@lunora/advisor 1.0.0-alpha.21 → 1.0.0-alpha.211

package/dist/packem_shared/constraintValidator-Dr9Py3FD.mjs

@@ -1,186 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const MAX_EXAMPLE_IDS = 5;
-const rowId = (row) => typeof row["_id"] === "string" ? row["_id"] : "?";
-const truncatedSuffix = (capped, cap, phrase) => capped ? ` (sample capped at ${cap.toString()} rows — ${phrase})` : "";
-const formatExamples = (ids, total) => {
-  const examples = ids.slice(0, MAX_EXAMPLE_IDS);
-  const more = total - examples.length;
-  const list = examples.map((id) => `"${id}"`).join(", ");
-  return more > 0 ? `${list} (+${more.toString()} more)` : list;
-};
-const checkFkRelation = (lint, sample, relation, targetSample) => {
-  if (relation.kind !== "one") {
-    return void 0;
-  }
-  const fkColumn = relation.field;
-  const danglingIds = [];
-  for (const row of sample.rows) {
-    const fkValue = row[fkColumn];
-    if (fkValue === null || fkValue === void 0) {
-      continue;
-    }
-    const fkString = String(fkValue);
-    if (!targetSample.existingIds.has(fkString)) {
-      danglingIds.push(rowId(row));
-    }
-  }
-  if (danglingIds.length === 0) {
-    return void 0;
-  }
-  const isTruncated = sample.truncated || targetSample.truncated;
-  const cap = Math.min(sample.cap, targetSample.cap);
-  const detail = `Table "${sample.table}": ${danglingIds.length.toString()} sampled row(s) have a dangling FK value in column "${fkColumn}" — the referenced "${relation.table}" row does not exist. Row ids: ${formatExamples(danglingIds, danglingIds.length)}${truncatedSuffix(isTruncated, cap, "more rows may exist beyond the window")}.`;
-  return emit(lint, {
-    cacheKey: `constraint_validator:fk:${sample.table}:${fkColumn}`,
-    detail,
-    metadata: {
-      cap,
-      column: fkColumn,
-      count: danglingIds.length,
-      examples: danglingIds.slice(0, MAX_EXAMPLE_IDS),
-      kind: "fk",
-      referencesTable: relation.table,
-      table: sample.table,
-      truncated: isTruncated
-    }
-  });
-};
-const checkNullField = (lint, sample, field, isRequired) => {
-  if (!isRequired) {
-    return void 0;
-  }
-  const nullIds = [];
-  for (const row of sample.rows) {
-    const value = row[field];
-    if (value === null || value === void 0) {
-      nullIds.push(rowId(row));
-    }
-  }
-  if (nullIds.length === 0) {
-    return void 0;
-  }
-  const detail = `Table "${sample.table}": ${nullIds.length.toString()} sampled row(s) have a null/missing value in column "${field}", which is declared as non-optional. Row ids: ${formatExamples(nullIds, nullIds.length)}${truncatedSuffix(sample.truncated, sample.cap, "more rows may exist beyond the window")}.`;
-  return emit(lint, {
-    cacheKey: `constraint_validator:null:${sample.table}:${field}`,
-    detail,
-    metadata: {
-      cap: sample.cap,
-      column: field,
-      count: nullIds.length,
-      examples: nullIds.slice(0, MAX_EXAMPLE_IDS),
-      kind: "null",
-      table: sample.table,
-      truncated: sample.truncated
-    }
-  });
-};
-const compositeKey = (row, fields) => {
-  const parts = [];
-  for (const field of fields) {
-    const value = row[field];
-    if (value === null || value === void 0) {
-      return void 0;
-    }
-    parts.push(JSON.stringify(value));
-  }
-  return parts.join("|");
-};
-const recordDuplicate = (id, existingId, duplicateIds) => {
-  if (!duplicateIds.includes(existingId)) {
-    duplicateIds.push(existingId);
-  }
-  duplicateIds.push(id);
-};
-const checkUniqueIndex = (lint, sample, index) => {
-  if (index.kind !== "index" || index.unique !== true) {
-    return void 0;
-  }
-  const seen = /* @__PURE__ */ new Map();
-  const duplicateIds = [];
-  for (const row of sample.rows) {
-    const id = rowId(row);
-    const key = compositeKey(row, index.fields);
-    if (key === void 0) {
-      continue;
-    }
-    const existingId = seen.get(key);
-    if (existingId === void 0) {
-      seen.set(key, id);
-    } else {
-      recordDuplicate(id, existingId, duplicateIds);
-    }
-  }
-  if (duplicateIds.length === 0) {
-    return void 0;
-  }
-  const detail = `Table "${sample.table}": ${duplicateIds.length.toString()} sampled row(s) share duplicate values on unique index "${index.name}" (${index.fields.join(", ")}). Row ids: ${formatExamples(duplicateIds, duplicateIds.length)}${truncatedSuffix(sample.truncated, sample.cap, "duplicates beyond the window may exist")}.`;
-  return emit(lint, {
-    cacheKey: `constraint_validator:unique:${sample.table}:${index.name}`,
-    detail,
-    metadata: {
-      cap: sample.cap,
-      count: duplicateIds.length,
-      examples: duplicateIds.slice(0, MAX_EXAMPLE_IDS),
-      fields: index.fields,
-      index: index.name,
-      kind: "unique",
-      table: sample.table,
-      truncated: sample.truncated
-    }
-  });
-};
-const checkTable = (lint, sample, sampleByTable, tableByName) => {
-  const schemaTable = tableByName.get(sample.table);
-  if (!schemaTable) {
-    return [];
-  }
-  const findings = [];
-  for (const relation of schemaTable.relations) {
-    const targetSample = sampleByTable.get(relation.table);
-    if (!targetSample) {
-      continue;
-    }
-    const f = checkFkRelation(lint, sample, relation, targetSample);
-    if (f) {
-      findings.push(f);
-    }
-  }
-  for (const field of schemaTable.fields) {
-    const isRequired = !schemaTable.optionalFields?.has(field);
-    const f = checkNullField(lint, sample, field, isRequired);
-    if (f) {
-      findings.push(f);
-    }
-  }
-  for (const index of schemaTable.indexes) {
-    const f = checkUniqueIndex(lint, sample, index);
-    if (f) {
-      findings.push(f);
-    }
-  }
-  return findings;
-};
-const constraintValidator = {
-  categories: ["SCHEMA"],
-  description: "Sampled rows violate one or more declared constraints: a foreign-key column references a non-existent row, a non-optional column contains null, or a unique-indexed column has duplicate values. These violations indicate data inserted before a constraint was enforced (e.g. a schema migration, a raw import, or a bug in a past data-migration transform).",
-  facing: "INTERNAL",
-  level: "WARN",
-  name: "constraint_validator",
-  remediation: "Inspect the listed rows and correct or remove the violating values. Run a data migration to backfill nulls, dedup unique violations, or re-link dangling FK references. For FK violations, confirm the target table rows exist before fixing the referencing rows.",
-  run: (context) => {
-    if (!context.tableSamples || context.tableSamples.length === 0) {
-      return [];
-    }
-    const sampleByTable = /* @__PURE__ */ new Map();
-    for (const sample of context.tableSamples) {
-      sampleByTable.set(sample.table, sample);
-    }
-    const tableByName = new Map(context.schema.tables.map((table) => [table.name, table]));
-    return context.tableSamples.flatMap((sample) => checkTable(constraintValidator, sample, sampleByTable, tableByName));
-  },
-  source: "runtime",
-  title: "Constraint violation"
-};
-
-export { constraintValidator as default };

package/dist/packem_shared/containerInstanceKeyFromUserInput-BUXj2J4w.mjs

@@ -1,19 +0,0 @@
-import { m as makeArgumentDerivedSinkLint } from './argument-derived-sink-C1xTTqAt.mjs';
-
-const containerInstanceKeyFromUserInput = makeArgumentDerivedSinkLint({
-  cacheKey: (access) => `container_instance_key_from_user_input:${access.file}:${access.line.toString()}`,
-  categories: ["SECURITY"],
-  description: "A `ctx.containers.<name>.get` call routes to a container instance using a key derived from the handler's `args` with no server-side scoping. Any caller can supply another tenant's key and reach that tenant's container instance — a cross-tenant insecure direct object reference (IDOR).",
-  detail: (access) => `\`ctx.containers.*.${access.method}\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) routes to a container instance using a key derived from \`args\` with no server-side scoping — any caller can reach another tenant's container (IDOR). Derive the key from a server-trusted identity (e.g. \`\${ctx.auth.userId}\`).`,
-  facing: "EXTERNAL",
-  getAccesses: (context) => context.containerKeyAccesses,
-  level: "WARN",
-  metadata: (access) => {
-    return { exportName: access.exportName, file: access.file, line: access.line, method: access.method };
-  },
-  name: "container_instance_key_from_user_input",
-  remediation: `Derive the container instance key from a server-trusted identity (e.g. \`\${ctx.auth.userId}\`) or a record the caller owns — never pass request input straight to \`ctx.containers.<name>.get\`.`,
-  title: "Possible cross-tenant IDOR from arg-derived unscoped container key"
-});
-
-export { containerInstanceKeyFromUserInput as default };

package/dist/packem_shared/containerOversizedInstance-5U1VKPRM.mjs

@@ -1,36 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const LARGE_NAMED = /* @__PURE__ */ new Set(["standard-3", "standard-4"]);
-const VCPU_THRESHOLD = 2;
-const MEMORY_MIB_THRESHOLD = 4096;
-const isOversized = (instanceType) => typeof instanceType === "string" ? LARGE_NAMED.has(instanceType) : (instanceType.vcpu ?? 0) > VCPU_THRESHOLD || (instanceType.memoryMib ?? 0) > MEMORY_MIB_THRESHOLD;
-const containerOversizedInstance = {
-  categories: ["PERFORMANCE"],
-  description: "A container is declared on a large instance type, whose provisioned memory and disk are billed for the lifetime of every running instance.",
-  facing: "INTERNAL",
-  level: "INFO",
-  name: "container_oversized_instance",
-  remediation: "Confirm the workload needs this size; a smaller instanceType (lite/basic/standard-1) costs less while idle-but-running.",
-  run: (context) => {
-    const findings = [];
-    for (const container of context.containers ?? []) {
-      const { instanceType } = container;
-      if (instanceType === void 0 || !isOversized(instanceType)) {
-        continue;
-      }
-      const size = typeof instanceType === "string" ? instanceType : JSON.stringify(instanceType);
-      findings.push(
-        emit(containerOversizedInstance, {
-          cacheKey: `container_oversized_instance:${container.exportName}`,
-          detail: `Container "${container.exportName}" uses a large instance type (${size}); its memory + disk are billed while any instance runs.`,
-          metadata: { container: container.exportName, instanceType }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Oversized container instance"
-};
-
-export { containerOversizedInstance as default };

package/dist/packem_shared/containerPublicInternet-CuNerJE5.mjs

@@ -1,30 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const containerPublicInternet = {
-  categories: ["SECURITY"],
-  description: "A container leaves outbound internet access at the default (enabled), which is billed per GB of egress and widens the attack surface.",
-  facing: "INTERNAL",
-  level: "INFO",
-  name: "container_public_internet",
-  remediation: "Set `enableInternet: false` on the container if it doesn't call external services, or `true` to opt in deliberately.",
-  run: (context) => {
-    const findings = [];
-    for (const container of context.containers ?? []) {
-      if (container.enableInternet !== void 0) {
-        continue;
-      }
-      findings.push(
-        emit(containerPublicInternet, {
-          cacheKey: `container_public_internet:${container.exportName}`,
-          detail: `Container "${container.exportName}" doesn't set enableInternet, so outbound internet is on by default (egress is billed).`,
-          metadata: { container: container.exportName }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Container egress enabled by default"
-};
-
-export { containerPublicInternet as default };

package/dist/packem_shared/containerRuntimeEgressRelaxation-B0LlfmDA.mjs

@@ -1,26 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const containerRuntimeEgressRelaxation = {
-  categories: ["SECURITY"],
-  description: "A runtime `.egress.allow(...)` / `.egress.deny(...)` / `.egress.setAllowed(...)` call mutates the container's egress firewall at runtime, re-opening a network surface the static analysis assumes is locked to the `defineContainer` declaration.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "container_runtime_egress_relaxation",
-  remediation: "Prefer declaring the egress policy statically in `lunora/containers.ts` where it is auditable. When a runtime mutation is unavoidable, scope it behind a server-trusted check and keep the change narrow (a specific host, not a broad allow) rather than an unconditional relaxation.",
-  run: (context) => {
-    if (context.containerOverrides === void 0) {
-      return [];
-    }
-    return context.containerOverrides.filter((override) => override.kind === "egress_relaxation").map(
-      (override) => emit(containerRuntimeEgressRelaxation, {
-        cacheKey: `container_runtime_egress_relaxation:${override.file}:${override.line.toString()}`,
-        detail: `\`${override.exportName}\` calls \`.egress.${override.detail}(...)\` at runtime, mutating the container's egress firewall.`,
-        metadata: { exportName: override.exportName, file: override.file, line: override.line, method: override.detail }
-      })
-    );
-  },
-  source: "static",
-  title: "Runtime egress mutation relaxes the container firewall"
-};
-
-export { containerRuntimeEgressRelaxation as default };

package/dist/packem_shared/containerStartEnableInternetOverride-DDaHZQ1L.mjs

@@ -1,26 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const containerStartEnableInternetOverride = {
-  categories: ["SECURITY"],
-  description: "A runtime `.start({ enableInternet: true, … })` call overrides the static `defineContainer` declaration and re-opens public internet egress for that container instance, defeating the `container_public_internet` lint's assumption that the declaration is authoritative.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "container_start_enable_internet_override",
-  remediation: "Avoid overriding `enableInternet` at `.start()` time. Set it once on the `defineContainer` declaration in `lunora/containers.ts` so the static advisors can reason about it, and gate any runtime opt-in behind a server-trusted check rather than an unconditional literal.",
-  run: (context) => {
-    if (context.containerOverrides === void 0) {
-      return [];
-    }
-    return context.containerOverrides.filter((override) => override.kind === "enable_internet").map(
-      (override) => emit(containerStartEnableInternetOverride, {
-        cacheKey: `container_start_enable_internet_override:${override.file}:${override.line.toString()}`,
-        detail: `\`${override.exportName}\` calls \`.start({ enableInternet: true })\`, overriding the container's static egress posture.`,
-        metadata: { exportName: override.exportName, file: override.file, line: override.line }
-      })
-    );
-  },
-  source: "static",
-  title: "Runtime .start() override re-enables container internet access"
-};
-
-export { containerStartEnableInternetOverride as default };

package/dist/packem_shared/duplicateIndex-BOublMSt.mjs

@@ -1,57 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const isLeadingPrefix = (a, b) => {
-  if (a.length > b.length) {
-    return false;
-  }
-  return a.every((field, position) => field === b[position]);
-};
-const duplicateIndex = {
-  categories: ["PERFORMANCE"],
-  description: "A secondary index is redundant because another index already covers every lookup it serves (its columns are a leading prefix of the other's). The redundant index costs storage and is maintained on every write for no read benefit.",
-  facing: "INTERNAL",
-  level: "INFO",
-  name: "duplicate_index",
-  remediation: "Drop the redundant index; the covering index already serves its lookups.",
-  run: (context) => {
-    const findings = [];
-    for (const table of context.schema.tables) {
-      const secondary = table.indexes.filter((index) => index.kind === "index");
-      for (const candidate of secondary) {
-        if (candidate.unique === true) {
-          continue;
-        }
-        const cover = secondary.find((other) => {
-          if (other === candidate) {
-            return false;
-          }
-          if (!isLeadingPrefix(candidate.fields, other.fields)) {
-            return false;
-          }
-          const sameLength = candidate.fields.length === other.fields.length;
-          return sameLength ? candidate.name > other.name : true;
-        });
-        if (!cover) {
-          continue;
-        }
-        findings.push(
-          emit(duplicateIndex, {
-            cacheKey: `duplicate_index:${table.name}:${candidate.name}`,
-            detail: `Index "${candidate.name}" on table "${table.name}" (${candidate.fields.join(", ")}) is redundant — index "${cover.name}" (${cover.fields.join(", ")}) already covers its lookups.`,
-            metadata: {
-              coveredBy: { fields: cover.fields, name: cover.name },
-              fields: candidate.fields,
-              index: candidate.name,
-              table: table.name
-            }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Duplicate / redundant index"
-};
-
-export { duplicateIndex as default };

package/dist/packem_shared/emptyIndex-BX8EuEY7.mjs

@@ -1,32 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const emptyIndex = {
-  categories: ["SCHEMA"],
-  description: "An index declares no columns, so it indexes nothing and can never narrow a read.",
-  facing: "INTERNAL",
-  level: "WARN",
-  name: "empty_index",
-  remediation: "Give the index its columns, or remove it.",
-  run: (context) => {
-    const findings = [];
-    for (const table of context.schema.tables) {
-      for (const index of table.indexes) {
-        if (index.kind !== "index" || index.fields.length > 0) {
-          continue;
-        }
-        findings.push(
-          emit(emptyIndex, {
-            cacheKey: `empty_index:${table.name}:${index.name}`,
-            detail: `Index "${index.name}" on table "${table.name}" declares no columns.`,
-            metadata: { index: index.name, table: table.name }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Empty index"
-};
-
-export { emptyIndex as default };

package/dist/packem_shared/externalSourceOnGlobal-Bg-NfCX9.mjs

@@ -1,30 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const externalSourceOnGlobal = {
-  categories: ["SCHEMA"],
-  description: "A table is both `.source(...)` and `.global()`. A global table lives in the external/global tier; a sourced table is materialized into a shard DO's SQLite — the two are mutually exclusive.",
-  facing: "INTERNAL",
-  level: "ERROR",
-  name: "external_source_on_global",
-  remediation: 'Drop either `.source(...)` or `.global()`. To ingest an external database into per-tenant DOs, use `.source(...)` with `.shardBy(...)`; to read it in place as a global table, use `.global({ backend: "hyperdrive" })`.',
-  run: (context) => {
-    const findings = [];
-    for (const table of context.schema.tables) {
-      if (table.externalSource === void 0 || table.shardKind !== "global") {
-        continue;
-      }
-      findings.push(
-        emit(externalSourceOnGlobal, {
-          cacheKey: `external_source_on_global:${table.name}`,
-          detail: `Table \`${table.name}\` is both \`.source(...)\` and \`.global()\` — contradictory. A sourced table materializes into a shard DO's SQLite; a global table lives in the external tier.`,
-          metadata: { table: table.name }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Sourced table cannot also be global"
-};
-
-export { externalSourceOnGlobal as default };

package/dist/packem_shared/externalSourceUnscoped-5vT-Bup3.mjs

@@ -1,44 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const externalSourceUnscoped = {
-  categories: ["SECURITY"],
-  description: "A `.source(...)` table that is also `.shardBy(...)` has no `tenantBy` mapper, so every tenant's Durable Object runs the same unscoped query and replicates the whole multitenant table — a cross-tenant data leak.",
-  facing: "EXTERNAL",
-  level: "ERROR",
-  name: "external_source_unscoped",
-  remediation: "Add `tenantBy: (shardKey) => [shardKey]` (matching the query's bound parameters) so each shard DO pulls only its own tenant's rows. The shard key MUST bind into the source `WHERE`.",
-  run: (context) => {
-    const findings = [];
-    for (const table of context.schema.tables) {
-      if (table.externalSource === void 0 || table.shardKind !== "shardBy") {
-        continue;
-      }
-      if (table.externalSource.unanalyzable) {
-        findings.push(
-          emit(externalSourceUnscoped, {
-            cacheKey: `external_source_unscoped:${table.name}`,
-            detail: `Table \`${table.name}\` is \`.source(...)\` + \`.shardBy(...)\` but its source config is not a static object literal, so \`tenantBy\` can't be verified. Confirm \`tenantBy\` binds the shard key into the query, or inline the config so the linter can check it — an unscoped query leaks every tenant's rows into each DO.`,
-            level: "WARN",
-            metadata: { table: table.name }
-          })
-        );
-        continue;
-      }
-      if (table.externalSource.hasTenantBy) {
-        continue;
-      }
-      findings.push(
-        emit(externalSourceUnscoped, {
-          cacheKey: `external_source_unscoped:${table.name}`,
-          detail: `Table \`${table.name}\` is \`.source(...)\` + \`.shardBy(...)\` but declares no \`tenantBy\` — every tenant DO would pull the whole table. Add a \`tenantBy\` that binds the shard key into the query.`,
-          metadata: { table: table.name }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Sourced + sharded table is not tenant-scoped"
-};
-
-export { externalSourceUnscoped as default };

package/dist/packem_shared/filterWithoutIndex-BYVeJaSs.mjs

@@ -1,31 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const filterWithoutIndex = {
-  categories: ["PERFORMANCE"],
-  description: "A query calls `.filter()` without a `.withIndex()` / `.withSearchIndex()`, so it loads every row in the table and filters in memory — a full table scan that gets linearly slower as the table grows.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "filter_without_index",
-  remediation: 'Narrow the read with `.withIndex("name", (q) => q.eq(...))` first, then `.filter()` only for what the index cannot express.',
-  run: (context) => {
-    const findings = [];
-    for (const read of context.queries ?? []) {
-      if (!read.hasFilter || read.hasIndex || read.table === "") {
-        continue;
-      }
-      const location = read.line > 0 ? `${read.file}:${read.line.toString()}` : read.file;
-      findings.push(
-        emit(filterWithoutIndex, {
-          cacheKey: `filter_without_index:${read.file}:${read.line.toString()}:${read.table}`,
-          detail: `Query on "${read.table}" at ${location} calls .filter() without an index — it loads every row of "${read.table}" and filters in memory.`,
-          metadata: { file: read.file, line: read.line, table: read.table }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Filter without index"
-};
-
-export { filterWithoutIndex as default };

package/dist/packem_shared/finding-Dm_zvzS1.mjs

@@ -1,16 +0,0 @@
-const emit = (lint, occurrence) => {
-  return {
-    cacheKey: occurrence.cacheKey,
-    categories: occurrence.categories ?? lint.categories,
-    description: lint.description,
-    detail: occurrence.detail,
-    facing: occurrence.facing ?? lint.facing,
-    level: occurrence.level ?? lint.level,
-    metadata: occurrence.metadata,
-    name: lint.name,
-    remediation: lint.remediation,
-    title: lint.title
-  };
-};
-
-export { emit as e };

package/dist/packem_shared/fk-index-IUK1ukgs.mjs

@@ -1,7 +0,0 @@
-const PRIMARY_KEY = "_id";
-const suggestIndexName = (field) => `by${field.charAt(0).toUpperCase()}${field.slice(1)}`;
-const leadingIndexedColumns = (table) => new Set(
-  table.indexes.filter((index) => index.kind === "index").map((index) => index.fields[0]).filter((field) => field !== void 0)
-);
-
-export { PRIMARY_KEY as P, leadingIndexedColumns as l, suggestIndexName as s };

package/dist/packem_shared/flagGatesSecurityWithUnsafeDefault-BhIs0shr.mjs

@@ -1,41 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const PROTECT_TOKENS = /* @__PURE__ */ new Set(["enforce", "gate", "lockdown", "rls"]);
-const PERMIT_TOKENS = /* @__PURE__ */ new Set(["allow", "bypass", "permit"]);
-const ACRONYM_WORD_BOUNDARY = /(?<=[A-Z])(?=[A-Z][a-z])/gu;
-const CAMEL_HUMP_BOUNDARY = /(?<=[a-z0-9])(?=[A-Z])/gu;
-const NON_ALPHANUMERIC_RUN = /[^a-z0-9]+/u;
-const tokenize = (key) => key.replaceAll(ACRONYM_WORD_BOUNDARY, " ").replaceAll(CAMEL_HUMP_BOUNDARY, " ").toLowerCase().split(NON_ALPHANUMERIC_RUN).filter((token) => token.length > 0);
-const hasUnsafeDefault = (row) => {
-  const tokens = tokenize(row.key);
-  const isProtect = tokens.some((token) => PROTECT_TOKENS.has(token));
-  const isPermit = tokens.some((token) => PERMIT_TOKENS.has(token));
-  if (isProtect === isPermit) {
-    return false;
-  }
-  return isProtect ? !row.defaultValue : row.defaultValue;
-};
-const flagGatesSecurityWithUnsafeDefault = {
-  categories: ["SECURITY"],
-  description: "A `ctx.flags.boolean(key, default)` read on a security-shaped key has a fail-open default that selects the permissive branch. OpenFeature returns the default when the provider errors, so an outage silently disables a protection (a `false` default on an `enforce`/`rls`/`gate`/`lockdown` key) or grants a permission (a `true` default on an `allow`/`permit`/`bypass` key).",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "flag_gates_security_with_unsafe_default",
-  remediation: "Flip the default so a provider outage fails closed: default a protection flag (`enforce*`/`rls*`/`gate*`/`lockdown*`) to `true`, and a permission/bypass flag (`allow*`/`permit*`/`bypass*`) to `false`. The safe default is always the restrictive branch — never let an unreachable flag backend open access.",
-  run: (context) => {
-    if (context.flagSecurityDefaults === void 0) {
-      return [];
-    }
-    return context.flagSecurityDefaults.filter((row) => hasUnsafeDefault(row)).map(
-      (row) => emit(flagGatesSecurityWithUnsafeDefault, {
-        cacheKey: `flag_gates_security_with_unsafe_default:${row.file}:${row.line.toString()}`,
-        detail: `\`ctx.flags.boolean("${row.key}", ${String(row.defaultValue)})\` in \`${row.exportName}\` (${row.file}:${row.line.toString()}) fails open to the permissive branch — a provider outage returns \`${String(row.defaultValue)}\`, ${row.defaultValue ? "granting the guarded permission" : "disabling the guarded protection"}.`,
-        metadata: { defaultValue: row.defaultValue, exportName: row.exportName, file: row.file, key: row.key, line: row.line }
-      })
-    );
-  },
-  source: "static",
-  title: "Security flag fails open to the permissive branch"
-};
-
-export { flagGatesSecurityWithUnsafeDefault as default };

package/dist/packem_shared/fromServerSchema-BiB6JSiW.mjs

@@ -1,59 +0,0 @@
-const fromServerSchema = (schema) => {
-  return {
-    rlsMode: schema.rlsMode,
-    tables: Object.entries(schema.tables).map(([name, table]) => {
-      const indexes = [
-        ...table.indexes.map((index) => {
-          return { fields: index.fields, kind: "index", name: index.name, unique: index.unique };
-        }),
-        ...table.searchIndexes.map((index) => {
-          return { fields: [index.field, ...index.filterFields ?? []], kind: "search", name: index.name };
-        }),
-        ...table.rankIndexes.map((index) => {
-          return { fields: [...index.sortBy.map((key) => key.field), ...index.partitionBy ?? []], kind: "rank", name: index.name };
-        }),
-        ...table.vectorIndexes.map((index) => {
-          return { fields: [index.field], kind: "vector", name: index.name };
-        })
-      ];
-      const optionalFields = /* @__PURE__ */ new Set();
-      for (const [fieldName, validator] of Object.entries(table.shape)) {
-        if (validator.kind === "optional") {
-          optionalFields.add(fieldName);
-        } else {
-          const column = validator._meta?.column;
-          if (column?.notNull === false) {
-            optionalFields.add(fieldName);
-          }
-        }
-      }
-      return {
-        externallyManaged: table.isExternallyManaged ?? false,
-        externalSource: table.externalSource ? {
-          hasReconcile: table.externalSource.reconcileEveryMs !== void 0,
-          hasTenantBy: table.externalSource.tenantBy !== void 0,
-          mode: table.externalSource.mode
-        } : void 0,
-        fields: Object.keys(table.shape),
-        indexes,
-        isPublic: table.isPublic ?? false,
-        name,
-        optionalFields,
-        shardKind: table.shardMode.kind,
-        softDelete: table.softDeleteMode,
-        relations: Object.entries(table.relationMap).map(([accessor, relation]) => {
-          return {
-            field: relation.field,
-            kind: relation.kind,
-            name: accessor,
-            onDelete: relation.onDelete,
-            references: relation.references,
-            table: relation.table
-          };
-        })
-      };
-    })
-  };
-};
-
-export { fromServerSchema };