@lunora/advisor 1.0.0-alpha.21 → 1.0.0-alpha.211

package/dist/packem_shared/ratelimitMiddlewareFailOpen-CJgDCaUw.mjs

@@ -1,33 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const SENSITIVE_TOKENS = ["signin", "signup", "login", "register", "reset", "password", "otp", "verify", "payment", "checkout"];
-const normalize = (value) => value.toLowerCase().replaceAll(/[^a-z0-9]+/gu, "");
-const matchesSensitiveToken = (value) => {
-  const normalized = normalize(value);
-  return SENSITIVE_TOKENS.some((token) => normalized.includes(token));
-};
-const guardsSensitiveFlow = (row) => matchesSensitiveToken(row.exportName) || matchesSensitiveToken(row.limitName);
-const ratelimitMiddlewareFailOpen = {
-  categories: ["SECURITY"],
-  description: "A rate-limit or Turnstile middleware guarding a sensitive auth/payment procedure is configured `failOpen: true`, so a limiter store outage or a failed Turnstile siteverify silently admits every request — turning a transient failure into an unthrottled brute-force / abuse window.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "ratelimit_middleware_fail_open",
-  remediation: "Drop `failOpen: true` (the default is fail-closed) on the rate-limit / Turnstile guard for auth and payment flows, or move the escape hatch to a non-sensitive procedure. Prefer rejecting traffic with a 503 over admitting unlimited unauthenticated attempts when the limiter or siteverify is unavailable.",
-  run: (context) => {
-    if (context.failOpenGuards === void 0) {
-      return [];
-    }
-    return context.failOpenGuards.filter((row) => row.failOpen && guardsSensitiveFlow(row)).map(
-      (row) => emit(ratelimitMiddlewareFailOpen, {
-        cacheKey: `ratelimit_middleware_fail_open:${row.file}:${row.line.toString()}`,
-        detail: `\`${row.callee}(...)\` in \`${row.exportName}\` (${row.file}:${row.line.toString()}) sets \`failOpen: true\` while guarding a sensitive flow — a limiter/siteverify outage then admits every request instead of rejecting it.`,
-        metadata: { callee: row.callee, exportName: row.exportName, file: row.file, limitName: row.limitName, line: row.line }
-      })
-    );
-  },
-  source: "static",
-  title: "Fail-open rate-limit / CAPTCHA guard on a sensitive procedure"
-};
-
-export { ratelimitMiddlewareFailOpen as default };

package/dist/packem_shared/relationReferencesUnknownField-CjbLScJ1.mjs

@@ -1,54 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-import { t as tableColumnSet } from './helpers-BySnKhVB.mjs';
-
-const missingColumns = (byName, columnsOf, holder, relation) => {
-  const target = byName.get(relation.table);
-  if (!target) {
-    return [];
-  }
-  const fkTable = relation.kind === "one" ? holder : target;
-  const referencedTable = relation.kind === "one" ? target : holder;
-  const problems = [];
-  if (!columnsOf(fkTable).has(relation.field)) {
-    problems.push({ column: relation.field, owner: fkTable.name, side: "field" });
-  }
-  if (!columnsOf(referencedTable).has(relation.references)) {
-    problems.push({ column: relation.references, owner: referencedTable.name, side: "references" });
-  }
-  return problems;
-};
-const relationReferencesUnknownField = {
-  categories: ["SCHEMA"],
-  description: "A relation references a foreign-key or referenced column that is not declared on its table, so the join can never resolve.",
-  facing: "INTERNAL",
-  level: "ERROR",
-  name: "relation_references_unknown_field",
-  remediation: "Fix the `field` / `references` column name in the relation, or add the missing column.",
-  run: (context) => {
-    const byName = new Map(context.schema.tables.map((table) => [table.name, table]));
-    const columnsCache = /* @__PURE__ */ new Map();
-    const columnsOf = (table) => {
-      let columns = columnsCache.get(table);
-      if (!columns) {
-        columns = tableColumnSet(table);
-        columnsCache.set(table, columns);
-      }
-      return columns;
-    };
-    return context.schema.tables.flatMap(
-      (table) => table.relations.flatMap(
-        (relation) => missingColumns(byName, columnsOf, table, relation).map(
-          (problem) => emit(relationReferencesUnknownField, {
-            cacheKey: `relation_references_unknown_field:${table.name}:${relation.name}:${problem.side}`,
-            detail: `Relation "${relation.name}" on table "${table.name}" uses ${problem.side} "${problem.column}", which is not declared on table "${problem.owner}".`,
-            metadata: { column: problem.column, owner: problem.owner, relation: relation.name, side: problem.side, table: table.name }
-          })
-        )
-      )
-    );
-  },
-  source: "static",
-  title: "Relation references unknown field"
-};
-
-export { relationReferencesUnknownField as default };

package/dist/packem_shared/relationReferencesUnknownTable-DrorpKYe.mjs

@@ -1,33 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const relationReferencesUnknownTable = {
-  categories: ["SCHEMA"],
-  description: "A relation targets a table that does not exist in the schema. The relation can never load — the target is a typo or a removed/renamed table.",
-  facing: "INTERNAL",
-  level: "ERROR",
-  name: "relation_references_unknown_table",
-  remediation: "Fix the target table name in the relation, or add the missing table to the schema.",
-  run: (context) => {
-    const findings = [];
-    const tableNames = new Set(context.schema.tables.map((table) => table.name));
-    for (const table of context.schema.tables) {
-      for (const relation of table.relations) {
-        if (tableNames.has(relation.table)) {
-          continue;
-        }
-        findings.push(
-          emit(relationReferencesUnknownTable, {
-            cacheKey: `relation_references_unknown_table:${table.name}:${relation.name}`,
-            detail: `Relation "${relation.name}" on table "${table.name}" targets table "${relation.table}", which does not exist in the schema.`,
-            metadata: { relation: relation.name, table: table.name, target: relation.table }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Relation references unknown table"
-};
-
-export { relationReferencesUnknownTable as default };

package/dist/packem_shared/rlsUncoveredTable-CxEfZ5eZ.mjs

@@ -1,56 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const rlsUncoveredTable = {
-  categories: ["SECURITY"],
-  description: "A public procedure reads or writes a table that is covered by an RLS policy elsewhere in the app, but this procedure's builder chain does not include `.use(rls(...))`. The raw, unwrapped `ctx.db` silently bypasses every policy in the list.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "rls_uncovered_table",
-  remediation: "Add `.use(rls(policies))` to the procedure's builder chain — e.g. `c.use(rls(myPolicies)).query(...)` — so its `ctx.db` is wrapped by the same policy evaluator as the rest of the app. If this procedure is intentionally privileged (e.g. a background job), declare it with `internalQuery` / `internalMutation` / `internalAction` instead of the public builder so the intent is explicit.",
-  // eslint-disable-next-line sonarjs/cognitive-complexity -- the policy/table cross-reference is clearest as one linear pass; splitting it would obscure the flow.
-  run: (context) => {
-    if (context.rlsProcedures === void 0) {
-      return [];
-    }
-    const policyCoveredTables = /* @__PURE__ */ new Set();
-    for (const procedure of context.rlsProcedures) {
-      for (const table of procedure.rlsTables) {
-        if (table !== "") {
-          policyCoveredTables.add(table);
-        }
-      }
-    }
-    if (policyCoveredTables.size === 0) {
-      return [];
-    }
-    const findings = [];
-    for (const procedure of context.rlsProcedures) {
-      if (procedure.usesRls) {
-        continue;
-      }
-      if (procedure.visibility === "internal") {
-        continue;
-      }
-      const touched = /* @__PURE__ */ new Set();
-      for (const table of [...procedure.tablesRead, ...procedure.tablesWritten]) {
-        if (table !== "" && policyCoveredTables.has(table)) {
-          touched.add(table);
-        }
-      }
-      for (const table of touched) {
-        findings.push(
-          emit(rlsUncoveredTable, {
-            cacheKey: `rls_uncovered_table:${procedure.file}:${procedure.exportName}:${table}`,
-            detail: `\`${procedure.exportName}\` in ${procedure.file} accesses table \`${table}\` without \`.use(rls(...))\` — the table is policy-gated elsewhere in the app but this procedure bypasses those policies entirely.`,
-            metadata: { exportName: procedure.exportName, file: procedure.file, table }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "RLS-gated table accessed without rls() middleware"
-};
-
-export { rlsUncoveredTable as default };

package/dist/packem_shared/shapeTargetsGlobalTable-DHrf4Koi.mjs

@@ -1,34 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const shapeTargetsGlobalTable = {
-  categories: ["PERFORMANCE"],
-  description: "A `defineShape` replicates from a `.global()` table. Global tables live outside the shard DO's SQLite op-log, so the shape is served through the cross-shard tier — coordinator/poll-refreshed and latency-tiered, not poke-live like a sharded shape.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "shape_targets_global_table",
-  remediation: "Expected if you want the cross-shard tier — just don't assume poke-live freshness; global shapes refresh on a poll. For live updates, replicate from a sharded table instead (denormalize the columns you need into the shard).",
-  run: (context) => {
-    if (context.shapes === void 0) {
-      return [];
-    }
-    const globalTables = new Set(context.schema.tables.filter((table) => table.shardKind === "global").map((table) => table.name));
-    const findings = [];
-    for (const shape of context.shapes) {
-      if (shape.table === void 0 || !globalTables.has(shape.table)) {
-        continue;
-      }
-      findings.push(
-        emit(shapeTargetsGlobalTable, {
-          cacheKey: `shape_targets_global_table:${shape.exportName}`,
-          detail: `Shape \`${shape.exportName}\` (${shape.file}) replicates from the \`.global()\` table \`${shape.table}\`. It is served through the cross-shard global tier — poll-refreshed and latency-tiered, not poke-live.`,
-          metadata: { exportName: shape.exportName, file: shape.file, table: shape.table }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Shape replicates from a global (cross-shard) table"
-};
-
-export { shapeTargetsGlobalTable as default };

package/dist/packem_shared/shapeUnknownTable-C8aDWFoe.mjs

@@ -1,34 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const shapeUnknownTable = {
-  categories: ["SCHEMA"],
-  description: "A `defineShape` is bound to a `table` name that does not exist in the schema. The shape can never resolve a rowset — its subscription seeds empty and errors at the first flush.",
-  facing: "INTERNAL",
-  level: "ERROR",
-  name: "shape_unknown_table",
-  remediation: "Fix the shape's `table` to a real table name (check for a typo or a table that was renamed/removed).",
-  run: (context) => {
-    if (context.shapes === void 0) {
-      return [];
-    }
-    const knownTables = new Set(context.schema.tables.map((table) => table.name));
-    const findings = [];
-    for (const shape of context.shapes) {
-      if (shape.table === void 0 || knownTables.has(shape.table)) {
-        continue;
-      }
-      findings.push(
-        emit(shapeUnknownTable, {
-          cacheKey: `shape_unknown_table:${shape.exportName}`,
-          detail: `Shape \`${shape.exportName}\` (${shape.file}) replicates from table \`${shape.table}\`, which is not declared in the schema. The shape can never resolve a rowset.`,
-          metadata: { exportName: shape.exportName, file: shape.file, table: shape.table }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Shape bound to an unknown table"
-};
-
-export { shapeUnknownTable as default };

package/dist/packem_shared/softDeleteIncludeDeletedFromArgs-BLqDKrkM.mjs

@@ -1,38 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const softDeleteIncludeDeletedFromArgs = {
-  categories: ["SECURITY"],
-  description: "A `.public()` read passes `includeDeleted` (hardcoded `true` or derived from `args`) on a `.softDelete()` table, resurfacing soft-deleted rows to callers that should never see them.",
-  facing: "EXTERNAL",
-  level: "INFO",
-  name: "soft_delete_include_deleted_from_args",
-  remediation: "Drop `includeDeleted` from the public read so soft-deleted rows stay hidden, or move the trash/restore view behind an internal (or RLS/role-gated) procedure. Never wire `includeDeleted` from `args` on a public read — an attacker can set it to see rows the app treats as deleted.",
-  run: (context) => {
-    if (context.softDeleteReads === void 0) {
-      return [];
-    }
-    const softDeleteTables = new Set(context.schema.tables.filter((table) => table.softDelete !== void 0).map((table) => table.name));
-    if (softDeleteTables.size === 0) {
-      return [];
-    }
-    return context.softDeleteReads.filter((row) => row.visibility === "public" && row.table !== "" && softDeleteTables.has(row.table) && (row.hardcodedTrue || row.fromArgs)).map((row) => {
-      const location = `\`${row.exportName}\` (${row.file}:${row.line.toString()})`;
-      const detail = row.fromArgs ? `The public read in ${location} wires \`includeDeleted\` from request \`args\` on soft-delete table \`${row.table}\`, letting any caller resurface soft-deleted rows the app treats as gone.` : `The public read in ${location} hardcodes \`includeDeleted: true\` on soft-delete table \`${row.table}\`, returning soft-deleted rows to every caller.`;
-      return emit(softDeleteIncludeDeletedFromArgs, {
-        cacheKey: `soft_delete_include_deleted_from_args:${row.file}:${row.line.toString()}:${row.table}`,
-        detail,
-        metadata: {
-          exportName: row.exportName,
-          file: row.file,
-          line: row.line,
-          source: row.fromArgs ? "args" : "literal",
-          table: row.table
-        }
-      });
-    });
-  },
-  source: "static",
-  title: "Soft-deleted rows resurfaced via includeDeleted on a public read"
-};
-
-export { softDeleteIncludeDeletedFromArgs as default };

package/dist/packem_shared/sqlInjectionRisk-zwytYGLt.mjs

@@ -1,26 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const sqlInjectionRisk = {
-  categories: ["SECURITY"],
-  description: "A `ctx.sql` tagged-template interpolates an unparameterized string-building expression (concatenation or nested template) instead of a bound value — splicing raw text into the query and reopening SQL injection.",
-  facing: "EXTERNAL",
-  level: "ERROR",
-  name: "sql_injection_risk",
-  remediation: "Pass the value through a bound placeholder so the driver parameterizes it — keep request input inside a `ctx.sql` placeholder instead of concatenating it into the query string. Never build SQL text from request input by hand.",
-  run: (context) => {
-    if (context.sqlInterpolations === void 0) {
-      return [];
-    }
-    return context.sqlInterpolations.map(
-      (interpolation) => emit(sqlInjectionRisk, {
-        cacheKey: `sql_injection_risk:${interpolation.file}:${interpolation.line.toString()}`,
-        detail: `\`ctx.sql\` in \`${interpolation.exportName}\` (${interpolation.file}:${interpolation.line.toString()}) interpolates a string-building expression instead of a bound value — a SQL-injection vector. Pass the value through a bound placeholder so the driver parameterizes it.`,
-        metadata: { exportName: interpolation.exportName, file: interpolation.file, line: interpolation.line }
-      })
-    );
-  },
-  source: "static",
-  title: "Possible SQL injection in ctx.sql interpolation"
-};
-
-export { sqlInjectionRisk as default };

package/dist/packem_shared/storageGenerateUploadUrlNoContentTypePin-Da4L9Ge8.mjs

@@ -1,26 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const storageGenerateUploadUrlNoContentTypePin = {
-  categories: ["SECURITY"],
-  description: "A `ctx.storage.generateUploadUrl(key, …)` call has no `contentType` pin, so the signed PUT URL it mints authorizes any content-type/size the client chooses — `upload()`'s `allowedContentTypes`/`maxSize` guards never run for a client-side PUT against this URL.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "storage_generate_upload_url_no_content_type_pin",
-  remediation: "Pass `contentType` to `ctx.storage.generateUploadUrl(key, { contentType })` so the signature only authorizes a PUT with that exact content-type. If the client's upload size/type also needs bounding, prefer `upload()`/`store()` (with `allowedContentTypes`/`maxSize`) over a client-side signed PUT.",
-  run: (context) => {
-    if (context.storageUploads === void 0) {
-      return [];
-    }
-    return context.storageUploads.filter((row) => row.method === "generateUploadUrl" && row.analyzable && !row.presentKeys.includes("contentType")).map(
-      (row) => emit(storageGenerateUploadUrlNoContentTypePin, {
-        cacheKey: `storage_generate_upload_url_no_content_type_pin:${row.file}:${row.line.toString()}`,
-        detail: `\`ctx.storage.generateUploadUrl\` in \`${row.exportName}\` (${row.file}:${row.line.toString()}) has no \`contentType\` pin — the signed PUT it mints accepts any type/size, minted client-side and bypassing \`upload()\`'s guards.`,
-        metadata: { exportName: row.exportName, file: row.file, line: row.line }
-      })
-    );
-  },
-  source: "static",
-  title: "generateUploadUrl signed PUT with no content-type pin"
-};
-
-export { storageGenerateUploadUrlNoContentTypePin as default };

package/dist/packem_shared/storageKeyFromUserArgs-B86elJgS.mjs

@@ -1,19 +0,0 @@
-import { m as makeArgumentDerivedSinkLint } from './argument-derived-sink-C1xTTqAt.mjs';
-
-const storageKeyFromUserArgs = makeArgumentDerivedSinkLint({
-  cacheKey: (access) => `storage_key_from_user_args:${access.file}:${access.line.toString()}`,
-  categories: ["SECURITY"],
-  description: "A `ctx.storage.*` call uses an R2 object key taken directly from the handler's `args` with no server-side scoping. The bucket methods key by the caller-supplied string, so any caller can read, overwrite, or delete another user's object — object-level IDOR.",
-  detail: (access) => `\`ctx.storage.*.${access.method}\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) uses an object key derived from \`args\` with no server-side scoping — any caller can read/overwrite/delete another user's object (IDOR). Prefix the key with a server-trusted identity (e.g. \`\${ctx.auth.userId}/…\`) or resolve the object through an owned record.`,
-  facing: "EXTERNAL",
-  getAccesses: (context) => context.storageKeyAccesses,
-  level: "ERROR",
-  metadata: (access) => {
-    return { exportName: access.exportName, file: access.file, line: access.line, method: access.method };
-  },
-  name: "storage_key_from_user_args",
-  remediation: `Prefix the object key with a server-trusted identity (e.g. \`\${ctx.auth.userId}/…\`) or resolve the object through a record the caller is known to own. Never pass request input straight through as an R2 object key.`,
-  title: "R2 object key taken directly from user args (IDOR)"
-});
-
-export { storageKeyFromUserArgs as default };

package/dist/packem_shared/storagePresignedUrlForPrivateContent-yGmb8uqz.mjs

@@ -1,47 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const SIGNER_METHODS = /* @__PURE__ */ new Set(["getPresignedUrl", "getSignedUrl"]);
-const NEAR_MAX_EXPIRES_THRESHOLD_SECONDS = 6 * 24 * 60 * 60;
-const isNativePresignedCall = (row) => row.method === "getPresignedUrl";
-const isNearExpiryCeiling = (row) => SIGNER_METHODS.has(row.method) && row.expiresInSeconds !== void 0 && row.expiresInSeconds >= NEAR_MAX_EXPIRES_THRESHOLD_SECONDS;
-const storagePresignedUrlForPrivateContent = {
-  categories: ["SECURITY"],
-  description: "`ctx.storage.getPresignedUrl(...)` mints a native S3 SigV4 URL that resolves directly against R2, bypassing the Worker's auth/RLS/rate-limit entirely — the wrong choice for private or policy-gated content. Either signer minting an `expiresInSeconds` near the shared 7-day ceiling also hands out a long-lived bearer credential.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "storage_presigned_url_for_private_content",
-  remediation: "For private/per-user/policy-gated content, use `getSignedUrl` (resolves back through the Worker, so your auth/RLS/rate-limit gates still run) instead of `getPresignedUrl`. Reserve `getPresignedUrl` for genuinely public or bulk content. On either signer, keep `expiresInSeconds` as short as the use case allows — well under the 7-day ceiling — rather than minting a near-maximum-lifetime URL.",
-  run: (context) => {
-    if (context.storageUploads === void 0) {
-      return [];
-    }
-    return context.storageUploads.filter((row) => isNativePresignedCall(row) || isNearExpiryCeiling(row)).map((row) => {
-      const native = isNativePresignedCall(row);
-      const nearCeiling = isNearExpiryCeiling(row);
-      const location = `\`${row.exportName}\` (${row.file}:${row.line.toString()})`;
-      let detail;
-      if (native && nearCeiling) {
-        detail = `\`ctx.storage.getPresignedUrl\` in ${location} mints a native S3 SigV4 URL — bypasses the Worker's auth/RLS/rate-limit entirely — with an \`expiresInSeconds\` of ${(row.expiresInSeconds ?? 0).toString()}s, near the 7-day signing ceiling.`;
-      } else if (native) {
-        detail = `\`ctx.storage.getPresignedUrl\` in ${location} mints a native S3 SigV4 URL that resolves directly against R2, bypassing the Worker's auth/RLS/rate-limit entirely. Use \`getSignedUrl\` for app-gated access to private content.`;
-      } else {
-        detail = `\`ctx.storage.${row.method}\` in ${location} requests an \`expiresInSeconds\` of ${(row.expiresInSeconds ?? 0).toString()}s, near the 7-day signing ceiling — a leaked link stays valid for almost a week.`;
-      }
-      return emit(storagePresignedUrlForPrivateContent, {
-        cacheKey: `storage_presigned_url_for_private_content:${row.file}:${row.line.toString()}`,
-        detail,
-        metadata: {
-          expiresInSeconds: row.expiresInSeconds,
-          exportName: row.exportName,
-          file: row.file,
-          line: row.line,
-          method: row.method
-        }
-      });
-    });
-  },
-  source: "static",
-  title: "Native presigned URL or near-max-TTL signed URL for private content"
-};
-
-export { storagePresignedUrlForPrivateContent as default };

package/dist/packem_shared/storageUploadWithoutContentTypeAllowlist-BV-gF1lT.mjs

@@ -1,27 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const UPLOAD_METHODS = /* @__PURE__ */ new Set(["store", "upload"]);
-const storageUploadWithoutContentTypeAllowlist = {
-  categories: ["SECURITY"],
-  description: "A `ctx.storage.upload`/`store` call has no `allowedContentTypes` allowlist, so an uploader can store any content-type — including `text/html` or `image/svg+xml` — which, served back from `publicBaseUrl`, is a stored-XSS vector against your own origin.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "storage_upload_without_content_type_allowlist",
-  remediation: 'Pass `allowedContentTypes: ["image/png", "image/jpeg", …]` to `ctx.storage.upload`/`store` so an uploaded object\'s `contentType` must match an approved list. Reject anything HTML/SVG/script-executable unless the app genuinely needs to serve it.',
-  run: (context) => {
-    if (context.storageUploads === void 0) {
-      return [];
-    }
-    return context.storageUploads.filter((row) => UPLOAD_METHODS.has(row.method) && row.analyzable && !row.presentKeys.includes("allowedContentTypes")).map(
-      (row) => emit(storageUploadWithoutContentTypeAllowlist, {
-        cacheKey: `storage_upload_without_content_type_allowlist:${row.file}:${row.line.toString()}`,
-        detail: `\`ctx.storage.${row.method}\` in \`${row.exportName}\` (${row.file}:${row.line.toString()}) has no \`allowedContentTypes\` allowlist — any content-type is accepted, including \`text/html\`/\`image/svg+xml\`, a stored-XSS risk if the object is served from \`publicBaseUrl\`.`,
-        metadata: { exportName: row.exportName, file: row.file, line: row.line, method: row.method }
-      })
-    );
-  },
-  source: "static",
-  title: "Storage upload with no content-type allowlist"
-};
-
-export { storageUploadWithoutContentTypeAllowlist as default };

package/dist/packem_shared/storageUploadWithoutMaxSize-DpxO59wU.mjs

@@ -1,27 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const UPLOAD_METHODS = /* @__PURE__ */ new Set(["store", "upload"]);
-const storageUploadWithoutMaxSize = {
-  categories: ["SECURITY"],
-  description: "A `ctx.storage.upload`/`store` call has no `maxSize` cap, so a caller can push an unbounded body straight into R2 through the Worker — unbounded storage/billing exhaustion, and for a streamed body, unbounded worker time.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "storage_upload_without_max_size",
-  remediation: "Pass a `maxSize` (bytes) to `ctx.storage.upload`/`store` sized to the largest legitimate object the app accepts. `ArrayBuffer`/`Blob` bodies are rejected up front when oversized; a `ReadableStream` body is aborted mid-transfer once the limit is exceeded.",
-  run: (context) => {
-    if (context.storageUploads === void 0) {
-      return [];
-    }
-    return context.storageUploads.filter((row) => UPLOAD_METHODS.has(row.method) && row.analyzable && !row.presentKeys.includes("maxSize")).map(
-      (row) => emit(storageUploadWithoutMaxSize, {
-        cacheKey: `storage_upload_without_max_size:${row.file}:${row.line.toString()}`,
-        detail: `\`ctx.storage.${row.method}\` in \`${row.exportName}\` (${row.file}:${row.line.toString()}) has no \`maxSize\` cap — a caller can push an unbounded body into R2, exhausting storage/billing.`,
-        metadata: { exportName: row.exportName, file: row.file, line: row.line, method: row.method }
-      })
-    );
-  },
-  source: "static",
-  title: "Storage upload with no size cap"
-};
-
-export { storageUploadWithoutMaxSize as default };

package/dist/packem_shared/tableWithoutInsert-CbbaYIP4.mjs

@@ -1,34 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const tableWithoutInsert = {
-  categories: ["SCHEMA"],
-  description: 'No function inserts into this table via `ctx.db.insert("<table>", …)`. It may be read-only by design (seeded by a migration, replicated, or written through a path the advisor can\'t see) — or it may be dead schema.',
-  facing: "INTERNAL",
-  level: "INFO",
-  name: "table_without_insert",
-  remediation: 'If the table should be writable, add a mutation that calls `ctx.db.insert("<table>", …)`. If it is read-only or seeded elsewhere, this advisory can be ignored.',
-  run: (context) => {
-    if (context.inserts === void 0) {
-      return [];
-    }
-    const insertedTables = new Set(context.inserts.filter((write) => write.table !== "").map((write) => write.table));
-    const findings = [];
-    for (const table of context.schema.tables) {
-      if (insertedTables.has(table.name) || table.externallyManaged === true) {
-        continue;
-      }
-      findings.push(
-        emit(tableWithoutInsert, {
-          cacheKey: `table_without_insert:${table.name}`,
-          detail: `No function calls \`ctx.db.insert("${table.name}", …)\` — table "${table.name}" has no discovered insert path.`,
-          metadata: { table: table.name }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Table has no insert path"
-};
-
-export { tableWithoutInsert as default };

package/dist/packem_shared/unboundedStringArgument-DThg2-wt.mjs

@@ -1,32 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const unboundedStringArgument = {
-  categories: ["SECURITY"],
-  description: "A public `v.string()` argument has no maximum-length bound. An unbounded string lets a client submit arbitrarily large input — abusing storage and CPU on every request that processes it.",
-  facing: "EXTERNAL",
-  level: "INFO",
-  name: "unbounded_string_arg",
-  remediation: "Add a max-length bound via `.check(...)` / `.meta({ maxLength })` on the string validator (e.g. cap a name at 256, a body at a few KB). Size the cap to the field's real-world maximum.",
-  run: (context) => {
-    if (context.argValidators === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const procedure of context.argValidators) {
-      for (const argument of procedure.unboundedStringArgs) {
-        findings.push(
-          emit(unboundedStringArgument, {
-            cacheKey: `unbounded_string_arg:${procedure.file}:${procedure.exportName}:${argument}`,
-            detail: `Arg \`${argument}\` of public procedure \`${procedure.exportName}\` (${procedure.file}:${procedure.line.toString()}) is an unbounded \`v.string()\`. Add a max-length bound to cap payload size.`,
-            metadata: { argument, exportName: procedure.exportName, file: procedure.file, line: procedure.line }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Public string argument has no length bound"
-};
-
-export { unboundedStringArgument as default };

package/dist/packem_shared/unindexedForeignKey-BgJbKyqK.mjs

@@ -1,45 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-import { l as leadingIndexedColumns, P as PRIMARY_KEY, s as suggestIndexName } from './fk-index-IUK1ukgs.mjs';
-
-const unindexedForeignKey = {
-  categories: ["PERFORMANCE"],
-  description: "A foreign-key column declared by a `one` relation has no index leading with it. Reads that filter or join on the column full-scan the table, which gets linearly slower as rows accumulate.",
-  facing: "EXTERNAL",
-  level: "INFO",
-  name: "unindexed_foreign_key",
-  remediation: 'Add a secondary index leading with the FK column, e.g. `.index("byAuthorId", ["authorId"])`.',
-  run: (context) => {
-    const findings = [];
-    for (const table of context.schema.tables) {
-      const indexed = leadingIndexedColumns(table);
-      for (const relation of table.relations) {
-        if (relation.kind !== "one") {
-          continue;
-        }
-        const fkColumn = relation.field;
-        if (fkColumn === PRIMARY_KEY || indexed.has(fkColumn)) {
-          continue;
-        }
-        const suggestedIndex = suggestIndexName(fkColumn);
-        findings.push(
-          emit(unindexedForeignKey, {
-            cacheKey: `unindexed_foreign_key:${table.name}:${fkColumn}`,
-            detail: `Relation "${relation.name}" on table "${table.name}" references "${relation.table}" via column "${fkColumn}", which is not the leading column of any index. Reads filtering or joining on "${fkColumn}" full-scan "${table.name}".`,
-            metadata: {
-              fkColumn,
-              references: { column: relation.references, table: relation.table },
-              relation: relation.name,
-              suggestedIndex: { fields: [fkColumn], name: suggestedIndex },
-              table: table.name
-            }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Unindexed foreign key"
-};
-
-export { unindexedForeignKey as default };

package/dist/packem_shared/unindexedRelationTarget-D6eyj6Xx.mjs

@@ -1,53 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-import { P as PRIMARY_KEY, l as leadingIndexedColumns, s as suggestIndexName } from './fk-index-IUK1ukgs.mjs';
-
-const unindexedRelationTarget = {
-  categories: ["PERFORMANCE"],
-  description: "A `many` relation's foreign-key column on the target table has no index leading with it. Relation predicates (`some`/`none`/`every`) and `with:` child reads filter the target on that column, full-scanning it as rows accumulate.",
-  facing: "EXTERNAL",
-  level: "INFO",
-  name: "unindexed_relation_target",
-  remediation: 'Add a secondary index on the target table leading with the FK column, e.g. `.index("byAuthorId", ["authorId"])`.',
-  run: (context) => {
-    const findings = [];
-    const tablesByName = new Map(context.schema.tables.map((table) => [table.name, table]));
-    for (const table of context.schema.tables) {
-      for (const relation of table.relations) {
-        if (relation.kind !== "many") {
-          continue;
-        }
-        const target = tablesByName.get(relation.table);
-        if (target === void 0) {
-          continue;
-        }
-        const fkColumn = relation.field;
-        if (fkColumn === PRIMARY_KEY) {
-          continue;
-        }
-        const coveredByForeignKeyLint = target.relations.some((targetRelation) => targetRelation.kind === "one" && targetRelation.field === fkColumn);
-        if (coveredByForeignKeyLint || leadingIndexedColumns(target).has(fkColumn)) {
-          continue;
-        }
-        const suggestedIndex = suggestIndexName(fkColumn);
-        findings.push(
-          emit(unindexedRelationTarget, {
-            cacheKey: `unindexed_relation_target:${relation.table}:${fkColumn}`,
-            detail: `Relation "${relation.name}" on table "${table.name}" is a to-many over "${relation.table}" via its column "${fkColumn}", which is not the leading column of any index on "${relation.table}". Relation predicates (\`some\`/\`none\`/\`every\`) and \`with:\` reads of "${relation.name}" full-scan "${relation.table}".`,
-            metadata: {
-              fkColumn,
-              references: { column: relation.references, table: table.name },
-              relation: relation.name,
-              suggestedIndex: { fields: [fkColumn], name: suggestedIndex },
-              table: relation.table
-            }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Unindexed relation target"
-};
-
-export { unindexedRelationTarget as default };