@lunora/advisor 1.0.0-alpha.2 → 1.0.0-alpha.20

package/dist/packem_shared/storagePresignedUrlForPrivateContent-yGmb8uqz.mjs

@@ -0,0 +1,47 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const SIGNER_METHODS = /* @__PURE__ */ new Set(["getPresignedUrl", "getSignedUrl"]);
+const NEAR_MAX_EXPIRES_THRESHOLD_SECONDS = 6 * 24 * 60 * 60;
+const isNativePresignedCall = (row) => row.method === "getPresignedUrl";
+const isNearExpiryCeiling = (row) => SIGNER_METHODS.has(row.method) && row.expiresInSeconds !== void 0 && row.expiresInSeconds >= NEAR_MAX_EXPIRES_THRESHOLD_SECONDS;
+const storagePresignedUrlForPrivateContent = {
+  categories: ["SECURITY"],
+  description: "`ctx.storage.getPresignedUrl(...)` mints a native S3 SigV4 URL that resolves directly against R2, bypassing the Worker's auth/RLS/rate-limit entirely — the wrong choice for private or policy-gated content. Either signer minting an `expiresInSeconds` near the shared 7-day ceiling also hands out a long-lived bearer credential.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "storage_presigned_url_for_private_content",
+  remediation: "For private/per-user/policy-gated content, use `getSignedUrl` (resolves back through the Worker, so your auth/RLS/rate-limit gates still run) instead of `getPresignedUrl`. Reserve `getPresignedUrl` for genuinely public or bulk content. On either signer, keep `expiresInSeconds` as short as the use case allows — well under the 7-day ceiling — rather than minting a near-maximum-lifetime URL.",
+  run: (context) => {
+    if (context.storageUploads === void 0) {
+      return [];
+    }
+    return context.storageUploads.filter((row) => isNativePresignedCall(row) || isNearExpiryCeiling(row)).map((row) => {
+      const native = isNativePresignedCall(row);
+      const nearCeiling = isNearExpiryCeiling(row);
+      const location = `\`${row.exportName}\` (${row.file}:${row.line.toString()})`;
+      let detail;
+      if (native && nearCeiling) {
+        detail = `\`ctx.storage.getPresignedUrl\` in ${location} mints a native S3 SigV4 URL — bypasses the Worker's auth/RLS/rate-limit entirely — with an \`expiresInSeconds\` of ${(row.expiresInSeconds ?? 0).toString()}s, near the 7-day signing ceiling.`;
+      } else if (native) {
+        detail = `\`ctx.storage.getPresignedUrl\` in ${location} mints a native S3 SigV4 URL that resolves directly against R2, bypassing the Worker's auth/RLS/rate-limit entirely. Use \`getSignedUrl\` for app-gated access to private content.`;
+      } else {
+        detail = `\`ctx.storage.${row.method}\` in ${location} requests an \`expiresInSeconds\` of ${(row.expiresInSeconds ?? 0).toString()}s, near the 7-day signing ceiling — a leaked link stays valid for almost a week.`;
+      }
+      return emit(storagePresignedUrlForPrivateContent, {
+        cacheKey: `storage_presigned_url_for_private_content:${row.file}:${row.line.toString()}`,
+        detail,
+        metadata: {
+          expiresInSeconds: row.expiresInSeconds,
+          exportName: row.exportName,
+          file: row.file,
+          line: row.line,
+          method: row.method
+        }
+      });
+    });
+  },
+  source: "static",
+  title: "Native presigned URL or near-max-TTL signed URL for private content"
+};
+
+export { storagePresignedUrlForPrivateContent as default };

package/dist/packem_shared/storageUploadWithoutContentTypeAllowlist-BV-gF1lT.mjs

@@ -0,0 +1,27 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const UPLOAD_METHODS = /* @__PURE__ */ new Set(["store", "upload"]);
+const storageUploadWithoutContentTypeAllowlist = {
+  categories: ["SECURITY"],
+  description: "A `ctx.storage.upload`/`store` call has no `allowedContentTypes` allowlist, so an uploader can store any content-type — including `text/html` or `image/svg+xml` — which, served back from `publicBaseUrl`, is a stored-XSS vector against your own origin.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "storage_upload_without_content_type_allowlist",
+  remediation: 'Pass `allowedContentTypes: ["image/png", "image/jpeg", …]` to `ctx.storage.upload`/`store` so an uploaded object\'s `contentType` must match an approved list. Reject anything HTML/SVG/script-executable unless the app genuinely needs to serve it.',
+  run: (context) => {
+    if (context.storageUploads === void 0) {
+      return [];
+    }
+    return context.storageUploads.filter((row) => UPLOAD_METHODS.has(row.method) && row.analyzable && !row.presentKeys.includes("allowedContentTypes")).map(
+      (row) => emit(storageUploadWithoutContentTypeAllowlist, {
+        cacheKey: `storage_upload_without_content_type_allowlist:${row.file}:${row.line.toString()}`,
+        detail: `\`ctx.storage.${row.method}\` in \`${row.exportName}\` (${row.file}:${row.line.toString()}) has no \`allowedContentTypes\` allowlist — any content-type is accepted, including \`text/html\`/\`image/svg+xml\`, a stored-XSS risk if the object is served from \`publicBaseUrl\`.`,
+        metadata: { exportName: row.exportName, file: row.file, line: row.line, method: row.method }
+      })
+    );
+  },
+  source: "static",
+  title: "Storage upload with no content-type allowlist"
+};
+
+export { storageUploadWithoutContentTypeAllowlist as default };

package/dist/packem_shared/storageUploadWithoutMaxSize-DpxO59wU.mjs

@@ -0,0 +1,27 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const UPLOAD_METHODS = /* @__PURE__ */ new Set(["store", "upload"]);
+const storageUploadWithoutMaxSize = {
+  categories: ["SECURITY"],
+  description: "A `ctx.storage.upload`/`store` call has no `maxSize` cap, so a caller can push an unbounded body straight into R2 through the Worker — unbounded storage/billing exhaustion, and for a streamed body, unbounded worker time.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "storage_upload_without_max_size",
+  remediation: "Pass a `maxSize` (bytes) to `ctx.storage.upload`/`store` sized to the largest legitimate object the app accepts. `ArrayBuffer`/`Blob` bodies are rejected up front when oversized; a `ReadableStream` body is aborted mid-transfer once the limit is exceeded.",
+  run: (context) => {
+    if (context.storageUploads === void 0) {
+      return [];
+    }
+    return context.storageUploads.filter((row) => UPLOAD_METHODS.has(row.method) && row.analyzable && !row.presentKeys.includes("maxSize")).map(
+      (row) => emit(storageUploadWithoutMaxSize, {
+        cacheKey: `storage_upload_without_max_size:${row.file}:${row.line.toString()}`,
+        detail: `\`ctx.storage.${row.method}\` in \`${row.exportName}\` (${row.file}:${row.line.toString()}) has no \`maxSize\` cap — a caller can push an unbounded body into R2, exhausting storage/billing.`,
+        metadata: { exportName: row.exportName, file: row.file, line: row.line, method: row.method }
+      })
+    );
+  },
+  source: "static",
+  title: "Storage upload with no size cap"
+};
+
+export { storageUploadWithoutMaxSize as default };

package/dist/packem_shared/{userCreatingMutationWithoutCaptcha-CH31YsUZ.mjs → userCreatingMutationWithoutCaptcha-2DZtWIPb.mjs}

@@ -1,4 +1,5 @@
 import { e as emit } from './finding-Dm_zvzS1.mjs';
+import { i as isPublicWrite } from './helpers-BySnKhVB.mjs';
 
 const userCreatingMutationWithoutCaptcha = {
   categories: ["SECURITY"],
@@ -13,9 +14,8 @@ const userCreatingMutationWithoutCaptcha = {
     }
     const findings = [];
     for (const procedure of context.procedureProtections) {
-      const isPublicWrite = procedure.visibility === "public" && (procedure.kind === "mutation" || procedure.kind === "action");
       const sensitive = procedure.writesUserTable || procedure.callsMail;
-      if (!isPublicWrite || !sensitive || procedure.usesCaptcha) {
+      if (!isPublicWrite(procedure) || !sensitive || procedure.usesCaptcha) {
         continue;
       }
       const reason = procedure.writesUserTable ? "writes a user/session table" : "sends mail";

package/dist/packem_shared/vectorsNamespaceFromUserInput-CQhr5bVn.mjs

@@ -0,0 +1,19 @@
+import { m as makeArgumentDerivedSinkLint } from './argument-derived-sink-C1xTTqAt.mjs';
+
+const vectorsNamespaceFromUserInput = makeArgumentDerivedSinkLint({
+  cacheKey: (access) => `vectors_namespace_from_user_input:${access.file}:${access.line.toString()}`,
+  categories: ["SECURITY"],
+  description: "A `ctx.vectors.query`/`upsert`/`upsertMany` call uses a `namespace` derived from the handler's `args` with no server-side scoping. A Vectorize namespace partitions one index into isolated sub-collections, so an unscoped namespace lets any caller read or poison another tenant's vectors.",
+  detail: (access) => `\`ctx.vectors.${access.method}\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) uses a Vectorize namespace derived from \`args\` with no server-side scoping — any caller can read or poison another tenant's vectors. Derive the namespace from a server-trusted identity (e.g. \`\${ctx.auth.orgId}\`), never from \`args\`.`,
+  facing: "EXTERNAL",
+  getAccesses: (context) => context.vectorNamespaceAccesses,
+  level: "WARN",
+  metadata: (access) => {
+    return { exportName: access.exportName, file: access.file, line: access.line, method: access.method };
+  },
+  name: "vectors_namespace_from_user_input",
+  remediation: `Derive the \`namespace\` from a server-trusted identity (e.g. \`\${ctx.auth.orgId}\`), never from \`args\`.`,
+  title: "Vectorize namespace derived from unscoped user input"
+});
+
+export { vectorsNamespaceFromUserInput as default };

package/dist/packem_shared/workflowDuplicateStepName-ioBxPBCy.mjs

@@ -0,0 +1,48 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const workflowDuplicateStepName = {
+  categories: ["SCHEMA"],
+  description: "Two durable steps in this workflow share a name. Cloudflare memoizes a step by its name, so on replay the second call returns the first step's cached result instead of running its body — silently skipping the work without an error.",
+  facing: "INTERNAL",
+  level: "ERROR",
+  // eslint-disable-next-line no-secrets/no-secrets -- the lint's rule id, not a credential
+  name: "workflow_duplicate_step_name",
+  remediation: "Give every `step.do` / `step.sleep` / `step.sleepUntil` / `step.waitForEvent` call in the workflow a unique name. If a step legitimately repeats (e.g. a loop), make the name distinct per iteration by interpolating the item id into the step name.",
+  run: (context) => {
+    if (context.workflows === void 0) {
+      return [];
+    }
+    const findings = [];
+    for (const workflow of context.workflows) {
+      const { steps } = workflow;
+      if (steps === void 0 || steps.length === 0) {
+        continue;
+      }
+      const firstLineByName = /* @__PURE__ */ new Map();
+      const reported = /* @__PURE__ */ new Set();
+      for (const step of steps) {
+        const firstLine = firstLineByName.get(step.name);
+        if (firstLine === void 0) {
+          firstLineByName.set(step.name, step.line);
+          continue;
+        }
+        if (reported.has(step.name)) {
+          continue;
+        }
+        reported.add(step.name);
+        findings.push(
+          emit(workflowDuplicateStepName, {
+            cacheKey: `workflow_duplicate_step_name:${workflow.exportName}:${step.name}`,
+            detail: `Workflow "${workflow.exportName}" reuses the durable step name "${step.name}" (first at line ${String(firstLine)}, again at line ${String(step.line)}). The second call returns the first's cached result instead of running.`,
+            metadata: { firstLine, line: step.line, stepName: step.name, workflow: workflow.exportName }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Duplicate durable step name in workflow"
+};
+
+export { workflowDuplicateStepName as default };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/advisor",
-  "version": "1.0.0-alpha.2",
+  "version": "1.0.0-alpha.20",
   "description": "Schema & query lints (splinter-style advisors) for Lunora, feeding the Studio Advisors view",
   "keywords": [
     "advisor",
@@ -25,7 +25,7 @@
     "directory": "packages/advisor"
   },
   "files": [
-    "dist",
+    "./dist",
     "README.md",
     "LICENSE.md",
     "__assets__"
@@ -46,7 +46,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/server": "1.0.0-alpha.1"
+    "@lunora/errors": "1.0.0-alpha.2",
+    "@lunora/server": "1.0.0-alpha.17"
   },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"

package/dist/packem_shared/helpers-DNCkMWZQ.mjs

@@ -1,4 +0,0 @@
-const SYSTEM_FIELDS = /* @__PURE__ */ new Set(["_creationTime", "_id"]);
-const tableColumnSet = (table) => /* @__PURE__ */ new Set([...SYSTEM_FIELDS, ...table.fields]);
-
-export { tableColumnSet as t };