@lunora/advisor 1.0.0-alpha.3 → 1.0.0-alpha.30

package/dist/packem_shared/circularFk-CNcAVuYa.mjs

@@ -0,0 +1,127 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const MAX_CYCLES = 100;
+const circularFk = {
+  categories: ["SCHEMA"],
+  description: "A chain of foreign-key relations forms a cycle (e.g. A → B → C → A). Circular FK dependencies can cause unexpected behavior during DELETE operations — a CASCADE chain may loop indefinitely, and even a RESTRICT cycle prevents deletion of any row in the loop without temporarily disabling constraints.",
+  facing: "INTERNAL",
+  level: "WARN",
+  name: "circular_fk",
+  remediation: "Remove or break the cycle by dropping at least one FK relation from the loop. Consider replacing the circular dependency with a nullable FK and explicit application logic, or restructure the schema using a junction table.",
+  run: (context) => {
+    const findings = [];
+    const order = [...new Set(context.schema.tables.map((table) => table.name))].sort();
+    const indexOf = new Map(order.map((name, index) => [name, index]));
+    const adjacency = /* @__PURE__ */ new Map();
+    for (const table of context.schema.tables) {
+      for (const relation of table.relations) {
+        if (relation.kind !== "one" || !indexOf.has(relation.table)) {
+          continue;
+        }
+        let targets = adjacency.get(table.name);
+        if (targets === void 0) {
+          targets = /* @__PURE__ */ new Set();
+          adjacency.set(table.name, targets);
+        }
+        targets.add(relation.table);
+      }
+    }
+    const blocked = /* @__PURE__ */ new Set();
+    const blockMap = /* @__PURE__ */ new Map();
+    const stack = [];
+    const reported = /* @__PURE__ */ new Set();
+    let capped = false;
+    const unblock = (vertex) => {
+      blocked.delete(vertex);
+      const dependents = blockMap.get(vertex);
+      if (dependents === void 0) {
+        return;
+      }
+      for (const dependent of dependents) {
+        dependents.delete(dependent);
+        if (blocked.has(dependent)) {
+          unblock(dependent);
+        }
+      }
+    };
+    const emitCurrentCycle = () => {
+      const cycle = [...stack];
+      if (cycle.length < 2) {
+        return;
+      }
+      let minIndex = 0;
+      for (let index = 1; index < cycle.length; index += 1) {
+        if (cycle[index] < cycle[minIndex]) {
+          minIndex = index;
+        }
+      }
+      const canonical = [...cycle.slice(minIndex), ...cycle.slice(0, minIndex)];
+      const key = canonical.join("→");
+      if (reported.has(key)) {
+        return;
+      }
+      reported.add(key);
+      const displayPath = [...canonical, canonical[0]].join(" → ");
+      findings.push(
+        emit(circularFk, {
+          cacheKey: `circular_fk:${key}`,
+          detail: `Circular foreign-key dependency detected: ${displayPath}. This cycle can cause unexpected behavior during DELETE operations.`,
+          metadata: {
+            cycle: canonical,
+            path: displayPath,
+            tables: canonical
+          }
+        })
+      );
+      if (reported.size >= MAX_CYCLES) {
+        capped = true;
+      }
+    };
+    const circuit = (vertex, start, startIndex) => {
+      let foundCycle = false;
+      stack.push(vertex);
+      blocked.add(vertex);
+      for (const neighbor of adjacency.get(vertex) ?? []) {
+        if (capped) {
+          break;
+        }
+        if (indexOf.get(neighbor) < startIndex) {
+          continue;
+        }
+        if (neighbor === start) {
+          emitCurrentCycle();
+          foundCycle = true;
+        } else if (!blocked.has(neighbor) && circuit(neighbor, start, startIndex)) {
+          foundCycle = true;
+        }
+      }
+      if (foundCycle) {
+        unblock(vertex);
+      } else {
+        for (const neighbor of adjacency.get(vertex) ?? []) {
+          if (indexOf.get(neighbor) < startIndex) {
+            continue;
+          }
+          let dependents = blockMap.get(neighbor);
+          if (dependents === void 0) {
+            dependents = /* @__PURE__ */ new Set();
+            blockMap.set(neighbor, dependents);
+          }
+          dependents.add(vertex);
+        }
+      }
+      stack.pop();
+      return foundCycle;
+    };
+    for (let startIndex = 0; startIndex < order.length && !capped; startIndex += 1) {
+      blocked.clear();
+      blockMap.clear();
+      circuit(order[startIndex], order[startIndex], startIndex);
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Circular foreign-key dependency"
+};
+
+export { circularFk as default };

package/dist/packem_shared/{constraintValidator-Dr9Py3FD.mjs → constraintValidator-CxwtpJ6E.mjs}

@@ -9,10 +9,28 @@ const formatExamples = (ids, total) => {
   const list = examples.map((id) => `"${id}"`).join(", ");
   return more > 0 ? `${list} (+${more.toString()} more)` : list;
 };
+const resolveReferenceValues = (referencedColumn, targetSample) => {
+  if (referencedColumn === "_id") {
+    return targetSample.existingIds;
+  }
+  const values = /* @__PURE__ */ new Set();
+  for (const row of targetSample.rows) {
+    const value = row[referencedColumn];
+    if (value !== null && value !== void 0) {
+      values.add(String(value));
+    }
+  }
+  return values;
+};
 const checkFkRelation = (lint, sample, relation, targetSample) => {
   if (relation.kind !== "one") {
     return void 0;
   }
+  if (targetSample.truncated) {
+    return void 0;
+  }
+  const referencedColumn = relation.references;
+  const referenceValues = resolveReferenceValues(referencedColumn, targetSample);
   const fkColumn = relation.field;
   const danglingIds = [];
   for (const row of sample.rows) {
@@ -21,16 +39,17 @@ const checkFkRelation = (lint, sample, relation, targetSample) => {
       continue;
     }
     const fkString = String(fkValue);
-    if (!targetSample.existingIds.has(fkString)) {
+    if (!referenceValues.has(fkString)) {
       danglingIds.push(rowId(row));
     }
   }
   if (danglingIds.length === 0) {
     return void 0;
   }
-  const isTruncated = sample.truncated || targetSample.truncated;
-  const cap = Math.min(sample.cap, targetSample.cap);
-  const detail = `Table "${sample.table}": ${danglingIds.length.toString()} sampled row(s) have a dangling FK value in column "${fkColumn}" — the referenced "${relation.table}" row does not exist. Row ids: ${formatExamples(danglingIds, danglingIds.length)}${truncatedSuffix(isTruncated, cap, "more rows may exist beyond the window")}.`;
+  const isTruncated = sample.truncated;
+  const { cap } = sample;
+  const referencedLabel = referencedColumn === "_id" ? `"${relation.table}"` : `"${relation.table}"."${referencedColumn}"`;
+  const detail = `Table "${sample.table}": ${danglingIds.length.toString()} sampled row(s) have a dangling FK value in column "${fkColumn}" — the referenced ${referencedLabel} row does not exist. Row ids: ${formatExamples(danglingIds, danglingIds.length)}${truncatedSuffix(isTruncated, cap, "more rows may exist beyond the window")}.`;
   return emit(lint, {
     cacheKey: `constraint_validator:fk:${sample.table}:${fkColumn}`,
     detail,
@@ -40,6 +59,7 @@ const checkFkRelation = (lint, sample, relation, targetSample) => {
       count: danglingIds.length,
       examples: danglingIds.slice(0, MAX_EXAMPLE_IDS),
       kind: "fk",
+      references: referencedColumn,
       referencesTable: relation.table,
       table: sample.table,
       truncated: isTruncated

package/dist/packem_shared/containerInstanceKeyFromUserInput-BUXj2J4w.mjs

@@ -0,0 +1,19 @@
+import { m as makeArgumentDerivedSinkLint } from './argument-derived-sink-C1xTTqAt.mjs';
+
+const containerInstanceKeyFromUserInput = makeArgumentDerivedSinkLint({
+  cacheKey: (access) => `container_instance_key_from_user_input:${access.file}:${access.line.toString()}`,
+  categories: ["SECURITY"],
+  description: "A `ctx.containers.<name>.get` call routes to a container instance using a key derived from the handler's `args` with no server-side scoping. Any caller can supply another tenant's key and reach that tenant's container instance — a cross-tenant insecure direct object reference (IDOR).",
+  detail: (access) => `\`ctx.containers.*.${access.method}\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) routes to a container instance using a key derived from \`args\` with no server-side scoping — any caller can reach another tenant's container (IDOR). Derive the key from a server-trusted identity (e.g. \`\${ctx.auth.userId}\`).`,
+  facing: "EXTERNAL",
+  getAccesses: (context) => context.containerKeyAccesses,
+  level: "WARN",
+  metadata: (access) => {
+    return { exportName: access.exportName, file: access.file, line: access.line, method: access.method };
+  },
+  name: "container_instance_key_from_user_input",
+  remediation: `Derive the container instance key from a server-trusted identity (e.g. \`\${ctx.auth.userId}\`) or a record the caller owns — never pass request input straight to \`ctx.containers.<name>.get\`.`,
+  title: "Possible cross-tenant IDOR from arg-derived unscoped container key"
+});
+
+export { containerInstanceKeyFromUserInput as default };

package/dist/packem_shared/containerRuntimeEgressRelaxation-B0LlfmDA.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const containerRuntimeEgressRelaxation = {
+  categories: ["SECURITY"],
+  description: "A runtime `.egress.allow(...)` / `.egress.deny(...)` / `.egress.setAllowed(...)` call mutates the container's egress firewall at runtime, re-opening a network surface the static analysis assumes is locked to the `defineContainer` declaration.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "container_runtime_egress_relaxation",
+  remediation: "Prefer declaring the egress policy statically in `lunora/containers.ts` where it is auditable. When a runtime mutation is unavoidable, scope it behind a server-trusted check and keep the change narrow (a specific host, not a broad allow) rather than an unconditional relaxation.",
+  run: (context) => {
+    if (context.containerOverrides === void 0) {
+      return [];
+    }
+    return context.containerOverrides.filter((override) => override.kind === "egress_relaxation").map(
+      (override) => emit(containerRuntimeEgressRelaxation, {
+        cacheKey: `container_runtime_egress_relaxation:${override.file}:${override.line.toString()}`,
+        detail: `\`${override.exportName}\` calls \`.egress.${override.detail}(...)\` at runtime, mutating the container's egress firewall.`,
+        metadata: { exportName: override.exportName, file: override.file, line: override.line, method: override.detail }
+      })
+    );
+  },
+  source: "static",
+  title: "Runtime egress mutation relaxes the container firewall"
+};
+
+export { containerRuntimeEgressRelaxation as default };

package/dist/packem_shared/containerStartEnableInternetOverride-DDaHZQ1L.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const containerStartEnableInternetOverride = {
+  categories: ["SECURITY"],
+  description: "A runtime `.start({ enableInternet: true, … })` call overrides the static `defineContainer` declaration and re-opens public internet egress for that container instance, defeating the `container_public_internet` lint's assumption that the declaration is authoritative.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "container_start_enable_internet_override",
+  remediation: "Avoid overriding `enableInternet` at `.start()` time. Set it once on the `defineContainer` declaration in `lunora/containers.ts` so the static advisors can reason about it, and gate any runtime opt-in behind a server-trusted check rather than an unconditional literal.",
+  run: (context) => {
+    if (context.containerOverrides === void 0) {
+      return [];
+    }
+    return context.containerOverrides.filter((override) => override.kind === "enable_internet").map(
+      (override) => emit(containerStartEnableInternetOverride, {
+        cacheKey: `container_start_enable_internet_override:${override.file}:${override.line.toString()}`,
+        detail: `\`${override.exportName}\` calls \`.start({ enableInternet: true })\`, overriding the container's static egress posture.`,
+        metadata: { exportName: override.exportName, file: override.file, line: override.line }
+      })
+    );
+  },
+  source: "static",
+  title: "Runtime .start() override re-enables container internet access"
+};
+
+export { containerStartEnableInternetOverride as default };

package/dist/packem_shared/dedupeCacheKeys-r5B7u_yq.mjs

@@ -0,0 +1,13 @@
+const dedupeCacheKeys = (findings) => {
+  const seen = /* @__PURE__ */ new Map();
+  return findings.map((finding) => {
+    const occurrence = (seen.get(finding.cacheKey) ?? 0) + 1;
+    seen.set(finding.cacheKey, occurrence);
+    if (occurrence === 1) {
+      return finding;
+    }
+    return { ...finding, cacheKey: `${finding.cacheKey}:${occurrence.toString()}` };
+  });
+};
+
+export { dedupeCacheKeys };

package/dist/packem_shared/externalSourceIncrementalNoDeletePath-DvX9cRBD.mjs

@@ -0,0 +1,45 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const externalSourceIncrementalNoDeletePath = {
+  categories: ["SCHEMA"],
+  description: "A `.source({ mode: 'incremental' })` table declares no delete-visibility path (`reconcileEveryMs` or `softDeleteColumn`), so upstream deletes are never applied and the materialized table accumulates phantom rows.",
+  facing: "EXTERNAL",
+  level: "ERROR",
+  name: "external_source_incremental_no_delete_path",
+  remediation: "Add `reconcileEveryMs` (a periodic full-pull sweep that GCs vanished rows) or `softDeleteColumn` (an upstream tombstone column the incremental pull returns). Incremental ingest can't see a delete otherwise.",
+  run: (context) => {
+    const findings = [];
+    for (const table of context.schema.tables) {
+      const source = table.externalSource;
+      if (source === void 0) {
+        continue;
+      }
+      if (source.unanalyzable) {
+        findings.push(
+          emit(externalSourceIncrementalNoDeletePath, {
+            cacheKey: `external_source_incremental_no_delete_path:${table.name}`,
+            detail: `Table \`${table.name}\`'s \`.source(...)\` config is not a static object literal, so its \`mode\`/delete-visibility can't be verified. If it is \`mode: "incremental"\`, confirm it declares \`reconcileEveryMs\` or \`softDeleteColumn\` — an incremental source without one accumulates phantom rows on every upstream delete.`,
+            level: "WARN",
+            metadata: { table: table.name }
+          })
+        );
+        continue;
+      }
+      if (source.mode !== "incremental" || source.hasReconcile || source.hasSoftDelete) {
+        continue;
+      }
+      findings.push(
+        emit(externalSourceIncrementalNoDeletePath, {
+          cacheKey: `external_source_incremental_no_delete_path:${table.name}`,
+          detail: `Table \`${table.name}\` is \`.source({ mode: "incremental" })\` but declares neither \`reconcileEveryMs\` nor \`softDeleteColumn\` — an incremental pull never sees upstream deletes, so the materialized table would accumulate phantom rows. Add one of the two delete-visibility paths.`,
+          metadata: { table: table.name }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Incremental sourced table has no delete-visibility path"
+};
+
+export { externalSourceIncrementalNoDeletePath as default };

package/dist/packem_shared/externalSourceOnGlobal-Bg-NfCX9.mjs

@@ -0,0 +1,30 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const externalSourceOnGlobal = {
+  categories: ["SCHEMA"],
+  description: "A table is both `.source(...)` and `.global()`. A global table lives in the external/global tier; a sourced table is materialized into a shard DO's SQLite — the two are mutually exclusive.",
+  facing: "INTERNAL",
+  level: "ERROR",
+  name: "external_source_on_global",
+  remediation: 'Drop either `.source(...)` or `.global()`. To ingest an external database into per-tenant DOs, use `.source(...)` with `.shardBy(...)`; to read it in place as a global table, use `.global({ backend: "hyperdrive" })`.',
+  run: (context) => {
+    const findings = [];
+    for (const table of context.schema.tables) {
+      if (table.externalSource === void 0 || table.shardKind !== "global") {
+        continue;
+      }
+      findings.push(
+        emit(externalSourceOnGlobal, {
+          cacheKey: `external_source_on_global:${table.name}`,
+          detail: `Table \`${table.name}\` is both \`.source(...)\` and \`.global()\` — contradictory. A sourced table materializes into a shard DO's SQLite; a global table lives in the external tier.`,
+          metadata: { table: table.name }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Sourced table cannot also be global"
+};
+
+export { externalSourceOnGlobal as default };

package/dist/packem_shared/externalSourceUnscoped-5vT-Bup3.mjs

@@ -0,0 +1,44 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const externalSourceUnscoped = {
+  categories: ["SECURITY"],
+  description: "A `.source(...)` table that is also `.shardBy(...)` has no `tenantBy` mapper, so every tenant's Durable Object runs the same unscoped query and replicates the whole multitenant table — a cross-tenant data leak.",
+  facing: "EXTERNAL",
+  level: "ERROR",
+  name: "external_source_unscoped",
+  remediation: "Add `tenantBy: (shardKey) => [shardKey]` (matching the query's bound parameters) so each shard DO pulls only its own tenant's rows. The shard key MUST bind into the source `WHERE`.",
+  run: (context) => {
+    const findings = [];
+    for (const table of context.schema.tables) {
+      if (table.externalSource === void 0 || table.shardKind !== "shardBy") {
+        continue;
+      }
+      if (table.externalSource.unanalyzable) {
+        findings.push(
+          emit(externalSourceUnscoped, {
+            cacheKey: `external_source_unscoped:${table.name}`,
+            detail: `Table \`${table.name}\` is \`.source(...)\` + \`.shardBy(...)\` but its source config is not a static object literal, so \`tenantBy\` can't be verified. Confirm \`tenantBy\` binds the shard key into the query, or inline the config so the linter can check it — an unscoped query leaks every tenant's rows into each DO.`,
+            level: "WARN",
+            metadata: { table: table.name }
+          })
+        );
+        continue;
+      }
+      if (table.externalSource.hasTenantBy) {
+        continue;
+      }
+      findings.push(
+        emit(externalSourceUnscoped, {
+          cacheKey: `external_source_unscoped:${table.name}`,
+          detail: `Table \`${table.name}\` is \`.source(...)\` + \`.shardBy(...)\` but declares no \`tenantBy\` — every tenant DO would pull the whole table. Add a \`tenantBy\` that binds the shard key into the query.`,
+          metadata: { table: table.name }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Sourced + sharded table is not tenant-scoped"
+};
+
+export { externalSourceUnscoped as default };

package/dist/packem_shared/flagGatesSecurityWithUnsafeDefault-BhIs0shr.mjs

@@ -0,0 +1,41 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const PROTECT_TOKENS = /* @__PURE__ */ new Set(["enforce", "gate", "lockdown", "rls"]);
+const PERMIT_TOKENS = /* @__PURE__ */ new Set(["allow", "bypass", "permit"]);
+const ACRONYM_WORD_BOUNDARY = /(?<=[A-Z])(?=[A-Z][a-z])/gu;
+const CAMEL_HUMP_BOUNDARY = /(?<=[a-z0-9])(?=[A-Z])/gu;
+const NON_ALPHANUMERIC_RUN = /[^a-z0-9]+/u;
+const tokenize = (key) => key.replaceAll(ACRONYM_WORD_BOUNDARY, " ").replaceAll(CAMEL_HUMP_BOUNDARY, " ").toLowerCase().split(NON_ALPHANUMERIC_RUN).filter((token) => token.length > 0);
+const hasUnsafeDefault = (row) => {
+  const tokens = tokenize(row.key);
+  const isProtect = tokens.some((token) => PROTECT_TOKENS.has(token));
+  const isPermit = tokens.some((token) => PERMIT_TOKENS.has(token));
+  if (isProtect === isPermit) {
+    return false;
+  }
+  return isProtect ? !row.defaultValue : row.defaultValue;
+};
+const flagGatesSecurityWithUnsafeDefault = {
+  categories: ["SECURITY"],
+  description: "A `ctx.flags.boolean(key, default)` read on a security-shaped key has a fail-open default that selects the permissive branch. OpenFeature returns the default when the provider errors, so an outage silently disables a protection (a `false` default on an `enforce`/`rls`/`gate`/`lockdown` key) or grants a permission (a `true` default on an `allow`/`permit`/`bypass` key).",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "flag_gates_security_with_unsafe_default",
+  remediation: "Flip the default so a provider outage fails closed: default a protection flag (`enforce*`/`rls*`/`gate*`/`lockdown*`) to `true`, and a permission/bypass flag (`allow*`/`permit*`/`bypass*`) to `false`. The safe default is always the restrictive branch — never let an unreachable flag backend open access.",
+  run: (context) => {
+    if (context.flagSecurityDefaults === void 0) {
+      return [];
+    }
+    return context.flagSecurityDefaults.filter((row) => hasUnsafeDefault(row)).map(
+      (row) => emit(flagGatesSecurityWithUnsafeDefault, {
+        cacheKey: `flag_gates_security_with_unsafe_default:${row.file}:${row.line.toString()}`,
+        detail: `\`ctx.flags.boolean("${row.key}", ${String(row.defaultValue)})\` in \`${row.exportName}\` (${row.file}:${row.line.toString()}) fails open to the permissive branch — a provider outage returns \`${String(row.defaultValue)}\`, ${row.defaultValue ? "granting the guarded permission" : "disabling the guarded protection"}.`,
+        metadata: { defaultValue: row.defaultValue, exportName: row.exportName, file: row.file, key: row.key, line: row.line }
+      })
+    );
+  },
+  source: "static",
+  title: "Security flag fails open to the permissive branch"
+};
+
+export { flagGatesSecurityWithUnsafeDefault as default };

package/dist/packem_shared/{fromServerSchema-DinF1nph.mjs → fromServerSchema-BjAZdvJ6.mjs}

@@ -1,5 +1,6 @@
 const fromServerSchema = (schema) => {
   return {
+    rlsMode: schema.rlsMode,
     tables: Object.entries(schema.tables).map(([name, table]) => {
       const indexes = [
         ...table.indexes.map((index) => {
@@ -28,10 +29,19 @@ const fromServerSchema = (schema) => {
       }
       return {
         externallyManaged: table.isExternallyManaged ?? false,
+        externalSource: table.externalSource ? {
+          hasReconcile: table.externalSource.reconcileEveryMs !== void 0,
+          hasSoftDelete: table.externalSource.softDeleteColumn !== void 0,
+          hasTenantBy: table.externalSource.tenantBy !== void 0,
+          mode: table.externalSource.mode
+        } : void 0,
         fields: Object.keys(table.shape),
         indexes,
+        isPublic: table.isPublic ?? false,
         name,
         optionalFields,
+        shardKind: table.shardMode.kind,
+        softDelete: table.softDeleteMode,
         relations: Object.entries(table.relationMap).map(([accessor, relation]) => {
           return {
             field: relation.field,

package/dist/packem_shared/{hardcodedSecret-W2pz1UZB.mjs → hardcodedSecret-Be-pKVdn.mjs}

@@ -1,3 +1,4 @@
+import { dedupeCacheKeys } from './dedupeCacheKeys-r5B7u_yq.mjs';
 import { e as emit } from './finding-Dm_zvzS1.mjs';
 
 const hardcodedSecret = {
@@ -12,21 +13,16 @@ const hardcodedSecret = {
       return [];
     }
     const findings = [];
-    const occurrenceCount = /* @__PURE__ */ new Map();
     for (const secret of context.secretLiterals) {
-      const baseKey = `${secret.file}:${secret.line.toString()}:${secret.kind}`;
-      const occurrence = (occurrenceCount.get(baseKey) ?? 0) + 1;
-      occurrenceCount.set(baseKey, occurrence);
-      const occurrenceSuffix = occurrence > 1 ? `:${occurrence.toString()}` : "";
       findings.push(
         emit(hardcodedSecret, {
-          cacheKey: `hardcoded_secret:${baseKey}${occurrenceSuffix}`,
+          cacheKey: `hardcoded_secret:${secret.file}:${secret.line.toString()}:${secret.kind}`,
           detail: `A ${secret.kind.replaceAll("_", " ")} (${secret.preview}) is hard-coded at ${secret.file}:${secret.line.toString()}. Move it to \`.dev.vars\` / \`wrangler secret put\` and read it from \`env\`. Rotate the exposed value.`,
           metadata: { file: secret.file, kind: secret.kind, line: secret.line, preview: secret.preview }
         })
       );
     }
-    return findings;
+    return dedupeCacheKeys(findings);
   },
   source: "static",
   title: "Hard-coded secret in source"

package/dist/packem_shared/helpers-BySnKhVB.mjs

@@ -0,0 +1,31 @@
+const OWNERSHIP_FIELD_NAMES = /* @__PURE__ */ new Set([
+  "accountId",
+  "authorId",
+  "createdBy",
+  "createdById",
+  "organizationId",
+  "orgId",
+  "ownerId",
+  "tenantId",
+  "updatedBy",
+  "userId",
+  "workspaceId"
+]);
+const PII_FIELD_NAMES = /* @__PURE__ */ new Set([
+  "address",
+  "dateOfBirth",
+  "dob",
+  "email",
+  "firstName",
+  "lastName",
+  "phone",
+  "phoneNumber",
+  "socialSecurityNumber",
+  "ssn"
+]);
+const SYSTEM_FIELDS = /* @__PURE__ */ new Set(["_creationTime", "_id"]);
+const ownershipOrPiiColumns = (table) => table.fields.filter((field) => OWNERSHIP_FIELD_NAMES.has(field) || PII_FIELD_NAMES.has(field));
+const tableColumnSet = (table) => /* @__PURE__ */ new Set([...SYSTEM_FIELDS, ...table.fields]);
+const isPublicWrite = (procedure) => procedure.visibility === "public" && (procedure.kind === "mutation" || procedure.kind === "action");
+
+export { PII_FIELD_NAMES as P, isPublicWrite as i, ownershipOrPiiColumns as o, tableColumnSet as t };

package/dist/packem_shared/hotShard-CkC7qpre.mjs

@@ -0,0 +1,60 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const HOT_SHARE_THRESHOLD = 0.5;
+const MIN_TOTAL_REQUESTS = 50;
+const hotShard = {
+  categories: ["PERFORMANCE"],
+  description: "One shard is taking a disproportionate share of a sharded function's traffic, so the busy shard becomes a single-DO bottleneck while its siblings sit idle — the hot-key skew sharding is meant to avoid.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "hot_shard",
+  remediation: "Re-shard on a higher-cardinality / more evenly-distributed key, or split the hot entity's state, so request volume spreads across shards instead of concentrating on one.",
+  run: (context) => {
+    const active = (context.shardTraffic ?? []).filter((shard) => shard.requests > 0);
+    const byGroup = /* @__PURE__ */ new Map();
+    for (const shard of active) {
+      const groupKey = shard.group ?? "";
+      const bucket = byGroup.get(groupKey);
+      if (bucket === void 0) {
+        byGroup.set(groupKey, [shard]);
+      } else {
+        bucket.push(shard);
+      }
+    }
+    const findings = [];
+    for (const [groupKey, groupShards] of byGroup) {
+      const totalRequests = groupShards.reduce((sum, shard) => sum + shard.requests, 0);
+      if (groupShards.length < 2 || totalRequests < MIN_TOTAL_REQUESTS) {
+        continue;
+      }
+      for (const shard of groupShards) {
+        const share = shard.requests / totalRequests;
+        if (share < HOT_SHARE_THRESHOLD) {
+          continue;
+        }
+        const scope = shard.group !== void 0 && shard.group !== "" ? `"${shard.group}" ` : "";
+        const label = shard.shardKey === "" ? "the root shard" : `shard "${shard.shardKey}"`;
+        const percent = Math.round(share * 100);
+        findings.push(
+          emit(hotShard, {
+            cacheKey: `hot_shard:${groupKey}:${shard.shardKey}`,
+            detail: `${scope}${label} handled ${shard.requests.toString()} of ${totalRequests.toString()} requests (${percent.toString()}%) across ${groupShards.length.toString()} shards — a hot-key skew. Re-shard on a more evenly-distributed key.`,
+            metadata: {
+              group: shard.group,
+              requests: shard.requests,
+              shardCount: groupShards.length,
+              shardKey: shard.shardKey,
+              share,
+              totalRequests
+            }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "runtime",
+  title: "Hot shard"
+};
+
+export { hotShard as default };

package/dist/packem_shared/httpActionMissingAuthGuard-CxipddNx.mjs

@@ -0,0 +1,35 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const surfaceLabel = (kind, method) => kind === "httpRoute" && method ? `\`httpRoute\` ${method} handler` : "`httpAction` handler";
+const httpActionMissingAuthGuard = {
+  categories: ["SECURITY"],
+  description: "An `httpAction`/`httpRoute` handler performs a side effect (`ctx.runMutation`/`ctx.runAction`/a `ctx.db` write) but never reads `ctx.auth` — an unauthenticated HTTP endpoint driving a state change, bypassing the identity/RLS checks that guard the rest of the app.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "http_action_missing_auth_guard",
+  remediation: "Read `ctx.auth` in the handler before the side effect — call `await ctx.auth.getIdentity()` (or check `ctx.auth.userId`) and reject unauthenticated/unauthorized requests, or forward through a `mutation`/`action` whose RLS policies enforce access. If the endpoint is intentionally public (e.g. a signed webhook), verify the provider signature before the write.",
+  run: (context) => {
+    if (context.httpActionGuards === void 0) {
+      return [];
+    }
+    return context.httpActionGuards.filter((row) => !row.readsAuth).map((row) => {
+      const surface = surfaceLabel(row.kind, row.method);
+      return emit(httpActionMissingAuthGuard, {
+        cacheKey: `http_action_missing_auth_guard:${row.file}:${row.line.toString()}`,
+        detail: `${surface} \`${row.exportName}\` (${row.file}:${row.line.toString()}) calls \`ctx.${row.sideEffect}\` but never reads \`ctx.auth\` — an anonymous caller can drive this write. Authenticate the request before the side effect.`,
+        metadata: {
+          exportName: row.exportName,
+          file: row.file,
+          kind: row.kind,
+          line: row.line,
+          sideEffect: row.sideEffect,
+          ...row.method ? { method: row.method } : {}
+        }
+      });
+    });
+  },
+  source: "static",
+  title: "Unauthenticated HTTP handler performs a side effect"
+};
+
+export { httpActionMissingAuthGuard as default };