@lunora/advisor 1.0.0-alpha.8 → 1.0.0-alpha.80

package/dist/packem_shared/unindexedRelationTarget-D6eyj6Xx.mjs

@@ -1,53 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-import { P as PRIMARY_KEY, l as leadingIndexedColumns, s as suggestIndexName } from './fk-index-IUK1ukgs.mjs';
-
-const unindexedRelationTarget = {
-  categories: ["PERFORMANCE"],
-  description: "A `many` relation's foreign-key column on the target table has no index leading with it. Relation predicates (`some`/`none`/`every`) and `with:` child reads filter the target on that column, full-scanning it as rows accumulate.",
-  facing: "EXTERNAL",
-  level: "INFO",
-  name: "unindexed_relation_target",
-  remediation: 'Add a secondary index on the target table leading with the FK column, e.g. `.index("byAuthorId", ["authorId"])`.',
-  run: (context) => {
-    const findings = [];
-    const tablesByName = new Map(context.schema.tables.map((table) => [table.name, table]));
-    for (const table of context.schema.tables) {
-      for (const relation of table.relations) {
-        if (relation.kind !== "many") {
-          continue;
-        }
-        const target = tablesByName.get(relation.table);
-        if (target === void 0) {
-          continue;
-        }
-        const fkColumn = relation.field;
-        if (fkColumn === PRIMARY_KEY) {
-          continue;
-        }
-        const coveredByForeignKeyLint = target.relations.some((targetRelation) => targetRelation.kind === "one" && targetRelation.field === fkColumn);
-        if (coveredByForeignKeyLint || leadingIndexedColumns(target).has(fkColumn)) {
-          continue;
-        }
-        const suggestedIndex = suggestIndexName(fkColumn);
-        findings.push(
-          emit(unindexedRelationTarget, {
-            cacheKey: `unindexed_relation_target:${relation.table}:${fkColumn}`,
-            detail: `Relation "${relation.name}" on table "${table.name}" is a to-many over "${relation.table}" via its column "${fkColumn}", which is not the leading column of any index on "${relation.table}". Relation predicates (\`some\`/\`none\`/\`every\`) and \`with:\` reads of "${relation.name}" full-scan "${relation.table}".`,
-            metadata: {
-              fkColumn,
-              references: { column: relation.references, table: table.name },
-              relation: relation.name,
-              suggestedIndex: { fields: [fkColumn], name: suggestedIndex },
-              table: relation.table
-            }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Unindexed relation target"
-};
-
-export { unindexedRelationTarget as default };

package/dist/packem_shared/userCreatingMutationWithoutCaptcha-CH31YsUZ.mjs

@@ -1,42 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const userCreatingMutationWithoutCaptcha = {
-  categories: ["SECURITY"],
-  description: "A public `mutation`/`action` that creates a user/session or sends mail has no CAPTCHA / bot check. Account-creating and mail-sending endpoints are prime automated-abuse targets (credential stuffing, mailbox flooding, disposable-account farming).",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "user_creating_mutation_without_captcha",
-  remediation: "Add a server-verified human check: `.use(verifyTurnstile({ secret, token }))` from `@lunora/auth`, or wrap it with `.use(protectPublic({ rateLimit, captcha }))` from `@lunora/server`. Pair with a rate limit for defense in depth.",
-  run: (context) => {
-    if (context.procedureProtections === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const procedure of context.procedureProtections) {
-      const isPublicWrite = procedure.visibility === "public" && (procedure.kind === "mutation" || procedure.kind === "action");
-      const sensitive = procedure.writesUserTable || procedure.callsMail;
-      if (!isPublicWrite || !sensitive || procedure.usesCaptcha) {
-        continue;
-      }
-      const reason = procedure.writesUserTable ? "writes a user/session table" : "sends mail";
-      findings.push(
-        emit(userCreatingMutationWithoutCaptcha, {
-          cacheKey: `user_creating_mutation_without_captcha:${procedure.file}:${procedure.exportName}`,
-          detail: `Public ${procedure.kind} \`${procedure.exportName}\` (${procedure.file}) ${reason} but has no CAPTCHA check. Add \`.use(verifyTurnstile(...))\` or \`.use(protectPublic({ captcha }))\`.`,
-          metadata: {
-            callsMail: procedure.callsMail,
-            exportName: procedure.exportName,
-            file: procedure.file,
-            kind: procedure.kind,
-            writesUserTable: procedure.writesUserTable
-          }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Account-creating / mail-sending write without a CAPTCHA"
-};
-
-export { userCreatingMutationWithoutCaptcha as default };

package/dist/packem_shared/workflowUnknownTarget-Cdd7WhKQ.mjs

@@ -1,34 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const workflowUnknownTarget = {
-  categories: ["SCHEMA"],
-  description: 'A `ctx.workflows.get("<name>")` call references a workflow that is not declared by any `defineWorkflow` export in `lunora/workflows.ts`. The name is a typo or points at a removed/renamed workflow — the call throws at runtime.',
-  facing: "INTERNAL",
-  level: "ERROR",
-  name: "workflow_unknown_target",
-  remediation: 'Fix the workflow name in the `ctx.workflows.get("…")` call, or add the missing `defineWorkflow` export to `lunora/workflows.ts`.',
-  run: (context) => {
-    if (context.workflows === void 0 || context.workflowCalls === void 0) {
-      return [];
-    }
-    const declared = new Set(context.workflows.map((workflow) => workflow.exportName));
-    const findings = [];
-    for (const call of context.workflowCalls) {
-      if (call.workflow === "" || declared.has(call.workflow)) {
-        continue;
-      }
-      findings.push(
-        emit(workflowUnknownTarget, {
-          cacheKey: `workflow_unknown_target:${call.file}:${call.exportName}:${call.workflow}`,
-          detail: `\`ctx.workflows.get("${call.workflow}")\` in "${call.exportName}" (${call.file}) references workflow "${call.workflow}", which is not declared in lunora/workflows.ts.`,
-          metadata: { exportName: call.exportName, file: call.file, line: call.line, workflow: call.workflow }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Workflow call references unknown workflow"
-};
-
-export { workflowUnknownTarget as default };

package/dist/packem_shared/workflowUnused-D0jHxdz9.mjs

@@ -1,38 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const workflowUnused = {
-  categories: ["SCHEMA"],
-  description: 'No function starts this workflow via `ctx.workflows.get("<name>")`. It may be triggered through a path the advisor can\'t see (the Cloudflare API, a wrangler invocation, a cross-service binding) — or it may be dead code that still deploys as a billable WorkflowEntrypoint.',
-  facing: "INTERNAL",
-  level: "INFO",
-  name: "workflow_unused",
-  remediation: 'If the workflow should be triggered in-app, start it from a mutation/action with `ctx.workflows.get("<name>").create({ params })`. If it is started externally or is no longer needed, this advisory can be ignored (or remove the `defineWorkflow` export).',
-  run: (context) => {
-    if (context.workflows === void 0) {
-      return [];
-    }
-    const calls = context.workflowCalls ?? [];
-    if (calls.some((call) => call.workflow === "")) {
-      return [];
-    }
-    const started = new Set(calls.map((call) => call.workflow));
-    const findings = [];
-    for (const workflow of context.workflows) {
-      if (started.has(workflow.exportName)) {
-        continue;
-      }
-      findings.push(
-        emit(workflowUnused, {
-          cacheKey: `workflow_unused:${workflow.exportName}`,
-          detail: `No function calls \`ctx.workflows.get("${workflow.exportName}")\` — workflow "${workflow.exportName}" is declared but never started in app code.`,
-          metadata: { workflow: workflow.exportName }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Workflow is never started"
-};
-
-export { workflowUnused as default };