@lunora/advisor 1.0.0-alpha.2 → 1.0.0-alpha.21

package/dist/packem_shared/containerStartEnableInternetOverride-DDaHZQ1L.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const containerStartEnableInternetOverride = {
+  categories: ["SECURITY"],
+  description: "A runtime `.start({ enableInternet: true, … })` call overrides the static `defineContainer` declaration and re-opens public internet egress for that container instance, defeating the `container_public_internet` lint's assumption that the declaration is authoritative.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "container_start_enable_internet_override",
+  remediation: "Avoid overriding `enableInternet` at `.start()` time. Set it once on the `defineContainer` declaration in `lunora/containers.ts` so the static advisors can reason about it, and gate any runtime opt-in behind a server-trusted check rather than an unconditional literal.",
+  run: (context) => {
+    if (context.containerOverrides === void 0) {
+      return [];
+    }
+    return context.containerOverrides.filter((override) => override.kind === "enable_internet").map(
+      (override) => emit(containerStartEnableInternetOverride, {
+        cacheKey: `container_start_enable_internet_override:${override.file}:${override.line.toString()}`,
+        detail: `\`${override.exportName}\` calls \`.start({ enableInternet: true })\`, overriding the container's static egress posture.`,
+        metadata: { exportName: override.exportName, file: override.file, line: override.line }
+      })
+    );
+  },
+  source: "static",
+  title: "Runtime .start() override re-enables container internet access"
+};
+
+export { containerStartEnableInternetOverride as default };

package/dist/packem_shared/externalSourceOnGlobal-Bg-NfCX9.mjs

@@ -0,0 +1,30 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const externalSourceOnGlobal = {
+  categories: ["SCHEMA"],
+  description: "A table is both `.source(...)` and `.global()`. A global table lives in the external/global tier; a sourced table is materialized into a shard DO's SQLite — the two are mutually exclusive.",
+  facing: "INTERNAL",
+  level: "ERROR",
+  name: "external_source_on_global",
+  remediation: 'Drop either `.source(...)` or `.global()`. To ingest an external database into per-tenant DOs, use `.source(...)` with `.shardBy(...)`; to read it in place as a global table, use `.global({ backend: "hyperdrive" })`.',
+  run: (context) => {
+    const findings = [];
+    for (const table of context.schema.tables) {
+      if (table.externalSource === void 0 || table.shardKind !== "global") {
+        continue;
+      }
+      findings.push(
+        emit(externalSourceOnGlobal, {
+          cacheKey: `external_source_on_global:${table.name}`,
+          detail: `Table \`${table.name}\` is both \`.source(...)\` and \`.global()\` — contradictory. A sourced table materializes into a shard DO's SQLite; a global table lives in the external tier.`,
+          metadata: { table: table.name }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Sourced table cannot also be global"
+};
+
+export { externalSourceOnGlobal as default };

package/dist/packem_shared/externalSourceUnscoped-5vT-Bup3.mjs

@@ -0,0 +1,44 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const externalSourceUnscoped = {
+  categories: ["SECURITY"],
+  description: "A `.source(...)` table that is also `.shardBy(...)` has no `tenantBy` mapper, so every tenant's Durable Object runs the same unscoped query and replicates the whole multitenant table — a cross-tenant data leak.",
+  facing: "EXTERNAL",
+  level: "ERROR",
+  name: "external_source_unscoped",
+  remediation: "Add `tenantBy: (shardKey) => [shardKey]` (matching the query's bound parameters) so each shard DO pulls only its own tenant's rows. The shard key MUST bind into the source `WHERE`.",
+  run: (context) => {
+    const findings = [];
+    for (const table of context.schema.tables) {
+      if (table.externalSource === void 0 || table.shardKind !== "shardBy") {
+        continue;
+      }
+      if (table.externalSource.unanalyzable) {
+        findings.push(
+          emit(externalSourceUnscoped, {
+            cacheKey: `external_source_unscoped:${table.name}`,
+            detail: `Table \`${table.name}\` is \`.source(...)\` + \`.shardBy(...)\` but its source config is not a static object literal, so \`tenantBy\` can't be verified. Confirm \`tenantBy\` binds the shard key into the query, or inline the config so the linter can check it — an unscoped query leaks every tenant's rows into each DO.`,
+            level: "WARN",
+            metadata: { table: table.name }
+          })
+        );
+        continue;
+      }
+      if (table.externalSource.hasTenantBy) {
+        continue;
+      }
+      findings.push(
+        emit(externalSourceUnscoped, {
+          cacheKey: `external_source_unscoped:${table.name}`,
+          detail: `Table \`${table.name}\` is \`.source(...)\` + \`.shardBy(...)\` but declares no \`tenantBy\` — every tenant DO would pull the whole table. Add a \`tenantBy\` that binds the shard key into the query.`,
+          metadata: { table: table.name }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Sourced + sharded table is not tenant-scoped"
+};
+
+export { externalSourceUnscoped as default };

package/dist/packem_shared/flagGatesSecurityWithUnsafeDefault-BhIs0shr.mjs

@@ -0,0 +1,41 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const PROTECT_TOKENS = /* @__PURE__ */ new Set(["enforce", "gate", "lockdown", "rls"]);
+const PERMIT_TOKENS = /* @__PURE__ */ new Set(["allow", "bypass", "permit"]);
+const ACRONYM_WORD_BOUNDARY = /(?<=[A-Z])(?=[A-Z][a-z])/gu;
+const CAMEL_HUMP_BOUNDARY = /(?<=[a-z0-9])(?=[A-Z])/gu;
+const NON_ALPHANUMERIC_RUN = /[^a-z0-9]+/u;
+const tokenize = (key) => key.replaceAll(ACRONYM_WORD_BOUNDARY, " ").replaceAll(CAMEL_HUMP_BOUNDARY, " ").toLowerCase().split(NON_ALPHANUMERIC_RUN).filter((token) => token.length > 0);
+const hasUnsafeDefault = (row) => {
+  const tokens = tokenize(row.key);
+  const isProtect = tokens.some((token) => PROTECT_TOKENS.has(token));
+  const isPermit = tokens.some((token) => PERMIT_TOKENS.has(token));
+  if (isProtect === isPermit) {
+    return false;
+  }
+  return isProtect ? !row.defaultValue : row.defaultValue;
+};
+const flagGatesSecurityWithUnsafeDefault = {
+  categories: ["SECURITY"],
+  description: "A `ctx.flags.boolean(key, default)` read on a security-shaped key has a fail-open default that selects the permissive branch. OpenFeature returns the default when the provider errors, so an outage silently disables a protection (a `false` default on an `enforce`/`rls`/`gate`/`lockdown` key) or grants a permission (a `true` default on an `allow`/`permit`/`bypass` key).",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "flag_gates_security_with_unsafe_default",
+  remediation: "Flip the default so a provider outage fails closed: default a protection flag (`enforce*`/`rls*`/`gate*`/`lockdown*`) to `true`, and a permission/bypass flag (`allow*`/`permit*`/`bypass*`) to `false`. The safe default is always the restrictive branch — never let an unreachable flag backend open access.",
+  run: (context) => {
+    if (context.flagSecurityDefaults === void 0) {
+      return [];
+    }
+    return context.flagSecurityDefaults.filter((row) => hasUnsafeDefault(row)).map(
+      (row) => emit(flagGatesSecurityWithUnsafeDefault, {
+        cacheKey: `flag_gates_security_with_unsafe_default:${row.file}:${row.line.toString()}`,
+        detail: `\`ctx.flags.boolean("${row.key}", ${String(row.defaultValue)})\` in \`${row.exportName}\` (${row.file}:${row.line.toString()}) fails open to the permissive branch — a provider outage returns \`${String(row.defaultValue)}\`, ${row.defaultValue ? "granting the guarded permission" : "disabling the guarded protection"}.`,
+        metadata: { defaultValue: row.defaultValue, exportName: row.exportName, file: row.file, key: row.key, line: row.line }
+      })
+    );
+  },
+  source: "static",
+  title: "Security flag fails open to the permissive branch"
+};
+
+export { flagGatesSecurityWithUnsafeDefault as default };

package/dist/packem_shared/{fromServerSchema-DinF1nph.mjs → fromServerSchema-BiB6JSiW.mjs}

@@ -1,5 +1,6 @@
 const fromServerSchema = (schema) => {
   return {
+    rlsMode: schema.rlsMode,
     tables: Object.entries(schema.tables).map(([name, table]) => {
       const indexes = [
         ...table.indexes.map((index) => {
@@ -28,10 +29,18 @@ const fromServerSchema = (schema) => {
       }
       return {
         externallyManaged: table.isExternallyManaged ?? false,
+        externalSource: table.externalSource ? {
+          hasReconcile: table.externalSource.reconcileEveryMs !== void 0,
+          hasTenantBy: table.externalSource.tenantBy !== void 0,
+          mode: table.externalSource.mode
+        } : void 0,
         fields: Object.keys(table.shape),
         indexes,
+        isPublic: table.isPublic ?? false,
         name,
         optionalFields,
+        shardKind: table.shardMode.kind,
+        softDelete: table.softDeleteMode,
         relations: Object.entries(table.relationMap).map(([accessor, relation]) => {
           return {
             field: relation.field,

package/dist/packem_shared/helpers-BySnKhVB.mjs

@@ -0,0 +1,31 @@
+const OWNERSHIP_FIELD_NAMES = /* @__PURE__ */ new Set([
+  "accountId",
+  "authorId",
+  "createdBy",
+  "createdById",
+  "organizationId",
+  "orgId",
+  "ownerId",
+  "tenantId",
+  "updatedBy",
+  "userId",
+  "workspaceId"
+]);
+const PII_FIELD_NAMES = /* @__PURE__ */ new Set([
+  "address",
+  "dateOfBirth",
+  "dob",
+  "email",
+  "firstName",
+  "lastName",
+  "phone",
+  "phoneNumber",
+  "socialSecurityNumber",
+  "ssn"
+]);
+const SYSTEM_FIELDS = /* @__PURE__ */ new Set(["_creationTime", "_id"]);
+const ownershipOrPiiColumns = (table) => table.fields.filter((field) => OWNERSHIP_FIELD_NAMES.has(field) || PII_FIELD_NAMES.has(field));
+const tableColumnSet = (table) => /* @__PURE__ */ new Set([...SYSTEM_FIELDS, ...table.fields]);
+const isPublicWrite = (procedure) => procedure.visibility === "public" && (procedure.kind === "mutation" || procedure.kind === "action");
+
+export { PII_FIELD_NAMES as P, isPublicWrite as i, ownershipOrPiiColumns as o, tableColumnSet as t };

package/dist/packem_shared/httpActionMissingAuthGuard-CxipddNx.mjs

@@ -0,0 +1,35 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const surfaceLabel = (kind, method) => kind === "httpRoute" && method ? `\`httpRoute\` ${method} handler` : "`httpAction` handler";
+const httpActionMissingAuthGuard = {
+  categories: ["SECURITY"],
+  description: "An `httpAction`/`httpRoute` handler performs a side effect (`ctx.runMutation`/`ctx.runAction`/a `ctx.db` write) but never reads `ctx.auth` — an unauthenticated HTTP endpoint driving a state change, bypassing the identity/RLS checks that guard the rest of the app.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "http_action_missing_auth_guard",
+  remediation: "Read `ctx.auth` in the handler before the side effect — call `await ctx.auth.getIdentity()` (or check `ctx.auth.userId`) and reject unauthenticated/unauthorized requests, or forward through a `mutation`/`action` whose RLS policies enforce access. If the endpoint is intentionally public (e.g. a signed webhook), verify the provider signature before the write.",
+  run: (context) => {
+    if (context.httpActionGuards === void 0) {
+      return [];
+    }
+    return context.httpActionGuards.filter((row) => !row.readsAuth).map((row) => {
+      const surface = surfaceLabel(row.kind, row.method);
+      return emit(httpActionMissingAuthGuard, {
+        cacheKey: `http_action_missing_auth_guard:${row.file}:${row.line.toString()}`,
+        detail: `${surface} \`${row.exportName}\` (${row.file}:${row.line.toString()}) calls \`ctx.${row.sideEffect}\` but never reads \`ctx.auth\` — an anonymous caller can drive this write. Authenticate the request before the side effect.`,
+        metadata: {
+          exportName: row.exportName,
+          file: row.file,
+          kind: row.kind,
+          line: row.line,
+          sideEffect: row.sideEffect,
+          ...row.method ? { method: row.method } : {}
+        }
+      });
+    });
+  },
+  source: "static",
+  title: "Unauthenticated HTTP handler performs a side effect"
+};
+
+export { httpActionMissingAuthGuard as default };

package/dist/packem_shared/httpActionResponseHeaderInjection-DOFS7pFT.mjs

@@ -0,0 +1,39 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const VIA_LABELS = {
+  "headers-append": "a `headers.append(...)` call",
+  "headers-ctor": "a `new Headers({...})` initializer",
+  "headers-set": "a `headers.set(...)` call",
+  "response-init": "a `Response` init `headers` object"
+};
+const httpActionResponseHeaderInjection = {
+  categories: ["SECURITY"],
+  description: "An `httpAction` handler writes a response-header value derived from raw request input (`request.headers`/URL/query/body) with no CR/LF sanitizer. A `Request`-derived string placed verbatim into a response header lets a caller smuggle `\\r\\n` and inject extra headers or split the response (HTTP response splitting / header injection).",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "http_action_response_header_injection",
+  remediation: "Never place a raw request value into a response header. Route it through a CR/LF guard (`isSafeHeaderValue` from `@lunora/server`, rejecting values containing `\\r`/`\\n`/`\\0`), URL-encode it (`encodeURIComponent`), or coerce it to a number — before writing the header. `String(...)` / `.toString()` do NOT strip CR/LF and are not sufficient.",
+  run: (context) => {
+    if (context.httpHeaderWrites === void 0) {
+      return [];
+    }
+    return context.httpHeaderWrites.map((row) => {
+      const header = row.headerName === "" ? "a response header" : `the \`${row.headerName}\` response header`;
+      return emit(httpActionResponseHeaderInjection, {
+        cacheKey: `http_action_response_header_injection:${row.file}:${row.line.toString()}`,
+        detail: `\`${row.exportName}\` (${row.file}:${row.line.toString()}) writes ${header} from raw request input via ${VIA_LABELS[row.via]} with no CR/LF guard — a caller can smuggle \`\\r\\n\` to inject headers or split the response. Route the value through \`isSafeHeaderValue\` or \`encodeURIComponent\` first.`,
+        metadata: {
+          exportName: row.exportName,
+          file: row.file,
+          headerName: row.headerName,
+          line: row.line,
+          via: row.via
+        }
+      });
+    });
+  },
+  source: "static",
+  title: "Response header written from unsanitized request input"
+};
+
+export { httpActionResponseHeaderInjection as default };

package/dist/packem_shared/identityUndeclaredClaimTrusted-D8nXV2dd.mjs

@@ -0,0 +1,32 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const identityUndeclaredClaimTrusted = {
+  categories: ["SECURITY"],
+  description: "An authorization read of `auth.identity.<key>` for a claim outside the declared `defineIdentity({ ... })` contract. `defineIdentity` validates only declared claims and forwards undeclared ones verbatim, so the value the policy trusts was never validated — an attacker's token can forge it.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "identity_undeclared_claim_trusted",
+  remediation: "Declare the claim in `defineIdentity({ ... })` (e.g. `role: v.optional(v.string())`) so the worker validates it at the trust boundary before a policy reads it, or stop trusting it for authorization. Declared claims (and `userId`) are validated; undeclared claims are forwarded unchecked.",
+  run: (context) => {
+    if (context.identityClaimReads === void 0) {
+      return [];
+    }
+    return context.identityClaimReads.filter((row) => !row.declared).map((row) => {
+      const location = `\`${row.exportName}\` (${row.file}:${row.line.toString()})`;
+      return emit(identityUndeclaredClaimTrusted, {
+        cacheKey: `identity_undeclared_claim_trusted:${row.file}:${row.line.toString()}:${row.key}`,
+        detail: `\`${row.key}\` in ${location} is read off \`identity\` but is not declared in \`defineIdentity({ ... })\`. Undeclared claims are forwarded unvalidated, so this authorization decision trusts a forgeable value.`,
+        metadata: {
+          exportName: row.exportName,
+          file: row.file,
+          key: row.key,
+          line: row.line
+        }
+      });
+    });
+  },
+  source: "static",
+  title: "Authorization trusts an undeclared identity claim"
+};
+
+export { identityUndeclaredClaimTrusted as default };

package/dist/packem_shared/imagesUrlSourceFromUserInput-YcDQ0b_Y.mjs

@@ -0,0 +1,19 @@
+import { m as makeArgumentDerivedSinkLint } from './argument-derived-sink-C1xTTqAt.mjs';
+
+const imagesUrlSourceFromUserInput = makeArgumentDerivedSinkLint({
+  cacheKey: (access) => `images_url_source_from_user_input:${access.file}:${access.line.toString()}`,
+  categories: ["SECURITY"],
+  description: "A `buildImageDeliveryUrl({ key, … })` call's `key` — the CDN transform's source image, an absolute URL or an origin-relative key — is derived from the handler's `args` with no server-side scoping, so any caller can point the CDN's on-the-fly transform at an attacker-chosen origin (SSRF / open proxy) or an arbitrary key under the account's own store.",
+  detail: (access) => `\`buildImageDeliveryUrl\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) builds its delivery URL from a \`key\` derived from \`args\` with no server-side scoping — any caller can point the CDN's on-the-fly transform at an attacker-chosen origin or store key. Validate \`key\` against an allowlist, or derive it from server-trusted state.`,
+  facing: "EXTERNAL",
+  getAccesses: (context) => context.imageDeliveryUrlAccesses,
+  level: "WARN",
+  metadata: (access) => {
+    return { exportName: access.exportName, file: access.file, line: access.line };
+  },
+  name: "images_url_source_from_user_input",
+  remediation: "Validate `key` against an allowlist of known origins/prefixes before calling `buildImageDeliveryUrl`, or derive it from server-trusted state (a stored record's own image key) rather than passing `args` straight through.",
+  title: "Image delivery URL built from unscoped user input"
+});
+
+export { imagesUrlSourceFromUserInput as default };

package/dist/packem_shared/{indexReferencesUnknownField-DH0_dbUY.mjs → indexReferencesUnknownField-BSWNngxX.mjs}

@@ -1,5 +1,5 @@
 import { e as emit } from './finding-Dm_zvzS1.mjs';
-import { t as tableColumnSet } from './helpers-DNCkMWZQ.mjs';
+import { t as tableColumnSet } from './helpers-BySnKhVB.mjs';
 
 const indexReferencesUnknownField = {
   categories: ["SCHEMA"],

package/dist/packem_shared/insertManyUnsafeUserData-Dn77XpmX.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const insertManyUnsafeUserData = {
+  categories: ["SECURITY"],
+  description: "A public procedure calls `ctx.db.insertManyUnsafe(...)`, which writes rows straight to storage and bypasses both the per-row validators and the schema's insert triggers (server-trusted columns, ownership stamping, RLS write checks). On a public entry point the rows are request-shaped, so a caller can write columns they shouldn't control and skip every trigger-enforced invariant.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "insert_many_unsafe_user_data",
+  remediation: "Use the validated `ctx.db.insert(...)` path in public procedures so validators and insert triggers run. If you need the unsafe bulk write, move it into an internal function (`internalMutation`/`internalAction`) that is fed only server-constructed rows, never request input.",
+  run: (context) => {
+    if (context.procedureProtections === void 0) {
+      return [];
+    }
+    return context.procedureProtections.filter((procedure) => procedure.usesInsertManyUnsafe && procedure.visibility === "public").map(
+      (procedure) => emit(insertManyUnsafeUserData, {
+        cacheKey: `insert_many_unsafe_user_data:${procedure.file}:${procedure.exportName}`,
+        detail: `\`${procedure.exportName}\` (${procedure.file}) is public and calls \`ctx.db.insertManyUnsafe(...)\`, bypassing validators and insert triggers on request-shaped rows. Switch to \`ctx.db.insert(...)\`, or move the bulk write into an internal function fed server-built rows.`,
+        metadata: { exportName: procedure.exportName, file: procedure.file, kind: procedure.kind }
+      })
+    );
+  },
+  source: "static",
+  title: "Public procedure uses insertManyUnsafe (bypasses validators and triggers)"
+};
+
+export { insertManyUnsafeUserData as default };

package/dist/packem_shared/kvUnscopedUserKeyIdor-YWwmfE8X.mjs

@@ -0,0 +1,19 @@
+import { m as makeArgumentDerivedSinkLint } from './argument-derived-sink-C1xTTqAt.mjs';
+
+const kvUnscopedUserKeyIdor = makeArgumentDerivedSinkLint({
+  cacheKey: (access) => `kv_unscoped_user_key_idor:${access.file}:${access.line.toString()}`,
+  categories: ["SECURITY"],
+  description: "A `ctx.kv` read/write uses a namespace key derived from the handler's `args` with no server-side scoping. Workers KV is a flat namespace, so an unscoped key lets any caller read, overwrite, or delete another user's entry — an insecure direct object reference (IDOR).",
+  detail: (access) => `\`ctx.kv.${access.method}\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) uses a KV key derived from \`args\` with no server-side scoping — any caller can read/overwrite/delete another user's entry (IDOR). Prefix the key with a server-trusted identity (e.g. \`\${ctx.auth.userId}:…\`).`,
+  facing: "EXTERNAL",
+  getAccesses: (context) => context.kvKeyAccesses,
+  level: "ERROR",
+  metadata: (access) => {
+    return { exportName: access.exportName, file: access.file, line: access.line, method: access.method };
+  },
+  name: "kv_unscoped_user_key_idor",
+  remediation: `Prefix every \`ctx.kv\` key with a server-trusted identity (e.g. \`\${ctx.auth.userId}:\${args.id}\`) so a caller can only address their own entries. Never pass request input straight to \`ctx.kv.get\`/\`put\`/\`delete\`.`,
+  title: "Possible IDOR from arg-derived unscoped KV key"
+});
+
+export { kvUnscopedUserKeyIdor as default };

package/dist/packem_shared/mailInboundDispatchWithoutVerify-CHSRA8zz.mjs

@@ -0,0 +1,28 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const mailInboundDispatchWithoutVerify = {
+  categories: ["SECURITY"],
+  description: "`createInboundEmailHandler({...})` has no `verify` hook, so it trusts every inbound message — the `from` address is spoofable and DKIM/SPF/DMARC verdicts go unchecked. If the handler dispatches into a Lunora function (admin bearer, RLS disabled), a forged sender can drive privileged writes (a confused-deputy escalation).",
+  facing: "EXTERNAL",
+  level: "ERROR",
+  // eslint-disable-next-line no-secrets/no-secrets -- the lint's rule id, not a credential
+  name: "mail_inbound_dispatch_without_verify",
+  remediation: "Pass a `verify` hook to `createInboundEmailHandler({...})` that rejects the message unless its DKIM/SPF/DMARC authentication verdicts pass and the sender is expected — before any dispatch into a Lunora function. Never trust the `from` header alone.",
+  run: (context) => {
+    if (context.configCalls === void 0) {
+      return [];
+    }
+    return context.configCalls.filter((call) => call.callee === "createInboundEmailHandler" && call.analyzable && !call.presentKeys.includes("verify")).map(
+      (call) => emit(mailInboundDispatchWithoutVerify, {
+        // eslint-disable-next-line no-secrets/no-secrets -- the lint's rule id, not a credential
+        cacheKey: `mail_inbound_dispatch_without_verify:${call.file}:${call.line.toString()}`,
+        detail: `\`createInboundEmailHandler({...})\` in ${call.file}:${call.line.toString()} has no \`verify\` hook — it trusts the spoofable \`from\` address and unchecked DKIM/SPF/DMARC verdicts. A forged sender can then reach whatever the handler dispatches to (a Lunora function runs with the admin bearer and RLS disabled). Add a \`verify\` gate that enforces the authentication verdicts before dispatch.`,
+        metadata: { callee: call.callee, file: call.file, line: call.line }
+      })
+    );
+  },
+  source: "static",
+  title: "Inbound email handler without a verify hook"
+};
+
+export { mailInboundDispatchWithoutVerify as default };

package/dist/packem_shared/mailRecipientFromRequestInput-Cka2qu5J.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const mailRecipientFromRequestInput = {
+  categories: ["SECURITY"],
+  description: "A `ctx.mail`/`ctx.email` `send`/`queue` call sets a recipient field (to/cc/bcc) from the handler's `args` with no server-side scoping. Sending to an address taken straight from request input turns the deployment into an open relay / spam amplifier.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "mail_recipient_from_request_input",
+  remediation: "Derive recipients from server-trusted state (e.g. the authenticated user's own record via `ctx.auth`), never straight from `args`. If user-chosen recipients are intended, gate the path behind authentication and rate limiting.",
+  run: (context) => {
+    if (context.mailRecipientAccesses === void 0) {
+      return [];
+    }
+    return context.mailRecipientAccesses.map(
+      (access) => emit(mailRecipientFromRequestInput, {
+        cacheKey: `mail_recipient_from_request_input:${access.file}:${access.line.toString()}`,
+        detail: `\`ctx.mail.${access.method}\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) sets a recipient field (to/cc/bcc) derived from \`args\` with no server-side scoping — any caller can direct mail to an arbitrary address (open relay / spam amplifier). Derive the recipient from server-trusted state instead (e.g. \`ctx.auth.user.email\`).`,
+        metadata: { exportName: access.exportName, file: access.file, line: access.line, method: access.method }
+      })
+    );
+  },
+  source: "static",
+  title: "Mail recipient derived from request input"
+};
+
+export { mailRecipientFromRequestInput as default };

package/dist/packem_shared/maskWeakHashStrategyOnPii-1c4q8Opf.mjs

@@ -0,0 +1,35 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const PII_COLUMN_RE = /address|birthdate|creditcard|dateofbirth|dob|driverslicense|email|firstname|fullname|lastname|nationalid|passport|phone|socialsecurity|ssn|taxid/u;
+const isPiiColumn = (column) => PII_COLUMN_RE.test(column.replaceAll(/[^a-z0-9]/giu, "").toLowerCase());
+const maskWeakHashStrategyOnPii = {
+  categories: ["SECURITY"],
+  description: 'A `mask(policies)` column named like PII (email, SSN, phone, …) uses the `"hash"` strategy. `"hash"` is an unsalted 32-bit FNV-1a digest — brute-force-recoverable and cross-row-correlatable — not a confidentiality control, so it does not actually hide the value.',
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "mask_weak_hash_strategy_on_pii",
+  remediation: 'Use `"redact"` instead of `"hash"` for this column — e.g. `mask({ <table>: { <column>: "redact" } })`. Reserve `"hash"` for columns where a stable, joinable pseudonym is the goal and the value itself is not sensitive.',
+  run: (context) => {
+    if (context.maskStrategies === void 0) {
+      return [];
+    }
+    const findings = [];
+    for (const strategy of context.maskStrategies) {
+      if (strategy.strategy !== "hash" || !isPiiColumn(strategy.column)) {
+        continue;
+      }
+      findings.push(
+        emit(maskWeakHashStrategyOnPii, {
+          cacheKey: `mask_weak_hash_strategy_on_pii:${strategy.file}:${strategy.line.toString()}`,
+          detail: `\`${strategy.exportName}\` in ${strategy.file} masks \`${strategy.table === "" ? strategy.column : `${strategy.table}.${strategy.column}`}\` with \`"hash"\` — its name suggests PII, and \`"hash"\` is brute-force-recoverable and leaks cross-row equality. Use \`"redact"\` instead.`,
+          metadata: { column: strategy.column, exportName: strategy.exportName, file: strategy.file, table: strategy.table }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: 'Weak "hash" mask strategy on a PII column'
+};
+
+export { maskWeakHashStrategyOnPii as default };

package/dist/packem_shared/maskedRelationLeakViaWith-CPI4s0sl.mjs

@@ -0,0 +1,76 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const maskedTablesOf = (context) => {
+  const tables = /* @__PURE__ */ new Set();
+  for (const procedure of context.maskProcedures ?? []) {
+    for (const { table } of procedure.maskColumns) {
+      if (table !== "") {
+        tables.add(table);
+      }
+    }
+  }
+  for (const strategy of context.maskStrategies ?? []) {
+    if (strategy.table !== "") {
+      tables.add(strategy.table);
+    }
+  }
+  return tables;
+};
+const relationTargetsOf = (context) => {
+  const targets = /* @__PURE__ */ new Map();
+  for (const table of context.schema.tables) {
+    for (const relation of table.relations) {
+      targets.set(`${table.name} ${relation.name}`, relation.table);
+    }
+  }
+  return targets;
+};
+const maskedRelationLeakViaWith = {
+  categories: ["SECURITY"],
+  description: "A public read hydrates a masked table through a `with` relation. Column masking does not descend into `with`-hydrated relations, so the related table's masked columns are returned in the clear.",
+  facing: "EXTERNAL",
+  level: "INFO",
+  name: "masked_relation_leak_via_with",
+  remediation: "Don't hydrate a masked table through `with` on an unprotected read: drop the relation, project only non-sensitive columns, or route the parent read through a procedure that re-applies masking to the joined table. Masking is per-procedure and top-level only — it never reaches `with`-loaded relations.",
+  run: (context) => {
+    if (context.relationLoads === void 0) {
+      return [];
+    }
+    const maskedTables = maskedTablesOf(context);
+    if (maskedTables.size === 0) {
+      return [];
+    }
+    const relationTargets = relationTargetsOf(context);
+    const findings = [];
+    for (const row of context.relationLoads) {
+      if (row.visibility !== "public" || row.parentTable === "") {
+        continue;
+      }
+      for (const relation of row.relations) {
+        const target = relationTargets.get(`${row.parentTable} ${relation}`);
+        if (target === void 0 || !maskedTables.has(target)) {
+          continue;
+        }
+        findings.push(
+          emit(maskedRelationLeakViaWith, {
+            cacheKey: `masked_relation_leak_via_with:${row.file}:${row.line.toString()}:${row.parentTable}:${relation}`,
+            detail: `The public read in \`${row.exportName}\` (${row.file}:${row.line.toString()}) hydrates relation \`${relation}\` (masked table \`${target}\`) via \`with\` on \`${row.parentTable}\`. Masking is top-level only and does not descend into \`with\`, so \`${target}\`'s masked columns are returned in the clear.`,
+            metadata: {
+              exportName: row.exportName,
+              file: row.file,
+              line: row.line,
+              parentTable: row.parentTable,
+              relation,
+              relationTable: target
+            }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Masked table surfaced unmasked through a with-relation on a public read"
+};
+
+export { maskedRelationLeakViaWith as default };

package/dist/packem_shared/mutatorFullRowReplace-BJnNDaIV.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const mutatorFullRowReplace = {
+  categories: ["SCHEMA"],
+  description: "A custom mutator's `server` impl writes with `ctx.db.replace(id, document)` — a whole-row overwrite. On a synced table this clobbers a concurrent edit to a different column; `ctx.db.patch(id, { field })` merges at the column level so independent field edits coexist.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "mutator_full_row_replace",
+  remediation: "Prefer `ctx.db.patch(id, { onlyTheChangedField })` so a concurrent edit to another column isn't lost. Keep `replace` only when the mutator genuinely owns the entire row (e.g. a full-form save).",
+  run: (context) => {
+    if (context.mutatorWrites === void 0) {
+      return [];
+    }
+    return context.mutatorWrites.map(
+      (write) => emit(mutatorFullRowReplace, {
+        cacheKey: `mutator_full_row_replace:${write.exportName}:${String(write.line)}`,
+        detail: `Mutator \`${write.exportName}\` (${write.file}:${String(write.line)}) writes with \`ctx.db.replace(...)\`, overwriting the whole row. A concurrent edit to a different column is clobbered — use \`ctx.db.patch(id, { field })\` to merge at the column level.`,
+        metadata: { exportName: write.exportName, file: write.file, line: write.line }
+      })
+    );
+  },
+  source: "static",
+  title: "Mutator overwrites the whole row (clobbers concurrent column edits)"
+};
+
+export { mutatorFullRowReplace as default };

package/dist/packem_shared/normalizeIdUsedAsAuthorization-BVPtCpzT.mjs

@@ -0,0 +1,50 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const SINK_LABELS = {
+  delete: "deletes the row",
+  get: "reads the row",
+  patch: "patches the row"
+};
+const normalizeIdUsedAsAuthorization = {
+  categories: ["SECURITY"],
+  description: "A `.public()` `query`/`mutation` gates a `ctx.db.get`/`patch`/`delete` on a null-checked `ctx.db.normalizeId(table, id)` result with no ownership predicate and no RLS. `normalizeId` validates id *shape* only — it never reads the database — so a non-null result proves the id is well-formed, never that the caller owns the row (an IDOR).",
+  facing: "EXTERNAL",
+  level: "INFO",
+  name: "normalize_id_used_as_authorization",
+  remediation: 'Don\'t treat a non-null `normalizeId` result as authorization — it only validates id shape. After loading the row, compare its ownership column (`userId`/`ownerId`/…) against the server-trusted identity (`ctx.auth.userId`), or protect the procedure with `.use(rls(...))` / put the schema in `.rls("required")` mode so the row policy runs on every access.',
+  run: (context) => {
+    if (context.normalizeIdAuthorizations === void 0) {
+      return [];
+    }
+    const rlsRequired = context.schema.rlsMode === "required";
+    const rlsOptOutTables = new Set(context.schema.tables.filter((table) => table.isPublic).map((table) => table.name));
+    const findings = [];
+    for (const row of context.normalizeIdAuthorizations) {
+      if (row.visibility !== "public" || row.usesRls || row.mentionsOwnership) {
+        continue;
+      }
+      if (rlsRequired && (row.table === "" || !rlsOptOutTables.has(row.table))) {
+        continue;
+      }
+      const target = row.table === "" ? "the row" : `the \`${row.table}\` row`;
+      findings.push(
+        emit(normalizeIdUsedAsAuthorization, {
+          cacheKey: `normalize_id_used_as_authorization:${row.file}:${row.line.toString()}`,
+          detail: `Public procedure \`${row.exportName}\` (${row.file}:${row.line.toString()}) gates access on \`ctx.db.normalizeId(...)\` and then ${SINK_LABELS[row.sinkMethod]} — but \`normalizeId\` only validates id shape, it never reads the database or checks ownership. Any caller supplying a well-formed id of ${target} reaches it (IDOR). Compare the loaded row's ownership column against \`ctx.auth\`, or cover the procedure with \`.use(rls(...))\`.`,
+          metadata: {
+            exportName: row.exportName,
+            file: row.file,
+            line: row.line,
+            sinkMethod: row.sinkMethod,
+            table: row.table
+          }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "normalizeId result used as authorization (validates id shape, not ownership)"
+};
+
+export { normalizeIdUsedAsAuthorization as default };