@lunora/advisor 1.0.0-alpha.8 → 1.0.0-alpha.9

package/dist/index.d.mts

@@ -577,10 +577,27 @@ interface AdvisorTableSample {
 * how `AdvisorContainer` tracks `ContainerIR` and `AdvisorInsertWrite` tracks
 * `InsertWriteIR`).
 */
+/** One durable step call lifted from a workflow handler body — the input the duplicate-step-name lint compares. Structural subset of codegen's `WorkflowStepIR`. */
+interface AdvisorWorkflowStep {
+  /** 1-based line of the durable step call, or `0` when unknown. */
+  line: number;
+  /** The native step method invoked: `do` / `sleep` / `sleepUntil` / `waitForEvent`. */
+  method: string;
+  /** The step's static label (the first string-literal argument). */
+  name: string;
+}
 /** One workflow declared via a `defineWorkflow()` export in `lunora/workflows.ts`. */
 interface AdvisorWorkflow {
   /** The `lunora/workflows.ts` export name, e.g. `orderPipeline`. */
   exportName: string;
+  /**
+  * The durable step labels discovered in the handler body, in source order —
+  * the duplicate-step-name input. Cloudflare memoizes a step by its name, so a
+  * name used twice makes the second call silently return the first's cached
+  * result. Supplied by the codegen feeder; `undefined` for runtime callers,
+  * where the lint finds nothing.
+  */
+  steps?: ReadonlyArray<AdvisorWorkflowStep>;
 }
 /** One `ctx.workflows.get("name")` call discovered in a function body. */
 interface AdvisorWorkflowCall {
@@ -1523,6 +1540,25 @@ declare const unindexedRelationTarget: Lint;
 */
 declare const userCreatingMutationWithoutCaptcha: Lint;
 /**
+* Flags a durable step name reused within one workflow.
+*
+* Cloudflare Workflows memoizes every `step.do` / `step.sleep` / `step.sleepUntil`
+* / `step.waitForEvent` call by its name: on replay the runtime returns the cached
+* result for a name it has already seen. Two distinct steps that share a name are
+* therefore a silent bug — the second call never runs its body and instead yields
+* the first's result, skipping the work (a charge, a write, an external wait)
+* without error. Hence `ERROR`/`INTERNAL`: it is a developer-facing correctness
+* defect in the workflow's own code, not a runtime-data nit.
+*
+* Only the first string-literal argument of each step call is compared; a step
+* named dynamically (`step.do(\`load-${id}\`, …)`) is omitted by the feeder, so a
+* deliberately-parameterized fan-out is never flagged. `ctx.runStep(stepDef, …)`
+* names (which come from `defineStep` in another file) are out of scope here.
+* Only runs when the declaration feeder supplied step evidence
+* (`workflow.steps` present); a runtime caller flags nothing.
+*/
+declare const workflowDuplicateStepName: Lint;
+/**
 * A correctness lint: every `ctx.workflows.get("name")` call must reference a
 * workflow that exists — i.e. a `defineWorkflow` export in `lunora/workflows.ts`.
 * A `.get("x")` whose `"x"` resolves to no declared workflow is a typo or a
@@ -1584,4 +1620,4 @@ interface RunAdvisorOptions {
 * `static` lints at build time and defer `runtime` lints to a live shard.
 */
 declare const runAdvisor: (context: LintContext, options?: RunAdvisorOptions) => Finding[];
-export { AE_METRIC_EVENTS, ALL_LINTS, type AdvisorAdminRoute, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorContainer, type AdvisorHyperdriveCall, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorMaskProcedure, type AdvisorMutatorWrite, type AdvisorNondeterministicCall, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorR2sqlCall, type AdvisorRelation, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShape, type AdvisorShardTraffic, type AdvisorSqlInterpolation, type AdvisorTable, type AdvisorTableSample, type AdvisorTableScan, type AdvisorWorkflow, type AdvisorWorkflowCall, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type Category, type Facing, type Finding, type Level, type Lint, type LintContext, type LintSource, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, adminRouteWithoutGuard, authApiCallWithoutHeaders, circularFk, constraintValidator, containerOversizedInstance, containerPublicInternet, duplicateIndex, emptyIndex, filterWithoutIndex, fromServerSchema, hardcodedSecret, hotShard, hyperdriveOutsideAction, indexReferencesUnknownField, indexUtilization, loadAnalyticsRuntimeMetrics, maskUncoveredPiiColumn, mutatorFullRowReplace, nondeterministicQueryMutation, policyReferencesUnknownTable, publicArgumentUsesAny, publicMutationWithoutRatelimit, r2sqlOutsideAction, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, sqlInjectionRisk, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, workflowUnknownTarget, workflowUnused };
+export { AE_METRIC_EVENTS, ALL_LINTS, type AdvisorAdminRoute, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorContainer, type AdvisorHyperdriveCall, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorMaskProcedure, type AdvisorMutatorWrite, type AdvisorNondeterministicCall, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorR2sqlCall, type AdvisorRelation, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShape, type AdvisorShardTraffic, type AdvisorSqlInterpolation, type AdvisorTable, type AdvisorTableSample, type AdvisorTableScan, type AdvisorWorkflow, type AdvisorWorkflowCall, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type Category, type Facing, type Finding, type Level, type Lint, type LintContext, type LintSource, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, adminRouteWithoutGuard, authApiCallWithoutHeaders, circularFk, constraintValidator, containerOversizedInstance, containerPublicInternet, duplicateIndex, emptyIndex, filterWithoutIndex, fromServerSchema, hardcodedSecret, hotShard, hyperdriveOutsideAction, indexReferencesUnknownField, indexUtilization, loadAnalyticsRuntimeMetrics, maskUncoveredPiiColumn, mutatorFullRowReplace, nondeterministicQueryMutation, policyReferencesUnknownTable, publicArgumentUsesAny, publicMutationWithoutRatelimit, r2sqlOutsideAction, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, sqlInjectionRisk, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };

package/dist/index.d.ts

@@ -577,10 +577,27 @@ interface AdvisorTableSample {
 * how `AdvisorContainer` tracks `ContainerIR` and `AdvisorInsertWrite` tracks
 * `InsertWriteIR`).
 */
+/** One durable step call lifted from a workflow handler body — the input the duplicate-step-name lint compares. Structural subset of codegen's `WorkflowStepIR`. */
+interface AdvisorWorkflowStep {
+  /** 1-based line of the durable step call, or `0` when unknown. */
+  line: number;
+  /** The native step method invoked: `do` / `sleep` / `sleepUntil` / `waitForEvent`. */
+  method: string;
+  /** The step's static label (the first string-literal argument). */
+  name: string;
+}
 /** One workflow declared via a `defineWorkflow()` export in `lunora/workflows.ts`. */
 interface AdvisorWorkflow {
   /** The `lunora/workflows.ts` export name, e.g. `orderPipeline`. */
   exportName: string;
+  /**
+  * The durable step labels discovered in the handler body, in source order —
+  * the duplicate-step-name input. Cloudflare memoizes a step by its name, so a
+  * name used twice makes the second call silently return the first's cached
+  * result. Supplied by the codegen feeder; `undefined` for runtime callers,
+  * where the lint finds nothing.
+  */
+  steps?: ReadonlyArray<AdvisorWorkflowStep>;
 }
 /** One `ctx.workflows.get("name")` call discovered in a function body. */
 interface AdvisorWorkflowCall {
@@ -1523,6 +1540,25 @@ declare const unindexedRelationTarget: Lint;
 */
 declare const userCreatingMutationWithoutCaptcha: Lint;
 /**
+* Flags a durable step name reused within one workflow.
+*
+* Cloudflare Workflows memoizes every `step.do` / `step.sleep` / `step.sleepUntil`
+* / `step.waitForEvent` call by its name: on replay the runtime returns the cached
+* result for a name it has already seen. Two distinct steps that share a name are
+* therefore a silent bug — the second call never runs its body and instead yields
+* the first's result, skipping the work (a charge, a write, an external wait)
+* without error. Hence `ERROR`/`INTERNAL`: it is a developer-facing correctness
+* defect in the workflow's own code, not a runtime-data nit.
+*
+* Only the first string-literal argument of each step call is compared; a step
+* named dynamically (`step.do(\`load-${id}\`, …)`) is omitted by the feeder, so a
+* deliberately-parameterized fan-out is never flagged. `ctx.runStep(stepDef, …)`
+* names (which come from `defineStep` in another file) are out of scope here.
+* Only runs when the declaration feeder supplied step evidence
+* (`workflow.steps` present); a runtime caller flags nothing.
+*/
+declare const workflowDuplicateStepName: Lint;
+/**
 * A correctness lint: every `ctx.workflows.get("name")` call must reference a
 * workflow that exists — i.e. a `defineWorkflow` export in `lunora/workflows.ts`.
 * A `.get("x")` whose `"x"` resolves to no declared workflow is a typo or a
@@ -1584,4 +1620,4 @@ interface RunAdvisorOptions {
 * `static` lints at build time and defer `runtime` lints to a live shard.
 */
 declare const runAdvisor: (context: LintContext, options?: RunAdvisorOptions) => Finding[];
-export { AE_METRIC_EVENTS, ALL_LINTS, type AdvisorAdminRoute, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorContainer, type AdvisorHyperdriveCall, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorMaskProcedure, type AdvisorMutatorWrite, type AdvisorNondeterministicCall, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorR2sqlCall, type AdvisorRelation, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShape, type AdvisorShardTraffic, type AdvisorSqlInterpolation, type AdvisorTable, type AdvisorTableSample, type AdvisorTableScan, type AdvisorWorkflow, type AdvisorWorkflowCall, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type Category, type Facing, type Finding, type Level, type Lint, type LintContext, type LintSource, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, adminRouteWithoutGuard, authApiCallWithoutHeaders, circularFk, constraintValidator, containerOversizedInstance, containerPublicInternet, duplicateIndex, emptyIndex, filterWithoutIndex, fromServerSchema, hardcodedSecret, hotShard, hyperdriveOutsideAction, indexReferencesUnknownField, indexUtilization, loadAnalyticsRuntimeMetrics, maskUncoveredPiiColumn, mutatorFullRowReplace, nondeterministicQueryMutation, policyReferencesUnknownTable, publicArgumentUsesAny, publicMutationWithoutRatelimit, r2sqlOutsideAction, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, sqlInjectionRisk, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, workflowUnknownTarget, workflowUnused };
+export { AE_METRIC_EVENTS, ALL_LINTS, type AdvisorAdminRoute, type AdvisorArgumentValidator, type AdvisorAuthApiCall, type AdvisorContainer, type AdvisorHyperdriveCall, type AdvisorIndex, type AdvisorIndexHit, type AdvisorInsertWrite, type AdvisorMaskProcedure, type AdvisorMutatorWrite, type AdvisorNondeterministicCall, type AdvisorProcedureProtection, type AdvisorQueryRead, type AdvisorR2sqlCall, type AdvisorRelation, type AdvisorRlsProcedure, type AdvisorSchema, type AdvisorSecretLiteral, type AdvisorShape, type AdvisorShardTraffic, type AdvisorSqlInterpolation, type AdvisorTable, type AdvisorTableSample, type AdvisorTableScan, type AdvisorWorkflow, type AdvisorWorkflowCall, type AnalyticsMetricsOptions, type AnalyticsMetricsSource, type AnalyticsRuntimeMetrics, type Category, type Facing, type Finding, type Level, type Lint, type LintContext, type LintSource, RUNTIME_LINTS, RunAdvisorOptions, STATIC_LINTS, adminRouteWithoutGuard, authApiCallWithoutHeaders, circularFk, constraintValidator, containerOversizedInstance, containerPublicInternet, duplicateIndex, emptyIndex, filterWithoutIndex, fromServerSchema, hardcodedSecret, hotShard, hyperdriveOutsideAction, indexReferencesUnknownField, indexUtilization, loadAnalyticsRuntimeMetrics, maskUncoveredPiiColumn, mutatorFullRowReplace, nondeterministicQueryMutation, policyReferencesUnknownTable, publicArgumentUsesAny, publicMutationWithoutRatelimit, r2sqlOutsideAction, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, sqlInjectionRisk, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };

package/dist/index.mjs

@@ -30,6 +30,7 @@ import unboundedStringArgument from './packem_shared/unboundedStringArgument-DTh
 import unindexedForeignKey from './packem_shared/unindexedForeignKey-BgJbKyqK.mjs';
 import unindexedRelationTarget from './packem_shared/unindexedRelationTarget-D6eyj6Xx.mjs';
 import userCreatingMutationWithoutCaptcha from './packem_shared/userCreatingMutationWithoutCaptcha-CH31YsUZ.mjs';
+import workflowDuplicateStepName from './packem_shared/workflowDuplicateStepName-ioBxPBCy.mjs';
 import workflowUnknownTarget from './packem_shared/workflowUnknownTarget-Cdd7WhKQ.mjs';
 import workflowUnused from './packem_shared/workflowUnused-D0jHxdz9.mjs';
 export { AE_METRIC_EVENTS, loadAnalyticsRuntimeMetrics } from './packem_shared/AE_METRIC_EVENTS-DexctYv6.mjs';
@@ -40,6 +41,7 @@ const STATIC_LINTS = [
   relationReferencesUnknownTable,
   relationReferencesUnknownField,
   workflowUnknownTarget,
+  workflowDuplicateStepName,
   shapeUnknownTable,
   emptyIndex,
   circularFk,
@@ -82,4 +84,4 @@ const runAdvisor = (context, options = {}) => {
   return findings;
 };
 
-export { ALL_LINTS, RUNTIME_LINTS, STATIC_LINTS, adminRouteWithoutGuard, authApiCallWithoutHeaders, circularFk, constraintValidator, containerOversizedInstance, containerPublicInternet, duplicateIndex, emptyIndex, filterWithoutIndex, hardcodedSecret, hotShard, hyperdriveOutsideAction, indexReferencesUnknownField, indexUtilization, maskUncoveredPiiColumn, mutatorFullRowReplace, nondeterministicQueryMutation, policyReferencesUnknownTable, publicArgumentUsesAny, publicMutationWithoutRatelimit, r2sqlOutsideAction, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, sqlInjectionRisk, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, workflowUnknownTarget, workflowUnused };
+export { ALL_LINTS, RUNTIME_LINTS, STATIC_LINTS, adminRouteWithoutGuard, authApiCallWithoutHeaders, circularFk, constraintValidator, containerOversizedInstance, containerPublicInternet, duplicateIndex, emptyIndex, filterWithoutIndex, hardcodedSecret, hotShard, hyperdriveOutsideAction, indexReferencesUnknownField, indexUtilization, maskUncoveredPiiColumn, mutatorFullRowReplace, nondeterministicQueryMutation, policyReferencesUnknownTable, publicArgumentUsesAny, publicMutationWithoutRatelimit, r2sqlOutsideAction, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, sqlInjectionRisk, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };

package/dist/packem_shared/workflowDuplicateStepName-ioBxPBCy.mjs

@@ -0,0 +1,48 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const workflowDuplicateStepName = {
+  categories: ["SCHEMA"],
+  description: "Two durable steps in this workflow share a name. Cloudflare memoizes a step by its name, so on replay the second call returns the first step's cached result instead of running its body — silently skipping the work without an error.",
+  facing: "INTERNAL",
+  level: "ERROR",
+  // eslint-disable-next-line no-secrets/no-secrets -- the lint's rule id, not a credential
+  name: "workflow_duplicate_step_name",
+  remediation: "Give every `step.do` / `step.sleep` / `step.sleepUntil` / `step.waitForEvent` call in the workflow a unique name. If a step legitimately repeats (e.g. a loop), make the name distinct per iteration by interpolating the item id into the step name.",
+  run: (context) => {
+    if (context.workflows === void 0) {
+      return [];
+    }
+    const findings = [];
+    for (const workflow of context.workflows) {
+      const { steps } = workflow;
+      if (steps === void 0 || steps.length === 0) {
+        continue;
+      }
+      const firstLineByName = /* @__PURE__ */ new Map();
+      const reported = /* @__PURE__ */ new Set();
+      for (const step of steps) {
+        const firstLine = firstLineByName.get(step.name);
+        if (firstLine === void 0) {
+          firstLineByName.set(step.name, step.line);
+          continue;
+        }
+        if (reported.has(step.name)) {
+          continue;
+        }
+        reported.add(step.name);
+        findings.push(
+          emit(workflowDuplicateStepName, {
+            cacheKey: `workflow_duplicate_step_name:${workflow.exportName}:${step.name}`,
+            detail: `Workflow "${workflow.exportName}" reuses the durable step name "${step.name}" (first at line ${String(firstLine)}, again at line ${String(step.line)}). The second call returns the first's cached result instead of running.`,
+            metadata: { firstLine, line: step.line, stepName: step.name, workflow: workflow.exportName }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Duplicate durable step name in workflow"
+};
+
+export { workflowDuplicateStepName as default };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/advisor",
-  "version": "1.0.0-alpha.8",
+  "version": "1.0.0-alpha.9",
   "description": "Schema & query lints (splinter-style advisors) for Lunora, feeding the Studio Advisors view",
   "keywords": [
     "advisor",