@lunora/advisor 0.0.0 → 1.0.0-alpha.10

package/dist/packem_shared/externalSourceOnGlobal-Bg-NfCX9.mjs

@@ -0,0 +1,30 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const externalSourceOnGlobal = {
+  categories: ["SCHEMA"],
+  description: "A table is both `.source(...)` and `.global()`. A global table lives in the external/global tier; a sourced table is materialized into a shard DO's SQLite — the two are mutually exclusive.",
+  facing: "INTERNAL",
+  level: "ERROR",
+  name: "external_source_on_global",
+  remediation: 'Drop either `.source(...)` or `.global()`. To ingest an external database into per-tenant DOs, use `.source(...)` with `.shardBy(...)`; to read it in place as a global table, use `.global({ backend: "hyperdrive" })`.',
+  run: (context) => {
+    const findings = [];
+    for (const table of context.schema.tables) {
+      if (table.externalSource === void 0 || table.shardKind !== "global") {
+        continue;
+      }
+      findings.push(
+        emit(externalSourceOnGlobal, {
+          cacheKey: `external_source_on_global:${table.name}`,
+          detail: `Table \`${table.name}\` is both \`.source(...)\` and \`.global()\` — contradictory. A sourced table materializes into a shard DO's SQLite; a global table lives in the external tier.`,
+          metadata: { table: table.name }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Sourced table cannot also be global"
+};
+
+export { externalSourceOnGlobal as default };

package/dist/packem_shared/externalSourceUnscoped-5vT-Bup3.mjs

@@ -0,0 +1,44 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const externalSourceUnscoped = {
+  categories: ["SECURITY"],
+  description: "A `.source(...)` table that is also `.shardBy(...)` has no `tenantBy` mapper, so every tenant's Durable Object runs the same unscoped query and replicates the whole multitenant table — a cross-tenant data leak.",
+  facing: "EXTERNAL",
+  level: "ERROR",
+  name: "external_source_unscoped",
+  remediation: "Add `tenantBy: (shardKey) => [shardKey]` (matching the query's bound parameters) so each shard DO pulls only its own tenant's rows. The shard key MUST bind into the source `WHERE`.",
+  run: (context) => {
+    const findings = [];
+    for (const table of context.schema.tables) {
+      if (table.externalSource === void 0 || table.shardKind !== "shardBy") {
+        continue;
+      }
+      if (table.externalSource.unanalyzable) {
+        findings.push(
+          emit(externalSourceUnscoped, {
+            cacheKey: `external_source_unscoped:${table.name}`,
+            detail: `Table \`${table.name}\` is \`.source(...)\` + \`.shardBy(...)\` but its source config is not a static object literal, so \`tenantBy\` can't be verified. Confirm \`tenantBy\` binds the shard key into the query, or inline the config so the linter can check it — an unscoped query leaks every tenant's rows into each DO.`,
+            level: "WARN",
+            metadata: { table: table.name }
+          })
+        );
+        continue;
+      }
+      if (table.externalSource.hasTenantBy) {
+        continue;
+      }
+      findings.push(
+        emit(externalSourceUnscoped, {
+          cacheKey: `external_source_unscoped:${table.name}`,
+          detail: `Table \`${table.name}\` is \`.source(...)\` + \`.shardBy(...)\` but declares no \`tenantBy\` — every tenant DO would pull the whole table. Add a \`tenantBy\` that binds the shard key into the query.`,
+          metadata: { table: table.name }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Sourced + sharded table is not tenant-scoped"
+};
+
+export { externalSourceUnscoped as default };

package/dist/packem_shared/filterWithoutIndex-BYVeJaSs.mjs

@@ -0,0 +1,31 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const filterWithoutIndex = {
+  categories: ["PERFORMANCE"],
+  description: "A query calls `.filter()` without a `.withIndex()` / `.withSearchIndex()`, so it loads every row in the table and filters in memory — a full table scan that gets linearly slower as the table grows.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "filter_without_index",
+  remediation: 'Narrow the read with `.withIndex("name", (q) => q.eq(...))` first, then `.filter()` only for what the index cannot express.',
+  run: (context) => {
+    const findings = [];
+    for (const read of context.queries ?? []) {
+      if (!read.hasFilter || read.hasIndex || read.table === "") {
+        continue;
+      }
+      const location = read.line > 0 ? `${read.file}:${read.line.toString()}` : read.file;
+      findings.push(
+        emit(filterWithoutIndex, {
+          cacheKey: `filter_without_index:${read.file}:${read.line.toString()}:${read.table}`,
+          detail: `Query on "${read.table}" at ${location} calls .filter() without an index — it loads every row of "${read.table}" and filters in memory.`,
+          metadata: { file: read.file, line: read.line, table: read.table }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Filter without index"
+};
+
+export { filterWithoutIndex as default };

package/dist/packem_shared/finding-Dm_zvzS1.mjs

@@ -0,0 +1,16 @@
+const emit = (lint, occurrence) => {
+  return {
+    cacheKey: occurrence.cacheKey,
+    categories: occurrence.categories ?? lint.categories,
+    description: lint.description,
+    detail: occurrence.detail,
+    facing: occurrence.facing ?? lint.facing,
+    level: occurrence.level ?? lint.level,
+    metadata: occurrence.metadata,
+    name: lint.name,
+    remediation: lint.remediation,
+    title: lint.title
+  };
+};
+
+export { emit as e };

package/dist/packem_shared/fk-index-IUK1ukgs.mjs

@@ -0,0 +1,7 @@
+const PRIMARY_KEY = "_id";
+const suggestIndexName = (field) => `by${field.charAt(0).toUpperCase()}${field.slice(1)}`;
+const leadingIndexedColumns = (table) => new Set(
+  table.indexes.filter((index) => index.kind === "index").map((index) => index.fields[0]).filter((field) => field !== void 0)
+);
+
+export { PRIMARY_KEY as P, leadingIndexedColumns as l, suggestIndexName as s };

package/dist/packem_shared/fromServerSchema-WVRvXPy8.mjs

@@ -0,0 +1,56 @@
+const fromServerSchema = (schema) => {
+  return {
+    tables: Object.entries(schema.tables).map(([name, table]) => {
+      const indexes = [
+        ...table.indexes.map((index) => {
+          return { fields: index.fields, kind: "index", name: index.name, unique: index.unique };
+        }),
+        ...table.searchIndexes.map((index) => {
+          return { fields: [index.field, ...index.filterFields ?? []], kind: "search", name: index.name };
+        }),
+        ...table.rankIndexes.map((index) => {
+          return { fields: [...index.sortBy.map((key) => key.field), ...index.partitionBy ?? []], kind: "rank", name: index.name };
+        }),
+        ...table.vectorIndexes.map((index) => {
+          return { fields: [index.field], kind: "vector", name: index.name };
+        })
+      ];
+      const optionalFields = /* @__PURE__ */ new Set();
+      for (const [fieldName, validator] of Object.entries(table.shape)) {
+        if (validator.kind === "optional") {
+          optionalFields.add(fieldName);
+        } else {
+          const column = validator._meta?.column;
+          if (column?.notNull === false) {
+            optionalFields.add(fieldName);
+          }
+        }
+      }
+      return {
+        externallyManaged: table.isExternallyManaged ?? false,
+        externalSource: table.externalSource ? {
+          hasReconcile: table.externalSource.reconcileEveryMs !== void 0,
+          hasTenantBy: table.externalSource.tenantBy !== void 0,
+          mode: table.externalSource.mode
+        } : void 0,
+        fields: Object.keys(table.shape),
+        indexes,
+        name,
+        optionalFields,
+        shardKind: table.shardMode.kind,
+        relations: Object.entries(table.relationMap).map(([accessor, relation]) => {
+          return {
+            field: relation.field,
+            kind: relation.kind,
+            name: accessor,
+            onDelete: relation.onDelete,
+            references: relation.references,
+            table: relation.table
+          };
+        })
+      };
+    })
+  };
+};
+
+export { fromServerSchema };

package/dist/packem_shared/hardcodedSecret-W2pz1UZB.mjs

@@ -0,0 +1,35 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const hardcodedSecret = {
+  categories: ["SECURITY"],
+  description: "A secret-shaped string literal (live API key, access key, private key, or high-entropy token) is hard-coded in the source. Committed secrets leak via clone/fork/history and force a redeploy to rotate.",
+  facing: "INTERNAL",
+  level: "ERROR",
+  name: "hardcoded_secret",
+  remediation: 'Move the secret out of source: set it locally in `.dev.vars` (`lunora env set <NAME> "<value>"`) and in production with `wrangler secret put <NAME>`, then read it at runtime from `env.<NAME>`. Rotate the exposed value — assume it is already compromised.',
+  run: (context) => {
+    if (context.secretLiterals === void 0) {
+      return [];
+    }
+    const findings = [];
+    const occurrenceCount = /* @__PURE__ */ new Map();
+    for (const secret of context.secretLiterals) {
+      const baseKey = `${secret.file}:${secret.line.toString()}:${secret.kind}`;
+      const occurrence = (occurrenceCount.get(baseKey) ?? 0) + 1;
+      occurrenceCount.set(baseKey, occurrence);
+      const occurrenceSuffix = occurrence > 1 ? `:${occurrence.toString()}` : "";
+      findings.push(
+        emit(hardcodedSecret, {
+          cacheKey: `hardcoded_secret:${baseKey}${occurrenceSuffix}`,
+          detail: `A ${secret.kind.replaceAll("_", " ")} (${secret.preview}) is hard-coded at ${secret.file}:${secret.line.toString()}. Move it to \`.dev.vars\` / \`wrangler secret put\` and read it from \`env\`. Rotate the exposed value.`,
+          metadata: { file: secret.file, kind: secret.kind, line: secret.line, preview: secret.preview }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Hard-coded secret in source"
+};
+
+export { hardcodedSecret as default };

package/dist/packem_shared/helpers-DNCkMWZQ.mjs

@@ -0,0 +1,4 @@
+const SYSTEM_FIELDS = /* @__PURE__ */ new Set(["_creationTime", "_id"]);
+const tableColumnSet = (table) => /* @__PURE__ */ new Set([...SYSTEM_FIELDS, ...table.fields]);
+
+export { tableColumnSet as t };

package/dist/packem_shared/hotShard-Ir5D0B6J.mjs

@@ -0,0 +1,48 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const HOT_SHARE_THRESHOLD = 0.5;
+const MIN_TOTAL_REQUESTS = 50;
+const hotShard = {
+  categories: ["PERFORMANCE"],
+  description: "One shard is taking a disproportionate share of a sharded function's traffic, so the busy shard becomes a single-DO bottleneck while its siblings sit idle — the hot-key skew sharding is meant to avoid.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "hot_shard",
+  remediation: "Re-shard on a higher-cardinality / more evenly-distributed key, or split the hot entity's state, so request volume spreads across shards instead of concentrating on one.",
+  run: (context) => {
+    const active = (context.shardTraffic ?? []).filter((shard) => shard.requests > 0);
+    const totalRequests = active.reduce((sum, shard) => sum + shard.requests, 0);
+    if (active.length < 2 || totalRequests < MIN_TOTAL_REQUESTS) {
+      return [];
+    }
+    const findings = [];
+    for (const shard of active) {
+      const share = shard.requests / totalRequests;
+      if (share < HOT_SHARE_THRESHOLD) {
+        continue;
+      }
+      const scope = shard.group !== void 0 && shard.group !== "" ? `"${shard.group}" ` : "";
+      const label = shard.shardKey === "" ? "the root shard" : `shard "${shard.shardKey}"`;
+      const percent = Math.round(share * 100);
+      findings.push(
+        emit(hotShard, {
+          cacheKey: `hot_shard:${shard.group ?? ""}:${shard.shardKey}`,
+          detail: `${scope}${label} handled ${shard.requests.toString()} of ${totalRequests.toString()} requests (${percent.toString()}%) across ${active.length.toString()} shards — a hot-key skew. Re-shard on a more evenly-distributed key.`,
+          metadata: {
+            group: shard.group,
+            requests: shard.requests,
+            shardCount: active.length,
+            shardKey: shard.shardKey,
+            share,
+            totalRequests
+          }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "runtime",
+  title: "Hot shard"
+};
+
+export { hotShard as default };

package/dist/packem_shared/hyperdriveOutsideAction-BgZqX7Xg.mjs

@@ -0,0 +1,30 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const hyperdriveOutsideAction = {
+  categories: ["SCHEMA"],
+  description: "A `query`/`mutation` handler accesses Hyperdrive via `ctx.sql`. Hyperdrive hits an external database Lunora does not own: queries are non-deterministic (like `fetch`) and external writes are invisible to live queries. `ctx.sql` is available on `ActionCtx` only and must be confined to `action` handlers.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "hyperdrive_outside_action",
+  remediation: "Move the `ctx.sql` access into an `action(...)` (the only context where it is typed), where external I/O is allowed. If a query/mutation needs the data, have the action read it via `ctx.sql` and write a projection into a `defineSchema` DO/D1 table — that write is tracked by live queries, whereas the external DB is not.",
+  run: (context) => {
+    if (context.hyperdriveCalls === void 0) {
+      return [];
+    }
+    const findings = [];
+    for (const call of context.hyperdriveCalls) {
+      findings.push(
+        emit(hyperdriveOutsideAction, {
+          cacheKey: `hyperdrive_outside_action:${call.file}:${call.line.toString()}:${call.callee}`,
+          detail: `\`${call.callee}(…)\` in ${call.exportName} (${call.file}:${call.line.toString()}) runs inside a ${call.kind} handler — Hyperdrive's \`ctx.sql\` is non-deterministic and non-reactive, so it is available only in actions. Move the external SQL into an \`action\` and project the result into a Lunora table if a query/mutation needs it.`,
+          metadata: { callee: call.callee, exportName: call.exportName, file: call.file, kind: call.kind, line: call.line }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Hyperdrive `ctx.sql` used outside an action"
+};
+
+export { hyperdriveOutsideAction as default };

package/dist/packem_shared/indexReferencesUnknownField-DH0_dbUY.mjs

@@ -0,0 +1,36 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+import { t as tableColumnSet } from './helpers-DNCkMWZQ.mjs';
+
+const indexReferencesUnknownField = {
+  categories: ["SCHEMA"],
+  description: "An index references a column that is not declared on its table. The index can never match, and the typo would otherwise surface only at runtime.",
+  facing: "INTERNAL",
+  level: "ERROR",
+  name: "index_references_unknown_field",
+  remediation: "Fix the column name in the index declaration, or add the column to the table.",
+  run: (context) => {
+    const findings = [];
+    for (const table of context.schema.tables) {
+      const columns = tableColumnSet(table);
+      for (const index of table.indexes) {
+        for (const field of index.fields) {
+          if (columns.has(field)) {
+            continue;
+          }
+          findings.push(
+            emit(indexReferencesUnknownField, {
+              cacheKey: `index_references_unknown_field:${table.name}:${index.name}:${field}`,
+              detail: `Index "${index.name}" on table "${table.name}" references column "${field}", which is not declared on the table.`,
+              metadata: { field, index: index.name, indexKind: index.kind, table: table.name }
+            })
+          );
+        }
+      }
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Index references unknown field"
+};
+
+export { indexReferencesUnknownField as default };

package/dist/packem_shared/indexUtilization-B5DMQ3bI.mjs

@@ -0,0 +1,45 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const HOT_SCAN_THRESHOLD = 25;
+const indexUtilization = {
+  categories: ["PERFORMANCE"],
+  description: "Recorded reads show an index the workload doesn't pay for: either a declared index no read ever used (dead overhead on every write) or a table read hot with no index at all (a repeated full scan that degrades as it grows).",
+  facing: "INTERNAL",
+  level: "INFO",
+  name: "index_utilization",
+  remediation: "Drop a dead index so writes stop maintaining it; add an index covering the hot full-scanned table's read predicate so the read stops scanning every row.",
+  run: (context) => {
+    const findings = [];
+    for (const hit of context.indexHits ?? []) {
+      if (hit.reads > 0) {
+        continue;
+      }
+      findings.push(
+        emit(indexUtilization, {
+          cacheKey: `index_utilization:dead_index:${hit.table}:${hit.index}`,
+          detail: `Index "${hit.index}" on table "${hit.table}" has recorded no reads since its counter was created — it's dead overhead: every write maintains it and nothing reads through it.`,
+          metadata: { index: hit.index, kind: "dead_index", reads: hit.reads, table: hit.table }
+        })
+      );
+    }
+    for (const scan of context.tableScans ?? []) {
+      if (scan.scans < HOT_SCAN_THRESHOLD) {
+        continue;
+      }
+      findings.push(
+        emit(indexUtilization, {
+          cacheKey: `index_utilization:hot_scan:${scan.table}`,
+          detail: `Table "${scan.table}" has been full-scanned ${scan.scans.toString()} times (cumulative) with no index — a repeated full scan that degrades linearly as "${scan.table}" grows. Add an index covering the read predicate.`,
+          facing: "EXTERNAL",
+          level: "WARN",
+          metadata: { kind: "hot_scan", scans: scan.scans, table: scan.table }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "runtime",
+  title: "Index utilization"
+};
+
+export { indexUtilization as default };

package/dist/packem_shared/maskUncoveredPiiColumn-DjGIPG6M.mjs

@@ -0,0 +1,61 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const maskUncoveredPiiColumn = {
+  categories: ["SECURITY"],
+  description: "A public procedure reads a table whose columns are masked by `.use(mask(...))` elsewhere in the app, but this procedure's builder chain does not include `.use(mask(...))`. It returns those columns in the clear while a sibling procedure redacts them.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "mask_uncovered_pii_column",
+  remediation: "Add `.use(mask(policies))` to the procedure's builder chain — e.g. `c.use(mask(myMasks)).query(...)` — so its returned rows redact the same columns as the rest of the app. If this procedure is intentionally privileged (e.g. an admin export), declare it with `internalQuery` / `internalMutation` / `internalAction` instead of the public builder so the intent is explicit.",
+  // eslint-disable-next-line sonarjs/cognitive-complexity -- the procedure/table/column cross-reference reads clearest as one linear pass; splitting it would obscure the flow.
+  run: (context) => {
+    if (context.maskProcedures === void 0) {
+      return [];
+    }
+    const maskedColumnsByTable = /* @__PURE__ */ new Map();
+    for (const procedure of context.maskProcedures) {
+      for (const { column, table } of procedure.maskColumns) {
+        if (table === "" || column === "") {
+          continue;
+        }
+        const columns = maskedColumnsByTable.get(table) ?? /* @__PURE__ */ new Set();
+        columns.add(column);
+        maskedColumnsByTable.set(table, columns);
+      }
+    }
+    if (maskedColumnsByTable.size === 0) {
+      return [];
+    }
+    const findings = [];
+    for (const procedure of context.maskProcedures) {
+      if (procedure.usesMask) {
+        continue;
+      }
+      if (procedure.visibility === "internal") {
+        continue;
+      }
+      const touched = /* @__PURE__ */ new Set();
+      for (const table of procedure.tablesRead) {
+        if (table !== "" && maskedColumnsByTable.has(table)) {
+          touched.add(table);
+        }
+      }
+      for (const table of touched) {
+        const columns = [...maskedColumnsByTable.get(table) ?? /* @__PURE__ */ new Set()].toSorted((a, b) => a.localeCompare(b));
+        const columnList = columns.map((column) => `\`${column}\``).join(", ");
+        findings.push(
+          emit(maskUncoveredPiiColumn, {
+            cacheKey: `mask_uncovered_pii_column:${procedure.file}:${procedure.exportName}:${table}`,
+            detail: `\`${procedure.exportName}\` in ${procedure.file} reads table \`${table}\` without \`.use(mask(...))\` — its column${columns.length === 1 ? "" : "s"} ${columnList} ${columns.length === 1 ? "is" : "are"} masked elsewhere in the app but returned in the clear here.`,
+            metadata: { columns, exportName: procedure.exportName, file: procedure.file, table }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Maskable column returned without mask() middleware"
+};
+
+export { maskUncoveredPiiColumn as default };

package/dist/packem_shared/mutatorFullRowReplace-BJnNDaIV.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const mutatorFullRowReplace = {
+  categories: ["SCHEMA"],
+  description: "A custom mutator's `server` impl writes with `ctx.db.replace(id, document)` — a whole-row overwrite. On a synced table this clobbers a concurrent edit to a different column; `ctx.db.patch(id, { field })` merges at the column level so independent field edits coexist.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "mutator_full_row_replace",
+  remediation: "Prefer `ctx.db.patch(id, { onlyTheChangedField })` so a concurrent edit to another column isn't lost. Keep `replace` only when the mutator genuinely owns the entire row (e.g. a full-form save).",
+  run: (context) => {
+    if (context.mutatorWrites === void 0) {
+      return [];
+    }
+    return context.mutatorWrites.map(
+      (write) => emit(mutatorFullRowReplace, {
+        cacheKey: `mutator_full_row_replace:${write.exportName}:${String(write.line)}`,
+        detail: `Mutator \`${write.exportName}\` (${write.file}:${String(write.line)}) writes with \`ctx.db.replace(...)\`, overwriting the whole row. A concurrent edit to a different column is clobbered — use \`ctx.db.patch(id, { field })\` to merge at the column level.`,
+        metadata: { exportName: write.exportName, file: write.file, line: write.line }
+      })
+    );
+  },
+  source: "static",
+  title: "Mutator overwrites the whole row (clobbers concurrent column edits)"
+};
+
+export { mutatorFullRowReplace as default };

package/dist/packem_shared/nondeterministicQueryMutation-GXES1fLp.mjs

@@ -0,0 +1,35 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const nondeterministicQueryMutation = {
+  categories: ["SCHEMA"],
+  description: "A `query`/`mutation` handler calls a non-deterministic API (`Date.now`, `Math.random`, `crypto.randomUUID`, `crypto.getRandomValues`, or `fetch`). These handlers may be re-run on OCC retry / subscription re-evaluation, so they must be deterministic — time, randomness, and network belong in an `action`.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "nondeterministic_query_mutation",
+  remediation: "Move the non-deterministic call into an `action(...)` (which runs once and may use ambient APIs), then pass the computed value into the mutation as an argument — e.g. compute `Date.now()` in the action and call `ctx.runMutation(api.…, { now })`. Take generated ids/timestamps as args instead of producing them in the handler.",
+  run: (context) => {
+    if (context.nondeterministicCalls === void 0) {
+      return [];
+    }
+    const findings = [];
+    const occurrenceCount = /* @__PURE__ */ new Map();
+    for (const call of context.nondeterministicCalls) {
+      const baseKey = `${call.file}:${call.line.toString()}:${call.callee}`;
+      const occurrence = (occurrenceCount.get(baseKey) ?? 0) + 1;
+      occurrenceCount.set(baseKey, occurrence);
+      const occurrenceSuffix = occurrence > 1 ? `:${occurrence.toString()}` : "";
+      findings.push(
+        emit(nondeterministicQueryMutation, {
+          cacheKey: `nondeterministic_query_mutation:${baseKey}${occurrenceSuffix}`,
+          detail: `\`${call.callee}(…)\` in ${call.exportName} (${call.file}:${call.line.toString()}) runs inside a ${call.kind} handler — query/mutation handlers must be deterministic. Compute it in an \`action\` and pass the value into the mutation as an argument.`,
+          metadata: { callee: call.callee, exportName: call.exportName, file: call.file, kind: call.kind, line: call.line }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Non-deterministic call in query/mutation handler"
+};
+
+export { nondeterministicQueryMutation as default };

package/dist/packem_shared/policyReferencesUnknownTable-DtaIEovd.mjs

@@ -0,0 +1,38 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const policyReferencesUnknownTable = {
+  categories: ["SECURITY"],
+  description: "An RLS policy is bound to a `table` name that does not exist in the schema. The `rls()` middleware never matches it, so the table the policy was meant to protect is left ungated — reads return unrestricted rows and writes are allowed.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "policy_references_unknown_table",
+  remediation: "Fix the policy's `table` to a real table name (check for a typo or a table that was renamed/removed). If the table is gone, delete the dead policy.",
+  run: (context) => {
+    if (context.rlsProcedures === void 0) {
+      return [];
+    }
+    const knownTables = new Set(context.schema.tables.map((table) => table.name));
+    const reported = /* @__PURE__ */ new Set();
+    const findings = [];
+    for (const procedure of context.rlsProcedures) {
+      for (const table of procedure.rlsTables) {
+        if (table === "" || knownTables.has(table) || reported.has(table)) {
+          continue;
+        }
+        reported.add(table);
+        findings.push(
+          emit(policyReferencesUnknownTable, {
+            cacheKey: `policy_references_unknown_table:${table}`,
+            detail: `An RLS policy in \`${procedure.exportName}\` (${procedure.file}) is bound to table \`${table}\`, which is not declared in the schema. The policy never matches, so \`${table}\` — if it exists under another name — is left ungated.`,
+            metadata: { exportName: procedure.exportName, file: procedure.file, table }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "static",
+  title: "RLS policy bound to an unknown table"
+};
+
+export { policyReferencesUnknownTable as default };

package/dist/packem_shared/publicArgumentUsesAny-C71b2NCf.mjs

@@ -0,0 +1,32 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const publicArgumentUsesAny = {
+  categories: ["SECURITY"],
+  description: "A public procedure declares a `v.any()` argument. `v.any()` accepts arbitrary untyped input from an untrusted client — defeating validation and opening injection / oversized-payload abuse.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "public_arg_uses_any",
+  remediation: "Replace `v.any()` with a precise validator — `v.object({...})`, `v.string()`, `v.union(...)`, etc. If the shape is genuinely dynamic, model the known variants with `v.union` rather than accepting anything.",
+  run: (context) => {
+    if (context.argValidators === void 0) {
+      return [];
+    }
+    const findings = [];
+    for (const procedure of context.argValidators) {
+      for (const argument of procedure.anyArgs) {
+        findings.push(
+          emit(publicArgumentUsesAny, {
+            cacheKey: `public_arg_uses_any:${procedure.file}:${procedure.exportName}:${argument}`,
+            detail: `Arg \`${argument}\` of public procedure \`${procedure.exportName}\` (${procedure.file}:${procedure.line.toString()}) is \`v.any()\` — untrusted input with no validation. Give it a precise validator.`,
+            metadata: { argument, exportName: procedure.exportName, file: procedure.file, line: procedure.line }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Public argument uses v.any()"
+};
+
+export { publicArgumentUsesAny as default };

package/dist/packem_shared/publicMutationWithoutRatelimit-xBpJ6GWK.mjs

@@ -0,0 +1,36 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const SENSITIVE_NAME_RE = /contact|forgot|login|magic|otp|register|reset|signin|signup|subscribe|verify/iu;
+const publicMutationWithoutRatelimit = {
+  categories: ["SECURITY"],
+  description: "A public `mutation`/`action` has no `rateLimit` middleware. Publicly-callable writes are flood and brute-force targets — an attacker can exhaust writes, mail quota, or credits, or guess credentials on auth-shaped endpoints.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "public_mutation_without_ratelimit",
+  remediation: 'Attach a rate limit: `.use(rateLimit(limiter, "<bucket>"))` from `@lunora/ratelimit`, or wrap the recommended public-procedure guards with `.use(protectPublic({ rateLimit, captcha }))` from `@lunora/server`. Genuinely-open writes can be acknowledged by adding a permissive limiter.',
+  run: (context) => {
+    if (context.procedureProtections === void 0) {
+      return [];
+    }
+    const findings = [];
+    for (const procedure of context.procedureProtections) {
+      const isPublicWrite = procedure.visibility === "public" && (procedure.kind === "mutation" || procedure.kind === "action");
+      if (!isPublicWrite || procedure.usesRateLimit) {
+        continue;
+      }
+      const sensitive = SENSITIVE_NAME_RE.test(procedure.exportName);
+      findings.push(
+        emit(publicMutationWithoutRatelimit, {
+          cacheKey: `public_mutation_without_ratelimit:${procedure.file}:${procedure.exportName}`,
+          detail: `Public ${procedure.kind} \`${procedure.exportName}\` (${procedure.file}) has no rate limit${sensitive ? " — its name suggests an auth/abuse-sensitive endpoint, so this is high-risk" : ""}. Add \`.use(rateLimit(...))\` or \`.use(protectPublic({ rateLimit }))\`.`,
+          metadata: { exportName: procedure.exportName, file: procedure.file, kind: procedure.kind, sensitive }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Public write without a rate limit"
+};
+
+export { publicMutationWithoutRatelimit as default };