@lunora/advisor 1.0.0-alpha.2 → 1.0.0-alpha.20

package/dist/index.mjs

@@ -1,42 +1,96 @@
 import constraintValidator from './packem_shared/constraintValidator-Dr9Py3FD.mjs';
 import hotShard from './packem_shared/hotShard-Ir5D0B6J.mjs';
 import indexUtilization from './packem_shared/indexUtilization-B5DMQ3bI.mjs';
+import actionFetchSsrf from './packem_shared/actionFetchSsrf-wbmYgzmz.mjs';
 import adminRouteWithoutGuard from './packem_shared/adminRouteWithoutGuard-UUGBkAjU.mjs';
+import aiRawRunEscapeHatch from './packem_shared/aiRawRunEscapeHatch-C29jd32J.mjs';
+import aiToolSideEffectPromptInjection from './packem_shared/aiToolSideEffectPromptInjection-BtD3alqB.mjs';
+import aiUnboundedGenerationPublic from './packem_shared/aiUnboundedGenerationPublic-CbAcSxLB.mjs';
+import allowUnauthenticatedShardAccessEnabled from './packem_shared/allowUnauthenticatedShardAccessEnabled-BcASq-jP.mjs';
 import authApiCallWithoutHeaders from './packem_shared/authApiCallWithoutHeaders-BeJhCZaf.mjs';
+import authCsrfCheckDisabled from './packem_shared/authCsrfCheckDisabled-DCf9FSoD.mjs';
+import authEmailVerificationDisabled from './packem_shared/authEmailVerificationDisabled-Dk-Tc5oU.mjs';
+import authSecureCookiesDisabled from './packem_shared/authSecureCookiesDisabled-osJrHW9Y.mjs';
+import authSessionFreshageZero from './packem_shared/authSessionFreshageZero-CjufCc_Q.mjs';
+import authTrustedOriginsWildcard from './packem_shared/authTrustedOriginsWildcard-ylv4PKzC.mjs';
+import browserAllowPrivateTargets from './packem_shared/browserAllowPrivateTargets-CBvQxLAM.mjs';
+import browserUserUrlWithoutAllowlist from './packem_shared/browserUserUrlWithoutAllowlist-CvhA6w59.mjs';
 import circularFk from './packem_shared/circularFk-B2freHrP.mjs';
+import containerInstanceKeyFromUserInput from './packem_shared/containerInstanceKeyFromUserInput-BUXj2J4w.mjs';
 import containerOversizedInstance from './packem_shared/containerOversizedInstance-5U1VKPRM.mjs';
 import containerPublicInternet from './packem_shared/containerPublicInternet-CuNerJE5.mjs';
+import containerRuntimeEgressRelaxation from './packem_shared/containerRuntimeEgressRelaxation-B0LlfmDA.mjs';
+import containerStartEnableInternetOverride from './packem_shared/containerStartEnableInternetOverride-DDaHZQ1L.mjs';
 import duplicateIndex from './packem_shared/duplicateIndex-BOublMSt.mjs';
 import emptyIndex from './packem_shared/emptyIndex-BX8EuEY7.mjs';
 import filterWithoutIndex from './packem_shared/filterWithoutIndex-BYVeJaSs.mjs';
+import flagGatesSecurityWithUnsafeDefault from './packem_shared/flagGatesSecurityWithUnsafeDefault-BhIs0shr.mjs';
 import hardcodedSecret from './packem_shared/hardcodedSecret-W2pz1UZB.mjs';
+import httpActionMissingAuthGuard from './packem_shared/httpActionMissingAuthGuard-CxipddNx.mjs';
+import httpActionResponseHeaderInjection from './packem_shared/httpActionResponseHeaderInjection-DOFS7pFT.mjs';
 import hyperdriveOutsideAction from './packem_shared/hyperdriveOutsideAction-BgZqX7Xg.mjs';
-import indexReferencesUnknownField from './packem_shared/indexReferencesUnknownField-DH0_dbUY.mjs';
+import identityUndeclaredClaimTrusted from './packem_shared/identityUndeclaredClaimTrusted-D8nXV2dd.mjs';
+import imagesUrlSourceFromUserInput from './packem_shared/imagesUrlSourceFromUserInput-YcDQ0b_Y.mjs';
+import indexReferencesUnknownField from './packem_shared/indexReferencesUnknownField-BSWNngxX.mjs';
+import insertManyUnsafeUserData from './packem_shared/insertManyUnsafeUserData-Dn77XpmX.mjs';
+import kvUnscopedUserKeyIdor from './packem_shared/kvUnscopedUserKeyIdor-YWwmfE8X.mjs';
+import mailInboundDispatchWithoutVerify from './packem_shared/mailInboundDispatchWithoutVerify-CHSRA8zz.mjs';
+import mailRecipientFromRequestInput from './packem_shared/mailRecipientFromRequestInput-Cka2qu5J.mjs';
 import maskUncoveredPiiColumn from './packem_shared/maskUncoveredPiiColumn-DjGIPG6M.mjs';
+import maskWeakHashStrategyOnPii from './packem_shared/maskWeakHashStrategyOnPii-1c4q8Opf.mjs';
+import maskedRelationLeakViaWith from './packem_shared/maskedRelationLeakViaWith-CPI4s0sl.mjs';
+import mutatorFullRowReplace from './packem_shared/mutatorFullRowReplace-BJnNDaIV.mjs';
 import nondeterministicQueryMutation from './packem_shared/nondeterministicQueryMutation-GXES1fLp.mjs';
+import normalizeIdUsedAsAuthorization from './packem_shared/normalizeIdUsedAsAuthorization-BVPtCpzT.mjs';
+import outputProjectionMissingOnPublicRead from './packem_shared/outputProjectionMissingOnPublicRead-Bl5IMx0k.mjs';
+import ownerFieldFromArgsNotAuth from './packem_shared/ownerFieldFromArgsNotAuth-mOw3hE5z.mjs';
+import paymentCreateWithoutAuthorize from './packem_shared/paymentCreateWithoutAuthorize-BYm4JLxo.mjs';
+import paymentWebhookWideTolerance from './packem_shared/paymentWebhookWideTolerance-D9QQJMJq.mjs';
+import plaintextSecretInWranglerVariables from './packem_shared/plaintextSecretInWranglerVariables-NKO4YkKf.mjs';
 import policyReferencesUnknownTable from './packem_shared/policyReferencesUnknownTable-DtaIEovd.mjs';
+import privilegedDispatchUnvalidatedPayload from './packem_shared/privilegedDispatchUnvalidatedPayload-5Forjckt.mjs';
+import privilegedFanoutFromPublicProcedure from './packem_shared/privilegedFanoutFromPublicProcedure-D3dL01B8.mjs';
 import publicArgumentUsesAny from './packem_shared/publicArgumentUsesAny-C71b2NCf.mjs';
-import publicMutationWithoutRatelimit from './packem_shared/publicMutationWithoutRatelimit-xBpJ6GWK.mjs';
+import publicMutationWithoutRatelimit from './packem_shared/publicMutationWithoutRatelimit-DbIhgi7j.mjs';
+import publicTableRlsOptoutConfusion from './packem_shared/publicTableRlsOptoutConfusion-Bn71yoD4.mjs';
+import queueWithoutDlq from './packem_shared/queueWithoutDlq-CSkGNb_0.mjs';
 import r2sqlOutsideAction from './packem_shared/r2sqlOutsideAction-CtqxvMuV.mjs';
-import relationReferencesUnknownField from './packem_shared/relationReferencesUnknownField-YznyXt_7.mjs';
+import ratelimitDefaultMemoryStore from './packem_shared/ratelimitDefaultMemoryStore-BISChG5C.mjs';
+import ratelimitKeySpoofableOrGlobal from './packem_shared/ratelimitKeySpoofableOrGlobal-DqlHYQQ3.mjs';
+import ratelimitMiddlewareFailOpen from './packem_shared/ratelimitMiddlewareFailOpen-CJgDCaUw.mjs';
+import relationReferencesUnknownField from './packem_shared/relationReferencesUnknownField-CjbLScJ1.mjs';
 import relationReferencesUnknownTable from './packem_shared/relationReferencesUnknownTable-DrorpKYe.mjs';
 import rlsUncoveredTable from './packem_shared/rlsUncoveredTable-CxEfZ5eZ.mjs';
+import shapeTargetsGlobalTable from './packem_shared/shapeTargetsGlobalTable-DHrf4Koi.mjs';
+import shapeUnknownTable from './packem_shared/shapeUnknownTable-C8aDWFoe.mjs';
+import softDeleteIncludeDeletedFromArgs from './packem_shared/softDeleteIncludeDeletedFromArgs-BLqDKrkM.mjs';
 import sqlInjectionRisk from './packem_shared/sqlInjectionRisk-zwytYGLt.mjs';
+import storageGenerateUploadUrlNoContentTypePin from './packem_shared/storageGenerateUploadUrlNoContentTypePin-Da4L9Ge8.mjs';
+import storageKeyFromUserArgs from './packem_shared/storageKeyFromUserArgs-B86elJgS.mjs';
+import storagePresignedUrlForPrivateContent from './packem_shared/storagePresignedUrlForPrivateContent-yGmb8uqz.mjs';
+import storageUploadWithoutContentTypeAllowlist from './packem_shared/storageUploadWithoutContentTypeAllowlist-BV-gF1lT.mjs';
+import storageUploadWithoutMaxSize from './packem_shared/storageUploadWithoutMaxSize-DpxO59wU.mjs';
 import tableWithoutInsert from './packem_shared/tableWithoutInsert-CbbaYIP4.mjs';
 import unboundedStringArgument from './packem_shared/unboundedStringArgument-DThg2-wt.mjs';
 import unindexedForeignKey from './packem_shared/unindexedForeignKey-BgJbKyqK.mjs';
 import unindexedRelationTarget from './packem_shared/unindexedRelationTarget-D6eyj6Xx.mjs';
-import userCreatingMutationWithoutCaptcha from './packem_shared/userCreatingMutationWithoutCaptcha-CH31YsUZ.mjs';
+import userCreatingMutationWithoutCaptcha from './packem_shared/userCreatingMutationWithoutCaptcha-2DZtWIPb.mjs';
+import vectorsNamespaceFromUserInput from './packem_shared/vectorsNamespaceFromUserInput-CQhr5bVn.mjs';
+import workflowDuplicateStepName from './packem_shared/workflowDuplicateStepName-ioBxPBCy.mjs';
 import workflowUnknownTarget from './packem_shared/workflowUnknownTarget-Cdd7WhKQ.mjs';
 import workflowUnused from './packem_shared/workflowUnused-D0jHxdz9.mjs';
-export { AE_METRIC_EVENTS, loadAnalyticsRuntimeMetrics } from './packem_shared/AE_METRIC_EVENTS-DexctYv6.mjs';
-export { fromServerSchema } from './packem_shared/fromServerSchema-DinF1nph.mjs';
+export { AE_METRIC_EVENTS, loadAnalyticsRuntimeMetrics } from './packem_shared/AE_METRIC_EVENTS-BM14d0lm.mjs';
+export { default as externalSourceOnGlobal } from './packem_shared/externalSourceOnGlobal-Bg-NfCX9.mjs';
+export { default as externalSourceUnscoped } from './packem_shared/externalSourceUnscoped-5vT-Bup3.mjs';
+export { fromServerSchema } from './packem_shared/fromServerSchema-BiB6JSiW.mjs';
 
 const STATIC_LINTS = [
   indexReferencesUnknownField,
   relationReferencesUnknownTable,
   relationReferencesUnknownField,
   workflowUnknownTarget,
+  workflowDuplicateStepName,
+  shapeUnknownTable,
   emptyIndex,
   circularFk,
   unindexedForeignKey,
@@ -44,7 +98,10 @@ const STATIC_LINTS = [
   duplicateIndex,
   tableWithoutInsert,
   workflowUnused,
+  queueWithoutDlq,
   filterWithoutIndex,
+  shapeTargetsGlobalTable,
+  mutatorFullRowReplace,
   nondeterministicQueryMutation,
   hyperdriveOutsideAction,
   r2sqlOutsideAction,
@@ -52,6 +109,7 @@ const STATIC_LINTS = [
   policyReferencesUnknownTable,
   rlsUncoveredTable,
   maskUncoveredPiiColumn,
+  maskWeakHashStrategyOnPii,
   containerOversizedInstance,
   containerPublicInternet,
   publicMutationWithoutRatelimit,
@@ -60,7 +118,51 @@ const STATIC_LINTS = [
   unboundedStringArgument,
   hardcodedSecret,
   sqlInjectionRisk,
-  adminRouteWithoutGuard
+  adminRouteWithoutGuard,
+  paymentCreateWithoutAuthorize,
+  mailInboundDispatchWithoutVerify,
+  ratelimitDefaultMemoryStore,
+  browserAllowPrivateTargets,
+  privilegedFanoutFromPublicProcedure,
+  insertManyUnsafeUserData,
+  aiUnboundedGenerationPublic,
+  actionFetchSsrf,
+  ownerFieldFromArgsNotAuth,
+  storageKeyFromUserArgs,
+  kvUnscopedUserKeyIdor,
+  containerInstanceKeyFromUserInput,
+  aiRawRunEscapeHatch,
+  vectorsNamespaceFromUserInput,
+  mailRecipientFromRequestInput,
+  browserUserUrlWithoutAllowlist,
+  privilegedDispatchUnvalidatedPayload,
+  containerStartEnableInternetOverride,
+  containerRuntimeEgressRelaxation,
+  authTrustedOriginsWildcard,
+  authCsrfCheckDisabled,
+  authSecureCookiesDisabled,
+  authEmailVerificationDisabled,
+  authSessionFreshageZero,
+  imagesUrlSourceFromUserInput,
+  ratelimitKeySpoofableOrGlobal,
+  publicTableRlsOptoutConfusion,
+  allowUnauthenticatedShardAccessEnabled,
+  storageUploadWithoutContentTypeAllowlist,
+  storageUploadWithoutMaxSize,
+  storageGenerateUploadUrlNoContentTypePin,
+  storagePresignedUrlForPrivateContent,
+  httpActionMissingAuthGuard,
+  httpActionResponseHeaderInjection,
+  ratelimitMiddlewareFailOpen,
+  flagGatesSecurityWithUnsafeDefault,
+  aiToolSideEffectPromptInjection,
+  identityUndeclaredClaimTrusted,
+  paymentWebhookWideTolerance,
+  softDeleteIncludeDeletedFromArgs,
+  maskedRelationLeakViaWith,
+  outputProjectionMissingOnPublicRead,
+  normalizeIdUsedAsAuthorization,
+  plaintextSecretInWranglerVariables
 ];
 const RUNTIME_LINTS = [hotShard, indexUtilization, constraintValidator];
 const ALL_LINTS = [...STATIC_LINTS, ...RUNTIME_LINTS];
@@ -76,4 +178,4 @@ const runAdvisor = (context, options = {}) => {
   return findings;
 };
 
-export { ALL_LINTS, RUNTIME_LINTS, STATIC_LINTS, adminRouteWithoutGuard, authApiCallWithoutHeaders, circularFk, constraintValidator, containerOversizedInstance, containerPublicInternet, duplicateIndex, emptyIndex, filterWithoutIndex, hardcodedSecret, hotShard, hyperdriveOutsideAction, indexReferencesUnknownField, indexUtilization, maskUncoveredPiiColumn, nondeterministicQueryMutation, policyReferencesUnknownTable, publicArgumentUsesAny, publicMutationWithoutRatelimit, r2sqlOutsideAction, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, sqlInjectionRisk, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, workflowUnknownTarget, workflowUnused };
+export { ALL_LINTS, RUNTIME_LINTS, STATIC_LINTS, actionFetchSsrf, adminRouteWithoutGuard, aiRawRunEscapeHatch, aiToolSideEffectPromptInjection, aiUnboundedGenerationPublic, allowUnauthenticatedShardAccessEnabled, authApiCallWithoutHeaders, authCsrfCheckDisabled, authEmailVerificationDisabled, authSecureCookiesDisabled, authSessionFreshageZero, authTrustedOriginsWildcard, browserAllowPrivateTargets, browserUserUrlWithoutAllowlist, circularFk, constraintValidator, containerInstanceKeyFromUserInput, containerOversizedInstance, containerPublicInternet, containerRuntimeEgressRelaxation, containerStartEnableInternetOverride, duplicateIndex, emptyIndex, filterWithoutIndex, flagGatesSecurityWithUnsafeDefault, hardcodedSecret, hotShard, httpActionMissingAuthGuard, httpActionResponseHeaderInjection, hyperdriveOutsideAction, identityUndeclaredClaimTrusted, imagesUrlSourceFromUserInput, indexReferencesUnknownField, indexUtilization, insertManyUnsafeUserData, kvUnscopedUserKeyIdor, mailInboundDispatchWithoutVerify, mailRecipientFromRequestInput, maskUncoveredPiiColumn, maskWeakHashStrategyOnPii, maskedRelationLeakViaWith, mutatorFullRowReplace, nondeterministicQueryMutation, normalizeIdUsedAsAuthorization, outputProjectionMissingOnPublicRead, ownerFieldFromArgsNotAuth, paymentCreateWithoutAuthorize, paymentWebhookWideTolerance, plaintextSecretInWranglerVariables, policyReferencesUnknownTable, privilegedDispatchUnvalidatedPayload, privilegedFanoutFromPublicProcedure, publicArgumentUsesAny, publicMutationWithoutRatelimit, publicTableRlsOptoutConfusion, queueWithoutDlq, r2sqlOutsideAction, ratelimitDefaultMemoryStore, ratelimitKeySpoofableOrGlobal, ratelimitMiddlewareFailOpen, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, softDeleteIncludeDeletedFromArgs, sqlInjectionRisk, storageGenerateUploadUrlNoContentTypePin, storageKeyFromUserArgs, storagePresignedUrlForPrivateContent, storageUploadWithoutContentTypeAllowlist, storageUploadWithoutMaxSize, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, vectorsNamespaceFromUserInput, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };

package/dist/packem_shared/{AE_METRIC_EVENTS-DexctYv6.mjs → AE_METRIC_EVENTS-BM14d0lm.mjs}

@@ -1,3 +1,5 @@
+import { LunoraError } from '@lunora/errors';
+
 const DATASET_NAME_PATTERN = /^[\w.-]+$/u;
 const AE_METRIC_EVENTS = {
   /** `lunora.index.hit` — one row per `(table, index)` use. `blob2`=table, `blob3`=index. */
@@ -22,7 +24,7 @@ const toText = (value) => {
 };
 const assertDataset = (dataset) => {
   if (!DATASET_NAME_PATTERN.test(dataset)) {
-    throw new Error(`@lunora/advisor: invalid Analytics Engine dataset name "${dataset}" — expected a bare table identifier.`);
+    throw new LunoraError("INTERNAL", `@lunora/advisor: invalid Analytics Engine dataset name "${dataset}" — expected a bare table identifier.`);
   }
 };
 const sqlString = (value) => `'${value.replaceAll("\\", "\\\\").replaceAll("'", "''")}'`;

package/dist/packem_shared/actionFetchSsrf-wbmYgzmz.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const actionFetchSsrf = {
+  categories: ["SECURITY"],
+  description: "An action's `ctx.fetch(url)` fetches a URL derived from the handler's `args`. `ctx.fetch` applies no host allowlist, so request-controlled URLs let a caller reach cloud metadata endpoints or internal services — server-side request forgery.",
+  facing: "EXTERNAL",
+  level: "ERROR",
+  name: "action_fetch_ssrf",
+  remediation: "Validate the URL against an allowlist of expected hosts before fetching, and reject private, loopback, and link-local addresses (notably `169.254.169.254`). Never pass request input straight to `ctx.fetch`.",
+  run: (context) => {
+    if (context.argumentDerivedFetches === void 0) {
+      return [];
+    }
+    return context.argumentDerivedFetches.map(
+      (fetchCall) => emit(actionFetchSsrf, {
+        cacheKey: `action_fetch_ssrf:${fetchCall.file}:${fetchCall.line.toString()}`,
+        detail: `\`ctx.fetch\` in \`${fetchCall.exportName}\` (${fetchCall.file}:${fetchCall.line.toString()}) fetches a URL derived from \`args\` — a server-side request forgery vector. Validate the URL against a host allowlist and reject private/link-local targets before fetching.`,
+        metadata: { exportName: fetchCall.exportName, file: fetchCall.file, line: fetchCall.line }
+      })
+    );
+  },
+  source: "static",
+  title: "Possible SSRF from arg-derived ctx.fetch URL"
+};
+
+export { actionFetchSsrf as default };

package/dist/packem_shared/aiRawRunEscapeHatch-C29jd32J.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const aiRawRunEscapeHatch = {
+  categories: ["SECURITY"],
+  description: "A `ctx.ai.run(model, …)` call selects its model from the handler's `args` with no server-side scoping. `ctx.ai.run` is the raw Workers AI binding passthrough, so an arg-derived model id lets any caller pick an arbitrary model — bypassing the typed `ctx.ai.model(...)` + AI-SDK layer's cap/schema.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "ai_raw_run_escape_hatch",
+  remediation: `Select the model from a fixed server-side allowlist — never from \`args\`. Prefer the typed \`ctx.ai.model(...)\` + \`generateText\`/\`streamText\` path with an output cap over the raw \`ctx.ai.run\` escape hatch.`,
+  run: (context) => {
+    if (context.aiRawRuns === void 0) {
+      return [];
+    }
+    return context.aiRawRuns.map(
+      (access) => emit(aiRawRunEscapeHatch, {
+        cacheKey: `ai_raw_run_escape_hatch:${access.file}:${access.line.toString()}`,
+        detail: `\`ctx.ai.run\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) selects its model from \`args\` with no server-side scoping — any caller can pick an arbitrary model, bypassing the typed AI-SDK layer's cap/schema. Select the model from a fixed server-side allowlist instead.`,
+        metadata: { exportName: access.exportName, file: access.file, line: access.line }
+      })
+    );
+  },
+  source: "static",
+  title: "Possible arbitrary model selection from arg-derived ctx.ai.run"
+};
+
+export { aiRawRunEscapeHatch as default };

package/dist/packem_shared/aiToolSideEffectPromptInjection-BtD3alqB.mjs

@@ -0,0 +1,33 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const aiToolSideEffectPromptInjection = {
+  categories: ["SECURITY"],
+  description: "A `generateText` / `streamText` call whose prompt/messages carry user-supplied text and whose model-callable `tools` perform a privileged side effect (DB write, `ctx.run` dispatch, or outbound send). An injected instruction in the user text can steer the model into firing that action — the confused-deputy prompt-injection hazard.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "ai_tool_side_effect_prompt_injection",
+  remediation: "Don't let a model with user-derived input directly trigger a privileged action. Have the tool return a proposal the server validates and authorizes before executing, gate the side effect behind an explicit human/step confirmation, or keep side-effecting tools out of any generation whose prompt includes untrusted input.",
+  run: (context) => {
+    if (context.aiToolSideEffects === void 0) {
+      return [];
+    }
+    return context.aiToolSideEffects.filter((row) => row.userInputDerived).map((row) => {
+      const location = `\`${row.exportName}\` (${row.file}:${row.line.toString()})`;
+      return emit(aiToolSideEffectPromptInjection, {
+        cacheKey: `ai_tool_side_effect_prompt_injection:${row.file}:${row.line.toString()}`,
+        detail: `\`${row.method}\` in ${location} feeds user-derived input to a model whose tools reach \`${row.sideEffect}\`. An injected instruction can steer the model into firing that side effect.`,
+        metadata: {
+          exportName: row.exportName,
+          file: row.file,
+          line: row.line,
+          method: row.method,
+          sideEffect: row.sideEffect
+        }
+      });
+    });
+  },
+  source: "static",
+  title: "AI tool side effect reachable via prompt injection"
+};
+
+export { aiToolSideEffectPromptInjection as default };

package/dist/packem_shared/aiUnboundedGenerationPublic-CbAcSxLB.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const aiUnboundedGenerationPublic = {
+  categories: ["SECURITY"],
+  description: "A public procedure runs an AI generation (`generateText`/`streamText`/`generateObject`/`streamObject`) with no `maxOutputTokens` bound. Generation bills per output token, so an anonymous caller can request arbitrarily long completions in a loop — a denial-of-wallet vector that also ties up worker time on long streams.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "ai_unbounded_generation_public",
+  remediation: "Cap the completion with `maxOutputTokens` in the generation config, and rate-limit the public entry point (`.use(rateLimit(...))`). For expensive models, prefer running generation from an internal, authenticated path rather than exposing it directly to anonymous callers.",
+  run: (context) => {
+    if (context.procedureProtections === void 0) {
+      return [];
+    }
+    return context.procedureProtections.filter((procedure) => procedure.unboundedAiGeneration && procedure.visibility === "public").map(
+      (procedure) => emit(aiUnboundedGenerationPublic, {
+        cacheKey: `ai_unbounded_generation_public:${procedure.file}:${procedure.exportName}`,
+        detail: `\`${procedure.exportName}\` (${procedure.file}) is public and runs an AI generation with no \`maxOutputTokens\` bound — an anonymous caller can drive unbounded, billable completions in a loop. Add a \`maxOutputTokens\` cap and rate-limit the entry point.`,
+        metadata: { exportName: procedure.exportName, file: procedure.file, kind: procedure.kind }
+      })
+    );
+  },
+  source: "static",
+  title: "Public procedure runs unbounded AI generation (no maxOutputTokens)"
+};
+
+export { aiUnboundedGenerationPublic as default };

package/dist/packem_shared/allowUnauthenticatedShardAccessEnabled-BcASq-jP.mjs

@@ -0,0 +1,30 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const allowUnauthenticatedShardAccessEnabled = {
+  categories: ["SECURITY"],
+  description: "`.extend(() => ({ allowUnauthenticatedShardAccess: true }))` disables the fail-closed default that denies an unauthenticated shard lookup. Combined with a schema that doesn't enforce `.rls(\"required\")` everywhere (or that leaves a table `.public()`), an unauthenticated caller can shard-hop into another tenant's rows with no row-security guard behind the door.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "allow_unauthenticated_shard_access_enabled",
+  remediation: "Prefer `authorizeShard` / `authorizeFanOut` (which take precedence over `allowUnauthenticatedShardAccess` and let you allow specific unauthenticated cases) over the blanket opt-out. If the app genuinely needs open shard access, enforce `.rls(\"required\")` on the schema with no `.public()` tables so a missing identity still can't read another tenant's rows.",
+  run: (context) => {
+    if (context.configCalls === void 0) {
+      return [];
+    }
+    const hasRlsGap = context.schema.rlsMode !== "required" || context.schema.tables.some((table) => table.isPublic);
+    if (!hasRlsGap) {
+      return [];
+    }
+    return context.configCalls.filter((call) => call.callee === "extend" && call.trueKeys.includes("allowUnauthenticatedShardAccess")).map(
+      (call) => emit(allowUnauthenticatedShardAccessEnabled, {
+        cacheKey: `allow_unauthenticated_shard_access_enabled:${call.file}:${call.line.toString()}`,
+        detail: `\`.extend(...)\` in ${call.file}:${call.line.toString()} sets \`allowUnauthenticatedShardAccess: true\`, and the schema has an RLS gap (no \`.rls("required")\`, or a \`.public()\` table) — an unauthenticated caller can shard-hop into another tenant's rows with no row-security guard behind the door.`,
+        metadata: { callee: call.callee, file: call.file, line: call.line }
+      })
+    );
+  },
+  source: "static",
+  title: "Unauthenticated shard access enabled on an RLS-gapped schema"
+};
+
+export { allowUnauthenticatedShardAccessEnabled as default };

package/dist/packem_shared/argument-derived-sink-C1xTTqAt.mjs

@@ -0,0 +1,30 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const makeArgumentDerivedSinkLint = (config) => {
+  const lint = {
+    categories: config.categories,
+    description: config.description,
+    facing: config.facing,
+    level: config.level,
+    name: config.name,
+    remediation: config.remediation,
+    run: (context) => {
+      const accesses = config.getAccesses(context);
+      if (accesses === void 0 || config.suppressWhen?.(context) === true) {
+        return [];
+      }
+      return accesses.map(
+        (access) => emit(lint, {
+          cacheKey: config.cacheKey(access),
+          detail: config.detail(access),
+          metadata: config.metadata(access)
+        })
+      );
+    },
+    source: "static",
+    title: config.title
+  };
+  return lint;
+};
+
+export { makeArgumentDerivedSinkLint as m };

package/dist/packem_shared/authCsrfCheckDisabled-DCf9FSoD.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const authCsrfCheckDisabled = {
+  categories: ["SECURITY"],
+  description: "A `createAuth({...})` call sets `advanced.disableCSRFCheck: true`, turning off better-auth's origin validation for state-changing auth requests — a cross-site request riding the ambient auth cookie is processed like a same-origin one.",
+  facing: "EXTERNAL",
+  level: "ERROR",
+  name: "auth_csrf_check_disabled",
+  remediation: "Remove `advanced.disableCSRFCheck: true` from `createAuth({...})` and rely on `trustedOrigins` for origin validation instead of disabling the check.",
+  run: (context) => {
+    if (context.authConfigs === void 0) {
+      return [];
+    }
+    return context.authConfigs.filter((config) => config.analyzable && config.disableCsrfCheck).map(
+      (config) => emit(authCsrfCheckDisabled, {
+        cacheKey: `auth_csrf_check_disabled:${config.file}:${config.line.toString()}`,
+        detail: `\`createAuth\` in \`${config.exportName}\` (${config.file}:${config.line.toString()}) sets \`advanced.disableCSRFCheck: true\`, turning off origin validation for state-changing auth requests. Remove the flag and rely on \`trustedOrigins\` instead.`,
+        metadata: { exportName: config.exportName, file: config.file, line: config.line }
+      })
+    );
+  },
+  source: "static",
+  title: "createAuth CSRF check disabled"
+};
+
+export { authCsrfCheckDisabled as default };

package/dist/packem_shared/authEmailVerificationDisabled-Dk-Tc5oU.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const authEmailVerificationDisabled = {
+  categories: ["SECURITY"],
+  description: "A `createAuth({...})` call enables `emailAndPassword` with no `requireEmailVerification: true`. better-auth defaults email verification off, so an account is usable before the caller has proven ownership of the email address.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "auth_email_verification_disabled",
+  remediation: "Set `emailAndPassword.requireEmailVerification: true` on `createAuth({...})` so a new account can't act until its email address is verified.",
+  run: (context) => {
+    if (context.authConfigs === void 0) {
+      return [];
+    }
+    return context.authConfigs.filter((config) => config.analyzable && config.emailPasswordEnabled && !config.requireEmailVerification).map(
+      (config) => emit(authEmailVerificationDisabled, {
+        cacheKey: `auth_email_verification_disabled:${config.file}:${config.line.toString()}`,
+        detail: `\`createAuth\` in \`${config.exportName}\` (${config.file}:${config.line.toString()}) enables \`emailAndPassword\` with no \`requireEmailVerification: true\`, so an account is usable before its email is proven. Set \`emailAndPassword.requireEmailVerification: true\`.`,
+        metadata: { exportName: config.exportName, file: config.file, line: config.line }
+      })
+    );
+  },
+  source: "static",
+  title: "createAuth email verification disabled"
+};
+
+export { authEmailVerificationDisabled as default };

package/dist/packem_shared/authSecureCookiesDisabled-osJrHW9Y.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const authSecureCookiesDisabled = {
+  categories: ["SECURITY"],
+  description: "A `createAuth({...})` call sets `advanced.useSecureCookies: false`, overriding Lunora's secure-by-default posture — the session cookie ships without `Secure` even on an HTTPS deployment, so it can be sent over a plaintext connection.",
+  facing: "EXTERNAL",
+  level: "ERROR",
+  name: "auth_secure_cookies_disabled",
+  remediation: "Remove `advanced.useSecureCookies: false` from `createAuth({...})` — let Lunora's secure-by-default posture set the `Secure` cookie attribute for an HTTPS deployment.",
+  run: (context) => {
+    if (context.authConfigs === void 0) {
+      return [];
+    }
+    return context.authConfigs.filter((config) => config.analyzable && config.secureCookiesDisabled).map(
+      (config) => emit(authSecureCookiesDisabled, {
+        cacheKey: `auth_secure_cookies_disabled:${config.file}:${config.line.toString()}`,
+        detail: `\`createAuth\` in \`${config.exportName}\` (${config.file}:${config.line.toString()}) sets \`advanced.useSecureCookies: false\`, so the session cookie ships without \`Secure\` even on an HTTPS deployment. Remove the override and let Lunora's secure-by-default posture apply.`,
+        metadata: { exportName: config.exportName, file: config.file, line: config.line }
+      })
+    );
+  },
+  source: "static",
+  title: "createAuth secure cookies disabled"
+};
+
+export { authSecureCookiesDisabled as default };

package/dist/packem_shared/authSessionFreshageZero-CjufCc_Q.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const authSessionFreshageZero = {
+  categories: ["SECURITY"],
+  description: "A `createAuth({...})` call sets `session.freshAge: 0`, disabling better-auth's recent-reauth check for sensitive operations — a long-lived stolen session can perform them without proving the caller still controls the credentials.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "auth_session_freshage_zero",
+  remediation: "Remove `session.freshAge: 0` from `createAuth({...})` (or set it to a real window) so sensitive operations require a recently re-authenticated session.",
+  run: (context) => {
+    if (context.authConfigs === void 0) {
+      return [];
+    }
+    return context.authConfigs.filter((config) => config.analyzable && config.sessionFreshAgeZero).map(
+      (config) => emit(authSessionFreshageZero, {
+        cacheKey: `auth_session_freshage_zero:${config.file}:${config.line.toString()}`,
+        detail: `\`createAuth\` in \`${config.exportName}\` (${config.file}:${config.line.toString()}) sets \`session.freshAge: 0\`, disabling the recent-reauth check for sensitive operations. Remove the override or set a real window.`,
+        metadata: { exportName: config.exportName, file: config.file, line: config.line }
+      })
+    );
+  },
+  source: "static",
+  title: "createAuth session freshAge zero"
+};
+
+export { authSessionFreshageZero as default };

package/dist/packem_shared/authTrustedOriginsWildcard-ylv4PKzC.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const authTrustedOriginsWildcard = {
+  categories: ["SECURITY"],
+  description: "A `createAuth({...})` call's `trustedOrigins` array contains a `\"*\"` entry, disabling better-auth's CSRF/origin validation entirely — any origin is accepted for state-changing auth requests.",
+  facing: "EXTERNAL",
+  level: "ERROR",
+  name: "auth_trusted_origins_wildcard",
+  remediation: 'List the specific origins your deployment serves in `trustedOrigins` instead of `"*"` — a wildcard disables origin validation for every caller.',
+  run: (context) => {
+    if (context.authConfigs === void 0) {
+      return [];
+    }
+    return context.authConfigs.filter((config) => config.analyzable && config.trustedOriginsWildcard).map(
+      (config) => emit(authTrustedOriginsWildcard, {
+        cacheKey: `auth_trusted_origins_wildcard:${config.file}:${config.line.toString()}`,
+        detail: `\`createAuth\` in \`${config.exportName}\` (${config.file}:${config.line.toString()}) sets \`trustedOrigins\` to include \`"*"\`, disabling CSRF/origin validation for every request. List the specific origins your deployment serves instead.`,
+        metadata: { exportName: config.exportName, file: config.file, line: config.line }
+      })
+    );
+  },
+  source: "static",
+  title: "createAuth trustedOrigins wildcard"
+};
+
+export { authTrustedOriginsWildcard as default };

package/dist/packem_shared/browserAllowPrivateTargets-CBvQxLAM.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const browserAllowPrivateTargets = {
+  categories: ["SECURITY"],
+  description: "`createBrowser({ allowPrivateTargets: true })` disables the private/internal-IP SSRF guard, letting a navigated URL reach cloud metadata endpoints, internal services, or loopback. Combined with a request-supplied URL this is a server-side request forgery path.",
+  facing: "EXTERNAL",
+  level: "ERROR",
+  name: "browser_allow_private_targets",
+  remediation: "Remove `allowPrivateTargets: true` from `createBrowser({...})` so the private/internal-address guard stays on. If a specific internal host is genuinely required, pin it with an `allowedHosts` allowlist instead of opening all private targets.",
+  run: (context) => {
+    if (context.configCalls === void 0) {
+      return [];
+    }
+    return context.configCalls.filter((call) => call.callee === "createBrowser" && call.trueKeys.includes("allowPrivateTargets")).map(
+      (call) => emit(browserAllowPrivateTargets, {
+        cacheKey: `browser_allow_private_targets:${call.file}:${call.line.toString()}`,
+        detail: `\`createBrowser({ allowPrivateTargets: true })\` in ${call.file}:${call.line.toString()} disables the private/internal-address SSRF guard — a navigated URL can then reach cloud metadata, internal services, or loopback. Remove the override, or pin the specific host with \`allowedHosts\` instead.`,
+        metadata: { callee: call.callee, file: call.file, line: call.line }
+      })
+    );
+  },
+  source: "static",
+  title: "Browser with private-target SSRF guard disabled"
+};
+
+export { browserAllowPrivateTargets as default };

package/dist/packem_shared/browserUserUrlWithoutAllowlist-CvhA6w59.mjs

@@ -0,0 +1,26 @@
+import { m as makeArgumentDerivedSinkLint } from './argument-derived-sink-C1xTTqAt.mjs';
+
+const browserUserUrlWithoutAllowlist = makeArgumentDerivedSinkLint({
+  cacheKey: (access) => `browser_user_url_without_allowlist:${access.file}:${access.line.toString()}`,
+  categories: ["SECURITY"],
+  description: "A `ctx.browser.<method>(url, …)` call navigates to a URL derived from the handler's `args` with no server-side scoping, and no `createBrowser` allowlist contains it. The default guard blocks private targets but not arbitrary public URLs, so any caller can make the headless browser an open-proxy / SSRF tool (fetch arbitrary third-party URLs, DNS-rebind to internal hosts).",
+  detail: (access) => `\`ctx.browser.${access.method}\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) navigates to a URL derived from \`args\` with no server-side scoping, and no \`createBrowser\` allowlist contains it — the default guard blocks private targets but not arbitrary public URLs, so any caller can turn the headless browser into an open-proxy / SSRF tool. Pin \`allowedHosts\` (and/or \`resolveDns\`) on \`createBrowser({...})\`, and derive the URL from server-trusted state where possible.`,
+  facing: "EXTERNAL",
+  getAccesses: (context) => context.browserUrlAccesses,
+  level: "WARN",
+  metadata: (access) => {
+    return { exportName: access.exportName, file: access.file, line: access.line, method: access.method };
+  },
+  name: "browser_user_url_without_allowlist",
+  remediation: "Pin the browser with an `allowedHosts` allowlist (and/or `resolveDns`) on `createBrowser({...})`, and derive the navigation URL from server-trusted state where possible rather than passing `args` straight to `ctx.browser`.",
+  // A `createBrowser` hardened with an `allowedHosts` allowlist or a pinned
+  // `resolveDns` contains the SSRF surface — suppress every finding when one is
+  // visible. Only an analyzable (non-spread, static object-literal) config call
+  // counts; an opaque config could set the key elsewhere but can't be relied on.
+  suppressWhen: (context) => (context.configCalls ?? []).some(
+    (call) => call.callee === "createBrowser" && call.analyzable && (call.presentKeys.includes("allowedHosts") || call.presentKeys.includes("resolveDns"))
+  ),
+  title: "Browser navigates to arg-derived URL with no allowlist"
+});
+
+export { browserUserUrlWithoutAllowlist as default };

package/dist/packem_shared/containerInstanceKeyFromUserInput-BUXj2J4w.mjs

@@ -0,0 +1,19 @@
+import { m as makeArgumentDerivedSinkLint } from './argument-derived-sink-C1xTTqAt.mjs';
+
+const containerInstanceKeyFromUserInput = makeArgumentDerivedSinkLint({
+  cacheKey: (access) => `container_instance_key_from_user_input:${access.file}:${access.line.toString()}`,
+  categories: ["SECURITY"],
+  description: "A `ctx.containers.<name>.get` call routes to a container instance using a key derived from the handler's `args` with no server-side scoping. Any caller can supply another tenant's key and reach that tenant's container instance — a cross-tenant insecure direct object reference (IDOR).",
+  detail: (access) => `\`ctx.containers.*.${access.method}\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) routes to a container instance using a key derived from \`args\` with no server-side scoping — any caller can reach another tenant's container (IDOR). Derive the key from a server-trusted identity (e.g. \`\${ctx.auth.userId}\`).`,
+  facing: "EXTERNAL",
+  getAccesses: (context) => context.containerKeyAccesses,
+  level: "WARN",
+  metadata: (access) => {
+    return { exportName: access.exportName, file: access.file, line: access.line, method: access.method };
+  },
+  name: "container_instance_key_from_user_input",
+  remediation: `Derive the container instance key from a server-trusted identity (e.g. \`\${ctx.auth.userId}\`) or a record the caller owns — never pass request input straight to \`ctx.containers.<name>.get\`.`,
+  title: "Possible cross-tenant IDOR from arg-derived unscoped container key"
+});
+
+export { containerInstanceKeyFromUserInput as default };

package/dist/packem_shared/containerRuntimeEgressRelaxation-B0LlfmDA.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const containerRuntimeEgressRelaxation = {
+  categories: ["SECURITY"],
+  description: "A runtime `.egress.allow(...)` / `.egress.deny(...)` / `.egress.setAllowed(...)` call mutates the container's egress firewall at runtime, re-opening a network surface the static analysis assumes is locked to the `defineContainer` declaration.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "container_runtime_egress_relaxation",
+  remediation: "Prefer declaring the egress policy statically in `lunora/containers.ts` where it is auditable. When a runtime mutation is unavoidable, scope it behind a server-trusted check and keep the change narrow (a specific host, not a broad allow) rather than an unconditional relaxation.",
+  run: (context) => {
+    if (context.containerOverrides === void 0) {
+      return [];
+    }
+    return context.containerOverrides.filter((override) => override.kind === "egress_relaxation").map(
+      (override) => emit(containerRuntimeEgressRelaxation, {
+        cacheKey: `container_runtime_egress_relaxation:${override.file}:${override.line.toString()}`,
+        detail: `\`${override.exportName}\` calls \`.egress.${override.detail}(...)\` at runtime, mutating the container's egress firewall.`,
+        metadata: { exportName: override.exportName, file: override.file, line: override.line, method: override.detail }
+      })
+    );
+  },
+  source: "static",
+  title: "Runtime egress mutation relaxes the container firewall"
+};
+
+export { containerRuntimeEgressRelaxation as default };