@lunora/advisor 1.0.0-alpha.21 → 1.0.0-alpha.210

package/dist/packem_shared/hardcodedSecret-W2pz1UZB.mjs

@@ -1,35 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const hardcodedSecret = {
-  categories: ["SECURITY"],
-  description: "A secret-shaped string literal (live API key, access key, private key, or high-entropy token) is hard-coded in the source. Committed secrets leak via clone/fork/history and force a redeploy to rotate.",
-  facing: "INTERNAL",
-  level: "ERROR",
-  name: "hardcoded_secret",
-  remediation: 'Move the secret out of source: set it locally in `.dev.vars` (`lunora env set <NAME> "<value>"`) and in production with `wrangler secret put <NAME>`, then read it at runtime from `env.<NAME>`. Rotate the exposed value — assume it is already compromised.',
-  run: (context) => {
-    if (context.secretLiterals === void 0) {
-      return [];
-    }
-    const findings = [];
-    const occurrenceCount = /* @__PURE__ */ new Map();
-    for (const secret of context.secretLiterals) {
-      const baseKey = `${secret.file}:${secret.line.toString()}:${secret.kind}`;
-      const occurrence = (occurrenceCount.get(baseKey) ?? 0) + 1;
-      occurrenceCount.set(baseKey, occurrence);
-      const occurrenceSuffix = occurrence > 1 ? `:${occurrence.toString()}` : "";
-      findings.push(
-        emit(hardcodedSecret, {
-          cacheKey: `hardcoded_secret:${baseKey}${occurrenceSuffix}`,
-          detail: `A ${secret.kind.replaceAll("_", " ")} (${secret.preview}) is hard-coded at ${secret.file}:${secret.line.toString()}. Move it to \`.dev.vars\` / \`wrangler secret put\` and read it from \`env\`. Rotate the exposed value.`,
-          metadata: { file: secret.file, kind: secret.kind, line: secret.line, preview: secret.preview }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Hard-coded secret in source"
-};
-
-export { hardcodedSecret as default };

package/dist/packem_shared/helpers-BySnKhVB.mjs

@@ -1,31 +0,0 @@
-const OWNERSHIP_FIELD_NAMES = /* @__PURE__ */ new Set([
-  "accountId",
-  "authorId",
-  "createdBy",
-  "createdById",
-  "organizationId",
-  "orgId",
-  "ownerId",
-  "tenantId",
-  "updatedBy",
-  "userId",
-  "workspaceId"
-]);
-const PII_FIELD_NAMES = /* @__PURE__ */ new Set([
-  "address",
-  "dateOfBirth",
-  "dob",
-  "email",
-  "firstName",
-  "lastName",
-  "phone",
-  "phoneNumber",
-  "socialSecurityNumber",
-  "ssn"
-]);
-const SYSTEM_FIELDS = /* @__PURE__ */ new Set(["_creationTime", "_id"]);
-const ownershipOrPiiColumns = (table) => table.fields.filter((field) => OWNERSHIP_FIELD_NAMES.has(field) || PII_FIELD_NAMES.has(field));
-const tableColumnSet = (table) => /* @__PURE__ */ new Set([...SYSTEM_FIELDS, ...table.fields]);
-const isPublicWrite = (procedure) => procedure.visibility === "public" && (procedure.kind === "mutation" || procedure.kind === "action");
-
-export { PII_FIELD_NAMES as P, isPublicWrite as i, ownershipOrPiiColumns as o, tableColumnSet as t };

package/dist/packem_shared/hotShard-Ir5D0B6J.mjs

@@ -1,48 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const HOT_SHARE_THRESHOLD = 0.5;
-const MIN_TOTAL_REQUESTS = 50;
-const hotShard = {
-  categories: ["PERFORMANCE"],
-  description: "One shard is taking a disproportionate share of a sharded function's traffic, so the busy shard becomes a single-DO bottleneck while its siblings sit idle — the hot-key skew sharding is meant to avoid.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "hot_shard",
-  remediation: "Re-shard on a higher-cardinality / more evenly-distributed key, or split the hot entity's state, so request volume spreads across shards instead of concentrating on one.",
-  run: (context) => {
-    const active = (context.shardTraffic ?? []).filter((shard) => shard.requests > 0);
-    const totalRequests = active.reduce((sum, shard) => sum + shard.requests, 0);
-    if (active.length < 2 || totalRequests < MIN_TOTAL_REQUESTS) {
-      return [];
-    }
-    const findings = [];
-    for (const shard of active) {
-      const share = shard.requests / totalRequests;
-      if (share < HOT_SHARE_THRESHOLD) {
-        continue;
-      }
-      const scope = shard.group !== void 0 && shard.group !== "" ? `"${shard.group}" ` : "";
-      const label = shard.shardKey === "" ? "the root shard" : `shard "${shard.shardKey}"`;
-      const percent = Math.round(share * 100);
-      findings.push(
-        emit(hotShard, {
-          cacheKey: `hot_shard:${shard.group ?? ""}:${shard.shardKey}`,
-          detail: `${scope}${label} handled ${shard.requests.toString()} of ${totalRequests.toString()} requests (${percent.toString()}%) across ${active.length.toString()} shards — a hot-key skew. Re-shard on a more evenly-distributed key.`,
-          metadata: {
-            group: shard.group,
-            requests: shard.requests,
-            shardCount: active.length,
-            shardKey: shard.shardKey,
-            share,
-            totalRequests
-          }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "runtime",
-  title: "Hot shard"
-};
-
-export { hotShard as default };

package/dist/packem_shared/httpActionMissingAuthGuard-CxipddNx.mjs

@@ -1,35 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const surfaceLabel = (kind, method) => kind === "httpRoute" && method ? `\`httpRoute\` ${method} handler` : "`httpAction` handler";
-const httpActionMissingAuthGuard = {
-  categories: ["SECURITY"],
-  description: "An `httpAction`/`httpRoute` handler performs a side effect (`ctx.runMutation`/`ctx.runAction`/a `ctx.db` write) but never reads `ctx.auth` — an unauthenticated HTTP endpoint driving a state change, bypassing the identity/RLS checks that guard the rest of the app.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "http_action_missing_auth_guard",
-  remediation: "Read `ctx.auth` in the handler before the side effect — call `await ctx.auth.getIdentity()` (or check `ctx.auth.userId`) and reject unauthenticated/unauthorized requests, or forward through a `mutation`/`action` whose RLS policies enforce access. If the endpoint is intentionally public (e.g. a signed webhook), verify the provider signature before the write.",
-  run: (context) => {
-    if (context.httpActionGuards === void 0) {
-      return [];
-    }
-    return context.httpActionGuards.filter((row) => !row.readsAuth).map((row) => {
-      const surface = surfaceLabel(row.kind, row.method);
-      return emit(httpActionMissingAuthGuard, {
-        cacheKey: `http_action_missing_auth_guard:${row.file}:${row.line.toString()}`,
-        detail: `${surface} \`${row.exportName}\` (${row.file}:${row.line.toString()}) calls \`ctx.${row.sideEffect}\` but never reads \`ctx.auth\` — an anonymous caller can drive this write. Authenticate the request before the side effect.`,
-        metadata: {
-          exportName: row.exportName,
-          file: row.file,
-          kind: row.kind,
-          line: row.line,
-          sideEffect: row.sideEffect,
-          ...row.method ? { method: row.method } : {}
-        }
-      });
-    });
-  },
-  source: "static",
-  title: "Unauthenticated HTTP handler performs a side effect"
-};
-
-export { httpActionMissingAuthGuard as default };

package/dist/packem_shared/httpActionResponseHeaderInjection-DOFS7pFT.mjs

@@ -1,39 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const VIA_LABELS = {
-  "headers-append": "a `headers.append(...)` call",
-  "headers-ctor": "a `new Headers({...})` initializer",
-  "headers-set": "a `headers.set(...)` call",
-  "response-init": "a `Response` init `headers` object"
-};
-const httpActionResponseHeaderInjection = {
-  categories: ["SECURITY"],
-  description: "An `httpAction` handler writes a response-header value derived from raw request input (`request.headers`/URL/query/body) with no CR/LF sanitizer. A `Request`-derived string placed verbatim into a response header lets a caller smuggle `\\r\\n` and inject extra headers or split the response (HTTP response splitting / header injection).",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "http_action_response_header_injection",
-  remediation: "Never place a raw request value into a response header. Route it through a CR/LF guard (`isSafeHeaderValue` from `@lunora/server`, rejecting values containing `\\r`/`\\n`/`\\0`), URL-encode it (`encodeURIComponent`), or coerce it to a number — before writing the header. `String(...)` / `.toString()` do NOT strip CR/LF and are not sufficient.",
-  run: (context) => {
-    if (context.httpHeaderWrites === void 0) {
-      return [];
-    }
-    return context.httpHeaderWrites.map((row) => {
-      const header = row.headerName === "" ? "a response header" : `the \`${row.headerName}\` response header`;
-      return emit(httpActionResponseHeaderInjection, {
-        cacheKey: `http_action_response_header_injection:${row.file}:${row.line.toString()}`,
-        detail: `\`${row.exportName}\` (${row.file}:${row.line.toString()}) writes ${header} from raw request input via ${VIA_LABELS[row.via]} with no CR/LF guard — a caller can smuggle \`\\r\\n\` to inject headers or split the response. Route the value through \`isSafeHeaderValue\` or \`encodeURIComponent\` first.`,
-        metadata: {
-          exportName: row.exportName,
-          file: row.file,
-          headerName: row.headerName,
-          line: row.line,
-          via: row.via
-        }
-      });
-    });
-  },
-  source: "static",
-  title: "Response header written from unsanitized request input"
-};
-
-export { httpActionResponseHeaderInjection as default };

package/dist/packem_shared/hyperdriveOutsideAction-BgZqX7Xg.mjs

@@ -1,30 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const hyperdriveOutsideAction = {
-  categories: ["SCHEMA"],
-  description: "A `query`/`mutation` handler accesses Hyperdrive via `ctx.sql`. Hyperdrive hits an external database Lunora does not own: queries are non-deterministic (like `fetch`) and external writes are invisible to live queries. `ctx.sql` is available on `ActionCtx` only and must be confined to `action` handlers.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "hyperdrive_outside_action",
-  remediation: "Move the `ctx.sql` access into an `action(...)` (the only context where it is typed), where external I/O is allowed. If a query/mutation needs the data, have the action read it via `ctx.sql` and write a projection into a `defineSchema` DO/D1 table — that write is tracked by live queries, whereas the external DB is not.",
-  run: (context) => {
-    if (context.hyperdriveCalls === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const call of context.hyperdriveCalls) {
-      findings.push(
-        emit(hyperdriveOutsideAction, {
-          cacheKey: `hyperdrive_outside_action:${call.file}:${call.line.toString()}:${call.callee}`,
-          detail: `\`${call.callee}(…)\` in ${call.exportName} (${call.file}:${call.line.toString()}) runs inside a ${call.kind} handler — Hyperdrive's \`ctx.sql\` is non-deterministic and non-reactive, so it is available only in actions. Move the external SQL into an \`action\` and project the result into a Lunora table if a query/mutation needs it.`,
-          metadata: { callee: call.callee, exportName: call.exportName, file: call.file, kind: call.kind, line: call.line }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Hyperdrive `ctx.sql` used outside an action"
-};
-
-export { hyperdriveOutsideAction as default };

package/dist/packem_shared/identityUndeclaredClaimTrusted-D8nXV2dd.mjs

@@ -1,32 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const identityUndeclaredClaimTrusted = {
-  categories: ["SECURITY"],
-  description: "An authorization read of `auth.identity.<key>` for a claim outside the declared `defineIdentity({ ... })` contract. `defineIdentity` validates only declared claims and forwards undeclared ones verbatim, so the value the policy trusts was never validated — an attacker's token can forge it.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "identity_undeclared_claim_trusted",
-  remediation: "Declare the claim in `defineIdentity({ ... })` (e.g. `role: v.optional(v.string())`) so the worker validates it at the trust boundary before a policy reads it, or stop trusting it for authorization. Declared claims (and `userId`) are validated; undeclared claims are forwarded unchecked.",
-  run: (context) => {
-    if (context.identityClaimReads === void 0) {
-      return [];
-    }
-    return context.identityClaimReads.filter((row) => !row.declared).map((row) => {
-      const location = `\`${row.exportName}\` (${row.file}:${row.line.toString()})`;
-      return emit(identityUndeclaredClaimTrusted, {
-        cacheKey: `identity_undeclared_claim_trusted:${row.file}:${row.line.toString()}:${row.key}`,
-        detail: `\`${row.key}\` in ${location} is read off \`identity\` but is not declared in \`defineIdentity({ ... })\`. Undeclared claims are forwarded unvalidated, so this authorization decision trusts a forgeable value.`,
-        metadata: {
-          exportName: row.exportName,
-          file: row.file,
-          key: row.key,
-          line: row.line
-        }
-      });
-    });
-  },
-  source: "static",
-  title: "Authorization trusts an undeclared identity claim"
-};
-
-export { identityUndeclaredClaimTrusted as default };

package/dist/packem_shared/imagesUrlSourceFromUserInput-YcDQ0b_Y.mjs

@@ -1,19 +0,0 @@
-import { m as makeArgumentDerivedSinkLint } from './argument-derived-sink-C1xTTqAt.mjs';
-
-const imagesUrlSourceFromUserInput = makeArgumentDerivedSinkLint({
-  cacheKey: (access) => `images_url_source_from_user_input:${access.file}:${access.line.toString()}`,
-  categories: ["SECURITY"],
-  description: "A `buildImageDeliveryUrl({ key, … })` call's `key` — the CDN transform's source image, an absolute URL or an origin-relative key — is derived from the handler's `args` with no server-side scoping, so any caller can point the CDN's on-the-fly transform at an attacker-chosen origin (SSRF / open proxy) or an arbitrary key under the account's own store.",
-  detail: (access) => `\`buildImageDeliveryUrl\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) builds its delivery URL from a \`key\` derived from \`args\` with no server-side scoping — any caller can point the CDN's on-the-fly transform at an attacker-chosen origin or store key. Validate \`key\` against an allowlist, or derive it from server-trusted state.`,
-  facing: "EXTERNAL",
-  getAccesses: (context) => context.imageDeliveryUrlAccesses,
-  level: "WARN",
-  metadata: (access) => {
-    return { exportName: access.exportName, file: access.file, line: access.line };
-  },
-  name: "images_url_source_from_user_input",
-  remediation: "Validate `key` against an allowlist of known origins/prefixes before calling `buildImageDeliveryUrl`, or derive it from server-trusted state (a stored record's own image key) rather than passing `args` straight through.",
-  title: "Image delivery URL built from unscoped user input"
-});
-
-export { imagesUrlSourceFromUserInput as default };

package/dist/packem_shared/indexReferencesUnknownField-BSWNngxX.mjs

@@ -1,36 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-import { t as tableColumnSet } from './helpers-BySnKhVB.mjs';
-
-const indexReferencesUnknownField = {
-  categories: ["SCHEMA"],
-  description: "An index references a column that is not declared on its table. The index can never match, and the typo would otherwise surface only at runtime.",
-  facing: "INTERNAL",
-  level: "ERROR",
-  name: "index_references_unknown_field",
-  remediation: "Fix the column name in the index declaration, or add the column to the table.",
-  run: (context) => {
-    const findings = [];
-    for (const table of context.schema.tables) {
-      const columns = tableColumnSet(table);
-      for (const index of table.indexes) {
-        for (const field of index.fields) {
-          if (columns.has(field)) {
-            continue;
-          }
-          findings.push(
-            emit(indexReferencesUnknownField, {
-              cacheKey: `index_references_unknown_field:${table.name}:${index.name}:${field}`,
-              detail: `Index "${index.name}" on table "${table.name}" references column "${field}", which is not declared on the table.`,
-              metadata: { field, index: index.name, indexKind: index.kind, table: table.name }
-            })
-          );
-        }
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Index references unknown field"
-};
-
-export { indexReferencesUnknownField as default };

package/dist/packem_shared/indexUtilization-B5DMQ3bI.mjs

@@ -1,45 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const HOT_SCAN_THRESHOLD = 25;
-const indexUtilization = {
-  categories: ["PERFORMANCE"],
-  description: "Recorded reads show an index the workload doesn't pay for: either a declared index no read ever used (dead overhead on every write) or a table read hot with no index at all (a repeated full scan that degrades as it grows).",
-  facing: "INTERNAL",
-  level: "INFO",
-  name: "index_utilization",
-  remediation: "Drop a dead index so writes stop maintaining it; add an index covering the hot full-scanned table's read predicate so the read stops scanning every row.",
-  run: (context) => {
-    const findings = [];
-    for (const hit of context.indexHits ?? []) {
-      if (hit.reads > 0) {
-        continue;
-      }
-      findings.push(
-        emit(indexUtilization, {
-          cacheKey: `index_utilization:dead_index:${hit.table}:${hit.index}`,
-          detail: `Index "${hit.index}" on table "${hit.table}" has recorded no reads since its counter was created — it's dead overhead: every write maintains it and nothing reads through it.`,
-          metadata: { index: hit.index, kind: "dead_index", reads: hit.reads, table: hit.table }
-        })
-      );
-    }
-    for (const scan of context.tableScans ?? []) {
-      if (scan.scans < HOT_SCAN_THRESHOLD) {
-        continue;
-      }
-      findings.push(
-        emit(indexUtilization, {
-          cacheKey: `index_utilization:hot_scan:${scan.table}`,
-          detail: `Table "${scan.table}" has been full-scanned ${scan.scans.toString()} times (cumulative) with no index — a repeated full scan that degrades linearly as "${scan.table}" grows. Add an index covering the read predicate.`,
-          facing: "EXTERNAL",
-          level: "WARN",
-          metadata: { kind: "hot_scan", scans: scan.scans, table: scan.table }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "runtime",
-  title: "Index utilization"
-};
-
-export { indexUtilization as default };

package/dist/packem_shared/insertManyUnsafeUserData-Dn77XpmX.mjs

@@ -1,26 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const insertManyUnsafeUserData = {
-  categories: ["SECURITY"],
-  description: "A public procedure calls `ctx.db.insertManyUnsafe(...)`, which writes rows straight to storage and bypasses both the per-row validators and the schema's insert triggers (server-trusted columns, ownership stamping, RLS write checks). On a public entry point the rows are request-shaped, so a caller can write columns they shouldn't control and skip every trigger-enforced invariant.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "insert_many_unsafe_user_data",
-  remediation: "Use the validated `ctx.db.insert(...)` path in public procedures so validators and insert triggers run. If you need the unsafe bulk write, move it into an internal function (`internalMutation`/`internalAction`) that is fed only server-constructed rows, never request input.",
-  run: (context) => {
-    if (context.procedureProtections === void 0) {
-      return [];
-    }
-    return context.procedureProtections.filter((procedure) => procedure.usesInsertManyUnsafe && procedure.visibility === "public").map(
-      (procedure) => emit(insertManyUnsafeUserData, {
-        cacheKey: `insert_many_unsafe_user_data:${procedure.file}:${procedure.exportName}`,
-        detail: `\`${procedure.exportName}\` (${procedure.file}) is public and calls \`ctx.db.insertManyUnsafe(...)\`, bypassing validators and insert triggers on request-shaped rows. Switch to \`ctx.db.insert(...)\`, or move the bulk write into an internal function fed server-built rows.`,
-        metadata: { exportName: procedure.exportName, file: procedure.file, kind: procedure.kind }
-      })
-    );
-  },
-  source: "static",
-  title: "Public procedure uses insertManyUnsafe (bypasses validators and triggers)"
-};
-
-export { insertManyUnsafeUserData as default };

package/dist/packem_shared/kvUnscopedUserKeyIdor-YWwmfE8X.mjs

@@ -1,19 +0,0 @@
-import { m as makeArgumentDerivedSinkLint } from './argument-derived-sink-C1xTTqAt.mjs';
-
-const kvUnscopedUserKeyIdor = makeArgumentDerivedSinkLint({
-  cacheKey: (access) => `kv_unscoped_user_key_idor:${access.file}:${access.line.toString()}`,
-  categories: ["SECURITY"],
-  description: "A `ctx.kv` read/write uses a namespace key derived from the handler's `args` with no server-side scoping. Workers KV is a flat namespace, so an unscoped key lets any caller read, overwrite, or delete another user's entry — an insecure direct object reference (IDOR).",
-  detail: (access) => `\`ctx.kv.${access.method}\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) uses a KV key derived from \`args\` with no server-side scoping — any caller can read/overwrite/delete another user's entry (IDOR). Prefix the key with a server-trusted identity (e.g. \`\${ctx.auth.userId}:…\`).`,
-  facing: "EXTERNAL",
-  getAccesses: (context) => context.kvKeyAccesses,
-  level: "ERROR",
-  metadata: (access) => {
-    return { exportName: access.exportName, file: access.file, line: access.line, method: access.method };
-  },
-  name: "kv_unscoped_user_key_idor",
-  remediation: `Prefix every \`ctx.kv\` key with a server-trusted identity (e.g. \`\${ctx.auth.userId}:\${args.id}\`) so a caller can only address their own entries. Never pass request input straight to \`ctx.kv.get\`/\`put\`/\`delete\`.`,
-  title: "Possible IDOR from arg-derived unscoped KV key"
-});
-
-export { kvUnscopedUserKeyIdor as default };

package/dist/packem_shared/mailInboundDispatchWithoutVerify-CHSRA8zz.mjs

@@ -1,28 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const mailInboundDispatchWithoutVerify = {
-  categories: ["SECURITY"],
-  description: "`createInboundEmailHandler({...})` has no `verify` hook, so it trusts every inbound message — the `from` address is spoofable and DKIM/SPF/DMARC verdicts go unchecked. If the handler dispatches into a Lunora function (admin bearer, RLS disabled), a forged sender can drive privileged writes (a confused-deputy escalation).",
-  facing: "EXTERNAL",
-  level: "ERROR",
-  // eslint-disable-next-line no-secrets/no-secrets -- the lint's rule id, not a credential
-  name: "mail_inbound_dispatch_without_verify",
-  remediation: "Pass a `verify` hook to `createInboundEmailHandler({...})` that rejects the message unless its DKIM/SPF/DMARC authentication verdicts pass and the sender is expected — before any dispatch into a Lunora function. Never trust the `from` header alone.",
-  run: (context) => {
-    if (context.configCalls === void 0) {
-      return [];
-    }
-    return context.configCalls.filter((call) => call.callee === "createInboundEmailHandler" && call.analyzable && !call.presentKeys.includes("verify")).map(
-      (call) => emit(mailInboundDispatchWithoutVerify, {
-        // eslint-disable-next-line no-secrets/no-secrets -- the lint's rule id, not a credential
-        cacheKey: `mail_inbound_dispatch_without_verify:${call.file}:${call.line.toString()}`,
-        detail: `\`createInboundEmailHandler({...})\` in ${call.file}:${call.line.toString()} has no \`verify\` hook — it trusts the spoofable \`from\` address and unchecked DKIM/SPF/DMARC verdicts. A forged sender can then reach whatever the handler dispatches to (a Lunora function runs with the admin bearer and RLS disabled). Add a \`verify\` gate that enforces the authentication verdicts before dispatch.`,
-        metadata: { callee: call.callee, file: call.file, line: call.line }
-      })
-    );
-  },
-  source: "static",
-  title: "Inbound email handler without a verify hook"
-};
-
-export { mailInboundDispatchWithoutVerify as default };

package/dist/packem_shared/mailRecipientFromRequestInput-Cka2qu5J.mjs

@@ -1,26 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const mailRecipientFromRequestInput = {
-  categories: ["SECURITY"],
-  description: "A `ctx.mail`/`ctx.email` `send`/`queue` call sets a recipient field (to/cc/bcc) from the handler's `args` with no server-side scoping. Sending to an address taken straight from request input turns the deployment into an open relay / spam amplifier.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "mail_recipient_from_request_input",
-  remediation: "Derive recipients from server-trusted state (e.g. the authenticated user's own record via `ctx.auth`), never straight from `args`. If user-chosen recipients are intended, gate the path behind authentication and rate limiting.",
-  run: (context) => {
-    if (context.mailRecipientAccesses === void 0) {
-      return [];
-    }
-    return context.mailRecipientAccesses.map(
-      (access) => emit(mailRecipientFromRequestInput, {
-        cacheKey: `mail_recipient_from_request_input:${access.file}:${access.line.toString()}`,
-        detail: `\`ctx.mail.${access.method}\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) sets a recipient field (to/cc/bcc) derived from \`args\` with no server-side scoping — any caller can direct mail to an arbitrary address (open relay / spam amplifier). Derive the recipient from server-trusted state instead (e.g. \`ctx.auth.user.email\`).`,
-        metadata: { exportName: access.exportName, file: access.file, line: access.line, method: access.method }
-      })
-    );
-  },
-  source: "static",
-  title: "Mail recipient derived from request input"
-};
-
-export { mailRecipientFromRequestInput as default };

package/dist/packem_shared/maskUncoveredPiiColumn-DjGIPG6M.mjs

@@ -1,61 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const maskUncoveredPiiColumn = {
-  categories: ["SECURITY"],
-  description: "A public procedure reads a table whose columns are masked by `.use(mask(...))` elsewhere in the app, but this procedure's builder chain does not include `.use(mask(...))`. It returns those columns in the clear while a sibling procedure redacts them.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "mask_uncovered_pii_column",
-  remediation: "Add `.use(mask(policies))` to the procedure's builder chain — e.g. `c.use(mask(myMasks)).query(...)` — so its returned rows redact the same columns as the rest of the app. If this procedure is intentionally privileged (e.g. an admin export), declare it with `internalQuery` / `internalMutation` / `internalAction` instead of the public builder so the intent is explicit.",
-  // eslint-disable-next-line sonarjs/cognitive-complexity -- the procedure/table/column cross-reference reads clearest as one linear pass; splitting it would obscure the flow.
-  run: (context) => {
-    if (context.maskProcedures === void 0) {
-      return [];
-    }
-    const maskedColumnsByTable = /* @__PURE__ */ new Map();
-    for (const procedure of context.maskProcedures) {
-      for (const { column, table } of procedure.maskColumns) {
-        if (table === "" || column === "") {
-          continue;
-        }
-        const columns = maskedColumnsByTable.get(table) ?? /* @__PURE__ */ new Set();
-        columns.add(column);
-        maskedColumnsByTable.set(table, columns);
-      }
-    }
-    if (maskedColumnsByTable.size === 0) {
-      return [];
-    }
-    const findings = [];
-    for (const procedure of context.maskProcedures) {
-      if (procedure.usesMask) {
-        continue;
-      }
-      if (procedure.visibility === "internal") {
-        continue;
-      }
-      const touched = /* @__PURE__ */ new Set();
-      for (const table of procedure.tablesRead) {
-        if (table !== "" && maskedColumnsByTable.has(table)) {
-          touched.add(table);
-        }
-      }
-      for (const table of touched) {
-        const columns = [...maskedColumnsByTable.get(table) ?? /* @__PURE__ */ new Set()].toSorted((a, b) => a.localeCompare(b));
-        const columnList = columns.map((column) => `\`${column}\``).join(", ");
-        findings.push(
-          emit(maskUncoveredPiiColumn, {
-            cacheKey: `mask_uncovered_pii_column:${procedure.file}:${procedure.exportName}:${table}`,
-            detail: `\`${procedure.exportName}\` in ${procedure.file} reads table \`${table}\` without \`.use(mask(...))\` — its column${columns.length === 1 ? "" : "s"} ${columnList} ${columns.length === 1 ? "is" : "are"} masked elsewhere in the app but returned in the clear here.`,
-            metadata: { columns, exportName: procedure.exportName, file: procedure.file, table }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Maskable column returned without mask() middleware"
-};
-
-export { maskUncoveredPiiColumn as default };

package/dist/packem_shared/maskWeakHashStrategyOnPii-1c4q8Opf.mjs

@@ -1,35 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const PII_COLUMN_RE = /address|birthdate|creditcard|dateofbirth|dob|driverslicense|email|firstname|fullname|lastname|nationalid|passport|phone|socialsecurity|ssn|taxid/u;
-const isPiiColumn = (column) => PII_COLUMN_RE.test(column.replaceAll(/[^a-z0-9]/giu, "").toLowerCase());
-const maskWeakHashStrategyOnPii = {
-  categories: ["SECURITY"],
-  description: 'A `mask(policies)` column named like PII (email, SSN, phone, …) uses the `"hash"` strategy. `"hash"` is an unsalted 32-bit FNV-1a digest — brute-force-recoverable and cross-row-correlatable — not a confidentiality control, so it does not actually hide the value.',
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "mask_weak_hash_strategy_on_pii",
-  remediation: 'Use `"redact"` instead of `"hash"` for this column — e.g. `mask({ <table>: { <column>: "redact" } })`. Reserve `"hash"` for columns where a stable, joinable pseudonym is the goal and the value itself is not sensitive.',
-  run: (context) => {
-    if (context.maskStrategies === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const strategy of context.maskStrategies) {
-      if (strategy.strategy !== "hash" || !isPiiColumn(strategy.column)) {
-        continue;
-      }
-      findings.push(
-        emit(maskWeakHashStrategyOnPii, {
-          cacheKey: `mask_weak_hash_strategy_on_pii:${strategy.file}:${strategy.line.toString()}`,
-          detail: `\`${strategy.exportName}\` in ${strategy.file} masks \`${strategy.table === "" ? strategy.column : `${strategy.table}.${strategy.column}`}\` with \`"hash"\` — its name suggests PII, and \`"hash"\` is brute-force-recoverable and leaks cross-row equality. Use \`"redact"\` instead.`,
-          metadata: { column: strategy.column, exportName: strategy.exportName, file: strategy.file, table: strategy.table }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: 'Weak "hash" mask strategy on a PII column'
-};
-
-export { maskWeakHashStrategyOnPii as default };

package/dist/packem_shared/maskedRelationLeakViaWith-CPI4s0sl.mjs

@@ -1,76 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const maskedTablesOf = (context) => {
-  const tables = /* @__PURE__ */ new Set();
-  for (const procedure of context.maskProcedures ?? []) {
-    for (const { table } of procedure.maskColumns) {
-      if (table !== "") {
-        tables.add(table);
-      }
-    }
-  }
-  for (const strategy of context.maskStrategies ?? []) {
-    if (strategy.table !== "") {
-      tables.add(strategy.table);
-    }
-  }
-  return tables;
-};
-const relationTargetsOf = (context) => {
-  const targets = /* @__PURE__ */ new Map();
-  for (const table of context.schema.tables) {
-    for (const relation of table.relations) {
-      targets.set(`${table.name} ${relation.name}`, relation.table);
-    }
-  }
-  return targets;
-};
-const maskedRelationLeakViaWith = {
-  categories: ["SECURITY"],
-  description: "A public read hydrates a masked table through a `with` relation. Column masking does not descend into `with`-hydrated relations, so the related table's masked columns are returned in the clear.",
-  facing: "EXTERNAL",
-  level: "INFO",
-  name: "masked_relation_leak_via_with",
-  remediation: "Don't hydrate a masked table through `with` on an unprotected read: drop the relation, project only non-sensitive columns, or route the parent read through a procedure that re-applies masking to the joined table. Masking is per-procedure and top-level only — it never reaches `with`-loaded relations.",
-  run: (context) => {
-    if (context.relationLoads === void 0) {
-      return [];
-    }
-    const maskedTables = maskedTablesOf(context);
-    if (maskedTables.size === 0) {
-      return [];
-    }
-    const relationTargets = relationTargetsOf(context);
-    const findings = [];
-    for (const row of context.relationLoads) {
-      if (row.visibility !== "public" || row.parentTable === "") {
-        continue;
-      }
-      for (const relation of row.relations) {
-        const target = relationTargets.get(`${row.parentTable} ${relation}`);
-        if (target === void 0 || !maskedTables.has(target)) {
-          continue;
-        }
-        findings.push(
-          emit(maskedRelationLeakViaWith, {
-            cacheKey: `masked_relation_leak_via_with:${row.file}:${row.line.toString()}:${row.parentTable}:${relation}`,
-            detail: `The public read in \`${row.exportName}\` (${row.file}:${row.line.toString()}) hydrates relation \`${relation}\` (masked table \`${target}\`) via \`with\` on \`${row.parentTable}\`. Masking is top-level only and does not descend into \`with\`, so \`${target}\`'s masked columns are returned in the clear.`,
-            metadata: {
-              exportName: row.exportName,
-              file: row.file,
-              line: row.line,
-              parentTable: row.parentTable,
-              relation,
-              relationTable: target
-            }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Masked table surfaced unmasked through a with-relation on a public read"
-};
-
-export { maskedRelationLeakViaWith as default };