is skipped rather than guessed at, so the lint under-reports
+* rather than raising false alarms.
+*/
+declare const shapeUnknownTable: Lint;
+/**
 * Flags a `ctx.sql` tagged-template that splices an unparameterized
 * string-building expression into the query.
 *
@@ -1387,6 +1540,25 @@ declare const unindexedRelationTarget: Lint;
 */
 declare const userCreatingMutationWithoutCaptcha: Lint;
 /**
+* Flags a durable step name reused within one workflow.
+*
+* Cloudflare Workflows memoizes every `step.do` / `step.sleep` / `step.sleepUntil`
+* / `step.waitForEvent` call by its name: on replay the runtime returns the cached
+* result for a name it has already seen. Two distinct steps that share a name are
+* therefore a silent bug — the second call never runs its body and instead yields
+* the first's result, skipping the work (a charge, a write, an external wait)
+* without error. Hence `ERROR`/`INTERNAL`: it is a developer-facing correctness
+* defect in the workflow's own code, not a runtime-data nit.
+*
+* Only the first string-literal argument of each step call is compared; a step
+* named dynamically (`step.do(\`load-${id}\`, …)`) is omitted by the feeder, so a
+* deliberately-parameterized fan-out is never flagged. `ctx.runStep(stepDef, …)`
+* names (which come from `defineStep` in another file) are out of scope here.
+* Only runs when the declaration feeder supplied step evidence
+* (`workflow.steps` present); a runtime caller flags nothing.
+*/
+declare const workflowDuplicateStepName: Lint;
+/**
 * A correctness lint: every `ctx.workflows.get("name")` call must reference a
 * workflow that exists — i.e. a `defineWorkflow` export in `lunora/workflows.ts`.
 * A `.get("x")` whose `"x"` resolves to no declared workflow is a typo or a
@@ -1448,4 +1620,4 @@ interface RunAdvisorOptions {
 * `static` lints at build time and defer `runtime` lints to a live shard.
 */
 declare const runAdvisor: (context: LintContext, options?: RunAdvisorOptions) => Finding[];
-export { AE_METRIC_EVENTS, ALL_LINTS, type AdvisorAdminRoute, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorContainer, type AdvisorHyperdriveCall, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorMaskProcedure, type AdvisorNondeterministicCall, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorR2sqlCall, type AdvisorRelation, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShardTraffic, type AdvisorSqlInterpolation, type AdvisorTable, type AdvisorTableSample, type AdvisorTableScan, type AdvisorWorkflow, type AdvisorWorkflowCall, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type Category, type Facing, type Finding, type Level, type Lint, type LintContext, type LintSource, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, adminRouteWithoutGuard, authApiCallWithoutHeaders, circularFk, constraintValidator, containerOversizedInstance, containerPublicInternet, duplicateIndex, emptyIndex, filterWithoutIndex, fromServerSchema, hardcodedSecret, hotShard, hyperdriveOutsideAction, indexReferencesUnknownField, indexUtilization, loadAnalyticsRuntimeMetrics, maskUncoveredPiiColumn, nondeterministicQueryMutation, policyReferencesUnknownTable, publicArgumentUsesAny, publicMutationWithoutRatelimit, r2sqlOutsideAction, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, sqlInjectionRisk, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, workflowUnknownTarget, workflowUnused };
+export { AE_METRIC_EVENTS, ALL_LINTS, type AdvisorAdminRoute, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorContainer, type AdvisorHyperdriveCall, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorMaskProcedure, type AdvisorMutatorWrite, type AdvisorNondeterministicCall, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorR2sqlCall, type AdvisorRelation, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShape, type AdvisorShardTraffic, type AdvisorSqlInterpolation, type AdvisorTable, type AdvisorTableSample, type AdvisorTableScan, type AdvisorWorkflow, type AdvisorWorkflowCall, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type Category, type Facing, type Finding, type Level, type Lint, type LintContext, type LintSource, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, adminRouteWithoutGuard, authApiCallWithoutHeaders, circularFk, constraintValidator, containerOversizedInstance, containerPublicInternet, duplicateIndex, emptyIndex, filterWithoutIndex, fromServerSchema, hardcodedSecret, hotShard, hyperdriveOutsideAction, indexReferencesUnknownField, indexUtilization, loadAnalyticsRuntimeMetrics, maskUncoveredPiiColumn, mutatorFullRowReplace, nondeterministicQueryMutation, policyReferencesUnknownTable, publicArgumentUsesAny, publicMutationWithoutRatelimit, r2sqlOutsideAction, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, sqlInjectionRisk, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };

package/dist/index.d.ts

@@ -214,6 +214,28 @@ interface AdvisorMaskProcedure {
   visibility: "internal" | "public";
 }
 /**
+* One whole-row `ctx.db.replace(id, document)` write discovered inside a custom
+* mutator's authoritative `server` impl (`lunora/mutators.ts`) — the input the
+* `mutator_full_row_replace` lint consumes.
+*
+* In the local-first sync engine a `replace` overwrites the entire row, so a
+* concurrent edit to a *different* column (committed between this mutator's read
+* and its write) is silently clobbered. `patch(id, { onlyTheField })` merges at
+* the column level instead, letting independent field edits coexist — the
+* blessed pattern for mutators on a synced (poke-live) table. Produced by the
+* codegen feeder, which attributes each `replace` to the mutator export
+* performing it; runtime callers don't supply it, so the lint finds nothing
+* there.
+*/
+interface AdvisorMutatorWrite {
+  /** The mutator export whose `server` impl performs the replace (e.g. `renameChannel`). */
+  exportName: string;
+  /** Openable source path the replace appears in — always `lunora/mutators.ts`. */
+  file: string;
+  /** 1-based line of the `replace(...)` call, or `0` when unknown. */
+  line: number;
+}
+/**
 * One non-deterministic API call discovered lexically inside a `query(...)` or
 * `mutation(...)` handler body — the input the `nondeterministic_query_mutation`
 * lint consumes. Produced by the codegen feeder, which walks each exported
@@ -384,6 +406,16 @@ interface AdvisorTable {
   optionalFields?: ReadonlySet<string>;
   /** Declared relations (`.relations((r) => …)`). */
   relations: ReadonlyArray<AdvisorRelation>;
+  /**
+  * Storage tier the table is declared in: `"global"` (a `.global()` table,
+  * lives in D1 — the cross-shard tier), `"shardBy"` (partitioned across
+  * shard DOs by a key), or `"root"` (the default single-DO table). Read by
+  * the `shape_*` lints to flag replication shapes targeting a `.global()`
+  * table (poll-refreshed/latency-tiered, not poke-live). Optional — the
+  * codegen feeder always supplies it, the runtime feeder derives it; a feeder
+  * that omits it leaves tier-sensitive lints to treat the table as local.
+  */
+  shardKind?: "global" | "root" | "shardBy";
 }
 /**
 * One declared index, flattened across Lunora's index kinds so a single lint can
@@ -440,6 +472,28 @@ interface AdvisorSecretLiteral {
   preview: string;
 }
 /**
+* A replication shape declared via `defineShape({ table, where, columns? })` in
+* `lunora/shapes.ts` (the local-first sync engine's partial-replication unit).
+* The `shape_*` lints cross-reference each shape's {@link AdvisorShape.table}
+* against the declared schema to flag a shape targeting an unknown table or a
+* `.global()` table (which replicates through the latency-tiered D1 poll path,
+* not the poke-live op-log). Supplied by the codegen feeder, which lifts only
+* the export name + the static `table` literal; absent for runtime callers,
+* where the shape lints find nothing.
+*/
+interface AdvisorShape {
+  /** Export binding name — the shape's registry key (e.g. `channelMessages`). */
+  exportName: string;
+  /** File the shape is declared in (relative, for the operator to open). */
+  file: string;
+  /**
+  * The `table` string literal the shape replicates from, or `undefined` when
+  * the feeder could not read it as a plain string literal — tier-sensitive
+  * lints skip a shape with no resolvable table rather than guessing.
+  */
+  table?: string;
+}
+/**
 * One shard's observed traffic share — the input the `hot_shard` runtime lint
 * consumes. Produced by the studio backend, which fans out over a sharded
 * function's shards and reads each shard's recorded request volume from the
@@ -523,10 +577,27 @@ interface AdvisorTableSample {
 * how `AdvisorContainer` tracks `ContainerIR` and `AdvisorInsertWrite` tracks
 * `InsertWriteIR`).
 */
+/** One durable step call lifted from a workflow handler body — the input the duplicate-step-name lint compares. Structural subset of codegen's `WorkflowStepIR`. */
+interface AdvisorWorkflowStep {
+  /** 1-based line of the durable step call, or `0` when unknown. */
+  line: number;
+  /** The native step method invoked: `do` / `sleep` / `sleepUntil` / `waitForEvent`. */
+  method: string;
+  /** The step's static label (the first string-literal argument). */
+  name: string;
+}
 /** One workflow declared via a `defineWorkflow()` export in `lunora/workflows.ts`. */
 interface AdvisorWorkflow {
   /** The `lunora/workflows.ts` export name, e.g. `orderPipeline`. */
   exportName: string;
+  /**
+  * The durable step labels discovered in the handler body, in source order —
+  * the duplicate-step-name input. Cloudflare memoizes a step by its name, so a
+  * name used twice makes the second call silently return the first's cached
+  * result. Supplied by the codegen feeder; `undefined` for runtime callers,
+  * where the lint finds nothing.
+  */
+  steps?: ReadonlyArray<AdvisorWorkflowStep>;
 }
 /** One `ctx.workflows.get("name")` call discovered in a function body. */
 interface AdvisorWorkflowCall {
@@ -660,6 +731,14 @@ interface LintContext {
   */
   maskProcedures?: ReadonlyArray<AdvisorMaskProcedure>;
   /**
+  * Whole-row `ctx.db.replace(id, document)` writes lifted from custom
+  * mutators' authoritative `server` impls (the `mutator_full_row_replace`
+  * input). Each `replace` overwrites the entire row, clobbering a concurrent
+  * edit to a different column on a synced table. Supplied by the codegen
+  * feeder; absent for runtime callers, where the lint finds nothing.
+  */
+  mutatorWrites?: ReadonlyArray<AdvisorMutatorWrite>;
+  /**
   * Non-deterministic API calls (`Date.now`, `Math.random`,
   * `crypto.randomUUID`, `crypto.getRandomValues`, `fetch`) discovered lexically
   * inside `query`/`mutation` handler bodies — the `nondeterministic_query_mutation`
@@ -708,6 +787,14 @@ interface LintContext {
   */
   secretLiterals?: ReadonlyArray<AdvisorSecretLiteral>;
   /**
+  * Replication shapes declared via `defineShape` in `lunora/shapes.ts` — the
+  * `shape_unknown_table` and `shape_targets_global_table` lint input. Each
+  * carries the export name and its static `table` literal, cross-referenced
+  * against {@link LintContext.schema}. Supplied by the codegen feeder; absent
+  * for runtime callers, where the shape lints find nothing.
+  */
+  shapes?: ReadonlyArray<AdvisorShape>;
+  /**
   * Per-shard observed traffic — the `hot_shard` lint input. Supplied by the
   * studio backend, which fans out over a sharded function's shards and reads
   * each shard's recorded request volume from the durable `__lunora_metrics`
@@ -1133,6 +1220,30 @@ declare const indexReferencesUnknownField: Lint;
 */
 declare const maskUncoveredPiiColumn: Lint;
 /**
+* Flags a custom mutator whose authoritative `server` impl writes a row with
+* `ctx.db.replace(id, document)` — a whole-document overwrite.
+*
+* The local-first sync engine serializes mutators in the shard DO, so two
+* mutators that touch the *same row* but *different columns* both run to
+* completion — but only if each writes its own column. A `replace` overwrites
+* the entire row from the document the mutator assembled, so a concurrent edit
+* to another column (committed between this mutator's read and its write, or
+* carried as a pending optimistic overlay on a client) is silently clobbered:
+* the kind of "two offline edits to different fields fight each other" data loss
+* a column-level merge avoids. `ctx.db.patch(id, { onlyTheChangedField })`
+* merges at the column level instead, so independent field edits coexist.
+*
+* `WARN`, not `ERROR`: `replace` is legitimate when the mutator genuinely owns
+* the whole row (a full-form save, a state-machine transition that rewrites
+* every field). The lint just surfaces the column-clobber risk so a developer
+* reaches for `patch` by default on a synced table.
+*
+* **Evidence supply**: runs only when the codegen feeder supplies
+* `context.mutatorWrites` (each a `replace` call lifted from a mutator's inline
+* `server` body); absent for runtime callers, where the lint finds nothing.
+*/
+declare const mutatorFullRowReplace: Lint;
+/**
 * Flags a non-deterministic API call inside a `query(...)` or `mutation(...)`
 * handler body.
 *
@@ -1285,6 +1396,48 @@ declare const relationReferencesUnknownTable: Lint;
 */
 declare const rlsUncoveredTable: Lint;
 /**
+* Flags a replication shape whose `table` is a `.global()` table.
+*
+* Poke-live replication is a per-shard-DO property: the shard owns its SQLite
+* and a monotonic `__cdc_log`, so a write produces an ordered op the DO pokes to
+* every subscriber at the next flush. A `.global()` table lives outside the
+* shard DO's SQLite op-log (in a global backend — D1, or Hyperdrive-fronted
+* Postgres/MySQL) — so a shape over a global table cannot be poke-live. It is
+* served through the cross-shard tier: **coordinator/poll-refreshed, latency-
+* tiered**, not live. That is a real and supported tier (it is the recommended
+* answer for cross-shard reads — denormalize, or move the joined table to
+* `.global()` and read through the global backend), but its freshness semantics
+* differ from a sharded shape's, so the boundary is surfaced rather than hidden.
+*
+* `WARN`, not `ERROR`: a global-table shape is a legitimate design once you
+* accept the poll-refresh latency; the lint just makes the tier explicit so a
+* developer does not assume poke-live freshness.
+*
+* **Evidence supply**: runs only when the codegen feeder supplies
+* `context.shapes`; the table's tier comes from the schema's `shardKind`. A
+* shape whose table is unknown (caught by `shape_unknown_table`) or whose tier
+* the feeder didn't supply is skipped.
+*/
+declare const shapeTargetsGlobalTable: Lint;
+/**
+* Flags a replication shape whose `table` names a table that does not exist in
+* the schema.
+*
+* `defineShape({ table: "messages", … })` binds a shape to a table by a plain
+* string. A live `subscribeShape("…")` resolves that shape server-side and runs
+* its membership query against the named table — so a typo, a stale name after a
+* rename, or a copy-paste mistake produces a shape that can never resolve a
+* rowset: the subscription seeds empty and then errors at the first flush
+* (`no such table`). This is a definite, build-time-detectable break, so it is
+* an `ERROR` — surfaced before the broken shape ever ships.
+*
+* **Evidence supply**: runs only when the codegen feeder supplies
+* `context.shapes`. A shape whose `table` wasn't a static string literal (no
+* resolvable name) is skipped rather than guessed at, so the lint under-reports
+* rather than raising false alarms.
+*/
+declare const shapeUnknownTable: Lint;
+/**
 * Flags a `ctx.sql` tagged-template that splices an unparameterized
 * string-building expression into the query.
 *
@@ -1387,6 +1540,25 @@ declare const unindexedRelationTarget: Lint;
 */
 declare const userCreatingMutationWithoutCaptcha: Lint;
 /**
+* Flags a durable step name reused within one workflow.
+*
+* Cloudflare Workflows memoizes every `step.do` / `step.sleep` / `step.sleepUntil`
+* / `step.waitForEvent` call by its name: on replay the runtime returns the cached
+* result for a name it has already seen. Two distinct steps that share a name are
+* therefore a silent bug — the second call never runs its body and instead yields
+* the first's result, skipping the work (a charge, a write, an external wait)
+* without error. Hence `ERROR`/`INTERNAL`: it is a developer-facing correctness
+* defect in the workflow's own code, not a runtime-data nit.
+*
+* Only the first string-literal argument of each step call is compared; a step
+* named dynamically (`step.do(\`load-${id}\`, …)`) is omitted by the feeder, so a
+* deliberately-parameterized fan-out is never flagged. `ctx.runStep(stepDef, …)`
+* names (which come from `defineStep` in another file) are out of scope here.
+* Only runs when the declaration feeder supplied step evidence
+* (`workflow.steps` present); a runtime caller flags nothing.
+*/
+declare const workflowDuplicateStepName: Lint;
+/**
 * A correctness lint: every `ctx.workflows.get("name")` call must reference a
 * workflow that exists — i.e. a `defineWorkflow` export in `lunora/workflows.ts`.
 * A `.get("x")` whose `"x"` resolves to no declared workflow is a typo or a
@@ -1448,4 +1620,4 @@ interface RunAdvisorOptions {
 * `static` lints at build time and defer `runtime` lints to a live shard.
 */
 declare const runAdvisor: (context: LintContext, options?: RunAdvisorOptions) => Finding[];
-export { AE_METRIC_EVENTS, ALL_LINTS, type AdvisorAdminRoute, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorContainer, type AdvisorHyperdriveCall, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorMaskProcedure, type AdvisorNondeterministicCall, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorR2sqlCall, type AdvisorRelation, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShardTraffic, type AdvisorSqlInterpolation, type AdvisorTable, type AdvisorTableSample, type AdvisorTableScan, type AdvisorWorkflow, type AdvisorWorkflowCall, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type Category, type Facing, type Finding, type Level, type Lint, type LintContext, type LintSource, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, adminRouteWithoutGuard, authApiCallWithoutHeaders, circularFk, constraintValidator, containerOversizedInstance, containerPublicInternet, duplicateIndex, emptyIndex, filterWithoutIndex, fromServerSchema, hardcodedSecret, hotShard, hyperdriveOutsideAction, indexReferencesUnknownField, indexUtilization, loadAnalyticsRuntimeMetrics, maskUncoveredPiiColumn, nondeterministicQueryMutation, policyReferencesUnknownTable, publicArgumentUsesAny, publicMutationWithoutRatelimit, r2sqlOutsideAction, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, sqlInjectionRisk, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, workflowUnknownTarget, workflowUnused };
+export { AE_METRIC_EVENTS, ALL_LINTS, type AdvisorAdminRoute, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorContainer, type AdvisorHyperdriveCall, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorMaskProcedure, type AdvisorMutatorWrite, type AdvisorNondeterministicCall, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorR2sqlCall, type AdvisorRelation, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShape, type AdvisorShardTraffic, type AdvisorSqlInterpolation, type AdvisorTable, type AdvisorTableSample, type AdvisorTableScan, type AdvisorWorkflow, type AdvisorWorkflowCall, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type Category, type Facing, type Finding, type Level, type Lint, type LintContext, type LintSource, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, adminRouteWithoutGuard, authApiCallWithoutHeaders, circularFk, constraintValidator, containerOversizedInstance, containerPublicInternet, duplicateIndex, emptyIndex, filterWithoutIndex, fromServerSchema, hardcodedSecret, hotShard, hyperdriveOutsideAction, indexReferencesUnknownField, indexUtilization, loadAnalyticsRuntimeMetrics, maskUncoveredPiiColumn, mutatorFullRowReplace, nondeterministicQueryMutation, policyReferencesUnknownTable, publicArgumentUsesAny, publicMutationWithoutRatelimit, r2sqlOutsideAction, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, sqlInjectionRisk, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };

package/dist/index.mjs

@@ -13,6 +13,7 @@ import hardcodedSecret from './packem_shared/hardcodedSecret-W2pz1UZB.mjs';
 import hyperdriveOutsideAction from './packem_shared/hyperdriveOutsideAction-BgZqX7Xg.mjs';
 import indexReferencesUnknownField from './packem_shared/indexReferencesUnknownField-DH0_dbUY.mjs';
 import maskUncoveredPiiColumn from './packem_shared/maskUncoveredPiiColumn-DjGIPG6M.mjs';
+import mutatorFullRowReplace from './packem_shared/mutatorFullRowReplace-BJnNDaIV.mjs';
 import nondeterministicQueryMutation from './packem_shared/nondeterministicQueryMutation-GXES1fLp.mjs';
 import policyReferencesUnknownTable from './packem_shared/policyReferencesUnknownTable-DtaIEovd.mjs';
 import publicArgumentUsesAny from './packem_shared/publicArgumentUsesAny-C71b2NCf.mjs';
@@ -21,22 +22,27 @@ import r2sqlOutsideAction from './packem_shared/r2sqlOutsideAction-CtqxvMuV.mjs'
 import relationReferencesUnknownField from './packem_shared/relationReferencesUnknownField-YznyXt_7.mjs';
 import relationReferencesUnknownTable from './packem_shared/relationReferencesUnknownTable-DrorpKYe.mjs';
 import rlsUncoveredTable from './packem_shared/rlsUncoveredTable-CxEfZ5eZ.mjs';
+import shapeTargetsGlobalTable from './packem_shared/shapeTargetsGlobalTable-DHrf4Koi.mjs';
+import shapeUnknownTable from './packem_shared/shapeUnknownTable-C8aDWFoe.mjs';
 import sqlInjectionRisk from './packem_shared/sqlInjectionRisk-zwytYGLt.mjs';
 import tableWithoutInsert from './packem_shared/tableWithoutInsert-CbbaYIP4.mjs';
 import unboundedStringArgument from './packem_shared/unboundedStringArgument-DThg2-wt.mjs';
 import unindexedForeignKey from './packem_shared/unindexedForeignKey-BgJbKyqK.mjs';
 import unindexedRelationTarget from './packem_shared/unindexedRelationTarget-D6eyj6Xx.mjs';
 import userCreatingMutationWithoutCaptcha from './packem_shared/userCreatingMutationWithoutCaptcha-CH31YsUZ.mjs';
+import workflowDuplicateStepName from './packem_shared/workflowDuplicateStepName-ioBxPBCy.mjs';
 import workflowUnknownTarget from './packem_shared/workflowUnknownTarget-Cdd7WhKQ.mjs';
 import workflowUnused from './packem_shared/workflowUnused-D0jHxdz9.mjs';
 export { AE_METRIC_EVENTS, loadAnalyticsRuntimeMetrics } from './packem_shared/AE_METRIC_EVENTS-DexctYv6.mjs';
-export { fromServerSchema } from './packem_shared/fromServerSchema-DinF1nph.mjs';
+export { fromServerSchema } from './packem_shared/fromServerSchema-TWb7dTHC.mjs';
 
 const STATIC_LINTS = [
   indexReferencesUnknownField,
   relationReferencesUnknownTable,
   relationReferencesUnknownField,
   workflowUnknownTarget,
+  workflowDuplicateStepName,
+  shapeUnknownTable,
   emptyIndex,
   circularFk,
   unindexedForeignKey,
@@ -45,6 +51,8 @@ const STATIC_LINTS = [
   tableWithoutInsert,
   workflowUnused,
   filterWithoutIndex,
+  shapeTargetsGlobalTable,
+  mutatorFullRowReplace,
   nondeterministicQueryMutation,
   hyperdriveOutsideAction,
   r2sqlOutsideAction,
@@ -76,4 +84,4 @@ const runAdvisor = (context, options = {}) => {
   return findings;
 };
 
-export { ALL_LINTS, RUNTIME_LINTS, STATIC_LINTS, adminRouteWithoutGuard, authApiCallWithoutHeaders, circularFk, constraintValidator, containerOversizedInstance, containerPublicInternet, duplicateIndex, emptyIndex, filterWithoutIndex, hardcodedSecret, hotShard, hyperdriveOutsideAction, indexReferencesUnknownField, indexUtilization, maskUncoveredPiiColumn, nondeterministicQueryMutation, policyReferencesUnknownTable, publicArgumentUsesAny, publicMutationWithoutRatelimit, r2sqlOutsideAction, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, sqlInjectionRisk, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, workflowUnknownTarget, workflowUnused };
+export { ALL_LINTS, RUNTIME_LINTS, STATIC_LINTS, adminRouteWithoutGuard, authApiCallWithoutHeaders, circularFk, constraintValidator, containerOversizedInstance, containerPublicInternet, duplicateIndex, emptyIndex, filterWithoutIndex, hardcodedSecret, hotShard, hyperdriveOutsideAction, indexReferencesUnknownField, indexUtilization, maskUncoveredPiiColumn, mutatorFullRowReplace, nondeterministicQueryMutation, policyReferencesUnknownTable, publicArgumentUsesAny, publicMutationWithoutRatelimit, r2sqlOutsideAction, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, sqlInjectionRisk, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };

package/dist/packem_shared/{fromServerSchema-DinF1nph.mjs → fromServerSchema-TWb7dTHC.mjs}

@@ -32,6 +32,7 @@ const fromServerSchema = (schema) => {
         indexes,
         name,
         optionalFields,
+        shardKind: table.shardMode.kind,
         relations: Object.entries(table.relationMap).map(([accessor, relation]) => {
           return {
             field: relation.field,

package/dist/packem_shared/mutatorFullRowReplace-BJnNDaIV.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const mutatorFullRowReplace = {
+  categories: ["SCHEMA"],
+  description: "A custom mutator's `server` impl writes with `ctx.db.replace(id, document)` — a whole-row overwrite. On a synced table this clobbers a concurrent edit to a different column; `ctx.db.patch(id, { field })` merges at the column level so independent field edits coexist.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "mutator_full_row_replace",
+  remediation: "Prefer `ctx.db.patch(id, { onlyTheChangedField })` so a concurrent edit to another column isn't lost. Keep `replace` only when the mutator genuinely owns the entire row (e.g. a full-form save).",
+  run: (context) => {
+    if (context.mutatorWrites === void 0) {
+      return [];
+    }
+    return context.mutatorWrites.map(
+      (write) => emit(mutatorFullRowReplace, {
+        cacheKey: `mutator_full_row_replace:${write.exportName}:${String(write.line)}`,
+        detail: `Mutator \`${write.exportName}\` (${write.file}:${String(write.line)}) writes with \`ctx.db.replace(...)\`, overwriting the whole row. A concurrent edit to a different column is clobbered — use \`ctx.db.patch(id, { field })\` to merge at the column level.`,
+        metadata: { exportName: write.exportName, file: write.file, line: write.line }
+      })
+    );
+  },
+  source: "static",
+  title: "Mutator overwrites the whole row (clobbers concurrent column edits)"
+};
+
+export { mutatorFullRowReplace as default };

package/dist/packem_shared/shapeTargetsGlobalTable-DHrf4Koi.mjs

@@ -0,0 +1,34 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const shapeTargetsGlobalTable = {
+  categories: ["PERFORMANCE"],
+  description: "A `defineShape` replicates from a `.global()` table. Global tables live outside the shard DO's SQLite op-log, so the shape is served through the cross-shard tier — coordinator/poll-refreshed and latency-tiered, not poke-live like a sharded shape.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "shape_targets_global_table",
+  remediation: "Expected if you want the cross-shard tier — just don't assume poke-live freshness; global shapes refresh on a poll. For live updates, replicate from a sharded table instead (denormalize the columns you need into the shard).",
+  run: (context) => {
+    if (context.shapes === void 0) {
+      return [];
+    }
+    const globalTables = new Set(context.schema.tables.filter((table) => table.shardKind === "global").map((table) => table.name));
+    const findings = [];
+    for (const shape of context.shapes) {
+      if (shape.table === void 0 || !globalTables.has(shape.table)) {
+        continue;
+      }
+      findings.push(
+        emit(shapeTargetsGlobalTable, {
+          cacheKey: `shape_targets_global_table:${shape.exportName}`,
+          detail: `Shape \`${shape.exportName}\` (${shape.file}) replicates from the \`.global()\` table \`${shape.table}\`. It is served through the cross-shard global tier — poll-refreshed and latency-tiered, not poke-live.`,
+          metadata: { exportName: shape.exportName, file: shape.file, table: shape.table }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Shape replicates from a global (cross-shard) table"
+};
+
+export { shapeTargetsGlobalTable as default };

package/dist/packem_shared/shapeUnknownTable-C8aDWFoe.mjs

@@ -0,0 +1,34 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const shapeUnknownTable = {
+  categories: ["SCHEMA"],
+  description: "A `defineShape` is bound to a `table` name that does not exist in the schema. The shape can never resolve a rowset — its subscription seeds empty and errors at the first flush.",
+  facing: "INTERNAL",
+  level: "ERROR",
+  name: "shape_unknown_table",
+  remediation: "Fix the shape's `table` to a real table name (check for a typo or a table that was renamed/removed).",
+  run: (context) => {
+    if (context.shapes === void 0) {
+      return [];
+    }
+    const knownTables = new Set(context.schema.tables.map((table) => table.name));
+    const findings = [];
+    for (const shape of context.shapes) {
+      if (shape.table === void 0 || knownTables.has(shape.table)) {
+        continue;
+      }
+      findings.push(
+        emit(shapeUnknownTable, {
+          cacheKey: `shape_unknown_table:${shape.exportName}`,
+          detail: `Shape \`${shape.exportName}\` (${shape.file}) replicates from table \`${shape.table}\`, which is not declared in the schema. The shape can never resolve a rowset.`,
+          metadata: { exportName: shape.exportName, file: shape.file, table: shape.table }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Shape bound to an unknown table"
+};
+
+export { shapeUnknownTable as default };

package/dist/packem_shared/workflowDuplicateStepName-ioBxPBCy.mjs

@@ -0,0 +1,48 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const workflowDuplicateStepName = {
+  categories: ["SCHEMA"],
+  description: "Two durable steps in this workflow share a name. Cloudflare memoizes a step by its name, so on replay the second call returns the first step's cached result instead of running its body — silently skipping the work without an error.",
+  facing: "INTERNAL",
+  level: "ERROR",
+  // eslint-disable-next-line no-secrets/no-secrets -- the lint's rule id, not a credential
+  name: "workflow_duplicate_step_name",
+  remediation: "Give every `step.do` / `step.sleep` / `step.sleepUntil` / `step.waitForEvent` call in the workflow a unique name. If a step legitimately repeats (e.g. a loop), make the name distinct per iteration by interpolating the item id into the step name.",
+  run: (context) => {
+    if (context.workflows === void 0) {
+      return [];
+    }
+    const findings = [];
+    for (const workflow of context.workflows) {
+      const { steps } = workflow;
+      if (steps === void 0 || steps.length === 0) {
+        continue;
+      }
+      const firstLineByName = /* @__PURE__ */ new Map();
+      const reported = /* @__PURE__ */ new Set();
+      for (const step of steps) {
+        const firstLine = firstLineByName.get(step.name);
+        if (firstLine === void 0) {
+          firstLineByName.set(step.name, step.line);
+          continue;
+        }
+        if (reported.has(step.name)) {
+          continue;
+        }
+        reported.add(step.name);
+        findings.push(
+          emit(workflowDuplicateStepName, {
+            cacheKey: `workflow_duplicate_step_name:${workflow.exportName}:${step.name}`,
+            detail: `Workflow "${workflow.exportName}" reuses the durable step name "${step.name}" (first at line ${String(firstLine)}, again at line ${String(step.line)}). The second call returns the first's cached result instead of running.`,
+            metadata: { firstLine, line: step.line, stepName: step.name, workflow: workflow.exportName }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Duplicate durable step name in workflow"
+};
+
+export { workflowDuplicateStepName as default };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/advisor",
-  "version": "1.0.0-alpha.7",
+  "version": "1.0.0-alpha.9",
   "description": "Schema & query lints (splinter-style advisors) for Lunora, feeding the Studio Advisors view",
   "keywords": [
     "advisor",
@@ -46,7 +46,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/server": "1.0.0-alpha.6"
+    "@lunora/server": "1.0.0-alpha.7"
   },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"