@lunora/advisor 1.0.0-alpha.20 → 1.0.0-alpha.200

package/dist/packem_shared/httpActionResponseHeaderInjection-DOFS7pFT.mjs

@@ -1,39 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const VIA_LABELS = {
-  "headers-append": "a `headers.append(...)` call",
-  "headers-ctor": "a `new Headers({...})` initializer",
-  "headers-set": "a `headers.set(...)` call",
-  "response-init": "a `Response` init `headers` object"
-};
-const httpActionResponseHeaderInjection = {
-  categories: ["SECURITY"],
-  description: "An `httpAction` handler writes a response-header value derived from raw request input (`request.headers`/URL/query/body) with no CR/LF sanitizer. A `Request`-derived string placed verbatim into a response header lets a caller smuggle `\\r\\n` and inject extra headers or split the response (HTTP response splitting / header injection).",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "http_action_response_header_injection",
-  remediation: "Never place a raw request value into a response header. Route it through a CR/LF guard (`isSafeHeaderValue` from `@lunora/server`, rejecting values containing `\\r`/`\\n`/`\\0`), URL-encode it (`encodeURIComponent`), or coerce it to a number — before writing the header. `String(...)` / `.toString()` do NOT strip CR/LF and are not sufficient.",
-  run: (context) => {
-    if (context.httpHeaderWrites === void 0) {
-      return [];
-    }
-    return context.httpHeaderWrites.map((row) => {
-      const header = row.headerName === "" ? "a response header" : `the \`${row.headerName}\` response header`;
-      return emit(httpActionResponseHeaderInjection, {
-        cacheKey: `http_action_response_header_injection:${row.file}:${row.line.toString()}`,
-        detail: `\`${row.exportName}\` (${row.file}:${row.line.toString()}) writes ${header} from raw request input via ${VIA_LABELS[row.via]} with no CR/LF guard — a caller can smuggle \`\\r\\n\` to inject headers or split the response. Route the value through \`isSafeHeaderValue\` or \`encodeURIComponent\` first.`,
-        metadata: {
-          exportName: row.exportName,
-          file: row.file,
-          headerName: row.headerName,
-          line: row.line,
-          via: row.via
-        }
-      });
-    });
-  },
-  source: "static",
-  title: "Response header written from unsanitized request input"
-};
-
-export { httpActionResponseHeaderInjection as default };

package/dist/packem_shared/hyperdriveOutsideAction-BgZqX7Xg.mjs

@@ -1,30 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const hyperdriveOutsideAction = {
-  categories: ["SCHEMA"],
-  description: "A `query`/`mutation` handler accesses Hyperdrive via `ctx.sql`. Hyperdrive hits an external database Lunora does not own: queries are non-deterministic (like `fetch`) and external writes are invisible to live queries. `ctx.sql` is available on `ActionCtx` only and must be confined to `action` handlers.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "hyperdrive_outside_action",
-  remediation: "Move the `ctx.sql` access into an `action(...)` (the only context where it is typed), where external I/O is allowed. If a query/mutation needs the data, have the action read it via `ctx.sql` and write a projection into a `defineSchema` DO/D1 table — that write is tracked by live queries, whereas the external DB is not.",
-  run: (context) => {
-    if (context.hyperdriveCalls === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const call of context.hyperdriveCalls) {
-      findings.push(
-        emit(hyperdriveOutsideAction, {
-          cacheKey: `hyperdrive_outside_action:${call.file}:${call.line.toString()}:${call.callee}`,
-          detail: `\`${call.callee}(…)\` in ${call.exportName} (${call.file}:${call.line.toString()}) runs inside a ${call.kind} handler — Hyperdrive's \`ctx.sql\` is non-deterministic and non-reactive, so it is available only in actions. Move the external SQL into an \`action\` and project the result into a Lunora table if a query/mutation needs it.`,
-          metadata: { callee: call.callee, exportName: call.exportName, file: call.file, kind: call.kind, line: call.line }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Hyperdrive `ctx.sql` used outside an action"
-};
-
-export { hyperdriveOutsideAction as default };

package/dist/packem_shared/identityUndeclaredClaimTrusted-D8nXV2dd.mjs

@@ -1,32 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const identityUndeclaredClaimTrusted = {
-  categories: ["SECURITY"],
-  description: "An authorization read of `auth.identity.<key>` for a claim outside the declared `defineIdentity({ ... })` contract. `defineIdentity` validates only declared claims and forwards undeclared ones verbatim, so the value the policy trusts was never validated — an attacker's token can forge it.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "identity_undeclared_claim_trusted",
-  remediation: "Declare the claim in `defineIdentity({ ... })` (e.g. `role: v.optional(v.string())`) so the worker validates it at the trust boundary before a policy reads it, or stop trusting it for authorization. Declared claims (and `userId`) are validated; undeclared claims are forwarded unchecked.",
-  run: (context) => {
-    if (context.identityClaimReads === void 0) {
-      return [];
-    }
-    return context.identityClaimReads.filter((row) => !row.declared).map((row) => {
-      const location = `\`${row.exportName}\` (${row.file}:${row.line.toString()})`;
-      return emit(identityUndeclaredClaimTrusted, {
-        cacheKey: `identity_undeclared_claim_trusted:${row.file}:${row.line.toString()}:${row.key}`,
-        detail: `\`${row.key}\` in ${location} is read off \`identity\` but is not declared in \`defineIdentity({ ... })\`. Undeclared claims are forwarded unvalidated, so this authorization decision trusts a forgeable value.`,
-        metadata: {
-          exportName: row.exportName,
-          file: row.file,
-          key: row.key,
-          line: row.line
-        }
-      });
-    });
-  },
-  source: "static",
-  title: "Authorization trusts an undeclared identity claim"
-};
-
-export { identityUndeclaredClaimTrusted as default };

package/dist/packem_shared/imagesUrlSourceFromUserInput-YcDQ0b_Y.mjs

@@ -1,19 +0,0 @@
-import { m as makeArgumentDerivedSinkLint } from './argument-derived-sink-C1xTTqAt.mjs';
-
-const imagesUrlSourceFromUserInput = makeArgumentDerivedSinkLint({
-  cacheKey: (access) => `images_url_source_from_user_input:${access.file}:${access.line.toString()}`,
-  categories: ["SECURITY"],
-  description: "A `buildImageDeliveryUrl({ key, … })` call's `key` — the CDN transform's source image, an absolute URL or an origin-relative key — is derived from the handler's `args` with no server-side scoping, so any caller can point the CDN's on-the-fly transform at an attacker-chosen origin (SSRF / open proxy) or an arbitrary key under the account's own store.",
-  detail: (access) => `\`buildImageDeliveryUrl\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) builds its delivery URL from a \`key\` derived from \`args\` with no server-side scoping — any caller can point the CDN's on-the-fly transform at an attacker-chosen origin or store key. Validate \`key\` against an allowlist, or derive it from server-trusted state.`,
-  facing: "EXTERNAL",
-  getAccesses: (context) => context.imageDeliveryUrlAccesses,
-  level: "WARN",
-  metadata: (access) => {
-    return { exportName: access.exportName, file: access.file, line: access.line };
-  },
-  name: "images_url_source_from_user_input",
-  remediation: "Validate `key` against an allowlist of known origins/prefixes before calling `buildImageDeliveryUrl`, or derive it from server-trusted state (a stored record's own image key) rather than passing `args` straight through.",
-  title: "Image delivery URL built from unscoped user input"
-});
-
-export { imagesUrlSourceFromUserInput as default };

package/dist/packem_shared/indexReferencesUnknownField-BSWNngxX.mjs

@@ -1,36 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-import { t as tableColumnSet } from './helpers-BySnKhVB.mjs';
-
-const indexReferencesUnknownField = {
-  categories: ["SCHEMA"],
-  description: "An index references a column that is not declared on its table. The index can never match, and the typo would otherwise surface only at runtime.",
-  facing: "INTERNAL",
-  level: "ERROR",
-  name: "index_references_unknown_field",
-  remediation: "Fix the column name in the index declaration, or add the column to the table.",
-  run: (context) => {
-    const findings = [];
-    for (const table of context.schema.tables) {
-      const columns = tableColumnSet(table);
-      for (const index of table.indexes) {
-        for (const field of index.fields) {
-          if (columns.has(field)) {
-            continue;
-          }
-          findings.push(
-            emit(indexReferencesUnknownField, {
-              cacheKey: `index_references_unknown_field:${table.name}:${index.name}:${field}`,
-              detail: `Index "${index.name}" on table "${table.name}" references column "${field}", which is not declared on the table.`,
-              metadata: { field, index: index.name, indexKind: index.kind, table: table.name }
-            })
-          );
-        }
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Index references unknown field"
-};
-
-export { indexReferencesUnknownField as default };

package/dist/packem_shared/indexUtilization-B5DMQ3bI.mjs

@@ -1,45 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const HOT_SCAN_THRESHOLD = 25;
-const indexUtilization = {
-  categories: ["PERFORMANCE"],
-  description: "Recorded reads show an index the workload doesn't pay for: either a declared index no read ever used (dead overhead on every write) or a table read hot with no index at all (a repeated full scan that degrades as it grows).",
-  facing: "INTERNAL",
-  level: "INFO",
-  name: "index_utilization",
-  remediation: "Drop a dead index so writes stop maintaining it; add an index covering the hot full-scanned table's read predicate so the read stops scanning every row.",
-  run: (context) => {
-    const findings = [];
-    for (const hit of context.indexHits ?? []) {
-      if (hit.reads > 0) {
-        continue;
-      }
-      findings.push(
-        emit(indexUtilization, {
-          cacheKey: `index_utilization:dead_index:${hit.table}:${hit.index}`,
-          detail: `Index "${hit.index}" on table "${hit.table}" has recorded no reads since its counter was created — it's dead overhead: every write maintains it and nothing reads through it.`,
-          metadata: { index: hit.index, kind: "dead_index", reads: hit.reads, table: hit.table }
-        })
-      );
-    }
-    for (const scan of context.tableScans ?? []) {
-      if (scan.scans < HOT_SCAN_THRESHOLD) {
-        continue;
-      }
-      findings.push(
-        emit(indexUtilization, {
-          cacheKey: `index_utilization:hot_scan:${scan.table}`,
-          detail: `Table "${scan.table}" has been full-scanned ${scan.scans.toString()} times (cumulative) with no index — a repeated full scan that degrades linearly as "${scan.table}" grows. Add an index covering the read predicate.`,
-          facing: "EXTERNAL",
-          level: "WARN",
-          metadata: { kind: "hot_scan", scans: scan.scans, table: scan.table }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "runtime",
-  title: "Index utilization"
-};
-
-export { indexUtilization as default };

package/dist/packem_shared/insertManyUnsafeUserData-Dn77XpmX.mjs

@@ -1,26 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const insertManyUnsafeUserData = {
-  categories: ["SECURITY"],
-  description: "A public procedure calls `ctx.db.insertManyUnsafe(...)`, which writes rows straight to storage and bypasses both the per-row validators and the schema's insert triggers (server-trusted columns, ownership stamping, RLS write checks). On a public entry point the rows are request-shaped, so a caller can write columns they shouldn't control and skip every trigger-enforced invariant.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "insert_many_unsafe_user_data",
-  remediation: "Use the validated `ctx.db.insert(...)` path in public procedures so validators and insert triggers run. If you need the unsafe bulk write, move it into an internal function (`internalMutation`/`internalAction`) that is fed only server-constructed rows, never request input.",
-  run: (context) => {
-    if (context.procedureProtections === void 0) {
-      return [];
-    }
-    return context.procedureProtections.filter((procedure) => procedure.usesInsertManyUnsafe && procedure.visibility === "public").map(
-      (procedure) => emit(insertManyUnsafeUserData, {
-        cacheKey: `insert_many_unsafe_user_data:${procedure.file}:${procedure.exportName}`,
-        detail: `\`${procedure.exportName}\` (${procedure.file}) is public and calls \`ctx.db.insertManyUnsafe(...)\`, bypassing validators and insert triggers on request-shaped rows. Switch to \`ctx.db.insert(...)\`, or move the bulk write into an internal function fed server-built rows.`,
-        metadata: { exportName: procedure.exportName, file: procedure.file, kind: procedure.kind }
-      })
-    );
-  },
-  source: "static",
-  title: "Public procedure uses insertManyUnsafe (bypasses validators and triggers)"
-};
-
-export { insertManyUnsafeUserData as default };

package/dist/packem_shared/kvUnscopedUserKeyIdor-YWwmfE8X.mjs

@@ -1,19 +0,0 @@
-import { m as makeArgumentDerivedSinkLint } from './argument-derived-sink-C1xTTqAt.mjs';
-
-const kvUnscopedUserKeyIdor = makeArgumentDerivedSinkLint({
-  cacheKey: (access) => `kv_unscoped_user_key_idor:${access.file}:${access.line.toString()}`,
-  categories: ["SECURITY"],
-  description: "A `ctx.kv` read/write uses a namespace key derived from the handler's `args` with no server-side scoping. Workers KV is a flat namespace, so an unscoped key lets any caller read, overwrite, or delete another user's entry — an insecure direct object reference (IDOR).",
-  detail: (access) => `\`ctx.kv.${access.method}\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) uses a KV key derived from \`args\` with no server-side scoping — any caller can read/overwrite/delete another user's entry (IDOR). Prefix the key with a server-trusted identity (e.g. \`\${ctx.auth.userId}:…\`).`,
-  facing: "EXTERNAL",
-  getAccesses: (context) => context.kvKeyAccesses,
-  level: "ERROR",
-  metadata: (access) => {
-    return { exportName: access.exportName, file: access.file, line: access.line, method: access.method };
-  },
-  name: "kv_unscoped_user_key_idor",
-  remediation: `Prefix every \`ctx.kv\` key with a server-trusted identity (e.g. \`\${ctx.auth.userId}:\${args.id}\`) so a caller can only address their own entries. Never pass request input straight to \`ctx.kv.get\`/\`put\`/\`delete\`.`,
-  title: "Possible IDOR from arg-derived unscoped KV key"
-});
-
-export { kvUnscopedUserKeyIdor as default };

package/dist/packem_shared/mailInboundDispatchWithoutVerify-CHSRA8zz.mjs

@@ -1,28 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const mailInboundDispatchWithoutVerify = {
-  categories: ["SECURITY"],
-  description: "`createInboundEmailHandler({...})` has no `verify` hook, so it trusts every inbound message — the `from` address is spoofable and DKIM/SPF/DMARC verdicts go unchecked. If the handler dispatches into a Lunora function (admin bearer, RLS disabled), a forged sender can drive privileged writes (a confused-deputy escalation).",
-  facing: "EXTERNAL",
-  level: "ERROR",
-  // eslint-disable-next-line no-secrets/no-secrets -- the lint's rule id, not a credential
-  name: "mail_inbound_dispatch_without_verify",
-  remediation: "Pass a `verify` hook to `createInboundEmailHandler({...})` that rejects the message unless its DKIM/SPF/DMARC authentication verdicts pass and the sender is expected — before any dispatch into a Lunora function. Never trust the `from` header alone.",
-  run: (context) => {
-    if (context.configCalls === void 0) {
-      return [];
-    }
-    return context.configCalls.filter((call) => call.callee === "createInboundEmailHandler" && call.analyzable && !call.presentKeys.includes("verify")).map(
-      (call) => emit(mailInboundDispatchWithoutVerify, {
-        // eslint-disable-next-line no-secrets/no-secrets -- the lint's rule id, not a credential
-        cacheKey: `mail_inbound_dispatch_without_verify:${call.file}:${call.line.toString()}`,
-        detail: `\`createInboundEmailHandler({...})\` in ${call.file}:${call.line.toString()} has no \`verify\` hook — it trusts the spoofable \`from\` address and unchecked DKIM/SPF/DMARC verdicts. A forged sender can then reach whatever the handler dispatches to (a Lunora function runs with the admin bearer and RLS disabled). Add a \`verify\` gate that enforces the authentication verdicts before dispatch.`,
-        metadata: { callee: call.callee, file: call.file, line: call.line }
-      })
-    );
-  },
-  source: "static",
-  title: "Inbound email handler without a verify hook"
-};
-
-export { mailInboundDispatchWithoutVerify as default };

package/dist/packem_shared/mailRecipientFromRequestInput-Cka2qu5J.mjs

@@ -1,26 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const mailRecipientFromRequestInput = {
-  categories: ["SECURITY"],
-  description: "A `ctx.mail`/`ctx.email` `send`/`queue` call sets a recipient field (to/cc/bcc) from the handler's `args` with no server-side scoping. Sending to an address taken straight from request input turns the deployment into an open relay / spam amplifier.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "mail_recipient_from_request_input",
-  remediation: "Derive recipients from server-trusted state (e.g. the authenticated user's own record via `ctx.auth`), never straight from `args`. If user-chosen recipients are intended, gate the path behind authentication and rate limiting.",
-  run: (context) => {
-    if (context.mailRecipientAccesses === void 0) {
-      return [];
-    }
-    return context.mailRecipientAccesses.map(
-      (access) => emit(mailRecipientFromRequestInput, {
-        cacheKey: `mail_recipient_from_request_input:${access.file}:${access.line.toString()}`,
-        detail: `\`ctx.mail.${access.method}\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) sets a recipient field (to/cc/bcc) derived from \`args\` with no server-side scoping — any caller can direct mail to an arbitrary address (open relay / spam amplifier). Derive the recipient from server-trusted state instead (e.g. \`ctx.auth.user.email\`).`,
-        metadata: { exportName: access.exportName, file: access.file, line: access.line, method: access.method }
-      })
-    );
-  },
-  source: "static",
-  title: "Mail recipient derived from request input"
-};
-
-export { mailRecipientFromRequestInput as default };

package/dist/packem_shared/maskUncoveredPiiColumn-DjGIPG6M.mjs

@@ -1,61 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const maskUncoveredPiiColumn = {
-  categories: ["SECURITY"],
-  description: "A public procedure reads a table whose columns are masked by `.use(mask(...))` elsewhere in the app, but this procedure's builder chain does not include `.use(mask(...))`. It returns those columns in the clear while a sibling procedure redacts them.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "mask_uncovered_pii_column",
-  remediation: "Add `.use(mask(policies))` to the procedure's builder chain — e.g. `c.use(mask(myMasks)).query(...)` — so its returned rows redact the same columns as the rest of the app. If this procedure is intentionally privileged (e.g. an admin export), declare it with `internalQuery` / `internalMutation` / `internalAction` instead of the public builder so the intent is explicit.",
-  // eslint-disable-next-line sonarjs/cognitive-complexity -- the procedure/table/column cross-reference reads clearest as one linear pass; splitting it would obscure the flow.
-  run: (context) => {
-    if (context.maskProcedures === void 0) {
-      return [];
-    }
-    const maskedColumnsByTable = /* @__PURE__ */ new Map();
-    for (const procedure of context.maskProcedures) {
-      for (const { column, table } of procedure.maskColumns) {
-        if (table === "" || column === "") {
-          continue;
-        }
-        const columns = maskedColumnsByTable.get(table) ?? /* @__PURE__ */ new Set();
-        columns.add(column);
-        maskedColumnsByTable.set(table, columns);
-      }
-    }
-    if (maskedColumnsByTable.size === 0) {
-      return [];
-    }
-    const findings = [];
-    for (const procedure of context.maskProcedures) {
-      if (procedure.usesMask) {
-        continue;
-      }
-      if (procedure.visibility === "internal") {
-        continue;
-      }
-      const touched = /* @__PURE__ */ new Set();
-      for (const table of procedure.tablesRead) {
-        if (table !== "" && maskedColumnsByTable.has(table)) {
-          touched.add(table);
-        }
-      }
-      for (const table of touched) {
-        const columns = [...maskedColumnsByTable.get(table) ?? /* @__PURE__ */ new Set()].toSorted((a, b) => a.localeCompare(b));
-        const columnList = columns.map((column) => `\`${column}\``).join(", ");
-        findings.push(
-          emit(maskUncoveredPiiColumn, {
-            cacheKey: `mask_uncovered_pii_column:${procedure.file}:${procedure.exportName}:${table}`,
-            detail: `\`${procedure.exportName}\` in ${procedure.file} reads table \`${table}\` without \`.use(mask(...))\` — its column${columns.length === 1 ? "" : "s"} ${columnList} ${columns.length === 1 ? "is" : "are"} masked elsewhere in the app but returned in the clear here.`,
-            metadata: { columns, exportName: procedure.exportName, file: procedure.file, table }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Maskable column returned without mask() middleware"
-};
-
-export { maskUncoveredPiiColumn as default };

package/dist/packem_shared/maskWeakHashStrategyOnPii-1c4q8Opf.mjs

@@ -1,35 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const PII_COLUMN_RE = /address|birthdate|creditcard|dateofbirth|dob|driverslicense|email|firstname|fullname|lastname|nationalid|passport|phone|socialsecurity|ssn|taxid/u;
-const isPiiColumn = (column) => PII_COLUMN_RE.test(column.replaceAll(/[^a-z0-9]/giu, "").toLowerCase());
-const maskWeakHashStrategyOnPii = {
-  categories: ["SECURITY"],
-  description: 'A `mask(policies)` column named like PII (email, SSN, phone, …) uses the `"hash"` strategy. `"hash"` is an unsalted 32-bit FNV-1a digest — brute-force-recoverable and cross-row-correlatable — not a confidentiality control, so it does not actually hide the value.',
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "mask_weak_hash_strategy_on_pii",
-  remediation: 'Use `"redact"` instead of `"hash"` for this column — e.g. `mask({ <table>: { <column>: "redact" } })`. Reserve `"hash"` for columns where a stable, joinable pseudonym is the goal and the value itself is not sensitive.',
-  run: (context) => {
-    if (context.maskStrategies === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const strategy of context.maskStrategies) {
-      if (strategy.strategy !== "hash" || !isPiiColumn(strategy.column)) {
-        continue;
-      }
-      findings.push(
-        emit(maskWeakHashStrategyOnPii, {
-          cacheKey: `mask_weak_hash_strategy_on_pii:${strategy.file}:${strategy.line.toString()}`,
-          detail: `\`${strategy.exportName}\` in ${strategy.file} masks \`${strategy.table === "" ? strategy.column : `${strategy.table}.${strategy.column}`}\` with \`"hash"\` — its name suggests PII, and \`"hash"\` is brute-force-recoverable and leaks cross-row equality. Use \`"redact"\` instead.`,
-          metadata: { column: strategy.column, exportName: strategy.exportName, file: strategy.file, table: strategy.table }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: 'Weak "hash" mask strategy on a PII column'
-};
-
-export { maskWeakHashStrategyOnPii as default };

package/dist/packem_shared/maskedRelationLeakViaWith-CPI4s0sl.mjs

@@ -1,76 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const maskedTablesOf = (context) => {
-  const tables = /* @__PURE__ */ new Set();
-  for (const procedure of context.maskProcedures ?? []) {
-    for (const { table } of procedure.maskColumns) {
-      if (table !== "") {
-        tables.add(table);
-      }
-    }
-  }
-  for (const strategy of context.maskStrategies ?? []) {
-    if (strategy.table !== "") {
-      tables.add(strategy.table);
-    }
-  }
-  return tables;
-};
-const relationTargetsOf = (context) => {
-  const targets = /* @__PURE__ */ new Map();
-  for (const table of context.schema.tables) {
-    for (const relation of table.relations) {
-      targets.set(`${table.name} ${relation.name}`, relation.table);
-    }
-  }
-  return targets;
-};
-const maskedRelationLeakViaWith = {
-  categories: ["SECURITY"],
-  description: "A public read hydrates a masked table through a `with` relation. Column masking does not descend into `with`-hydrated relations, so the related table's masked columns are returned in the clear.",
-  facing: "EXTERNAL",
-  level: "INFO",
-  name: "masked_relation_leak_via_with",
-  remediation: "Don't hydrate a masked table through `with` on an unprotected read: drop the relation, project only non-sensitive columns, or route the parent read through a procedure that re-applies masking to the joined table. Masking is per-procedure and top-level only — it never reaches `with`-loaded relations.",
-  run: (context) => {
-    if (context.relationLoads === void 0) {
-      return [];
-    }
-    const maskedTables = maskedTablesOf(context);
-    if (maskedTables.size === 0) {
-      return [];
-    }
-    const relationTargets = relationTargetsOf(context);
-    const findings = [];
-    for (const row of context.relationLoads) {
-      if (row.visibility !== "public" || row.parentTable === "") {
-        continue;
-      }
-      for (const relation of row.relations) {
-        const target = relationTargets.get(`${row.parentTable} ${relation}`);
-        if (target === void 0 || !maskedTables.has(target)) {
-          continue;
-        }
-        findings.push(
-          emit(maskedRelationLeakViaWith, {
-            cacheKey: `masked_relation_leak_via_with:${row.file}:${row.line.toString()}:${row.parentTable}:${relation}`,
-            detail: `The public read in \`${row.exportName}\` (${row.file}:${row.line.toString()}) hydrates relation \`${relation}\` (masked table \`${target}\`) via \`with\` on \`${row.parentTable}\`. Masking is top-level only and does not descend into \`with\`, so \`${target}\`'s masked columns are returned in the clear.`,
-            metadata: {
-              exportName: row.exportName,
-              file: row.file,
-              line: row.line,
-              parentTable: row.parentTable,
-              relation,
-              relationTable: target
-            }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Masked table surfaced unmasked through a with-relation on a public read"
-};
-
-export { maskedRelationLeakViaWith as default };

package/dist/packem_shared/mutatorFullRowReplace-BJnNDaIV.mjs

@@ -1,26 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const mutatorFullRowReplace = {
-  categories: ["SCHEMA"],
-  description: "A custom mutator's `server` impl writes with `ctx.db.replace(id, document)` — a whole-row overwrite. On a synced table this clobbers a concurrent edit to a different column; `ctx.db.patch(id, { field })` merges at the column level so independent field edits coexist.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "mutator_full_row_replace",
-  remediation: "Prefer `ctx.db.patch(id, { onlyTheChangedField })` so a concurrent edit to another column isn't lost. Keep `replace` only when the mutator genuinely owns the entire row (e.g. a full-form save).",
-  run: (context) => {
-    if (context.mutatorWrites === void 0) {
-      return [];
-    }
-    return context.mutatorWrites.map(
-      (write) => emit(mutatorFullRowReplace, {
-        cacheKey: `mutator_full_row_replace:${write.exportName}:${String(write.line)}`,
-        detail: `Mutator \`${write.exportName}\` (${write.file}:${String(write.line)}) writes with \`ctx.db.replace(...)\`, overwriting the whole row. A concurrent edit to a different column is clobbered — use \`ctx.db.patch(id, { field })\` to merge at the column level.`,
-        metadata: { exportName: write.exportName, file: write.file, line: write.line }
-      })
-    );
-  },
-  source: "static",
-  title: "Mutator overwrites the whole row (clobbers concurrent column edits)"
-};
-
-export { mutatorFullRowReplace as default };

package/dist/packem_shared/nondeterministicQueryMutation-GXES1fLp.mjs

@@ -1,35 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const nondeterministicQueryMutation = {
-  categories: ["SCHEMA"],
-  description: "A `query`/`mutation` handler calls a non-deterministic API (`Date.now`, `Math.random`, `crypto.randomUUID`, `crypto.getRandomValues`, or `fetch`). These handlers may be re-run on OCC retry / subscription re-evaluation, so they must be deterministic — time, randomness, and network belong in an `action`.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "nondeterministic_query_mutation",
-  remediation: "Move the non-deterministic call into an `action(...)` (which runs once and may use ambient APIs), then pass the computed value into the mutation as an argument — e.g. compute `Date.now()` in the action and call `ctx.runMutation(api.…, { now })`. Take generated ids/timestamps as args instead of producing them in the handler.",
-  run: (context) => {
-    if (context.nondeterministicCalls === void 0) {
-      return [];
-    }
-    const findings = [];
-    const occurrenceCount = /* @__PURE__ */ new Map();
-    for (const call of context.nondeterministicCalls) {
-      const baseKey = `${call.file}:${call.line.toString()}:${call.callee}`;
-      const occurrence = (occurrenceCount.get(baseKey) ?? 0) + 1;
-      occurrenceCount.set(baseKey, occurrence);
-      const occurrenceSuffix = occurrence > 1 ? `:${occurrence.toString()}` : "";
-      findings.push(
-        emit(nondeterministicQueryMutation, {
-          cacheKey: `nondeterministic_query_mutation:${baseKey}${occurrenceSuffix}`,
-          detail: `\`${call.callee}(…)\` in ${call.exportName} (${call.file}:${call.line.toString()}) runs inside a ${call.kind} handler — query/mutation handlers must be deterministic. Compute it in an \`action\` and pass the value into the mutation as an argument.`,
-          metadata: { callee: call.callee, exportName: call.exportName, file: call.file, kind: call.kind, line: call.line }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Non-deterministic call in query/mutation handler"
-};
-
-export { nondeterministicQueryMutation as default };

package/dist/packem_shared/normalizeIdUsedAsAuthorization-BVPtCpzT.mjs

@@ -1,50 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const SINK_LABELS = {
-  delete: "deletes the row",
-  get: "reads the row",
-  patch: "patches the row"
-};
-const normalizeIdUsedAsAuthorization = {
-  categories: ["SECURITY"],
-  description: "A `.public()` `query`/`mutation` gates a `ctx.db.get`/`patch`/`delete` on a null-checked `ctx.db.normalizeId(table, id)` result with no ownership predicate and no RLS. `normalizeId` validates id *shape* only — it never reads the database — so a non-null result proves the id is well-formed, never that the caller owns the row (an IDOR).",
-  facing: "EXTERNAL",
-  level: "INFO",
-  name: "normalize_id_used_as_authorization",
-  remediation: 'Don\'t treat a non-null `normalizeId` result as authorization — it only validates id shape. After loading the row, compare its ownership column (`userId`/`ownerId`/…) against the server-trusted identity (`ctx.auth.userId`), or protect the procedure with `.use(rls(...))` / put the schema in `.rls("required")` mode so the row policy runs on every access.',
-  run: (context) => {
-    if (context.normalizeIdAuthorizations === void 0) {
-      return [];
-    }
-    const rlsRequired = context.schema.rlsMode === "required";
-    const rlsOptOutTables = new Set(context.schema.tables.filter((table) => table.isPublic).map((table) => table.name));
-    const findings = [];
-    for (const row of context.normalizeIdAuthorizations) {
-      if (row.visibility !== "public" || row.usesRls || row.mentionsOwnership) {
-        continue;
-      }
-      if (rlsRequired && (row.table === "" || !rlsOptOutTables.has(row.table))) {
-        continue;
-      }
-      const target = row.table === "" ? "the row" : `the \`${row.table}\` row`;
-      findings.push(
-        emit(normalizeIdUsedAsAuthorization, {
-          cacheKey: `normalize_id_used_as_authorization:${row.file}:${row.line.toString()}`,
-          detail: `Public procedure \`${row.exportName}\` (${row.file}:${row.line.toString()}) gates access on \`ctx.db.normalizeId(...)\` and then ${SINK_LABELS[row.sinkMethod]} — but \`normalizeId\` only validates id shape, it never reads the database or checks ownership. Any caller supplying a well-formed id of ${target} reaches it (IDOR). Compare the loaded row's ownership column against \`ctx.auth\`, or cover the procedure with \`.use(rls(...))\`.`,
-          metadata: {
-            exportName: row.exportName,
-            file: row.file,
-            line: row.line,
-            sinkMethod: row.sinkMethod,
-            table: row.table
-          }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "normalizeId result used as authorization (validates id shape, not ownership)"
-};
-
-export { normalizeIdUsedAsAuthorization as default };