@lunora/advisor 0.0.0 → 1.0.0-alpha.10

package/dist/index.mjs

@@ -0,0 +1,89 @@
+import constraintValidator from './packem_shared/constraintValidator-Dr9Py3FD.mjs';
+import hotShard from './packem_shared/hotShard-Ir5D0B6J.mjs';
+import indexUtilization from './packem_shared/indexUtilization-B5DMQ3bI.mjs';
+import adminRouteWithoutGuard from './packem_shared/adminRouteWithoutGuard-UUGBkAjU.mjs';
+import authApiCallWithoutHeaders from './packem_shared/authApiCallWithoutHeaders-BeJhCZaf.mjs';
+import circularFk from './packem_shared/circularFk-B2freHrP.mjs';
+import containerOversizedInstance from './packem_shared/containerOversizedInstance-5U1VKPRM.mjs';
+import containerPublicInternet from './packem_shared/containerPublicInternet-CuNerJE5.mjs';
+import duplicateIndex from './packem_shared/duplicateIndex-BOublMSt.mjs';
+import emptyIndex from './packem_shared/emptyIndex-BX8EuEY7.mjs';
+import filterWithoutIndex from './packem_shared/filterWithoutIndex-BYVeJaSs.mjs';
+import hardcodedSecret from './packem_shared/hardcodedSecret-W2pz1UZB.mjs';
+import hyperdriveOutsideAction from './packem_shared/hyperdriveOutsideAction-BgZqX7Xg.mjs';
+import indexReferencesUnknownField from './packem_shared/indexReferencesUnknownField-DH0_dbUY.mjs';
+import maskUncoveredPiiColumn from './packem_shared/maskUncoveredPiiColumn-DjGIPG6M.mjs';
+import mutatorFullRowReplace from './packem_shared/mutatorFullRowReplace-BJnNDaIV.mjs';
+import nondeterministicQueryMutation from './packem_shared/nondeterministicQueryMutation-GXES1fLp.mjs';
+import policyReferencesUnknownTable from './packem_shared/policyReferencesUnknownTable-DtaIEovd.mjs';
+import publicArgumentUsesAny from './packem_shared/publicArgumentUsesAny-C71b2NCf.mjs';
+import publicMutationWithoutRatelimit from './packem_shared/publicMutationWithoutRatelimit-xBpJ6GWK.mjs';
+import r2sqlOutsideAction from './packem_shared/r2sqlOutsideAction-CtqxvMuV.mjs';
+import relationReferencesUnknownField from './packem_shared/relationReferencesUnknownField-YznyXt_7.mjs';
+import relationReferencesUnknownTable from './packem_shared/relationReferencesUnknownTable-DrorpKYe.mjs';
+import rlsUncoveredTable from './packem_shared/rlsUncoveredTable-CxEfZ5eZ.mjs';
+import shapeTargetsGlobalTable from './packem_shared/shapeTargetsGlobalTable-DHrf4Koi.mjs';
+import shapeUnknownTable from './packem_shared/shapeUnknownTable-C8aDWFoe.mjs';
+import sqlInjectionRisk from './packem_shared/sqlInjectionRisk-zwytYGLt.mjs';
+import tableWithoutInsert from './packem_shared/tableWithoutInsert-CbbaYIP4.mjs';
+import unboundedStringArgument from './packem_shared/unboundedStringArgument-DThg2-wt.mjs';
+import unindexedForeignKey from './packem_shared/unindexedForeignKey-BgJbKyqK.mjs';
+import unindexedRelationTarget from './packem_shared/unindexedRelationTarget-D6eyj6Xx.mjs';
+import userCreatingMutationWithoutCaptcha from './packem_shared/userCreatingMutationWithoutCaptcha-CH31YsUZ.mjs';
+import workflowDuplicateStepName from './packem_shared/workflowDuplicateStepName-ioBxPBCy.mjs';
+import workflowUnknownTarget from './packem_shared/workflowUnknownTarget-Cdd7WhKQ.mjs';
+import workflowUnused from './packem_shared/workflowUnused-D0jHxdz9.mjs';
+export { AE_METRIC_EVENTS, loadAnalyticsRuntimeMetrics } from './packem_shared/AE_METRIC_EVENTS-DexctYv6.mjs';
+export { default as externalSourceOnGlobal } from './packem_shared/externalSourceOnGlobal-Bg-NfCX9.mjs';
+export { default as externalSourceUnscoped } from './packem_shared/externalSourceUnscoped-5vT-Bup3.mjs';
+export { fromServerSchema } from './packem_shared/fromServerSchema-WVRvXPy8.mjs';
+
+const STATIC_LINTS = [
+  indexReferencesUnknownField,
+  relationReferencesUnknownTable,
+  relationReferencesUnknownField,
+  workflowUnknownTarget,
+  workflowDuplicateStepName,
+  shapeUnknownTable,
+  emptyIndex,
+  circularFk,
+  unindexedForeignKey,
+  unindexedRelationTarget,
+  duplicateIndex,
+  tableWithoutInsert,
+  workflowUnused,
+  filterWithoutIndex,
+  shapeTargetsGlobalTable,
+  mutatorFullRowReplace,
+  nondeterministicQueryMutation,
+  hyperdriveOutsideAction,
+  r2sqlOutsideAction,
+  authApiCallWithoutHeaders,
+  policyReferencesUnknownTable,
+  rlsUncoveredTable,
+  maskUncoveredPiiColumn,
+  containerOversizedInstance,
+  containerPublicInternet,
+  publicMutationWithoutRatelimit,
+  userCreatingMutationWithoutCaptcha,
+  publicArgumentUsesAny,
+  unboundedStringArgument,
+  hardcodedSecret,
+  sqlInjectionRisk,
+  adminRouteWithoutGuard
+];
+const RUNTIME_LINTS = [hotShard, indexUtilization, constraintValidator];
+const ALL_LINTS = [...STATIC_LINTS, ...RUNTIME_LINTS];
+const runAdvisor = (context, options = {}) => {
+  const lints = options.lints ?? ALL_LINTS;
+  const findings = [];
+  for (const lint of lints) {
+    if (options.source !== void 0 && lint.source !== options.source) {
+      continue;
+    }
+    findings.push(...lint.run(context));
+  }
+  return findings;
+};
+
+export { ALL_LINTS, RUNTIME_LINTS, STATIC_LINTS, adminRouteWithoutGuard, authApiCallWithoutHeaders, circularFk, constraintValidator, containerOversizedInstance, containerPublicInternet, duplicateIndex, emptyIndex, filterWithoutIndex, hardcodedSecret, hotShard, hyperdriveOutsideAction, indexReferencesUnknownField, indexUtilization, maskUncoveredPiiColumn, mutatorFullRowReplace, nondeterministicQueryMutation, policyReferencesUnknownTable, publicArgumentUsesAny, publicMutationWithoutRatelimit, r2sqlOutsideAction, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, sqlInjectionRisk, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };

package/dist/packem_shared/AE_METRIC_EVENTS-DexctYv6.mjs

@@ -0,0 +1,85 @@
+const DATASET_NAME_PATTERN = /^[\w.-]+$/u;
+const AE_METRIC_EVENTS = {
+  /** `lunora.index.hit` — one row per `(table, index)` use. `blob2`=table, `blob3`=index. */
+  indexHit: { event: "lunora.index.hit", index: "blob3", table: "blob2" },
+  /** `lunora.shard.request` — one row per shard dispatch. `blob2`=shardKey, `blob3`=group. */
+  shardRequest: { event: "lunora.shard.request", group: "blob3", shardKey: "blob2" },
+  /** `lunora.table.scan` — one row per full-scan. `blob2`=table. */
+  tableScan: { event: "lunora.table.scan", table: "blob2" }
+};
+const toCount = (value) => {
+  const numeric = typeof value === "number" ? value : Number(value);
+  return Number.isFinite(numeric) ? numeric : 0;
+};
+const toText = (value) => {
+  if (typeof value === "string") {
+    return value;
+  }
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return String(value);
+  }
+  return "";
+};
+const assertDataset = (dataset) => {
+  if (!DATASET_NAME_PATTERN.test(dataset)) {
+    throw new Error(`@lunora/advisor: invalid Analytics Engine dataset name "${dataset}" — expected a bare table identifier.`);
+  }
+};
+const sqlString = (value) => `'${value.replaceAll("\\", "\\\\").replaceAll("'", "''")}'`;
+const queryOrEmpty = async (source, sql) => {
+  try {
+    const result = await source.query(sql);
+    return result.rows;
+  } catch {
+    return [];
+  }
+};
+const loadShardTraffic = async (source, options) => {
+  const { event, group, shardKey } = AE_METRIC_EVENTS.shardRequest;
+  const groupFilter = options.group === void 0 ? "" : ` AND ${group} = ${sqlString(options.group)}`;
+  const sql = `SELECT ${shardKey} AS shardKey, ${group} AS shardGroup, sum(_sample_interval) AS requests FROM ${options.dataset} WHERE blob1 = ${sqlString(event)}${groupFilter} GROUP BY shardKey, shardGroup`;
+  const rows = await queryOrEmpty(source, sql);
+  return rows.map((row) => {
+    const shardGroup = toText(row.shardGroup);
+    return {
+      ...shardGroup === "" ? {} : { group: shardGroup },
+      requests: toCount(row.requests),
+      shardKey: toText(row.shardKey)
+    };
+  });
+};
+const loadTableScans = async (source, options) => {
+  const { event, table } = AE_METRIC_EVENTS.tableScan;
+  const sql = `SELECT ${table} AS scanTable, sum(_sample_interval) AS scans FROM ${options.dataset} WHERE blob1 = ${sqlString(event)} GROUP BY scanTable`;
+  const rows = await queryOrEmpty(source, sql);
+  return rows.map((row) => {
+    return { scans: toCount(row.scans), table: toText(row.scanTable) };
+  });
+};
+const loadIndexHits = async (source, options) => {
+  const { event, index, table } = AE_METRIC_EVENTS.indexHit;
+  const sql = `SELECT ${table} AS hitTable, ${index} AS hitIndex, sum(_sample_interval) AS reads FROM ${options.dataset} WHERE blob1 = ${sqlString(event)} GROUP BY hitTable, hitIndex`;
+  const rows = await queryOrEmpty(source, sql);
+  const hits = rows.map((row) => {
+    return { index: toText(row.hitIndex), reads: toCount(row.reads), table: toText(row.hitTable) };
+  });
+  if (options.declaredIndexes === void 0) {
+    return hits;
+  }
+  const seen = new Set(hits.map((hit) => `${hit.table}\0${hit.index}`));
+  const zeros = options.declaredIndexes.filter((declared) => !seen.has(`${declared.table}\0${declared.index}`)).map((declared) => {
+    return { index: declared.index, reads: 0, table: declared.table };
+  });
+  return [...hits, ...zeros];
+};
+const loadAnalyticsRuntimeMetrics = async (source, options) => {
+  assertDataset(options.dataset);
+  const [shardTraffic, tableScans, indexHits] = await Promise.all([
+    loadShardTraffic(source, options),
+    loadTableScans(source, options),
+    loadIndexHits(source, options)
+  ]);
+  return { indexHits, shardTraffic, tableScans };
+};
+
+export { AE_METRIC_EVENTS, loadAnalyticsRuntimeMetrics };

package/dist/packem_shared/adminRouteWithoutGuard-UUGBkAjU.mjs

@@ -0,0 +1,33 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const adminRouteWithoutGuard = {
+  categories: ["SECURITY"],
+  description: "An `httpRoute` on an admin/privileged path has no visible auth/admin guard. REST routes aren't covered by RLS, so an unguarded `/admin/*` route is callable by anyone who reaches the URL.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "admin_route_without_guard",
+  remediation: "Assert an authenticated, authorized caller at the top of the handler — check `ctx.auth` / `getSession(...)`, or a `requireAdmin`-style guard — and reject (401/403) before doing privileged work. For machine callers, verify a secret with a timing-safe compare.",
+  run: (context) => {
+    if (context.adminRoutes === void 0) {
+      return [];
+    }
+    const findings = [];
+    for (const route of context.adminRoutes) {
+      if (route.usesGuard) {
+        continue;
+      }
+      findings.push(
+        emit(adminRouteWithoutGuard, {
+          cacheKey: `admin_route_without_guard:${route.file}:${route.method}:${route.path}`,
+          detail: `Route \`${route.method} ${route.path}\` (\`${route.exportName}\` in ${route.file}) is on an admin/privileged path but its handler shows no auth/admin guard. Assert an authorized caller before doing privileged work.`,
+          metadata: { exportName: route.exportName, file: route.file, method: route.method, path: route.path }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Admin route without an auth guard"
+};
+
+export { adminRouteWithoutGuard as default };

package/dist/packem_shared/authApiCallWithoutHeaders-BeJhCZaf.mjs

@@ -0,0 +1,38 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const authApiCallWithoutHeaders = {
+  categories: ["SECURITY"],
+  description: "A `ctx.authApi.<method>(...)` call omits `headers` — better-auth skips session authorization and runs the call with full server-to-server privileges, regardless of the caller's identity.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "auth_api_call_without_headers",
+  remediation: "Pass the inbound `headers` from the incoming request into every `ctx.authApi.*` call: `ctx.authApi.<method>({ body, headers: request.headers })`. See the `withAuthPlugins` middleware doc for details.",
+  run: (context) => {
+    if (context.authApiCalls === void 0) {
+      return [];
+    }
+    const findings = [];
+    const occurrenceCount = /* @__PURE__ */ new Map();
+    for (const call of context.authApiCalls) {
+      if (call.hasHeaders) {
+        continue;
+      }
+      const baseKey = `${call.file}:${call.line.toString()}:${call.method}`;
+      const occurrence = (occurrenceCount.get(baseKey) ?? 0) + 1;
+      occurrenceCount.set(baseKey, occurrence);
+      const occurrenceSuffix = occurrence > 1 ? `:${occurrence.toString()}` : "";
+      findings.push(
+        emit(authApiCallWithoutHeaders, {
+          cacheKey: `auth_api_call_without_headers:${baseKey}${occurrenceSuffix}`,
+          detail: `\`ctx.authApi.${call.method || "<method>"}(…)\` in ${call.exportName} (${call.file}:${call.line.toString()}) is called without \`headers\` — better-auth skips session authorization, so this runs with full privileges. Pass the inbound \`headers\`.`,
+          metadata: { exportName: call.exportName, file: call.file, line: call.line, method: call.method }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Privileged ctx.authApi call missing headers"
+};
+
+export { authApiCallWithoutHeaders as default };

package/dist/packem_shared/circularFk-B2freHrP.mjs

@@ -0,0 +1,84 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const circularFk = {
+  categories: ["SCHEMA"],
+  description: "A chain of foreign-key relations forms a cycle (e.g. A → B → C → A). Circular FK dependencies can cause unexpected behavior during DELETE operations — a CASCADE chain may loop indefinitely, and even a RESTRICT cycle prevents deletion of any row in the loop without temporarily disabling constraints.",
+  facing: "INTERNAL",
+  level: "WARN",
+  name: "circular_fk",
+  remediation: "Remove or break the cycle by dropping at least one FK relation from the loop. Consider replacing the circular dependency with a nullable FK and explicit application logic, or restructure the schema using a junction table.",
+  run: (context) => {
+    const findings = [];
+    const edges = /* @__PURE__ */ new Map();
+    for (const table of context.schema.tables) {
+      for (const relation of table.relations) {
+        if (relation.kind !== "one") {
+          continue;
+        }
+        let targets = edges.get(table.name);
+        if (targets === void 0) {
+          targets = /* @__PURE__ */ new Set();
+          edges.set(table.name, targets);
+        }
+        targets.add(relation.table);
+      }
+    }
+    const onStack = /* @__PURE__ */ new Set();
+    const reported = /* @__PURE__ */ new Set();
+    const reportBackEdge = (neighbor, path) => {
+      const cycleStart = path.indexOf(neighbor);
+      if (cycleStart === -1) {
+        return;
+      }
+      const cycle = path.slice(cycleStart);
+      if (cycle.length < 2) {
+        return;
+      }
+      let minIndex = 0;
+      for (let index = 1; index < cycle.length; index += 1) {
+        if (cycle[index] < cycle[minIndex]) {
+          minIndex = index;
+        }
+      }
+      const canonical = [...cycle.slice(minIndex), ...cycle.slice(0, minIndex)];
+      const key = canonical.join("→");
+      if (reported.has(key)) {
+        return;
+      }
+      reported.add(key);
+      const displayPath = [...canonical, canonical[0]].join(" → ");
+      findings.push(
+        emit(circularFk, {
+          cacheKey: `circular_fk:${key}`,
+          detail: `Circular foreign-key dependency detected: ${displayPath}. This cycle can cause unexpected behavior during DELETE operations.`,
+          metadata: {
+            cycle: canonical,
+            path: displayPath,
+            tables: canonical
+          }
+        })
+      );
+    };
+    const dfs = (node, path) => {
+      onStack.add(node);
+      path.push(node);
+      for (const neighbor of edges.get(node) ?? []) {
+        if (onStack.has(neighbor)) {
+          reportBackEdge(neighbor, path);
+        } else {
+          dfs(neighbor, path);
+        }
+      }
+      path.pop();
+      onStack.delete(node);
+    };
+    for (const table of context.schema.tables) {
+      dfs(table.name, []);
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Circular foreign-key dependency"
+};
+
+export { circularFk as default };

package/dist/packem_shared/constraintValidator-Dr9Py3FD.mjs

@@ -0,0 +1,186 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const MAX_EXAMPLE_IDS = 5;
+const rowId = (row) => typeof row["_id"] === "string" ? row["_id"] : "?";
+const truncatedSuffix = (capped, cap, phrase) => capped ? ` (sample capped at ${cap.toString()} rows — ${phrase})` : "";
+const formatExamples = (ids, total) => {
+  const examples = ids.slice(0, MAX_EXAMPLE_IDS);
+  const more = total - examples.length;
+  const list = examples.map((id) => `"${id}"`).join(", ");
+  return more > 0 ? `${list} (+${more.toString()} more)` : list;
+};
+const checkFkRelation = (lint, sample, relation, targetSample) => {
+  if (relation.kind !== "one") {
+    return void 0;
+  }
+  const fkColumn = relation.field;
+  const danglingIds = [];
+  for (const row of sample.rows) {
+    const fkValue = row[fkColumn];
+    if (fkValue === null || fkValue === void 0) {
+      continue;
+    }
+    const fkString = String(fkValue);
+    if (!targetSample.existingIds.has(fkString)) {
+      danglingIds.push(rowId(row));
+    }
+  }
+  if (danglingIds.length === 0) {
+    return void 0;
+  }
+  const isTruncated = sample.truncated || targetSample.truncated;
+  const cap = Math.min(sample.cap, targetSample.cap);
+  const detail = `Table "${sample.table}": ${danglingIds.length.toString()} sampled row(s) have a dangling FK value in column "${fkColumn}" — the referenced "${relation.table}" row does not exist. Row ids: ${formatExamples(danglingIds, danglingIds.length)}${truncatedSuffix(isTruncated, cap, "more rows may exist beyond the window")}.`;
+  return emit(lint, {
+    cacheKey: `constraint_validator:fk:${sample.table}:${fkColumn}`,
+    detail,
+    metadata: {
+      cap,
+      column: fkColumn,
+      count: danglingIds.length,
+      examples: danglingIds.slice(0, MAX_EXAMPLE_IDS),
+      kind: "fk",
+      referencesTable: relation.table,
+      table: sample.table,
+      truncated: isTruncated
+    }
+  });
+};
+const checkNullField = (lint, sample, field, isRequired) => {
+  if (!isRequired) {
+    return void 0;
+  }
+  const nullIds = [];
+  for (const row of sample.rows) {
+    const value = row[field];
+    if (value === null || value === void 0) {
+      nullIds.push(rowId(row));
+    }
+  }
+  if (nullIds.length === 0) {
+    return void 0;
+  }
+  const detail = `Table "${sample.table}": ${nullIds.length.toString()} sampled row(s) have a null/missing value in column "${field}", which is declared as non-optional. Row ids: ${formatExamples(nullIds, nullIds.length)}${truncatedSuffix(sample.truncated, sample.cap, "more rows may exist beyond the window")}.`;
+  return emit(lint, {
+    cacheKey: `constraint_validator:null:${sample.table}:${field}`,
+    detail,
+    metadata: {
+      cap: sample.cap,
+      column: field,
+      count: nullIds.length,
+      examples: nullIds.slice(0, MAX_EXAMPLE_IDS),
+      kind: "null",
+      table: sample.table,
+      truncated: sample.truncated
+    }
+  });
+};
+const compositeKey = (row, fields) => {
+  const parts = [];
+  for (const field of fields) {
+    const value = row[field];
+    if (value === null || value === void 0) {
+      return void 0;
+    }
+    parts.push(JSON.stringify(value));
+  }
+  return parts.join("|");
+};
+const recordDuplicate = (id, existingId, duplicateIds) => {
+  if (!duplicateIds.includes(existingId)) {
+    duplicateIds.push(existingId);
+  }
+  duplicateIds.push(id);
+};
+const checkUniqueIndex = (lint, sample, index) => {
+  if (index.kind !== "index" || index.unique !== true) {
+    return void 0;
+  }
+  const seen = /* @__PURE__ */ new Map();
+  const duplicateIds = [];
+  for (const row of sample.rows) {
+    const id = rowId(row);
+    const key = compositeKey(row, index.fields);
+    if (key === void 0) {
+      continue;
+    }
+    const existingId = seen.get(key);
+    if (existingId === void 0) {
+      seen.set(key, id);
+    } else {
+      recordDuplicate(id, existingId, duplicateIds);
+    }
+  }
+  if (duplicateIds.length === 0) {
+    return void 0;
+  }
+  const detail = `Table "${sample.table}": ${duplicateIds.length.toString()} sampled row(s) share duplicate values on unique index "${index.name}" (${index.fields.join(", ")}). Row ids: ${formatExamples(duplicateIds, duplicateIds.length)}${truncatedSuffix(sample.truncated, sample.cap, "duplicates beyond the window may exist")}.`;
+  return emit(lint, {
+    cacheKey: `constraint_validator:unique:${sample.table}:${index.name}`,
+    detail,
+    metadata: {
+      cap: sample.cap,
+      count: duplicateIds.length,
+      examples: duplicateIds.slice(0, MAX_EXAMPLE_IDS),
+      fields: index.fields,
+      index: index.name,
+      kind: "unique",
+      table: sample.table,
+      truncated: sample.truncated
+    }
+  });
+};
+const checkTable = (lint, sample, sampleByTable, tableByName) => {
+  const schemaTable = tableByName.get(sample.table);
+  if (!schemaTable) {
+    return [];
+  }
+  const findings = [];
+  for (const relation of schemaTable.relations) {
+    const targetSample = sampleByTable.get(relation.table);
+    if (!targetSample) {
+      continue;
+    }
+    const f = checkFkRelation(lint, sample, relation, targetSample);
+    if (f) {
+      findings.push(f);
+    }
+  }
+  for (const field of schemaTable.fields) {
+    const isRequired = !schemaTable.optionalFields?.has(field);
+    const f = checkNullField(lint, sample, field, isRequired);
+    if (f) {
+      findings.push(f);
+    }
+  }
+  for (const index of schemaTable.indexes) {
+    const f = checkUniqueIndex(lint, sample, index);
+    if (f) {
+      findings.push(f);
+    }
+  }
+  return findings;
+};
+const constraintValidator = {
+  categories: ["SCHEMA"],
+  description: "Sampled rows violate one or more declared constraints: a foreign-key column references a non-existent row, a non-optional column contains null, or a unique-indexed column has duplicate values. These violations indicate data inserted before a constraint was enforced (e.g. a schema migration, a raw import, or a bug in a past data-migration transform).",
+  facing: "INTERNAL",
+  level: "WARN",
+  name: "constraint_validator",
+  remediation: "Inspect the listed rows and correct or remove the violating values. Run a data migration to backfill nulls, dedup unique violations, or re-link dangling FK references. For FK violations, confirm the target table rows exist before fixing the referencing rows.",
+  run: (context) => {
+    if (!context.tableSamples || context.tableSamples.length === 0) {
+      return [];
+    }
+    const sampleByTable = /* @__PURE__ */ new Map();
+    for (const sample of context.tableSamples) {
+      sampleByTable.set(sample.table, sample);
+    }
+    const tableByName = new Map(context.schema.tables.map((table) => [table.name, table]));
+    return context.tableSamples.flatMap((sample) => checkTable(constraintValidator, sample, sampleByTable, tableByName));
+  },
+  source: "runtime",
+  title: "Constraint violation"
+};
+
+export { constraintValidator as default };

package/dist/packem_shared/containerOversizedInstance-5U1VKPRM.mjs

@@ -0,0 +1,36 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const LARGE_NAMED = /* @__PURE__ */ new Set(["standard-3", "standard-4"]);
+const VCPU_THRESHOLD = 2;
+const MEMORY_MIB_THRESHOLD = 4096;
+const isOversized = (instanceType) => typeof instanceType === "string" ? LARGE_NAMED.has(instanceType) : (instanceType.vcpu ?? 0) > VCPU_THRESHOLD || (instanceType.memoryMib ?? 0) > MEMORY_MIB_THRESHOLD;
+const containerOversizedInstance = {
+  categories: ["PERFORMANCE"],
+  description: "A container is declared on a large instance type, whose provisioned memory and disk are billed for the lifetime of every running instance.",
+  facing: "INTERNAL",
+  level: "INFO",
+  name: "container_oversized_instance",
+  remediation: "Confirm the workload needs this size; a smaller instanceType (lite/basic/standard-1) costs less while idle-but-running.",
+  run: (context) => {
+    const findings = [];
+    for (const container of context.containers ?? []) {
+      const { instanceType } = container;
+      if (instanceType === void 0 || !isOversized(instanceType)) {
+        continue;
+      }
+      const size = typeof instanceType === "string" ? instanceType : JSON.stringify(instanceType);
+      findings.push(
+        emit(containerOversizedInstance, {
+          cacheKey: `container_oversized_instance:${container.exportName}`,
+          detail: `Container "${container.exportName}" uses a large instance type (${size}); its memory + disk are billed while any instance runs.`,
+          metadata: { container: container.exportName, instanceType }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Oversized container instance"
+};
+
+export { containerOversizedInstance as default };

package/dist/packem_shared/containerPublicInternet-CuNerJE5.mjs

@@ -0,0 +1,30 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const containerPublicInternet = {
+  categories: ["SECURITY"],
+  description: "A container leaves outbound internet access at the default (enabled), which is billed per GB of egress and widens the attack surface.",
+  facing: "INTERNAL",
+  level: "INFO",
+  name: "container_public_internet",
+  remediation: "Set `enableInternet: false` on the container if it doesn't call external services, or `true` to opt in deliberately.",
+  run: (context) => {
+    const findings = [];
+    for (const container of context.containers ?? []) {
+      if (container.enableInternet !== void 0) {
+        continue;
+      }
+      findings.push(
+        emit(containerPublicInternet, {
+          cacheKey: `container_public_internet:${container.exportName}`,
+          detail: `Container "${container.exportName}" doesn't set enableInternet, so outbound internet is on by default (egress is billed).`,
+          metadata: { container: container.exportName }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Container egress enabled by default"
+};
+
+export { containerPublicInternet as default };

package/dist/packem_shared/duplicateIndex-BOublMSt.mjs

@@ -0,0 +1,57 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const isLeadingPrefix = (a, b) => {
+  if (a.length > b.length) {
+    return false;
+  }
+  return a.every((field, position) => field === b[position]);
+};
+const duplicateIndex = {
+  categories: ["PERFORMANCE"],
+  description: "A secondary index is redundant because another index already covers every lookup it serves (its columns are a leading prefix of the other's). The redundant index costs storage and is maintained on every write for no read benefit.",
+  facing: "INTERNAL",
+  level: "INFO",
+  name: "duplicate_index",
+  remediation: "Drop the redundant index; the covering index already serves its lookups.",
+  run: (context) => {
+    const findings = [];
+    for (const table of context.schema.tables) {
+      const secondary = table.indexes.filter((index) => index.kind === "index");
+      for (const candidate of secondary) {
+        if (candidate.unique === true) {
+          continue;
+        }
+        const cover = secondary.find((other) => {
+          if (other === candidate) {
+            return false;
+          }
+          if (!isLeadingPrefix(candidate.fields, other.fields)) {
+            return false;
+          }
+          const sameLength = candidate.fields.length === other.fields.length;
+          return sameLength ? candidate.name > other.name : true;
+        });
+        if (!cover) {
+          continue;
+        }
+        findings.push(
+          emit(duplicateIndex, {
+            cacheKey: `duplicate_index:${table.name}:${candidate.name}`,
+            detail: `Index "${candidate.name}" on table "${table.name}" (${candidate.fields.join(", ")}) is redundant — index "${cover.name}" (${cover.fields.join(", ")}) already covers its lookups.`,
+            metadata: {
+              coveredBy: { fields: cover.fields, name: cover.name },
+              fields: candidate.fields,
+              index: candidate.name,
+              table: table.name
+            }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Duplicate / redundant index"
+};
+
+export { duplicateIndex as default };

package/dist/packem_shared/emptyIndex-BX8EuEY7.mjs

@@ -0,0 +1,32 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const emptyIndex = {
+  categories: ["SCHEMA"],
+  description: "An index declares no columns, so it indexes nothing and can never narrow a read.",
+  facing: "INTERNAL",
+  level: "WARN",
+  name: "empty_index",
+  remediation: "Give the index its columns, or remove it.",
+  run: (context) => {
+    const findings = [];
+    for (const table of context.schema.tables) {
+      for (const index of table.indexes) {
+        if (index.kind !== "index" || index.fields.length > 0) {
+          continue;
+        }
+        findings.push(
+          emit(emptyIndex, {
+            cacheKey: `empty_index:${table.name}:${index.name}`,
+            detail: `Index "${index.name}" on table "${table.name}" declares no columns.`,
+            metadata: { index: index.name, table: table.name }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Empty index"
+};
+
+export { emptyIndex as default };