@lunora/advisor 1.0.0-alpha.15 → 1.0.0-alpha.17

package/dist/packem_shared/paymentWebhookWideTolerance-D9QQJMJq.mjs

@@ -0,0 +1,35 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const WIDE_TOLERANCE_THRESHOLD_SECONDS = 60 * 60;
+const paymentWebhookWideTolerance = {
+  categories: ["SECURITY"],
+  description: "A payment webhook adapter configured with an implausibly wide `webhookToleranceSeconds` (over an hour). The timestamp tolerance is the webhook replay window; widening it far past the 300s default keeps captured signed events replayable long after capture, defeating the replay check.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "payment_webhook_wide_tolerance",
+  remediation: "Keep `webhookToleranceSeconds` at or near the 300s default — just enough for clock skew. If a wide window was set to work around retries or backfills, handle those with idempotency on the event id instead, not by loosening the replay-window guard.",
+  run: (context) => {
+    if (context.paymentWebhooks === void 0) {
+      return [];
+    }
+    const isWide = (row) => row.toleranceSeconds !== void 0 && row.toleranceSeconds >= WIDE_TOLERANCE_THRESHOLD_SECONDS;
+    return context.paymentWebhooks.filter((row) => isWide(row)).map((row) => {
+      const location = `\`${row.exportName}\` (${row.file}:${row.line.toString()})`;
+      return emit(paymentWebhookWideTolerance, {
+        cacheKey: `payment_webhook_wide_tolerance:${row.file}:${row.line.toString()}`,
+        detail: `\`${row.callee}\` in ${location} sets \`webhookToleranceSeconds\` to ${(row.toleranceSeconds ?? 0).toString()}s (default 300s). That replay window keeps captured signed events valid long after capture.`,
+        metadata: {
+          callee: row.callee,
+          exportName: row.exportName,
+          file: row.file,
+          line: row.line,
+          toleranceSeconds: row.toleranceSeconds
+        }
+      });
+    });
+  },
+  source: "static",
+  title: "Payment webhook replay-tolerance window is implausibly wide"
+};
+
+export { paymentWebhookWideTolerance as default };

package/dist/packem_shared/plaintextSecretInWranglerVariables-NKO4YkKf.mjs

@@ -0,0 +1,35 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const plaintextSecretInWranglerVariables = {
+  categories: ["SECURITY"],
+  description: "A plaintext secret is committed to `wrangler.jsonc`'s `vars` block. `vars` are cleartext — baked into the deployed Worker and checked into source control — so the secret leaks via the repo and the bundle, and rotating it needs a config edit plus a redeploy.",
+  facing: "INTERNAL",
+  level: "ERROR",
+  name: "plaintext_secret_in_wrangler_vars",
+  remediation: "Move the value out of `vars`: bind it through a Secrets Store (`ctx.secrets.get(<NAME>)`) or set it with `wrangler secret put <NAME>` and read it from `env.<NAME>`. Delete the `vars` entry and rotate the exposed value — assume it is already compromised. Public/publishable keys (name them `*_PUBLIC` / `*_PUBLISHABLE`) are exempt.",
+  run: (context) => {
+    if (context.wranglerVariables === void 0) {
+      return [];
+    }
+    const findings = [];
+    const occurrenceCount = /* @__PURE__ */ new Map();
+    for (const wranglerVariable of context.wranglerVariables) {
+      const baseKey = `${wranglerVariable.file}:${wranglerVariable.key}`;
+      const occurrence = (occurrenceCount.get(baseKey) ?? 0) + 1;
+      occurrenceCount.set(baseKey, occurrence);
+      const occurrenceSuffix = occurrence > 1 ? `:${occurrence.toString()}` : "";
+      findings.push(
+        emit(plaintextSecretInWranglerVariables, {
+          cacheKey: `plaintext_secret_in_wrangler_vars:${baseKey}${occurrenceSuffix}`,
+          detail: `The \`vars\` entry \`${wranglerVariable.key}\` in ${wranglerVariable.file} holds a plaintext ${wranglerVariable.kind.replaceAll("_", " ")} (${wranglerVariable.preview}). \`vars\` ship in cleartext to the deployed Worker and are committed to source control — move it to a Secrets Store binding or \`wrangler secret put\` and rotate the exposed value.`,
+          metadata: { file: wranglerVariable.file, key: wranglerVariable.key, kind: wranglerVariable.kind, preview: wranglerVariable.preview }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Plaintext secret in wrangler vars"
+};
+
+export { plaintextSecretInWranglerVariables as default };

package/dist/packem_shared/privilegedDispatchUnvalidatedPayload-5Forjckt.mjs

@@ -0,0 +1,37 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const privilegedDispatchUnvalidatedPayload = {
+  categories: ["SECURITY"],
+  description: "A `defineQueue`/`defineWorkflow` handler forwards its untrusted payload (queue body / workflow params) straight into a `ctx.run` dispatch whose target is RLS-gated. The handler runs under the system identity with RLS disabled, so the target's row policy — the only thing guarding it — is bypassed, letting a caller act as any user / write across tenants.",
+  facing: "EXTERNAL",
+  level: "ERROR",
+  name: "privileged_dispatch_unvalidated_payload",
+  remediation: "Don't forward an unchecked queue body / workflow param into an RLS-gated function. Re-derive the ownership/identity keys from server-trusted state (or an argument you validate against it) before dispatching, or route the work through a function that re-checks the caller's identity rather than relying on the row policy the privileged handler skips.",
+  run: (context) => {
+    if (context.privilegedDispatches === void 0) {
+      return [];
+    }
+    const rlsProcedures = context.rlsProcedures ?? [];
+    const targetUsesRls = (targetFile, targetExport) => rlsProcedures.some((procedure) => procedure.usesRls && procedure.file === targetFile && procedure.exportName === targetExport);
+    return context.privilegedDispatches.filter((dispatch) => targetUsesRls(dispatch.targetFile, dispatch.targetExport)).map((dispatch) => {
+      const handlerKind = dispatch.dispatchKind === "queue" ? "queue" : "workflow";
+      const payloadSource = dispatch.dispatchKind === "queue" ? "queue message body" : "workflow params";
+      return emit(privilegedDispatchUnvalidatedPayload, {
+        cacheKey: `privileged_dispatch_unvalidated_payload:${dispatch.file}:${dispatch.line.toString()}`,
+        detail: `The ${handlerKind} handler \`${dispatch.handlerExport}\` (${dispatch.file}:${dispatch.line.toString()}) forwards its untrusted ${payloadSource} straight into \`${dispatch.targetFile}.${dispatch.targetExport}\`, which is guarded by \`.use(rls(...))\`. The handler runs under the system identity with RLS disabled, so the target's row policy is bypassed — any ownership/identity field the payload controls lets a caller act as another user or write across tenants. Re-derive the identity keys from server-trusted state before dispatching, or route through a function that re-checks the caller.`,
+        metadata: {
+          dispatchKind: dispatch.dispatchKind,
+          file: dispatch.file,
+          handlerExport: dispatch.handlerExport,
+          line: dispatch.line,
+          targetExport: dispatch.targetExport,
+          targetFile: dispatch.targetFile
+        }
+      });
+    });
+  },
+  source: "static",
+  title: "Privileged handler forwards untrusted payload into an RLS-gated function"
+};
+
+export { privilegedDispatchUnvalidatedPayload as default };

package/dist/packem_shared/privilegedFanoutFromPublicProcedure-D3dL01B8.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const privilegedFanoutFromPublicProcedure = {
+  categories: ["SECURITY"],
+  description: "A public procedure fans work out to a privileged dispatch surface (`ctx.scheduler.runAfter`/`runAt`, a `ctx.queues.<name>` send, or `ctx.workflows.<name>.create`) with no rate-limit guard. Each dispatch runs later under the system identity and bills the account, so an anonymous caller can amplify cost and flood the async surface in a loop.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "privileged_fanout_from_public_procedure",
+  remediation: "Gate the public entry point with a rate limit (`.use(rateLimit(...))` or a `protectPublic({ rateLimit })` bundle), or make the fan-out procedure internal and trigger it only from an authenticated, guarded path. Never expose an unbounded scheduler/queue/workflow dispatch to anonymous callers.",
+  run: (context) => {
+    if (context.procedureProtections === void 0) {
+      return [];
+    }
+    return context.procedureProtections.filter((procedure) => procedure.fanOut && procedure.visibility === "public" && !procedure.usesRateLimit).map(
+      (procedure) => emit(privilegedFanoutFromPublicProcedure, {
+        cacheKey: `privileged_fanout_from_public_procedure:${procedure.file}:${procedure.exportName}`,
+        detail: `\`${procedure.exportName}\` (${procedure.file}) is public and fans work out to a privileged dispatch surface (scheduler/queue/workflow) with no rate limit — an anonymous caller can drive that billable, system-identity dispatch in a loop. Add a rate-limit guard, or make it internal and trigger it from an authenticated path.`,
+        metadata: { exportName: procedure.exportName, file: procedure.file, kind: procedure.kind }
+      })
+    );
+  },
+  source: "static",
+  title: "Public procedure fans out to a privileged dispatch surface"
+};
+
+export { privilegedFanoutFromPublicProcedure as default };

package/dist/packem_shared/publicTableRlsOptoutConfusion-DJ5GFSRD.mjs

@@ -0,0 +1,38 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+import { o as ownershipOrPiiColumns } from './helpers-BhGmRI2n.mjs';
+
+const publicTableRlsOptoutConfusion = {
+  categories: ["SECURITY"],
+  description: '`.public()` opts a table OUT of the schema\'s `.rls("required")` enforcement — it does not mean the table holds public data. A `.public()` table whose columns look ownership- or PII-shaped (`userId`, `email`, `ssn`, …) is exempt from the row-security guard, not "safe to expose".',
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "public_table_rls_optout_confusion",
+  remediation: 'Double-check this table actually needs the RLS opt-out. If it does not, remove `.public()` so `.rls("required")` covers it like every other table. If it genuinely must stay open (a shared lookup table, for instance), rename or comment it so the exemption is intentional rather than a name-implies-safety mistake, and make sure no procedure trusts `.public()` as an authorization boundary.',
+  run: (context) => {
+    if (context.schema.rlsMode !== "required") {
+      return [];
+    }
+    const findings = [];
+    for (const table of context.schema.tables) {
+      if (!table.isPublic) {
+        continue;
+      }
+      const flaggedColumns = ownershipOrPiiColumns(table);
+      if (flaggedColumns.length === 0) {
+        continue;
+      }
+      findings.push(
+        emit(publicTableRlsOptoutConfusion, {
+          cacheKey: `public_table_rls_optout_confusion:${table.name}`,
+          detail: `Table "${table.name}" is \`.public()\` (opted OUT of the schema's \`.rls("required")\` enforcement) but carries ownership/PII-shaped column(s): ${flaggedColumns.join(", ")}. \`.public()\` means "exempt from RLS", not "safe to expose" — confirm this table really needs the opt-out.`,
+          metadata: { columns: flaggedColumns, table: table.name }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Public table opts out of RLS but carries sensitive columns"
+};
+
+export { publicTableRlsOptoutConfusion as default };

package/dist/packem_shared/ratelimitDefaultMemoryStore-BISChG5C.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const ratelimitDefaultMemoryStore = {
+  categories: ["SECURITY"],
+  description: "`new RateLimiter({...})` has no `store`, so it falls back to a per-instance in-memory store. On Workers each request may hit a different isolate, so the counter never sums across them — the limit silently under-counts and is effectively a no-op under load, giving false protection against brute-force and cost abuse.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "ratelimit_default_memory_store",
+  remediation: "Pass a shared, durable `store` to `new RateLimiter({...})` (a Durable-Object- or KV-backed store) so every Worker isolate reads and writes the same bucket. The default in-memory store is per-isolate and does not enforce a global limit.",
+  run: (context) => {
+    if (context.configCalls === void 0) {
+      return [];
+    }
+    return context.configCalls.filter((call) => call.callee === "RateLimiter" && call.analyzable && !call.presentKeys.includes("store")).map(
+      (call) => emit(ratelimitDefaultMemoryStore, {
+        cacheKey: `ratelimit_default_memory_store:${call.file}:${call.line.toString()}`,
+        detail: `\`new RateLimiter({...})\` in ${call.file}:${call.line.toString()} has no \`store\` — it uses the per-instance in-memory store, which never sums across Worker isolates, so the limit silently under-counts under load. Pass a Durable-Object- or KV-backed \`store\` so the limit is enforced globally.`,
+        metadata: { callee: call.callee, file: call.file, line: call.line }
+      })
+    );
+  },
+  source: "static",
+  title: "RateLimiter using the default in-memory store"
+};
+
+export { ratelimitDefaultMemoryStore as default };

package/dist/packem_shared/ratelimitKeySpoofableOrGlobal-DqlHYQQ3.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const ratelimitKeySpoofableOrGlobal = {
+  categories: ["SECURITY"],
+  description: "A `rateLimit`/`dbRateLimit` middleware call's `key` selector is derived from the handler's `args` with no server-side scoping, so an attacker can rotate the key on every request (e.g. by resubmitting a different email/id) and never share a bucket with themselves — the limit never actually limits them.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "ratelimit_key_spoofable_or_global",
+  remediation: 'Derive the rate-limit `key` from a server-trusted value — `ctx.auth.userId` for authenticated callers, `ctx.ip` for anonymous ones (e.g. `key: (ctx) => ctx.auth.userId ?? ctx.ip ?? "anon"`) — instead of an `args` field the caller controls.',
+  run: (context) => {
+    if (context.ratelimitKeySelectors === void 0) {
+      return [];
+    }
+    return context.ratelimitKeySelectors.map(
+      (selector) => emit(ratelimitKeySpoofableOrGlobal, {
+        cacheKey: `ratelimit_key_spoofable_or_global:${selector.file}:${selector.line.toString()}`,
+        detail: `\`${selector.callee}(…, "${selector.limitName}", { key })\` in \`${selector.exportName}\` (${selector.file}:${selector.line.toString()}) derives its \`key\` from \`args\` with no server-side scoping — an attacker can rotate the key per request and bypass the limit. Derive \`key\` from \`ctx.auth.userId\` / \`ctx.ip\` instead.`,
+        metadata: { callee: selector.callee, exportName: selector.exportName, file: selector.file, limitName: selector.limitName, line: selector.line }
+      })
+    );
+  },
+  source: "static",
+  title: "Rate-limit key derived from spoofable user input"
+};
+
+export { ratelimitKeySpoofableOrGlobal as default };

package/dist/packem_shared/ratelimitMiddlewareFailOpen-CJgDCaUw.mjs

@@ -0,0 +1,33 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const SENSITIVE_TOKENS = ["signin", "signup", "login", "register", "reset", "password", "otp", "verify", "payment", "checkout"];
+const normalize = (value) => value.toLowerCase().replaceAll(/[^a-z0-9]+/gu, "");
+const matchesSensitiveToken = (value) => {
+  const normalized = normalize(value);
+  return SENSITIVE_TOKENS.some((token) => normalized.includes(token));
+};
+const guardsSensitiveFlow = (row) => matchesSensitiveToken(row.exportName) || matchesSensitiveToken(row.limitName);
+const ratelimitMiddlewareFailOpen = {
+  categories: ["SECURITY"],
+  description: "A rate-limit or Turnstile middleware guarding a sensitive auth/payment procedure is configured `failOpen: true`, so a limiter store outage or a failed Turnstile siteverify silently admits every request — turning a transient failure into an unthrottled brute-force / abuse window.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "ratelimit_middleware_fail_open",
+  remediation: "Drop `failOpen: true` (the default is fail-closed) on the rate-limit / Turnstile guard for auth and payment flows, or move the escape hatch to a non-sensitive procedure. Prefer rejecting traffic with a 503 over admitting unlimited unauthenticated attempts when the limiter or siteverify is unavailable.",
+  run: (context) => {
+    if (context.failOpenGuards === void 0) {
+      return [];
+    }
+    return context.failOpenGuards.filter((row) => row.failOpen && guardsSensitiveFlow(row)).map(
+      (row) => emit(ratelimitMiddlewareFailOpen, {
+        cacheKey: `ratelimit_middleware_fail_open:${row.file}:${row.line.toString()}`,
+        detail: `\`${row.callee}(...)\` in \`${row.exportName}\` (${row.file}:${row.line.toString()}) sets \`failOpen: true\` while guarding a sensitive flow — a limiter/siteverify outage then admits every request instead of rejecting it.`,
+        metadata: { callee: row.callee, exportName: row.exportName, file: row.file, limitName: row.limitName, line: row.line }
+      })
+    );
+  },
+  source: "static",
+  title: "Fail-open rate-limit / CAPTCHA guard on a sensitive procedure"
+};
+
+export { ratelimitMiddlewareFailOpen as default };

package/dist/packem_shared/{relationReferencesUnknownField-YznyXt_7.mjs → relationReferencesUnknownField-D4hckqi8.mjs}

@@ -1,5 +1,5 @@
 import { e as emit } from './finding-Dm_zvzS1.mjs';
-import { t as tableColumnSet } from './helpers-DNCkMWZQ.mjs';
+import { t as tableColumnSet } from './helpers-BhGmRI2n.mjs';
 
 const missingColumns = (byName, columnsOf, holder, relation) => {
   const target = byName.get(relation.table);

package/dist/packem_shared/softDeleteIncludeDeletedFromArgs-BLqDKrkM.mjs

@@ -0,0 +1,38 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const softDeleteIncludeDeletedFromArgs = {
+  categories: ["SECURITY"],
+  description: "A `.public()` read passes `includeDeleted` (hardcoded `true` or derived from `args`) on a `.softDelete()` table, resurfacing soft-deleted rows to callers that should never see them.",
+  facing: "EXTERNAL",
+  level: "INFO",
+  name: "soft_delete_include_deleted_from_args",
+  remediation: "Drop `includeDeleted` from the public read so soft-deleted rows stay hidden, or move the trash/restore view behind an internal (or RLS/role-gated) procedure. Never wire `includeDeleted` from `args` on a public read — an attacker can set it to see rows the app treats as deleted.",
+  run: (context) => {
+    if (context.softDeleteReads === void 0) {
+      return [];
+    }
+    const softDeleteTables = new Set(context.schema.tables.filter((table) => table.softDelete !== void 0).map((table) => table.name));
+    if (softDeleteTables.size === 0) {
+      return [];
+    }
+    return context.softDeleteReads.filter((row) => row.visibility === "public" && row.table !== "" && softDeleteTables.has(row.table) && (row.hardcodedTrue || row.fromArgs)).map((row) => {
+      const location = `\`${row.exportName}\` (${row.file}:${row.line.toString()})`;
+      const detail = row.fromArgs ? `The public read in ${location} wires \`includeDeleted\` from request \`args\` on soft-delete table \`${row.table}\`, letting any caller resurface soft-deleted rows the app treats as gone.` : `The public read in ${location} hardcodes \`includeDeleted: true\` on soft-delete table \`${row.table}\`, returning soft-deleted rows to every caller.`;
+      return emit(softDeleteIncludeDeletedFromArgs, {
+        cacheKey: `soft_delete_include_deleted_from_args:${row.file}:${row.line.toString()}:${row.table}`,
+        detail,
+        metadata: {
+          exportName: row.exportName,
+          file: row.file,
+          line: row.line,
+          source: row.fromArgs ? "args" : "literal",
+          table: row.table
+        }
+      });
+    });
+  },
+  source: "static",
+  title: "Soft-deleted rows resurfaced via includeDeleted on a public read"
+};
+
+export { softDeleteIncludeDeletedFromArgs as default };

package/dist/packem_shared/storageGenerateUploadUrlNoContentTypePin-Da4L9Ge8.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const storageGenerateUploadUrlNoContentTypePin = {
+  categories: ["SECURITY"],
+  description: "A `ctx.storage.generateUploadUrl(key, …)` call has no `contentType` pin, so the signed PUT URL it mints authorizes any content-type/size the client chooses — `upload()`'s `allowedContentTypes`/`maxSize` guards never run for a client-side PUT against this URL.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "storage_generate_upload_url_no_content_type_pin",
+  remediation: "Pass `contentType` to `ctx.storage.generateUploadUrl(key, { contentType })` so the signature only authorizes a PUT with that exact content-type. If the client's upload size/type also needs bounding, prefer `upload()`/`store()` (with `allowedContentTypes`/`maxSize`) over a client-side signed PUT.",
+  run: (context) => {
+    if (context.storageUploads === void 0) {
+      return [];
+    }
+    return context.storageUploads.filter((row) => row.method === "generateUploadUrl" && row.analyzable && !row.presentKeys.includes("contentType")).map(
+      (row) => emit(storageGenerateUploadUrlNoContentTypePin, {
+        cacheKey: `storage_generate_upload_url_no_content_type_pin:${row.file}:${row.line.toString()}`,
+        detail: `\`ctx.storage.generateUploadUrl\` in \`${row.exportName}\` (${row.file}:${row.line.toString()}) has no \`contentType\` pin — the signed PUT it mints accepts any type/size, minted client-side and bypassing \`upload()\`'s guards.`,
+        metadata: { exportName: row.exportName, file: row.file, line: row.line }
+      })
+    );
+  },
+  source: "static",
+  title: "generateUploadUrl signed PUT with no content-type pin"
+};
+
+export { storageGenerateUploadUrlNoContentTypePin as default };

package/dist/packem_shared/storageKeyFromUserArgs-B7k0iiGb.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const storageKeyFromUserArgs = {
+  categories: ["SECURITY"],
+  description: "A `ctx.storage.*` call uses an R2 object key taken directly from the handler's `args` with no server-side scoping. The bucket methods key by the caller-supplied string, so any caller can read, overwrite, or delete another user's object — object-level IDOR.",
+  facing: "EXTERNAL",
+  level: "ERROR",
+  name: "storage_key_from_user_args",
+  remediation: `Prefix the object key with a server-trusted identity (e.g. \`\${ctx.auth.userId}/…\`) or resolve the object through a record the caller is known to own. Never pass request input straight through as an R2 object key.`,
+  run: (context) => {
+    if (context.storageKeyAccesses === void 0) {
+      return [];
+    }
+    return context.storageKeyAccesses.map(
+      (access) => emit(storageKeyFromUserArgs, {
+        cacheKey: `storage_key_from_user_args:${access.file}:${access.line.toString()}`,
+        detail: `\`ctx.storage.*.${access.method}\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) uses an object key derived from \`args\` with no server-side scoping — any caller can read/overwrite/delete another user's object (IDOR). Prefix the key with a server-trusted identity (e.g. \`\${ctx.auth.userId}/…\`) or resolve the object through an owned record.`,
+        metadata: { exportName: access.exportName, file: access.file, line: access.line, method: access.method }
+      })
+    );
+  },
+  source: "static",
+  title: "R2 object key taken directly from user args (IDOR)"
+};
+
+export { storageKeyFromUserArgs as default };

package/dist/packem_shared/storagePresignedUrlForPrivateContent-yGmb8uqz.mjs

@@ -0,0 +1,47 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const SIGNER_METHODS = /* @__PURE__ */ new Set(["getPresignedUrl", "getSignedUrl"]);
+const NEAR_MAX_EXPIRES_THRESHOLD_SECONDS = 6 * 24 * 60 * 60;
+const isNativePresignedCall = (row) => row.method === "getPresignedUrl";
+const isNearExpiryCeiling = (row) => SIGNER_METHODS.has(row.method) && row.expiresInSeconds !== void 0 && row.expiresInSeconds >= NEAR_MAX_EXPIRES_THRESHOLD_SECONDS;
+const storagePresignedUrlForPrivateContent = {
+  categories: ["SECURITY"],
+  description: "`ctx.storage.getPresignedUrl(...)` mints a native S3 SigV4 URL that resolves directly against R2, bypassing the Worker's auth/RLS/rate-limit entirely — the wrong choice for private or policy-gated content. Either signer minting an `expiresInSeconds` near the shared 7-day ceiling also hands out a long-lived bearer credential.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "storage_presigned_url_for_private_content",
+  remediation: "For private/per-user/policy-gated content, use `getSignedUrl` (resolves back through the Worker, so your auth/RLS/rate-limit gates still run) instead of `getPresignedUrl`. Reserve `getPresignedUrl` for genuinely public or bulk content. On either signer, keep `expiresInSeconds` as short as the use case allows — well under the 7-day ceiling — rather than minting a near-maximum-lifetime URL.",
+  run: (context) => {
+    if (context.storageUploads === void 0) {
+      return [];
+    }
+    return context.storageUploads.filter((row) => isNativePresignedCall(row) || isNearExpiryCeiling(row)).map((row) => {
+      const native = isNativePresignedCall(row);
+      const nearCeiling = isNearExpiryCeiling(row);
+      const location = `\`${row.exportName}\` (${row.file}:${row.line.toString()})`;
+      let detail;
+      if (native && nearCeiling) {
+        detail = `\`ctx.storage.getPresignedUrl\` in ${location} mints a native S3 SigV4 URL — bypasses the Worker's auth/RLS/rate-limit entirely — with an \`expiresInSeconds\` of ${(row.expiresInSeconds ?? 0).toString()}s, near the 7-day signing ceiling.`;
+      } else if (native) {
+        detail = `\`ctx.storage.getPresignedUrl\` in ${location} mints a native S3 SigV4 URL that resolves directly against R2, bypassing the Worker's auth/RLS/rate-limit entirely. Use \`getSignedUrl\` for app-gated access to private content.`;
+      } else {
+        detail = `\`ctx.storage.${row.method}\` in ${location} requests an \`expiresInSeconds\` of ${(row.expiresInSeconds ?? 0).toString()}s, near the 7-day signing ceiling — a leaked link stays valid for almost a week.`;
+      }
+      return emit(storagePresignedUrlForPrivateContent, {
+        cacheKey: `storage_presigned_url_for_private_content:${row.file}:${row.line.toString()}`,
+        detail,
+        metadata: {
+          expiresInSeconds: row.expiresInSeconds,
+          exportName: row.exportName,
+          file: row.file,
+          line: row.line,
+          method: row.method
+        }
+      });
+    });
+  },
+  source: "static",
+  title: "Native presigned URL or near-max-TTL signed URL for private content"
+};
+
+export { storagePresignedUrlForPrivateContent as default };

package/dist/packem_shared/storageUploadWithoutContentTypeAllowlist-BV-gF1lT.mjs

@@ -0,0 +1,27 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const UPLOAD_METHODS = /* @__PURE__ */ new Set(["store", "upload"]);
+const storageUploadWithoutContentTypeAllowlist = {
+  categories: ["SECURITY"],
+  description: "A `ctx.storage.upload`/`store` call has no `allowedContentTypes` allowlist, so an uploader can store any content-type — including `text/html` or `image/svg+xml` — which, served back from `publicBaseUrl`, is a stored-XSS vector against your own origin.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "storage_upload_without_content_type_allowlist",
+  remediation: 'Pass `allowedContentTypes: ["image/png", "image/jpeg", …]` to `ctx.storage.upload`/`store` so an uploaded object\'s `contentType` must match an approved list. Reject anything HTML/SVG/script-executable unless the app genuinely needs to serve it.',
+  run: (context) => {
+    if (context.storageUploads === void 0) {
+      return [];
+    }
+    return context.storageUploads.filter((row) => UPLOAD_METHODS.has(row.method) && row.analyzable && !row.presentKeys.includes("allowedContentTypes")).map(
+      (row) => emit(storageUploadWithoutContentTypeAllowlist, {
+        cacheKey: `storage_upload_without_content_type_allowlist:${row.file}:${row.line.toString()}`,
+        detail: `\`ctx.storage.${row.method}\` in \`${row.exportName}\` (${row.file}:${row.line.toString()}) has no \`allowedContentTypes\` allowlist — any content-type is accepted, including \`text/html\`/\`image/svg+xml\`, a stored-XSS risk if the object is served from \`publicBaseUrl\`.`,
+        metadata: { exportName: row.exportName, file: row.file, line: row.line, method: row.method }
+      })
+    );
+  },
+  source: "static",
+  title: "Storage upload with no content-type allowlist"
+};
+
+export { storageUploadWithoutContentTypeAllowlist as default };

package/dist/packem_shared/storageUploadWithoutMaxSize-DpxO59wU.mjs

@@ -0,0 +1,27 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const UPLOAD_METHODS = /* @__PURE__ */ new Set(["store", "upload"]);
+const storageUploadWithoutMaxSize = {
+  categories: ["SECURITY"],
+  description: "A `ctx.storage.upload`/`store` call has no `maxSize` cap, so a caller can push an unbounded body straight into R2 through the Worker — unbounded storage/billing exhaustion, and for a streamed body, unbounded worker time.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "storage_upload_without_max_size",
+  remediation: "Pass a `maxSize` (bytes) to `ctx.storage.upload`/`store` sized to the largest legitimate object the app accepts. `ArrayBuffer`/`Blob` bodies are rejected up front when oversized; a `ReadableStream` body is aborted mid-transfer once the limit is exceeded.",
+  run: (context) => {
+    if (context.storageUploads === void 0) {
+      return [];
+    }
+    return context.storageUploads.filter((row) => UPLOAD_METHODS.has(row.method) && row.analyzable && !row.presentKeys.includes("maxSize")).map(
+      (row) => emit(storageUploadWithoutMaxSize, {
+        cacheKey: `storage_upload_without_max_size:${row.file}:${row.line.toString()}`,
+        detail: `\`ctx.storage.${row.method}\` in \`${row.exportName}\` (${row.file}:${row.line.toString()}) has no \`maxSize\` cap — a caller can push an unbounded body into R2, exhausting storage/billing.`,
+        metadata: { exportName: row.exportName, file: row.file, line: row.line, method: row.method }
+      })
+    );
+  },
+  source: "static",
+  title: "Storage upload with no size cap"
+};
+
+export { storageUploadWithoutMaxSize as default };

package/dist/packem_shared/vectorsNamespaceFromUserInput-CCSl5SYq.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const vectorsNamespaceFromUserInput = {
+  categories: ["SECURITY"],
+  description: "A `ctx.vectors.query`/`upsert`/`upsertMany` call uses a `namespace` derived from the handler's `args` with no server-side scoping. A Vectorize namespace partitions one index into isolated sub-collections, so an unscoped namespace lets any caller read or poison another tenant's vectors.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "vectors_namespace_from_user_input",
+  remediation: `Derive the \`namespace\` from a server-trusted identity (e.g. \`\${ctx.auth.orgId}\`), never from \`args\`.`,
+  run: (context) => {
+    if (context.vectorNamespaceAccesses === void 0) {
+      return [];
+    }
+    return context.vectorNamespaceAccesses.map(
+      (access) => emit(vectorsNamespaceFromUserInput, {
+        cacheKey: `vectors_namespace_from_user_input:${access.file}:${access.line.toString()}`,
+        detail: `\`ctx.vectors.${access.method}\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) uses a Vectorize namespace derived from \`args\` with no server-side scoping — any caller can read or poison another tenant's vectors. Derive the namespace from a server-trusted identity (e.g. \`\${ctx.auth.orgId}\`), never from \`args\`.`,
+        metadata: { exportName: access.exportName, file: access.file, line: access.line, method: access.method }
+      })
+    );
+  },
+  source: "static",
+  title: "Vectorize namespace derived from unscoped user input"
+};
+
+export { vectorsNamespaceFromUserInput as default };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/advisor",
-  "version": "1.0.0-alpha.15",
+  "version": "1.0.0-alpha.17",
   "description": "Schema & query lints (splinter-style advisors) for Lunora, feeding the Studio Advisors view",
   "keywords": [
     "advisor",
@@ -46,7 +46,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/server": "1.0.0-alpha.13"
+    "@lunora/errors": "1.0.0-alpha.1",
+    "@lunora/server": "1.0.0-alpha.15"
   },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"

package/dist/packem_shared/helpers-DNCkMWZQ.mjs

@@ -1,4 +0,0 @@
-const SYSTEM_FIELDS = /* @__PURE__ */ new Set(["_creationTime", "_id"]);
-const tableColumnSet = (table) => /* @__PURE__ */ new Set([...SYSTEM_FIELDS, ...table.fields]);
-
-export { tableColumnSet as t };